Search

A method and system for multipulse-pulse position modulation optical transmission that includes selecting a multipulse- pulse position modulation having a symbol alphabet having an upper-bound symbol alphabet size, and determining, based on at least one transmission characteristic associated with a transmitter, a subset of symbols of the selected symbol alphabet capable of being transmitted by the transmitter, the subset of symbols having a set of binary codewords. The method and system may include identifying two-symbol concatenation of binary codewords in the set of binary codewords, calculating a cross correlation of binary codeword in the set of binary code words through every two-symbol concatenation, determining a set of one or more acceptable codeword combinations by eliminating a portion of two-symbol concatenation of codewords corresponding to overlapping peaks in the respective calculated cross correlations, and transmitting, by the transmitter via an optical communication channel, information encoded based on the determined acceptable codeword combinations.

The invention relates to concealing information within error correction codes of adaptive rate wireless communication systems. In some embodiments, the invention includes selecting a modulation and coding scheme with a more robust error correction capacity than needed by current channel conditions; encoding a hidden message with a pre-shared key that is known by a covert transmitter and a covert receiver, and after a standard message is encoded by a transmitting station of the wireless communication systems, replacing codeword parity bits of codewords in the encoded standard message with the encoded hidden message at desigₙated locations. Before a receiving station of the wireless communication systems decodes the encoded standard message, a covert receiver extracts the embedded hidden message from the encoded standard message, replaces bit values of the embedded hidden message with zero at the designated locations, and decodes the extracted hidden message with the pre-shared key.

In this dissertation, we present an information hiding approach incorporating anonymity that builds on existing classical steganographic models. Current security definitions are not sufficient to analyze the proposed information hiding approach as steganography offers data privacy by hiding the existence of data, a property that is distinct from confidentiality (data existence is known but access is restricted) and authenticity (data existence is known but manipulation is restricted). Combinations of the latter two properties are common in analyses, such as Authenticated Encryption with Associated Data (AEAD), yet there is a lack of research on combinations with steganography. This dissertation also introduces the security definition of Authenticated Stegotext with Associated Data (ASAD), which captures steganographic properties even when there is contextual information provided alongside the hidden data. We develop a hierarchical framework of ASAD variants, corresponding to different channel demands. We present a real-world steganographic embedding scheme, Authenticated SteGotex with Associated tRansaction Data (ASGARD), that leverages a blockchain-based application as a medium for sending hidden data. We analyze ASGARD in our framework and show that it meets Level-4 ASAD security. Finally, we implement ASGARD on the Ethereum platform as a proof-of-concept and analyze some of the ways an adversary might detect our embedding activity by analyzing historical Ethereum data., Lieutenant, United States Navy, Approved for public release. Distribution is unlimited.

This thesis develops a machine learning approach to classify normal and anomalous JavaScript based on a static analysis of select features derived from the top 30 000 webpages on the internet. A dataset of 136 features was extracted from 100 000 raw JavaScript files. Nine test groups were created and tested using 10 subsets of features. K-means clustering was used to group the data and manually translate into binary classification. The results from the K-means clustering show moderate performance with distortions less than 1.0 from elbow plot analysis and average silhouette scores between 0.3 and 0.8 using silhouette analysis of the clustering. The classification of each JavaScript file was then examined using naïve Bayes algorithm to re-create and examine the performance of the highest performing classifiers using a less processing intensive method. Naïve Bayes was not a good model to re-create the K-means classifier. The best performing classifiers had a Matthews correlation coefficient of 0.75 when examining small JavaScript, and less that 0.38 when examining the medium or large JavaScript. The results show that most JavaScript files were small in file size, and file size was the only defining feature. No features tested effectively categorize the vast majority of JavaScript other than file size. Further research is needed to find features that more accurately encompass the majority of JavaScript to define normal JavaScript.

In this thesis, we analyze and optimize the modified polar decoding and syndrome matching radio network temporary identifier (RNTI) recovery method to de-anonymize the physical downlink control channel (PDCCH) in 5G networks. We present the impact on RNTI recovery of payload length, codeword length, signal-to-noise ratio (SNR) and the Hamming and longest common substring (LCS) recovery methods. Further, we consider the full set of RNTIs and downlink control information (DCI) fields that can be examined for user activity data and propose methods to track user activity within radio networks from the recovered data. Finally, we optimize the RNTI recovery method for different attacker scenarios to demonstrate how an attacker can recover RNTIs, track UEs, and aggregate data about the UE usage patterns and/or metadata about the user., DOD Space, Chantilly, VA 20151, Lieutenant Commander, United States Navy, Approved for public release. Distribution is unlimited.

A Covert Analysis Detection (CAD) system is an operationalized honeypot or honeynet that is designed to covertly capture, control and provide analysis capabilities of all traffic that flows through it. It was found that the covert data capture capability not only revealed the attackers tools ( captured as source code) and tactics ( collection of compromised systems), but also over time it revealed that that attacker's actual motive was the creation of a distributed denial of service (DDoS) network. The discovery of this lethal network tool and all the signatures of its creation and maintenance, proved the validity of the CAD's capabilities to aid in the enhancement of our information protection resources., Captain, United States Marine Corps, Approved for public release; distribution is unlimited.

Innovative solutions need to be developed to defend against the continued threat of computer worms. We propose the spectral graph theory worm detection model that utilizes traffic dispersion graphs, the strong node concept, and phantom components to create detection thresholds in the eigenspectrum of the dual basis. This detection method is employed in our proposed model to quickly and accurately detect worm attacks with different attack characteristics. It also intrinsically identifies infected nodes, potential victims, and estimates the worm scan rate. We test our model against the worm-free NPS2013 dataset, a modeled Blaster worm, and the WannaCry CTU-Malware-Capture-Botnet-284-1 and CTU-Malware-Capture-Botnet-285-1 datasets. Our results show that the spectral graph theory worm detection model has better performance rates compared to other models reviewed in literature.

For moving target defense (MTD) to shift advantage away from cyber attackers, we need techniques which render systems unpredictable but still manageable. We formulate a partially observable Markov decision process (POMDP) which facilitates optimized MTD capable of thwarting cyber attacks without excess overhead. This paper describes POMDP formulation including the use of an absorbing final state and attack penalty scaling factor to abstract defender-defined priorities into the model. An autonomous agent leverages the POMDP to select the optimal defense based on assessed cyber-attack phase. We offer an example formulation wherein attack suppression of greater than 99% and system availability of greater than 94% were maintained even as probability of detection of attack phase dropped to 74%.

With cyber attacks on the rise, cyber defenders require new, innovative solutions to provide network protection. We propose a spectral graph-based cyber detection and classification (SGCDC) system using phantom components, the strong node concept, and the dual-degree matrix to detect, classify, and respond to worm and distributed denial-of-service (DDoS) attacks. The system is analyzed using absorbing Markov chains and a novel Levy-impulse model that characterizes network SYN traffic to determine the theoretical false-alarm rates of the system. The detection mechanism is analyzed in the face of network noise and congestion using Weyl’s theorem, the Davis-Kahan theorem, and a novel application of the n-dimensional Euclidean metric. The SGCDC system is validated using real-world and synthetic datasets, including the WannaCry and Blaster worms and a SYN flood attack. The system accurately detected and classified the attacks in all but one case studied. The known attacking nodes were identified in less than 0.27 sec for the DDoS attack, and the worm-infected nodes were identified in less than one second after the second infected node began the target search and discovery process for the WannaCry and Blaster worm attacks. The system also produced a false-alarm rate of less than 0.005 under a scenario. These results improve upon other non-spectral graph systems that have detection rates of less than 0.97 sec and false alarm rates as high as 0.095 sec for worm and DDoS attacks., Lieutenant Commander, United States Navy, Approved for public release. distribution is unlimited

The advent of 5G promises a new age of speed and connectivity of mobile devices. Location-based services will reach a new state of accuracy as well. 4G/LTE implemented the timing advance group (TAG) to increase throughput by allowing user equipment (UE) to connect to multiple base stations (BSs). Timing advance (TA) commands are utilized in order to maintain time synchronization between each servicing BS by directing when the UE should transmit based on the distance to each associated BS. For 4G/LTE, each TA is a multiple of 78.125 meters. As the subcarrier spacing increases in 5G, this distance resolution drops proportionately. These TA commands are sent frequently as the UE moves throughout the environment and are unencrypted. This opens the concern that if an adversary were to collect and correctly associate the TAGs of a specific target, they may be able to ascertain a position estimate using multilateration. The TAG exploit has been examined for 4G/LTE and has been shown to be significant, but the new subcarrier spacing for 5G theoretically will increase the fidelity with which locations can be determined. The focus of this thesis is to establish a Cramér-Rao Lower Bound (CRLB) for position estimates based on the TA commands for each of the 5G sub-carrier spacing and to implement and test an algorithm for finding a position estimate based on target TAs through simulation., Lieutenant, United States Navy, Approved for public release. distribution is unlimited

The development and adoption of 5G technology is rapidly progressing worldwide, and users of this technology are expected to increase to three billion by 2026. Third generation Partnership Project (3GPP) has designed the specifications of this new network infrastructure with security in mind; however, ongoing research continues to verify and scrutinize the system to help keep the data traveling this network safe. This thesis evaluates the feasibility and performance of three different attacks on the anonymity of low-density parity-check (LDPC) encoded data in 5G physical downlink shared channel (PDSCH), then compares the findings to a similar study done of Polar coded data in physical downlink control channel (PDCCH). The anonymity attacks make use of a scrambling sequence, which is associated to a unique radio network temporary identifier (RNTI) and added to encoded data before transmission. Brute-force attacks, known plaintext attacks, and analysis using multiple messages were used to explore the security of this scrambling sequence and RNTI. This paper finds the standards used in PDSCH to provide more robust security than PDCCH and recommends the adaptation of parameters used in PDSCH in future applications., http://archive.org/details/anevaluationofde1094568323, Lieutenant, United States Navy, Approved for public release. Distribution is unlimited.

All computer network traffic can be associated with a specific signature based on a feature set within its metadata. There has been a significant effort in preprocessing data for machine learning for the purposes of transforming raw data into features that represent a large dataset and improve the accuracy of predictive models. This thesis develops a machine learning approach that can analyze and classify network traffic to determine the level and degree of secure practices within specific network identifiers. We propose a novel continuous learning methodology in which a clustering technique was utilized to identify labels to a previously unlabeled dataset. A neural network algorithm was then trained on the labeled flows and tested on an unknown dataset to determine the network security classification. This previously unknown dataset was then used to retrain the neural network, thus continuously expanding the database of feature sets for training in order to increase the security classification accuracy. By implementing the proposed methodology on a widely known dataset, we achieved an increase in security classification performance as compared to traditional classification techniques., Major, United States Marine Corps, Approved for public release. Distribution is unlimited.

As everyone knows, this has been an unusual year. In-person meetings, including this conference, have gone entirely online. This minitrack, which first appeared in 2005, will be entirely online and asynchronous in 2021.

This work describes a novel application of robust estimation to the detection of volumetric anomalies in computer network traffic. The proposed tests are based on sample location and dispersion and derived from relatively unknown Zero Order Statistics. The proposed tests are non-parametric and suitable for a range of applications to heavy-tailed data analysis outside of network traffic. The performance of these tests is examined using two different real-world denial-of-service attacks contained in actual high-volume backbone traffic. The proposed tests outperform traditional metrics such as mean and variance due to the presence of heavy tails in the network traffic, a frequent characteristic of traffic in actual networks. Monte Carlo analysis is used to quantify the performance gains and show an improvement in accuracy between 7 and 11% at very low false alarm rates. The proposed tests also demonstrate equivalent or superior performance to the median, a common robust statistic. Constructive timing of key system processes is used to demonstrate near real-time perfor- mance. Three- and six- second data windows containing between 750 and 1200 elements can be processed in less than one second using commodity hardware running unoptimized code. These timing results imply scalability to a variety of networks and commercial ap- plications. Scalability prospects are further enhanced by demonstrating resilient detection performance at attack volumes between 25 and 100 percent of baseline rates in both real and generated traffic.

Those who defend systems against cyber-attacks can use moving target defense (MTD) to their advantage. However, optimal MTD techniques have yet to be sufficiently explored. In terms of cost-benefit analysis, the desired level of attack suppression will come at the cost of network availability, and optimization tools might be able to harness the advantages of MTD without undue sacrifice. This thesis formulates an attack/defense scenario as a partially observable Markov decision process (POMDP) to facilitate optimal MTD of a host. We develop a system in which service and IP reconfigurations can be employed as defense against a five-stage attack to maximize system availability and minimize cost. With an attack/defense scenario involving five attack stages and two defense options, we explore the utility of the Determinized Sparse Partially Observable Tree (DESPOT) algorithm for online optimal defense selection using the POMDP formulation. We compare optimization of the system for three different cases of the POMDP with varying levels of uncertainty (i.e., probability of detection) representing potential real-world scenarios. A significant result of this thesis is our development of a framework for optimizing MTD techniques. We also demonstrate, within the limitations of this research, how to determine the bounds for best performance when using DESPOT as an MTD controller., Lieutenant, United States Navy, Approved for public release. distribution is unlimited

Channel-response-based physical-layer authentication systems are challenged by the use of millimeter-wave frequencies for wireless communications due to the reduced coherence time and the sparsity of multipath components typically encountered. We examine how such an environment makes the assumptions of previous works in physical-layer authentication unrealistic, and present an approach that can tolerate such challenges by anticipating channel-response features based on relatively simple environmental survey information and location information of the communicating nodes. In addition to its resilience to millimeter-wave channel phenomena, such an approach has the advantage of being independent of an alternative initial authentication mechanism, distinguishing it from the majority of previous channel-based physical-layer authentication works and enabling its use in multi-factor authentication. Our work examines to what extent multipath time delays caused by planar specular reflectors enable the authentication of a wireless user’s reported position. Our formulations are supported via simulation of multiple environments, and the efficacy of the proposed scheme is supported via analysis of its information entropy and the likelihood that a masquerading attempt will be inadvertently authenticated. The analysis indicates useful information entropy and miss rates can be achieved provided measurement error is adequately bounded., http://archive.org/details/gmillimeterwavep1094564010, Lieutenant Commander, United States Navy, Approved for public release; distribution is unlimited.

Includes supplementary material, Over the last decade there has been tremendous growth in the number of mobile subscribers across the globe. Along with this growth in mobile device use there has been an accompanying increase in the amount of personally identifiable information that is transmitted and stored by various entities on a daily basis. This presents a significant privacy risk to users. This research paper presents a methodology by which a passive eavesdropper of a network can identify addressing information (i.e., cell-Radio Network Temporary Identifier [RNTI]) assigned to transmissions in the 5G physical downlink control channel. The ability for an eavesdropper to obtain this information degrades the degree to which the transmitted data is anonymized, thereby potentially negatively impacting user’s privacy. The presented methodology determines this information by examining patterns in the frozen bit indices generated via the polar encoding and decoding processes and applied scrambling sequences. Simulations examined the effectiveness of the methodology under a variety of signal-to-noise ratio conditions and presented several optimization techniques. Through the presented methodology, this research paper aims to better inform industry and standards bodies of potential privacy vulnerabilities so that the existing mobile standards may be improved upon., Outstanding Thesis, Major, United States Marine Corps, Approved for public release. distribution is unlimited

Moving target defense (MTD) is a promising strategy for gaining advantage over cyber attackers, but these dynamic reconfigurations can impose significant overhead. We propose implementing MTD within an optimization framework so that we seize defensive advantage while minimizing overhead. This dissertation presents an MTD scheme that leverages partially observable Markov decision processes (POMDP) with absorbing states to select the optimal defense based on partial observations of the cyber attack phase. In this way, overhead is minimized as reconfigurations are triggered only when the potential benefit outweighs the cost. We formulate and implement a POMDP within a system with Monte-Carlo planning-based decision making configured to reflect defender-defined priorities for the cost-benefit tradeoff. The proposed system also includes a performance -monitoring scheme for continuous validation of the model, critical given attackers' ever-changing techniques. We present simulation results that confirm the system fulfills the design goals, thwarting 99% of inbound attacks while sustaining system availability at greater than 94% even as probability of attack phase detection dropped to 0.74. A comparable system that triggered MTD techniques pseudorandomly maintained just 43% availability when providing equivalent attack suppression, which illustrates the utility of our proposed scheme.

With cyber attacks on the rise, cyber defenders require new, innovative solutions to provide network protection. We propose a spectral graph-based cyber detection and classification (SGCDC) system using phantom components, the strong node concept, and the dual-degree matrix to detect, classify, and respond to worm and distributed denial-of-service (DDoS) attacks. The system is analyzed using absorbing Markov chains and a novel Levy-impulse model that characterizes network SYN traffic to determine the theoretical false-alarm rates of the system. The detection mechanism is analyzed in the face of network noise and congestion using Weyl’s theorem, the Davis-Kahan theorem, and a novel application of the n-dimensional Euclidean metric. The SGCDC system is validated using real-world and synthetic datasets, including the WannaCry and Blaster worms and a SYN flood attack. The system accurately detected and classified the attacks in all but one case studied. The known attacking nodes were identified in less than 0.27 sec for the DDoS attack, and the worm-infected nodes were identified in less than one second after the second infected node began the target search and discovery process for the WannaCry and Blaster worm attacks. The system also produced a false-alarm rate of less than 0.005 under a scenario. These results improve upon other non-spectral graph systems that have detection rates of less than 0.97 sec and false alarm rates as high as 0.095 sec for worm and DDoS attacks.

As the threat of cyber attack grows ever larger, new approaches to security are required. While there are several different types of intrusion detection systems (IDS), collaborative IDS (CIDS) offers particular promise in identifying distributed, coordinated attacks that might otherwise elude detection. Even for CIDS, there are unresolved issues associated with trusting participants and aggregating data. Blockchain technology appears capable of +ressing those issues if practical implementation strategies can be developed. To that end, we implement an Ethereum blockchain-based CIDS leveraging pluggable authentication modules. Our system is specifically crafted to detect doorknob rattling attacks by immutably recording login activity in a blockchain-protected ledger.

In this paper, we explore the performance of error correction code-based embedding in adaptive rate wireless communication systems. We first develop a model to illustrate the relationship between the selected modulation and coding scheme index, the current channel state, and the embedding capacity. Extensive simulations facilitate the development of expressions to describe the estimated embedding capacity for the proposed scheme when implemented within the single carrier physical layer of the IEEE 802.11ad, directional multi-Gigabit standard. We further identify and characterize various types of distortion and describe +itional constraints that may serve to reduce the available embedding margin and overall embedding capacity.

A system and method for clock-skew-based covert communication in which a message formed of message bits is mapped to corresponding symbols having predetermined clock skew values. For each corresponding symbol, an offset value is calculated and added to each timestamp in a predetermined quantity of outgoing TCP segments to generated altered TCP segments, such that an artificial clock skew is induced as measured by a receiver. A clock skew value is determined from each predetermined quantity of TCP segments and mapped to corresponding symbol. The symbols are then mapped to corresponding message bits, and the message is determined from the bits. In this way a message can be sent from a transmitter to a receiver in a way that is covert during transmission and deciphered at the receiver.