OS and Networks Commons^™

A Multimodal Immune System Inspired Defense Architecture For Detecting And Deterring Digital Pathogens In Container Hosted Web Services, Islam Khalil

Theses and Dissertations

With the increased use of web technologies, microservices, and Application Programming Interface (API) for integration between systems, and with the development of containerization of services on operating system level as a method of isolating system execution and for easing the deployment and scaling of systems, there is a growing need as well as opportunities for providing platforms that improve the security of such services. In our work, we propose an architecture for a containerization platform that utilizes various concepts derived from the human immune system. The goal of the proposed containerization platform is to introduce the concept of slowing down …

Delivering Computer-Based Training Within State Prisons, Kunal Jha

Theses and Dissertations

Internet-connected devices are ubiquitous, and our built environment allows us to tap into formerly impossible solutions. As our world increasingly depends on technology to operate, one demographic cannot gain exposure to internet-connected devices or web-based educational programs: incarcerated individuals. The Department of Justice reports that 5 out of 6 State Prisoners are arrested and returned to prison within nine years of their initial release. Research shows that education is a pathway to reducing the U.S. prison population. Individuals who participated in any educational program are 43 percent less likely to return to prison.1 Prisons in the United States often partner …

Adaptation Of Network Flow Problems For Course Of Action Generation, Alexander N. Stephens

Theses and Dissertations

This thesis introduces two methods to generate Courses of Action (COA) in distributed warfare scenarios: the Wargaming Commodity Course of Action Automated Method Under Uncertainty (WCCAAM-U2) and Dynamic Transshipment Problem (DTP)-generated COAs. Previous work by Deberry et al. used a Multi-Commodity Flow Problem (MCFP) to generate COAs for single-period wargame scenarios with known enemy force amounts. In WCCAAM-U2, we adapt an MCFP to work in situations where only intelligence estimates of enemy forces are known. Compared to two other COA-generation methods, the WCCAAAM-U2 COA outperforms the next highest-performing COA by 307% when compared by a ratio of objective success rate …

An Enhanced Cloud-Native Deep Learning Pipeline For The Classification Of Network Traffic, Ahmed Sobhy Elkenawy

Theses and Dissertations

In a rapidly changing world, the way of solving real-world problems has changed to leverage the power of the advancements in multiple fields. Cloud-native computing approaches can be utilized with deep learning techniques to provide solutions in several important areas. For instance, with the emergence of the pandemic, much dependence on modern technologies came out as a replacement for face-to-face interaction. Deep learning can reach a high level of accuracy, which makes it very effective in the support of modern services and technologies. However, there are some challenging issues because deep learning requires many large-scale experiments, which demand a lot …

Data Gathering In Cognitive Radio Ad Hoc And Sensor Wireless Networks, Kimberly A. Brown

Theses and Dissertations

Data gathering is a network communication task in which all of the network’s nodes send their individual messages to a distinguished sink node. In cognitive radio ad hoc and sensor wireless networks (CR-AHSWNs), unlicensed secondary users (SUs) opportunistically use channels when the licensed primary users are not using them. Therefore, the channels available to each SU vary with time and location, which makes the development of data gathering algorithms for CR-AHSWNs challenging.

In this thesis, a data gathering protocol for CR-AHSWNs is proposed. The protocol consists of several distributed SU action selection and channel selection algorithms. An algorithm that can …

Pattern-Of-Life Modeling Using Data Leakage In Smart Homes, Steven M. Beyer

Theses and Dissertations

This work investigates data leakage in smart homes by providing a Smart Home Automation Architecture (SHAA) and a device classifier and pattern-of-life analysis tool, CITIoT (Classify, Identify, and Track Internet of things). CITIoT was able to capture traffic from SHAA and classify 17 of 18 devices, identify 95% of the events that occurred, and track when users were home or away with near 100% accuracy. Additionally, a mitigation tool, MIoTL (Mitigation of IoT Leakage) is provided to defend against smart home data leakage. With mitigation, CITIoT was unable to identify motion and camera devices and was inundated with an average …

Using Self-Organizing Maps For Computer Network Intrusion Detection, Manuel R. Parrachavez

Theses and Dissertations

Anomaly detection in user access patterns using artificial neural networks is a novel way of combating the ever-present concern of computer network intrusion detection for many entities around the world. Anomaly detection is a technique in network security in which a profile is built around a user's normal daily actions. The data collected for these profiles can be as following: file access attempts; failed login attempts; file creations; file access failures; and countless others. This data is collected and used as training data for a neural network.

There are many types of neural networks, such as multi-layer feed-forward network; recurrent …

Resource Provisioning In Large-Scale Self-Organizing Distributed Systems, M. Brent Reynolds

Theses and Dissertations

This dissertation researches the mathematical translation of resource provisioning policy into mathematical terms and parameters to solve the on-line service placement problem. A norm called the Provisioning Norm is introduced. Theorems presented in the work show the Provisioning Norm utility function and greedy, random, local search effectively and efficiently solve the on-line problem. Caching of placements is shown to reduce the cost of change but does not improve response time performance. The use of feedback control theory is shown to be effective at significantly improving performance but increases the cost of change. The theoretical results are verified using a decentralized, …

Magnesium Object Manager Sandbox, A More Effective Sandbox Method For Windows 7, Martin A. Gilligan

Theses and Dissertations

A major issue in computer security is limiting the affects a program can have on a computer. One way is to place the program into a sandbox, a limited environment. Many attempts have been made to create a sandbox that maintains the usability of a program and effectively limits the effects of the program. Sandboxes that limit the resources programs can access, have succeeded. To test the effectiveness of a sandbox that limits the resources a program can access on Windows 7, the Magnesium Object Manager Sandbox (MOMS) is created. MOMS uses a kernel mode Windows component to monitor and …

Spear Phishing Attack Detection, David T. Merritt

Theses and Dissertations

This thesis addresses the problem of identifying email spear phishing attacks, which are indicative of cyber espionage. Spear phishing consists of targeted emails sent to entice a victim to open a malicious file attachment or click on a malicious link that leads to a compromise of their computer. Current detection methods fail to detect emails of this kind consistently. The SPEar phishing Attack Detection system (SPEAD) is developed to analyze all incoming emails on a network for the presence of spear phishing attacks. SPEAD analyzes the following file types: Windows Portable Executable and Common Object File Format (PE/COFF), Adobe Reader, …

Advanced I/O Techniques For Efficient And Highly Available Process Crash Recovery Protocols, Jason Warren Cornwell

Theses and Dissertations

As the number of CPU cores in high-performance computing platforms continues to grow, the availability and reliability of these systems become a primary concern. As such, some solutions are physical (ie. power backup) and some are software driven. Lawrence Berkeley National Laboratory has created a system-level fault-tolerant checkpoint/restart implementation for Linux Clusters. This allows processes to restart computations at the last known checkpoint in the event the system crashes. The checkpoint data creation is highly dependent on system input and output operations. This paper proposes: (i) a technique to improve the efficiency of these I/O operations and (ii) an alternative …

Cyber Situational Awareness Using Live Hypervisor-Based Virtual Machine Introspection, Dustyn A. Dodge

Theses and Dissertations

In this research, a compiled memory analysis tool for virtualization (CMAT-V) is developed as a virtual machine introspection (VMI) utility to conduct live analysis during cyber attacks. CMAT-V leverages static memory dump analysis techniques to provide live dynamic system state data. Unlike some VMI applications, CMAT-V bridges the semantic gap using derivation techniques. CMAT-V detects Windows-based operating systems and uses the Microsoft Symbol Server to provide this context to the user. This research demonstrates the usefulness of CMAT-V as a situational awareness tool during cyber attacks, tests the detection of CMAT-V from the guest system level and measures its impact …

Code White: A Signed Code Protection Mechanism For Smartphones, Joseph M. Hinson Iv

Theses and Dissertations

This research develops Code White, a hardware-implemented trusted execution mechanism for the Symbian mobile operating system. Code White combines a signed whitelist approach with the execution prevention technology offered by the ARM architecture. Testing shows that it prevents all untrusted user applications from executing while allowing all trusted applications to load and run. Performance testing in contrast with an unmodified Symbian system shows that the difference in load time increases linearly as the application file size increases. The predicted load time for an application with a one megabyte code section remains well below one second, ensuring uninterrupted experience for the …

A Study Of Three Artificial Neural Networks Models' Ability To Identify Emotions From Facial Images, Timothy Scott Hyde

Theses and Dissertations

Facial expressions conveying emotions are vital for human communication. They are also important in the studies of human interaction and behavioral studies. Recognition of emotions, using facial images, may provide a fast and practical approach that is noninvasive. Most previous studies of emotion recognition through facial images were based on the Facial Action Coding System (FACS). The FACS, which was developed by Ekman and Freisen in 1978, was created to identify different facial muscular actions. Previous artificial neural network-based approaches for classification of facial expressions focused on improving one particular neural network model for better accuracy. The purpose of this …

Development Of A Methodology For Customizing Insider Threat Auditing On A Linux Operating System, William T. Bai

Theses and Dissertations

Insider threats can pose a great risk to organizations and by their very nature are difficult to protect against. Auditing and system logging are capabilities present in most operating systems and can be used for detecting insider activity. However, current auditing methods are typically applied in a haphazard way, if at all, and are not conducive to contributing to an effective insider threat security policy. This research develops a methodology for designing a customized auditing and logging template for a Linux operating system. An intent-based insider threat risk assessment methodology is presented to create use case scenarios tailored to address …

A Distributed Network Logging Topology, Nicholas E. Fritts

Theses and Dissertations

Network logging is used to monitor computer systems for potential problems and threats by network administrators. Research has found that the more logging enabled, the more potential threats can be detected in the logs (Levoy, 2006). However, generally it is considered too costly to dedicate the manpower required to analyze the amount of logging data that it is possible to generate. Current research is working on different correlation and parsing techniques to help filter the data, but these methods function by having all of the data dumped in to a central repository. Central repositories are limited in the amount of …

Visually Managing Ipsec, Peter J. Dell'accio

Theses and Dissertations

The United States Air Force relies heavily on computer networks to transmit vast amounts of information throughout its organizations and with agencies throughout the Department of Defense. The data take many forms, utilize different protocols, and originate from various platforms and applications. It is not practical to apply security measures specific to individual applications, platforms, and protocols. Internet Protocol Security (IPsec) is a set of protocols designed to secure data traveling over IP networks, including the Internet. By applying security at the network layer of communications, data packets can be secured regardless of what application generated the data or which …

Performance Characteristics Of A Kernel-Space Packet Capture Module, Samuel W. Birch

Theses and Dissertations

Defending networks, network-connected assets, and the information they both carry and store is an operational challenge and a significant drain on resources. A plethora of historical and ongoing research efforts are focused on increasing the effectiveness of the defenses or reducing the costs of existing defenses. One valuable facet in defense is the ability to perform post mortem analysis of incidents that have occurred, and this tactic requires accurate storage and rapid retrieval of vast quantities of historical network data. This research improves the efficiency of capturing network packets to disk using commodity, general-purpose hardware and operating systems. It examines …

Dynamic Network Formation Using Ant Colony Optimization, Steven C. Oimoen

Theses and Dissertations

Military and industry are moving toward every device being network enabled and connected for reliable availability of communication and information. To make this type of system a reality, the devices must be capable of forming a network topology on their own in a dynamic environment to ensure that the correct information reaches a desired location and on-time. This research presents three contributions for solving highly dynamic (i.e. drastic change within the network) Multi-commodity Capacitated Network Design Problems (MCNDPs) resulting in a distributed multi-agent network design algorithm. The first contribution incorporates an Ant Colony Optimization (ACO) algorithm Ant Colony System (ACS) …

Using Predictive Rendering As A Vision-Aided Technique For Autonomous Aerial Refueling, Adam D. Weaver

Theses and Dissertations

This research effort seeks to characterize a vision-aided approach for an Unmanned Aerial System (UAS) to autonomously determine relative position to another aircraft in a formation, specifically to address the autonomous aerial refueling problem. A system consisting of a monocular digital camera coupled with inertial sensors onboard the UAS is analyzed for feasibility of using this vision-aided approach. A three-dimensional rendering of the tanker aircraft is used to generate predicted images of the tanker as seen by the receiver aircraft. A rigorous error model is developed to model the relative dynamics between an INS-equipped receiver and the tanker aircraft. A …

Feasibility Study Of Encoding Operational Mission Metadata Into Ipv6 Packet Headers, Timothy R. Policarpio

Theses and Dissertations

The purpose of this research is to determine the feasibility of using the header fields and header extensions of IPv6 packets to encode mission metadata into computer network streams. Specifically, this thesis seeks to answer several research questions addressing the performance of different packet header encoding methods, specifically which method provides the least end-to-end delay of a file transfer over a hypothetical network as well as which method produces the least amount of additional network overhead during its operation in the hypothetical network. The research questions are answered through a comprehensive literature review and with the use of several network …

Networks And Network Security, Michael Kuralt

Theses and Dissertations

In a world of ever-increasing security threats, companies have the difficult task of securing their networks from attack. One of the largest threats to a company is the users on its network. By educating its network administrators and employees about network threats, a company can lower its vulnerability to network attacks. Individual users also can benefit from understanding networks and network security by learning how to keep their computer and their information safe. Companies and users can stay safe by understanding how a network functions, what threats exist on the Internet, how to prevent and deal with attacks, and how …

Stochastic Estimation And Control Of Queues Within A Computer Network, Nathan C. Stuckey

Theses and Dissertations

An extended Kalman filter is used to estimate size and packet arrival rate of network queues. These estimates are used by a LQG steady state linear perturbation PI controller to regulate queue size within a computer network. This paper presents the derivation of the transient queue behavior for a system with Poisson traffic and exponential service times. This result is then validated for ideal traffic using a network simulated in OPNET. A more complex OPNET model is then used to test the adequacy of the transient queue size model when non-Poisson traffic is combined. The extended Kalman filter theory is …

On-Line Electronic Document Collaboration And Annotation, Trev R. Harmon

Theses and Dissertations

The Internet provides a powerful medium for communication and collaboration. The ability one has to connect and interact with web-based tools from anywhere in the world makes the Internet ideal for such tasks. However, the lack of native tools can be a hindrance when deploying collaborative initiatives, as many current projects require specialized software in order to operate. This thesis demonstrates, with the comparably recent advances in browser technology and Document Object Model (DOM) implementation, a web-based collaborative annotation system can be developed that can be accessed by a user through a standards-compliant web browser. Such a system, demonstrated to …

Development Of A Methodology For Customizing Insider Threat Auditing On A Microsoft Windows Xp® Operating System, Terry E. Levoy

Theses and Dissertations

Most organizations are aware that threats from trusted insiders pose a great risk to their organization and are very difficult to protect against. Auditing is recognized as an effective technique to detect malicious insider activities. However, current auditing methods are typically applied with a one-size-fits-all approach and may not be an appropriate mitigation strategy, especially towards insider threats. This research develops a 4-step methodology for designing a customized auditing template for a Microsoft Windows XP operating system. Two tailoring methods are presented which evaluate both by category and by configuration. Also developed are various metrics and weighting factors as a …

On The Effects Of Device Mobility Upon Resource-Sharing In A Simulated Wireless Grid Network, Arris Ray

Theses and Dissertations

The primary aim of modern computer networks is to permit simplified sharing of resources (e.g., files and data) or to provide access to remote resources (e.g., printers or remote file-systems). Grid networks aim to provide a more sophisticated framework for securely sharing, selecting and/or aggregating a wide-variety of remote resources, whether logical (e.g., files and data) or physical (e.g., remote sensors, processing power or disk storage space). Provided that circuit design continues to improve at the relatively steady pace that it has for the past decade, in addition to standard desktop systems, miniature and mobile devices will soon become substantially …

Comparative Analysis Of Active And Passive Mapping Techniques In An Internet-Based Local Area Network, James B. Kuntzelman

Theses and Dissertations

Network mapping technologies allow quick and easy discovery of computer systems throughout a network. Active mapping methods, such as using nmap, capitalize on the standard stimulus-response of network systems to probe target systems. In doing so, they create extra traffic on the network, both for the initial probe and for the target system's response. Passive mapping methods work opportunistically, listening for network traffic as it transits the system. As such, passive methods generate minimal network traffic overhead. Active methods are still standard methods for network information gathering; passive techniques are not normally used due to the possibility of missing important …

An All-To-All Multicast Routing Protocol In A Wireless Ad-Hoc Network To Improve Channel Utilization, Zhong Hua Zhou

Theses and Dissertations

Wireless Ad-hoc network has become more and more popular. Several different multicasting schemes for this type of network have been developed. But most of them are targeting a situation where the total number of senders is much less than the total number of receivers. This thesis analyzes different wireless communication patterns in ad hoc network, the trend for wireless communication and presents a new multicast scheme. It targets an ad-hoc network where all mobile hosts act as both senders and receivers. The proposed scheme in this thesis will reduce overheads by combining data packets that are destined for the same …

Multicast Algorithms For Mobile Satellite Communication Networks, Ryan W. Thomas

Theses and Dissertations

With the rise of mobile computing and an increasing need for ubiquitous high speed data connections, Internet-in-the-sky solutions are becoming increasingly viable. To reduce the network overhead of one-to-many transmissions, the multicast protocol has been devised. The implementation of multicast in these Low Earth Orbit (LEO) constellations is a critical component to achieving an omnipresent network environment. This research examines the system performance associated with two terrestrial-based multicast mobility solutions, Distance Vector Multicast Routing Protocol (DVMRP) with mobile IP and On Demand Multicast Routing Protocol (ODMRP). These protocols are implemented and simulated in a six plane, 66 satellite LEO constellation. …