Search

All computer network traffic can be associated with a specific signature based on a feature set within its metadata. There has been a significant effort in preprocessing data for machine learning for the purposes of transforming raw data into features that represent a large dataset and improve the accuracy of predictive models. This thesis develops a machine learning approach that can analyze and classify network traffic to determine the level and degree of secure practices within specific network identifiers. We propose a novel continuous learning methodology in which a clustering technique was utilized to identify labels to a previously unlabeled dataset. A neural network algorithm was then trained on the labeled flows and tested on an unknown dataset to determine the network security classification. This previously unknown dataset was then used to retrain the neural network, thus continuously expanding the database of feature sets for training in order to increase the security classification accuracy. By implementing the proposed methodology on a widely known dataset, we achieved an increase in security classification performance as compared to traditional classification techniques. Major, United States Marine Corps Approved for public release. Distribution is unlimited.

Network authentication between users is commonly performed through the process of exchanging cryptographic keys. However, this security practice could leave users vulnerable if an eavesdropper managed to ascertain these private keys and the manner that they are exchanged. As a result, alternative security methods can add new factors to uniquely authenticate trusted users and improve network security. Through signal multipath, previous research analyzed the time delay measurement between a channel tap’s indirect path from a physical reflector and that same channel tap’s direct, line-of-sight path to uniquely establish a stationary user’s identity to their physical position. Because these channel taps are dependent on the location of network users, an eavesdropper faces a difficult challenge to precisely imitate the same tap delay to gain unauthorized access. This thesis explores how tap delay measurements incrementally change as an authenticated user moves within a space. Through statistical analysis, our research aims to determine an acceptable tap delay interval that network users can use to track and maintain authentication for various speeds through a coverage area. Lieutenant Commander, United States Navy Approved for public release. Distribution is unlimited.

The modeling of picosecond pulse propagation on microwave integrated circuit interconnections is considered. Autoregressive moving-average (ARMA) and autoregressive (AR) parametric models are derived for lossy dispersive microstrip transmission lines and cascaded microstrip step discontinuities. We formulated mathematical expressions to relate the model parameters to the physical microstrip properties. New lumped-distributed equivalent circuit interconnections is modeled using frequency-dependent lumped parameters and lossy distributed transmission-line sections. We verified the equivalent circuit models through computer simulations and experimental measurements. Modern parameters estimation techniques are applied to system identification modeling. We develop several algorithms to estimate the model parameters from input and/or output measurements. The performance of the algorithms are evaluated using computer simulations and experimental results. http://archive.org/details/parametricmodeli1094537534 Major, United States Army Approved for public release; distribution is unlimited.

With cyber attacks on the rise, cyber defenders require new, innovative solutions to provide network protection. We propose a spectral graph-based cyber detection and classification (SGCDC) system using phantom components, the strong node concept, and the dual-degree matrix to detect, classify, and respond to worm and distributed denial-of-service (DDoS) attacks. The system is analyzed using absorbing Markov chains and a novel Levy-impulse model that characterizes network SYN traffic to determine the theoretical false-alarm rates of the system. The detection mechanism is analyzed in the face of network noise and congestion using Weyl’s theorem, the Davis-Kahan theorem, and a novel application of the n-dimensional Euclidean metric. The SGCDC system is validated using real-world and synthetic datasets, including the WannaCry and Blaster worms and a SYN flood attack. The system accurately detected and classified the attacks in all but one case studied. The known attacking nodes were identified in less than 0.27 sec for the DDoS attack, and the worm-infected nodes were identified in less than one second after the second infected node began the target search and discovery process for the WannaCry and Blaster worm attacks. The system also produced a false-alarm rate of less than 0.005 under a scenario. These results improve upon other non-spectral graph systems that have detection rates of less than 0.97 sec and false alarm rates as high as 0.095 sec for worm and DDoS attacks. Lieutenant Commander, United States Navy Approved for public release. distribution is unlimited

Moving target defense (MTD) is a promising strategy for gaining advantage over cyber attackers, but these dynamic reconfigurations can impose significant overhead. We propose implementing MTD within an optimization framework so that we seize defensive advantage while minimizing overhead. This dissertation presents an MTD scheme that leverages partially observable Markov decision processes (POMDP) with absorbing states to select the optimal defense based on partial observations of the cyber attack phase. In this way, overhead is minimized as reconfigurations are triggered only when the potential benefit outweighs the cost. We formulate and implement a POMDP within a system with Monte-Carlo planning-based decision making configured to reflect defender-defined priorities for the cost-benefit tradeoff. The proposed system also includes a performance -monitoring scheme for continuous validation of the model, critical given attackers' ever-changing techniques. We present simulation results that confirm the system fulfills the design goals, thwarting 99% of inbound attacks while sustaining system availability at greater than 94% even as probability of attack phase detection dropped to 0.74. A comparable system that triggered MTD techniques pseudorandomly maintained just 43% availability when providing equivalent attack suppression, which illustrates the utility of our proposed scheme. Lieutenant Commander, United States Navy Approved for public release. distribution is unlimited

Those who defend systems against cyber-attacks can use moving target defense (MTD) to their advantage. However, optimal MTD techniques have yet to be sufficiently explored. In terms of cost-benefit analysis, the desired level of attack suppression will come at the cost of network availability, and optimization tools might be able to harness the advantages of MTD without undue sacrifice. This thesis formulates an attack/defense scenario as a partially observable Markov decision process (POMDP) to facilitate optimal MTD of a host. We develop a system in which service and IP reconfigurations can be employed as defense against a five-stage attack to maximize system availability and minimize cost. With an attack/defense scenario involving five attack stages and two defense options, we explore the utility of the Determinized Sparse Partially Observable Tree (DESPOT) algorithm for online optimal defense selection using the POMDP formulation. We compare optimization of the system for three different cases of the POMDP with varying levels of uncertainty (i.e., probability of detection) representing potential real-world scenarios. A significant result of this thesis is our development of a framework for optimizing MTD techniques. We also demonstrate, within the limitations of this research, how to determine the bounds for best performance when using DESPOT as an MTD controller. Lieutenant, United States Navy Approved for public release. distribution is unlimited

Channel-response-based physical-layer authentication systems are challenged by the use of millimeter-wave frequencies for wireless communications due to the reduced coherence time and the sparsity of multipath components typically encountered. We examine how such an environment makes the assumptions of previous works in physical-layer authentication unrealistic, and present an approach that can tolerate such challenges by anticipating channel-response features based on relatively simple environmental survey information and location information of the communicating nodes. In addition to its resilience to millimeter-wave channel phenomena, such an approach has the advantage of being independent of an alternative initial authentication mechanism, distinguishing it from the majority of previous channel-based physical-layer authentication works and enabling its use in multi-factor authentication. Our work examines to what extent multipath time delays caused by planar specular reflectors enable the authentication of a wireless user’s reported position. Our formulations are supported via simulation of multiple environments, and the efficacy of the proposed scheme is supported via analysis of its information entropy and the likelihood that a masquerading attempt will be inadvertently authenticated. The analysis indicates useful information entropy and miss rates can be achieved provided measurement error is adequately bounded. http://archive.org/details/gmillimeterwavep1094564010 Lieutenant Commander, United States Navy Approved for public release; distribution is unlimited.

Blockchain technology has the potential to improve the areas of additive manufacturing, supply chain management, and many others within the Navy. An anomaly detection scheme that characterizes blockchain parameters as normal or anomalous using statistical analysis and hierarchical clustering methods was developed in this thesis. The histograms, probability distributions, and boxplots of the data were used to estimate thresholds for outliers that may indicate attacks. The thresholds obtained from dendrograms were used to form clusters and sub-clusters based on the hierarchical data structure; data point indices that do not fall within the threshold are considered anomalous and not included in the clusters. The anomaly detection scheme was implemented in the MATLAB programming environment and validated by successful anomaly detection corresponding to an attack on the public Ethereum blockchain network and in an experimental doorknob-rattling attack on a local blockchain research network. Hierarchical clustering proved to be a more powerful anomaly detection method than statistical analysis methods. http://archive.org/details/blockchainnetwor1094563492 Lieutenant Commander, United States Navy Approved for public release; distribution is unlimited.

There are 3.7 billion long-term evolution (LTE) subscribers worldwide, according to the Ericsson Mobility Report for the first quarter of 2019. To the average user, the exchange of this cellular traffic may seem secure; however, there exists at least one vulnerability: the unencrypted timing advance (TA). The TA is responsible for maintaining time synchronization between the evolved NodeB (eNB) and the user equipment (UE). Without it, the eNB-UE communication link fails, resulting in degraded cell service. By issuing faux TAs, an attacker disrupts the eNB-UE timing synchronization and denies service to the UEs. This thesis investigates specific effects such an attack has on targeted and time-adjacent users’ subframe bit-error rate (BER). Moreover, we show the disruption of a single user’s communications while leaving other users’ communications untouched. Through simulation, we show that delaying a target transmission is less desirable to the attacker since the eNB has delay-correcting capabilities. Additionally, by advancing a target transmission using one TA, we achieve, on average, 50% subframe BERs. Lastly, we demonstrate that the attacker has flexibility in issuing the TAs without interfering with time-adjacent users. Specifically, the attacker can issue roughly 48 TAs before incurring a non-zero BER on time adjacent users. With this functionality, combined with an unsecure timing mechanism, an attacker has the capability of denying service to a targeted individual. Lieutenant, United States Navy Approved for public release; distribution is unlimited.

In this dissertation, we investigated the methods for development of embedded channels within error correction mechanisms utilized to support adaptive rate communication systems. We developed an error correction code-based embedding scheme suitable for application in modern wireless data communication standards. We specifically implemented the scheme for both low-density parity check block codes and binary convolutional codes. While error correction code-based information hiding has been previously presented in literature, we sought to take advantage of the fact that these wireless systems have the ability to change their modulation and coding rates in response to changing channel conditions. We utilized this functionality to incorporate knowledge of the channel state into the scheme, which led to an increase in embedding capacity. We conducted extensive simulations to establish the performance of our embedding methodologies. Results from these simulations enabled the development of models to characterize the behavior of the embedded channels and identify sources of distortion in the underlying communication system. Finally, we developed expressions to define limitations on the capacity of these channels subject to a variety of constraints, including the selected modulation type and coding rate of the communication system, the current channel state, and the specific embedding implementation. Commander, United States Navy Approved for public release; distribution is unlimited.

As the threat of cyber attack grows ever larger, new approaches to security are required. While there are several different types of intrusion detection systems (IDS), collaborative IDS (CIDS) offers particular promise in identifying distributed, coordinated attacks that might otherwise elude detection. Even for this type of IDS, there are unresolved issues associated with trusting participants and aggregating data. Blockchain technology appears capable of addressing those issues. This thesis is focused on presenting a proof-of-concept experiment leveraging an Ethereum-based private blockchain for a CIDS that uses pluggable authentication modules (PAM) to track login activity toward detection of doorknob rattling attacks. http://archive.org/details/blockchainforuse1094563465 Outstanding Thesis Lieutenant, United States Navy Approved for public release; distribution is unlimited.

Supervised machine learning by convolutional neural networks has proven effective for regional object detection in digital imagery. However, when applied to low-spatial-resolution aerial imagery, such networks are generally less effective because of the low object-to-image size ratio, the unconstrained orientation of objects, and a shortage of labeled data. The purpose of this research is to assess whether a deep learning technique can be optimized for regional detection and classification of ships, aircraft, or similar platforms in aerial imagery. During tests, we sought and observed improvements in detection precision resulting from adaptations to the region proposal technique of the Faster Regional Convolutional Neural Network (R-CNN) model while using a shallower, fourteen-layer network. Specifically, we found that both k-means clustering and a segmented least-squares fitting technique reveal object orientation patterns in training data that can be used as the basis for the dimensions of Faster R-CNN region proposals. Detection precision was most notably improved for objects not tightly bound by a rectangular region due to their orientation in the image plane. Lieutenant, United States Navy Approved for public release; distribution is unlimited.

In this thesis, we evaluate a means of determining whether or not a network host is a virtual machine from the perspective of a network administrator using software-defined networking infrastructure. Virtualization presents a user with a desktop and computing environment identical to what is normally expected while also permitting them to be unwittingly controlled from outside the desktop environment. The added complexity of virtual environments causes extra computing delays, which may be observed in traffic round-trip times. In this thesis, we demonstrate how the observed round-trip times may be used to determine which machines were virtualized and which were running natively directly atop the hardware. Two versions of the experiment were performed. The first substantiated that the approach was feasible. The second, using a more realistic software-defined networking infrastructure, showed that delay measurement must be done by methods that minimize unnecessary hops before measurement, though the experiment still succeeded in differentiating virtual machines in the majority of cases. http://archive.org/details/virtualmachinede1094561313 Lieutenant Junior Grade, United States Navy Approved for public release; distribution is unlimited.

Unmanned systems have gained in prominence as platforms from which to conduct military operations. The Robot Operating System (ROS) is a widely adopted standard robotic middleware; however, its preliminary design is devoid of any network security features. Military grade unmanned systems must be guarded against network threats. ROS 2.0 is built upon the Data Distribution Service standard and is designed to provide solutions to identified ROS 1.0 security vulnerabilities by incorporating authentication, encryption, and process profile features. The Department of Defense is looking to use ROS 2.0 for its military-centric robotics platform. Through our work, we demonstrated that ROS 2.0 can serve as a functional platform for use in military grade unmanned systems. We tested the viability of ROS 2.0 to safeguard communications between an unmanned aerial swarm and a ground control station against rogue node and message-spoofing attacks. Our experiments employ the PX4 Multi Vehicle Simulation swarming three iris-quadcopter aerial drones within a Gazebo 9 simulation environment, utilizing QGroundControl as our ground control station. Drones were targeted individually to ascertain the effectiveness of our attack vectors under specific conditions. We demonstrated the effectiveness of ROS 2.0 in mitigating the chosen attack vectors but observed a measurable operational delay within our simulations. CRUSER/ONR http://archive.org/details/cybersecuritytes1094560458 Major, United States Marine Corps Approved for public release; distribution is unlimited.

The objective of this thesis is to implement an anomaly-detection method that can be used to detect congestion in a software-defined network. The method incorporates spectral graph theory and phantom node techniques. The experimental implementation of spectral graph theory used eigenvalue-eigenvector solutions to characterize a mathematical model of the network’s topology. In this thesis, we used the phantom node technique to determine congestion in the network by using a virtual node to set the threshold for available link capacity, or the maximum amount of traffic, that can cross the links in the network before the links are considered congested. Results show that when the network is congested, a shift occurs in the eigenvalue and eigenvalue index spectrum. Prior to congestion, the virtual node has the highest nodal influence in the lowest eigenvalue index; however, when a node becomes congested and high traffic in the node crosses the threshold set by the virtual node, the congested node takes the position of the virtual node in the eigenvalue index. The virtual node shifts to having the greatest nodal influence in the next-higher eigenvalue index in the spectrum. Essentially, the results show that anomalies, such as congestion, can be detected using the anomaly-detection method developed in thesis. http://archive.org/details/trafficcongestio1094558337 Lieutenant Commander, United States Navy Approved for public release; distribution is unlimited.

Network anomaly detection must be automated to meet requirements for real-time, accurate monitoring in the face of exponentially growing traffic volumes; however, this accuracy is often reduced when Gaussian methods are applied to non-Gaussian network traffic. To improve detection accuracy at requisite low false-alarm rates, we propose modeling network traffic and detecting anomalies using an entirely non-Gaussian methodology based on the α-stable distribution and appropriately-derived stable estimators. Using three publicly-available network traffic traces, we show that the non-Gaussian stable distribution provides a more ac curate traffic model under benign and attack scenarios, as well as a mixture of these conditions. In this research, we demonstrate that an α-stable traffic model enables adaptive techniques while significantly reducing data fit errors. To improve the accuracy of anomaly detection, computationally-efficient, α-stable -derived location and dispersion estimators are identified and developed. These estimators are implemented in a novel proof-of-concept, non-parametric, non-Gaussian detection system based on α-stable principles. The proposed real-time detection system achieves higher accuracy at a lower error rate than equivalent Gaussian methods and comparable state-of-the-practice techniques. http://archive.org/details/networknomalydet1094567548 Commander, United States Navy Approved for public release; distribution is unlimited.

The goal of this thesis is to determine the feasibility and provide a proof of concept for a covert communications channel based on induced clock skew. Transmission Control Protocol (TCP) timestamps provide a means for measuring clock skew between two hosts. By intentionally altering timestamps, a host can induce artificial clock skew as measured by the receiver, thereby providing a means to covertly communicate. A novel scheme for transforming symbols into skew values is developed in this work, along with methods for extraction at the receiver. We tested the proposed scheme in a laboratory network consisting of Dell laptops running Ubuntu 16.04. The results demonstrated a successful implementation of the proposed covert channel with achieved bit rates as high as 33 bits per second under ideal conditions. Forward error correction was also successfully employed in the form of a Reed–Solomon code to mitigate the effects of variation in delay over the Internet. Lieutenant, United States Navy Approved for public release; distribution is unlimited.

Networks protected by firewalls and physical separation schemes are threatened by multi-homed devices. The purpose of this study is to detect multi-homed devices on a computer network. More specifically, the goal is to evaluate passive detection of multi-homed devices running various operating systems while communicating on a network. TCP timestamp data was used to estimate clock skews using linear regression and linear optimization methods. Analysis revealed that detection depends on the consistency of the estimated clock skew. Through vertical testing, it was also shown that clock skew consistency depends on the installed operating system. The linear programming and linear regression methods agree with one another when clock skews are consistent, indicating that linear regression is sufficient to identify multi-homed hosts in networks with low network delay. Further analysis showed inconsistencies of clock skew estimation on newer versions of OS X and freeBSD 12.0; the clock skews from these operating systems prevented multi-homed fingerprinting using the proposed detection scheme. http://archive.org/details/investigatingdet1094556171 Lieutenant Commander, United States Navy Approved for public release; distribution is unlimited.

Wireless sensor networks provide a low-signature communications system that can be used for a wide variety of military applications. These networks are vulnerable to intrusion, however, and must balance security with performance and longevity. The neighbor discovery process is vital for nodes to maintain network connectivity but introduces security vulnerabilities; therefore, a lightweight security protocol is necessary to prevent unauthorized nodes from accessing network data and resources. In this thesis, we focus on the management of encryption keys in a resource-limited, peer-to-peer, decentralized network. Existing protocols for securing the neighbor discovery process use public key encryption, which is too computationally expensive for low-powered, resource-constrained IEEE 802.15.4-enabled devices. We therefore develop a key management scheme that modifies the Neighbor Discovery Protocol (NDP) and Secure Neighbor Discovery (SEND) protocol and implements the Diffie-Hellman key exchange algorithm for symmetric key management. We simulate our scheme in MATLAB to demonstrate its effectiveness in securing the neighbor discovery protocol while providing energy efficiency, key security, and error resistance. http://archive.org/details/symmetriclinkkey1094556114 Outstanding Thesis Captain, United States Marine Corps Approved for public release; distribution is unlimited.

Software-defined networking (SDN) has the potential to revolutionize the management capabilities of a highly distributed military communications environment. Yet, military adoption of SDN is contingent on a thorough analysis of security implications. In this thesis, we investigate a man-in-the-middle (MITM) attack that exploits the centralized topological view critical to SDN operations. In particular, we present a new scheme for detection and classification of the attack at the network layer. We apply wavelet analysis to detect anomalous conditions introduced by the MITM attack at traffic signals collected at network switch ports. Furthermore, we identify unique characteristics of reported anomalies in the collected traffic signals to build a classification framework. Other cyber events, such as a distributed denial-of-service attack and network congestion, are presented to the detection scheme to validate its general applicability. Overall, we successfully demonstrate the capability to detect and classify the MITM attack in addition to other cyber events at the network layer, thereby contributing to the security of SDN. http://archive.org/details/analysisoftraffi1094556120 Captain, United States Marine Corps Approved for public release; distribution is unlimited.

A wireless sensor network (WSN) collects and routes information from the environment to an aggregation point, known as a sink node. The sink node processes the information or acts as a gateway to forward information to another network. Due to its essential role in the network, the sink node is a high priority target for an attacker who wishes to disable a WSN. In this thesis, we focus on the mitigation of sink-node vulnerability in a WSN. Specifically, in this thesis we study the issue of protecting the sink node through anonymity techniques. In particular, we use a technique known as k-anonymity. To achieve k-anonymity, we use a specific routing protocol designed to work within the constraints of WSN communication protocols, specifically IEEE 802.15.4. We use and modify the Lightweight Ad hoc On-Demand – Next Generation (LOADng) reactive-routing protocol to achieve anonymity. This modified protocol prevents an attacker from identifying the sink node without adding significant complexity to the regular sensor nodes. We simulate the modified LOADng protocol using a custom-designed simulator in MATLAB. We demonstrate the effectiveness of our protocol and also show some of the performance tradeoffs that come with this method. http://archive.org/details/achievingsinknod1094555612 Major, United States Marine Corps Approved for public release; distribution is unlimited.

The ubiquity of cellular technology has woven a variety of services, now axiomatic, into modern social fabric. Among those services is the ability to provide mobile user location. Applications of these location-based services include providing directions, emergency services, fraud protection, and direct marketing. This work provides in-depth analysis of cellular positioning, which leverages the Long Term Evolution (LTE) signaling plane timing advance (TA) parameter for the end of user geolocation. Additionally, we propose a novel method of augmenting TA-based positioning, Cellular Synchronization Assisted Refinement (CeSAR). We simultaneously show CeSAR to be a network performance multiplier and security vulnerability vis-a-vis the method's electromagnetically passive nature. Furthermore, we demonstrate how CeSAR improves positioning by adding system information and mitigating the effects of poor network infrastructure geometry. Through robust statistical analysis, we derive a theoretical lower bound on TA-based positioning and demonstrate that a statistically efficient estimator is possible in this context. Furthermore, numerical studies are conducted with synthetic and empirical data. The real-world data are observed in actual network deployments found in geographically diverse environments, such as Maryland and California. The results not only demonstrate the efficiency of the estimator but show that accuracy on the order of tens of meters is possible. Indeed, TA-based positioning is shown to be accurate on the order of 40 m in some scenarios. Additionally, we demonstrate that CeSAR is able to passively provide improvements ranging from 10 to 254 m over TA-only positioning. http://archive.org/details/analysisndugment1094551605 Major, United States Marine Corps Approved for public release; distribution is unlimited.

The aim of this thesis was to determine the feasibility of identifying a device connected to the Internet through multiple interfaces (i.e., multi-homed) using only the information provided by passively observing network traffic. Since multi-homed hosts allow an alternate means for outside entities to circumvent the security of a firewall and gain access to a network, it is important for a network's security to be able to detect and remove such devices. In this work, the idea of using clock skew—which is the difference in perceived time between two system clocks—as a unique signature is utilized to identify hosts on a network that are potentially multi-homed. Testing was done on a software-defined network that contained a multi-homed host. After traffic between hosts was collected and analyzed, analysis of the confidence intervals of the device's clock skew was conducted to determine if IP addresses originating from the same host could be successfully detected solely from network traffic. Testing confirmed that the proposed scheme provided a valid means of detecting a multi-homed device on a network. This scheme was repeated on multiple hosts and on a device with multiple connections to the network. http://archive.org/details/detectingmultiho1094550588 Lieutenant, United States Navy Approved for public release; distribution is unlimited.

This thesis proposed a concept of distributed management of littoral operations at the tactical level, in which timeliness of information and reduced decision cycles are of critical importance. The use of mesh tactical networks augmented by sensor management, operational databases, and an appropriate level of automation of target recognition can turn the obstacles of land masses in littoral environments into a tactical advantage. Ultimately, this thesis concept aimed to enhance situational awareness by enabling the timely exploitation and dissemination of imagery data from small satellites and unmanned systems at the tactical level. Analyses of simulation and field experimentation results that focused on mobile ad-hoc networks (MANETs)—which connected dissimilar imaging sensors and enabled fusion of captured images—supported this concept. Mesh tactical radios provided an adequate range and quality of service (QoS) to enable networking of kinetic and non-kinetic assets equipped with imaging or data relaying capabilities and to support dissemination of imagery data. Additionally, multi-spectral image fusion of thermal and visual images for target recognition yielded the best classification performance after the use of speeded-up robust features (SURF) and artificial neural networks (ANNs). http://archive.org/details/multisensorimage1094547848 Lieutenant Commander, Hellenic Navy Approved for public release; distribution is unlimited.

A Generalized Hough Transform (GHT)-based classification scheme for an object-of-interest in maritime-domain images is proposed in this thesis. First, the object edge points are extracted and used to generate a representation of the object as a Hough coordinate table by using the GHT algorithm. The table is then reformatted to a contour map called a Hough features map. The coordinates of dominant peaks or Hough features on the map are extracted and fed into a feed-forward, back-propagation neural network for classification. In this research, the scheme is tested using perfect shapes of triangles, squares, circles, and stars and maritime-domain images of ships, aircraft, and clouds, and the classification results obtained are reported. http://archive.org/details/generalizedhough1094547851 Lieutenant, Royal Thai Navy Approved for public release; distribution is unlimited.

Software-defined networks are revolutionizing networking by providing unprecedented visibility into and control over data communication networks. The focus of this work is to develop a method to extract network features, develop a closed-loop control framework for a software-defined network, and build a test bed to validate the proposed scheme. The method developed to extract the network features is called the dual-basis analysis, which is based on the eigendecomposition of a weighted graph that accounts for the network topology and traffic load. A software-defined network closed-loop control scheme is developed; the scheme is modeled after a closed-loop control system that includes an observer and a controller. A particle filter and phantom node are used to estimate link data rates and identify the onset of congestion. Based on the outputs of the observer, the controller is able to balance traffic throughout the network to minimize congestion. A software-defined network test bed is developed to evaluate the proposed dual-basis representation and the closed-loop control scheme. The test bed is a real-world implementation of a software-defined network that consists of 13 switches and one controller. The test bed ensures that the proposed schemes are suitable even when applied in a hardware or software implementation. http://archive.org/details/spectralgraphory1094547309 Lieutenant Commander, United States Navy Approved for public release; distribution is unlimited.

Techniques for classifying maritime domain targets-of-interest within images are explored in this thesis. Geometric and photometric features within each image are extracted from processed images and are used to train a neural network. The trained neural network is tested with features of a known object. In the binary classification case, the neural network is used to determine whether a ship is present or not present in the image. In the multi-class and multi-level classification cases, the neural network is used to determine if the object belongs to one of four classes specified: warship, cargo ship, small boat, or other. The Hough transformation is used to identify and characterize linear patterns exhibited by objects in images. As an alternative to geometric and photometric features to classify targets-of-interest, these linear patterns are used to train a neural network. The performance of the neural network is then tested for binary, multi-class, and multi-level classification schemes. The development of neural-network-based techniques for automated target-of-interest classification is a significant result of this thesis. http://archive.org/details/improvingmaritim1094545252 Lieutenant, United States Navy Approved for public release; distribution is unlimited.

In this thesis, we propose a new software defined network monitoring scheme that provides the controller with a method to determine network states for the purpose of updating flow rules for network control and management. Network centrality and nodal influence metrics derived from the dual basis concept of the graph theory are used to monitor changes in a network. The proposed scheme uses a phantom node and the concept of a reference node to determine changes in these metrics in order to identify disconnected, congested, underutilized, and attacked nodes. The phantom node establishes a congestion threshold in the dual basis that is used to determine changes in node health and capacity due to network traffic. Multiple phantom nodes are used to produce multiple congestion thresholds for network monitoring. A congestion estimation method is proposed to estimate a node’s capacity used when it crosses the congestion threshold. Simulations are used to validate the concept of reference node, identification of node disconnections, congestion, and attacks, and the congestion estimation method. http://archive.org/details/softwaredefinedn1094543933 Lieutenant, United States Navy Approved for public release; distribution is unlimited.

The shift from wired to fully wireless communication is causing an increasing demand on the frequency spectrum. The cognitive radio was introduced to solve spectrum scarcity by allowing spectrum sharing between licensed and unlicensed users. This approach presents a challenge to source localization because of the cognitive radio’s capability to shift its spatial, frequency and temporal parameters. The extended semi-range-based (ESRB) and cooperative-received-signal-strength-based (CRSSB) localization schemes are proposed to overcome the challenge of identifying and locating a cognitive radio over time using a wireless sensor network. The objective of this thesis was to set up a testbed using GNU Radio and Universal Software Radio Peripherals (USRPs) to estimate the position of a cognitive radio device using the ESRB and CRSSB localization schemes. The ESRB algorithm does not provide accurate position estimates but the estimates are observed to be concentrated in the vicinity and converging toward the true position of the secondary user. The errors are believed to be caused by three factors: a limited number of sensor nodes used (four), an insufficient number of spectral scans per superframe (55), and the lack of synchronization among sensor nodes. The CRSSB localization scheme gave a more accurate position estimation. http://archive.org/details/radioimplementat1094543932 Captain, Tunisian Air Force Approved for public release; distribution is unlimited.

Wireless communication technology has become a critical aspect in many civilian and military applications. With regard to remote sensing, search and rescue, disaster relief operations and signals intelligence, there exists an interest in developing capabilities to collect these signals-of-interest. The objective of this dissertation is to maximize signal collection performance in the presence of signal measurement and sensor related errors. To accomplish this objective, we proposed a signal collection scheme that exploits an elevated, mobile network to maximize the collaborative collection of a target signal. The proposed scheme begins with source localization. This technique consists of an initial weighted least-squares estimate followed by a maximum-likelihood estimate. Implemented on an elevated, mobile network, this technique is able to obtain an optimal localization. To enhance localization robustness, we developed an outlier rejection process that mitigates the effects of measurement and sensor position errors. To collect the signal, this research quantified the effects of sensor position errors on beamforming and proposed a novel signal collection scheme that combines signal estimation and collaborative beamforming. Using all these techniques in concert, we were able to show that the proposed scheme outperforms standard collaborative beamforming in the presence of sensor position errors. http://archive.org/details/wirelesssourcelo1094543965 Captain, United States Air Force Approved for public release; distribution is unlimited.

In recent years, time synchronization has emerged as an essential research topic for wireless sensor networks. Numerous wireless network applications require a common reference time for collaborative data fusion and communications. Other time synchronization protocols have been proposed over the years, but none have eliminated the possibility of collisions associated with wireless packet transmissions while maintaining a precise level of synchronization for any given topology. In this thesis, we present a new hybrid time synchronization scheme that provides a high degree of network-wide synchronization and eliminates the possibility of collisions when transmitting timestamp messages. We propose an algorithm that allows a network to determine a broadcast sequence by which nodes transmit and forward messages and then conducts a network-wide synchronization based on received timestamp information. The proposed hybrid time synchronization scheme utilizes two existing protocols, namely relative referenceless receiver/receiver synchronization and ratio-based synchronization protocol, that provide a high degree of precision. We implement our broadcast sequencing algorithm in simulations and demonstrate its effective performance for a series of network topologies. We also present results demonstrating an improvement in network-wide synchronization using our hybrid scheme over other time synchronization protocols. http://archive.org/details/ahybridtimesynch1094543973 Outstanding Thesis Captain, United States Marine Corps Approved for public release; distribution is unlimited.

The conversion from homogeneous global system for mobile communications (GSM) networks to heterogeneous GSM/universal mobile telecommunications system (UMTS) networks is rapidly expanding. Previous research identified vulnerabilities in the GSM network that were fixed in the UMTS standard; however, the mobile device must successfully access the UMTS network to take advantage of security improvements. Therefore, a possible vulnerability not addressed in either the GSM or UMTS standards is the potential for a malicious entity to prevent a mobile device from handing over from a GSM to UMTS network, because the GSM network maintains the stand-alone dedicated control channel (SDCCH) uplink time slots. The process of testing this vulnerability requires the development of a device that monitors a GSM base transceiver station, identifies when a handover to UMTS message is sent, tracks the time slots of the SDCCH uplink, and transmits a GSM handover-failure message. In this thesis, we present an open-source coding scheme that utilizes parts of the OpenBTS source code to transmit a GSM handover-failure message using the universal software radio peripheral. The method is validated through the collection of the GSM transmitter messages by Airprobes GSM-receiver software. http://archive.org/details/softwaredefinedr1094538978 Lieutenant, United States Navy Approved for public release; distribution is unlimited.

Techniques for anomaly detection in the maritime domain by extracting traffic patterns from ship position data to generate atlases of expected ocean travel are developed in this thesis. An archive of historical data is used to develop a traffic density grid. The Hough transformation is used to extract linear patterns of elevated density from the traffic density grid, which can be considered the highways of the oceans. These highways collectively create an atlas that is used to define geographical regions of expected ship locations. Ship position reports are compared to the atlas of highways to flag as anomalous any ship that is not operating on an expected highway. The atlas generation techniques are demonstrated using automated information system (AIS) ship position data to detect highways in both open-ocean and coastal areas. Additionally, the atlas generation techniques are used to explore variability in ship traffic as a result of extreme weather and seasonal variation. Finally, anomaly detection is demonstrated by comparing AIS data from 2013 to the highways detected in the archive of data from 2012. The development of an automatic atlas generation technique that can be used to develop a definition of normal maritime behavior is the significant result of this thesis. http://archive.org/details/trafficpatternde1094538977 Outstanding Thesis Lieutenant, United States Navy Approved for public release; distribution is unlimited.

Spatiotemporal clustering is the process of grouping objects based on both their spatial and temporal similarity. This approach is useful when considering the distance between objects and how that distance changes through time. Spatiotemporal clustering analysis is applied to the maritime domain in this thesis, specifically to a defined area of water, during a period of time, in order to gain behavioral knowledge of vessel interactions and provide the opportunity to screen such interactions for further investigation. The proposed spatiotemporal clustering algorithm spatially clusters vessels in the water space using k-means clustering analysis, kinematically refines the clusters based on the similarity of vessel headings, speeds and the distance between them, and temporally analyzes the continuity of membership of the kinematic clusters through time to determine which clusters are moving. The algorithm is implemented in the MATLAB programming environment, verified with a synthetic data scenario, and validated with two real-world datasets. http://archive.org/details/aspatiotemporalc1094537731 Lieutenant, United States Navy Approved for public release; distribution is unlimited.

This thesis explores identification and classification of Orthogonal Frequency Division Multiple Access based signals and proposes a scheme to achieve this goal. Specifically, the cyclostationary pilot signature of an IEEE 802.16e standard compliant waveform is investigated. The proposed scheme performs waveform identification through a preamble cross-correlation technique. Classification is achieved through the use of a pilot cross-correlation technique in combination with an algorithm called the fast Fourier transform accumulation method that performs cyclostationary feature extraction in order to determine the cyclic prefix of the IEEE 802.16e waveform. Similar methods are then used for determining other OFDMA waveform parameters, such as the FFT size, Segment number and IDcell. The proposed scheme is implemented with MATLAB simulation code and the significant results of the simulation are presented and discussed. The MATLAB simulation validated the preamble cross-correlation process and the pilot cross-correlation technique in conjunction with the fast Fourier transform accumulation method as effective methods of signal identification and classification, respectively. http://archive.org/details/identificationnd109456804 Lieutenant, United States Navy

The objective of this thesis is to investigate the requirements and limitations of boost phase ballistic missile intercept systems that contain an interceptor and its guidance sensors (both radar and infrared). A three- dimensional computer model is developed for a multi-stage target with a boost phase acceleration profile that depends on total mass, propellant mass and the specific impulse in the gravity field. The radar cross-section and infrared radiation of the target structure is estimated as a function of the flight profile. The interceptor is a multi- stage missile that uses fused target location data provided by two ground-based radar sensors and two low earth orbit infrared sensors. Interceptor requirements and limitations are derived as a function of its initial position from the target launch point and the launch delay. Sensor requirements are also examined as a function of the signal-to- noise ratio during the target flight. Electronic attack considerations within the boost phase are also addressed including the use of decoys and noise jamming techniques. The significance of this investigation is that the system components within a complex boost phase intercept scenario can be quantified and requirements for the sensors can be numerically derived. http://archive.org/details/requirementsndli109451337 Captain, Turkish Air Force Approved for public release; distribution is unlimited.

Covert channels in modern communication networks are a source of security concerns. Such channels can be used to facilitate command and control of botnets or inject malicious contents into unsuspected end-user devices or network nodes. The vast majority of the documented covert channels make use of the upper layers of the Open Systems Interconnection (OSI) model. In this thesis, we present a new covert channel in IEEE 802.11 networks, making use of the Protocol Version field in the Medium Access Control (MAC) header. This is achieved by forging modified Clear To Send (CTS) and Acknowledgment (ACK) frames. Forward error correction mechanisms and interleaving were implemented to increase the proposed channel's robustness to error. A laboratory implementation of the proposed channel is presented by developing the necessary code in Python, operating in a Linux environment. We present the results of tests conducted on the proposed channel, including measurements of channel errors, available data rate for transmission, and level of covertness. http://archive.org/details/amaclayercovertc1094548138 Lieutenant, Portuguese Navy Approved for public release; distribution is unlimited.

In this thesis, we present an innovative scheme to favor the selection of M out of N available high-performing channels in multi-channel wireless networks through the application of states to individual channels. One channel selection scheme is random selection, which can lead to poor network performance when one or more data channels are disadvantaged. This is due to the inability of random selection to discriminate between high performing and disadvantaged channels. The novel proposed channel selection scheme is shown to perform nearly as well as the highest performing of N channels when one or more channels are disadvantaged. We develop a Markov-chain-based theoretical model and then present simulation results validating a significant performance increase of the proposed channel selection scheme. http://archive.org/details/statebasedchanne1094548139 Lieutenant, United States Navy Approved for public release; distribution is unlimited.

The propagation of bots into a botnet, and the various malicious activities that could be carried out from within a tactical network, poses a significant threat to network security and tactical operations. This thesis presents a network architecture with the objective of near real-time detection of malicious activity and its propagation within a data rate (bandwidth) limited environment with periodic losses of connectivity without adding significant burden to the network. A test bed is constructed that makes use of an intrusion detection system driven correlation tool, BotHunter, focused on outbound and inbound connections, rather than solely on inbound connections and a honeynet located in a high data rate area of a tactical network. The ability of the proposed architecture to identify malicious activities is validated when both BotHunter and the Honeynet successfully detect a bot infection. http://archive.org/details/atestbedfordetec109454650 US Marine Corps (USMC) author. Approved for public release; distribution is unlimited.

This thesis implements spectrum sensing and localization tasks using a radio frequency sensor network and analyzes the performance of this implementation through simulation. A sensor network based cooperative wideband spectrum sensing and localization scheme is proposed for the implementation of the tasks. In the proposed scheme, wavelet-based multi-resolution spectrum sensing and received signal strengthbased localization methods, which were originally proposed for cognitive radio applications, are adapted to radio frequency sensor networks. For cooperation of the nodes in the proposed scheme, a new three-bit hard combination technique is developed. A simulation model is created in MATLAB programming language to implement the proposed scheme and to analyze its simulation performance. The results of the simulation show that the proposed sensor network based cooperative wideband spectrum sensing and localization scheme is appropriate for radio frequency sensor networks and the proposed three-bit hard combination scheme is superior to the traditional hard combination schemes in terms of false alarm reduction. http://archive.org/details/cooperativewideb109454612 Turkish Air Force author. Approved for public release; distribution is unlimited.

This dissertation pioneers the concept of traffic-adaptive, flow-specific medium access and demonstrates that it outperforms contention, non-contention and hybrid techniques. The novel traffic-adaptive Cooperative Wireless Sensor Network Medium Access Control (CWS-MAC) scheme is proposed and shown to provide better throughput and delay performance than slotted, non-persistent carrier sense multiple access (CSMA), upon which the IEEE 802.11 standard is based, and time division multiple access (TDMA). A general model for traffic-adaptive, flow-specific medium access control is developed and hybrid, contention and non-contention schemes are shown to be special cases. This work also compares the energy efficiency of centralized and distributed solutions and proposes an energyefficient version of traffic-adaptive CWS-MAC that includes an adaptive sleep cycle coordinated through the use of preamble sampling. A preamble sampling probability parameter is introduced to manage the trade-off between energy efficiency and throughput and delay performance. Finally, this research quantifies the effect of large propagation delays on contention and contention-free medium access and proposes a flow-specific medium access scheme for networked satellite systems that is based on traffic-adaptive CWS-MAC and is shown to outperform both CSMA- and TDMA-based solutions. http://archive.org/details/trafficadaptivef1094547475 Commander, United States Navy Approved for public release; distribution is unlimited.

In this thesis, a scheme for the identification and classification of orthogonal frequency division multiplexing based signals is proposed. Specifically, the cyclostationary signature of IEEE 802.11 and IEEE 802.16 standard compliant waveforms is investigated. A model is introduced that identifies the waveform; in the case of IEEE 802.11, confirms identification decision via cyclostationary feature extraction. If the waveform is identified as being IEEE 802.16 compliant, the scheme will classify the cyclic prefix size of the waveform. After cyclic prefix classification, the 802.16 waveform will be subjected to cyclostationary feature extraction for identification confirmation. The cyclostationary signature of each waveform is generated via a computationally efficient algorithm called the fast Fourier transform accumulation method, which produces an estimate of the waveform's spectral correlation density function. Simulation results based on MATLAB implementation are presented. http://archive.org/details/identificationnd109454620 US Marine Corps (USMC) author. Approved for public release; distribution is unlimited.

In order to provide a step towards the goal of passing TCP/IP traffic across wireless sensor networks, a method for file transfer utilizing forward error correction (FEC) is studied. Previous work in the area of terminal communication across the sensor network is expanded upon to include file transfer in order to provide a more capable channel and a basis for testing the performance obtained through erasure coding. The results of the FEC implementation are examined using multiple sensor network configurations. The study is completed with recommendations for continued work towards developing tunneled TCP/IP data transfer across wireless sensor networks. http://archive.org/details/filetransferwith109454893 US Navy (USN) author. Approved for public release; distribution is unlimited.

This thesis proposes a least-squares error estimator for line-of-sight, direction of arrival-based localization and a hybrid source localization scheme that addresses multipath propagation for non-cooperative sources using random arrays of wireless sensors. Taking advantage of the dominant reflections, the proposed solution finds the location of a signal source by triangulation using the direction of arrival estimations of both the line-of-sight and the reflected components. It uses a space division multiple access, spread spectrum-based receiver to generate the direction of arrival estimates. The time difference of arrival information is used to discriminate between the line-of-sight and the non-line-of-sight signals and to associate the incoming multipath signal with the corresponding source and reflector pair. In special cases, the proposed scheme is capable of solving the association problem spatially without the need for time difference of arrival information. Simulation results are included to demonstrate that the proposed scheme provides improved estimates by exploiting the non-line-of-sight information. http://archive.org/details/sourcelocalizati109454822 Hellenic Navy author. Approved for public release; distribution is unlimited.

Existing semiconductor photodetectors produce a steady current or voltage output in response to incident light that depends on the intensity of the light beam. In contrast, biological vision systems produce a stream of pulses with pulse rate representing the amount of incident light power. The goal of this thesis is to explore the use of a four-layer PNPN semiconductor structure as an optical detector that produces pulses instead of steady current or voltage output. The first task of this thesis is to show that the pulse interval distribution is dependent on the intensity of the incident light beam, and that the distribution of pulse intervals is described by a renewal process statistical model. The second task of this thesis is to use the unique characteristics of the pulse generating circuit along with a neural network to construct a 2D sensor array capable of recognizing visual patterns, and thus modeling, to some extent, the human visual cortex. http://archive.org/details/pulsemodelightse109453775 Hellenic Navy author. Approved for public release; distribution is unlimited.

In this thesis, methods for forming a communications link of Wireless Sensor Networks (WSN) by enabling each WSN to act as a smart antenna are presented. Each WSN is simulated as a set of randomly placed sensor nodes within a planar area. The proposed method involves a searching WSN, a receiving WSN and a link budget for establishing the link. The searching WSN has the task of transmitting a search beam in order to find adjacent WSNs. Like a lighthouse this is done in a rotating beam style search using the sensor nodes as an aperiodic array. Results show that for a random array, we can achieve a specific beamwidth and gain as a function of the number of elements and area. We also demonstrate that for a given required gain level we can spatially thin the array without significant loss of gain or the effects of grating lobes. The receiving WSN uses a spread spectrum based space division multiple access (SDMA) receiver. This receiver is simulated to determine the direction of arrival from the searching WSN and to extract the location information from the searching WSN's signal with additive white Gaussian noise. From the DOA and the location information within the arriving signal, the WSN has sufficient knowledge to respond to the query of the searching WSN and form the communications link. http://archive.org/details/terrestrialcommu109454010 US Navy (USN) author. Approved for public release; distribution is unlimited.

A technique for terminal communication through transmission links established across a wireless sensor network is developed and tested. Using protocols established for conventional wireless communication networks as a guiding principle, different methodologies for link management, and segmentation and reassembly of information are explored. A protocol for sensor network encapsulation was designed and implemented across a network of terminals and wireless sensor motes. The study concludes with a discussion of the capabilities and limitations of this technique supported by results obtained through experiments under various scenarios. http://archive.org/details/tunneleddattrans109453023 Singapore Army author. Approved for public release; distribution is unlimited.

The advancement in communication and networking technologies lead to the emergence of network centric systems adopted by military forces. Many military forces around the world are equipping their ground soldiers with "man portable" or "mobile" wireless communication devices to form a local communication network as part of the overarching communication network for information warfare. In a non-line of sight environment, the devices' communication range to the base station degrades significantly. The research objective is to examine collaborative beamforming man portable wireless communication networks in a non-ideal propagation operation environment such as in a terrain with foliage. Using distributed beamforming techniques with wireless radios, the communication range can be increased to overcome foliage attenuation and other losses. Seasonal foliage effects on the wireless network were considered in the study. Wireless beamforming strategies were devised and an analysis of system performance and tradeoffs was conducted. System synchronization of the wireless collaborative communication network is a major challenge due to the lack of fixed infrastructure and the dynamic topology of the network. Two network synchronization schemes: mutual synchronization and master-slave synchronization were investigated. Finally, an analysis of phase errors, which affect the gains achieved by distributed beamforming, was performed. http://archive.org/details/distributedbeamf109453063 Singapore Technologies Kinetics Ltd author (civilian). Approved for public release; distribution is unlimited.

This thesis investigates the detection, classification, frame synchronization, and demodulation of wireless networking waveforms by a digital receiver. The approach is to develop detection thresholds for wireless networking signals based upon the probability density functions of the signal present or signal absent scenarios. A Neyman-Pearson test is applied to determine decision thresholds and the associated probabilities of detection. With a chosen threshold, MATLAB simulations are run utilizing models developed to generate and receive IEEE 802.11a, IEEE 802.16, and IEEE 802.11b signals in multipath channels characterized by Rayleigh fading. Algorithms are developed for frame synchronization for each of the three waveforms. The probability of signal detection, successful frame synchronization, and the bit error rates of the received packet header and data are calculated. The results show that, even in Rayleigh fading environments at low signal to noise levels, these three waveforms can be distinguished in a digital receiver. Further, the results show that significant signal information can be gathered on these wireless networking waveforms, even when the entire signal cannot be demodulated due to low signal to noise ratios. http://archive.org/details/signaldetectionn109453291 US Navy (USN) author. Approved for public release; distribution is unlimited.

Voice over Internet Protocol (VoIP) is an emerging technology with the potential to assist the United States Marine Corps in solving communication challenges stemming from modern operational concepts. This thesis conducts a review of VoIP standards and develops an H.323-based testbed for the study of tactical wireless VoIP performance. Methods of collecting and presenting voice quality parameters in packet-based networks are explored. Incorporation of an Adtech SX/14 Data Channel Simulator provides user control of a SONET-simulated wireless channel. Experiments quantify the effect of channel injected error rate on received voice traffic. Plots are generated to illustrate the relationship between channel error rate, packet loss, and the listening quality mean opinion score. Experimental results are extended by incorporating E-model delay considerations. Commercial voice recognition software is successfully used to measure the impact of the channel on speech intelligibility. The experiments and analysis conducted provide a cost effective approach to non-intrusive, objective voice quality assessment. http://archive.org/details/voiceoverinterne109453270 US Marine Corps (USMC) author. Approved for public release; distribution is unlimited.