Abstract Safety is a simple concept but an abstract task, specifically with aircraft. One critical safety system, the Traffic Collision Avoidance System II (TCAS), protects against mid-air collisions by predicting the course of other aircraft, determining the possibility of collision, and issuing a resolution advisory for avoidance. Previous research to identify vulnerabilities associated with TCAS’s communication processes discovered that a false injection attack presents the most comprehensive risk to veritable trust in TCAS, allowing for a mid-air collision. This research explores the viability of successfully executing a false injection attack against a target aircraft, triggering a resolution advisory. Monetary constraints precluded access to a physical TCAS unit; instead, this research creates a novel program, TCAS-False Injection Environment (TCAS-FIE), that incorporates real-world distributed computing systems to simulate a ground-based attacker scenario which explores how a false injection attack could target an operational aircraft. TCAS-FIEs’ simulation models are defined by parameters to execute tests that mimic real-world TCAS units during Mode S message processing. TCAS-FIE simulations execute tests over applicable ranges (5–30 miles), altitudes (25–45K ft), and bearings standard for real-world TCAS tracking. The comprehensive tests compare altitude, measure range closure rate, and measure signal strength from another aircraft to determine the delta in bearings over time. In the attack scenario, the ground-based adversary falsely injects a spoofed aircraft with characteristics matching a Boeing 737-800 aircraft, targeting an operational Boeing 737-800 aircraft. TCAS-FIE completes 555,000 simulations using the various ranges, altitudes, and bearings. The simulated success rate to trigger a resolution advisory is 32.63%, representing 181,099 successful resolution advisory triggers out of 555,000 total simulations. The results from additional analysis determine the required ranges, altitudes, and bearing parameters to trigger future resolution advisories, yielding a predictive threat map for aircraft false injection attacks. The resulting map provides situational awareness to pilots in the event of a real-world TCAS anomaly.

Sequence pattern mining (SPM) seeks to find multiple items that commonly occur together in a specific order. One common assumption is that the relevant differences between items are captured through creating distinct items. In some domains, this leads to an exponential increase in the number of items. This paper presents a new SPM, Sequence Mining of Temporal Clusters (SMTC), that allows item differentiation through attribute variables for domains with large numbers of items. It also provides a new technique for addressing interleaving, a phenomena that occurs when two sequences occur simultaneously resulting in their items alternating. By first clustering items temporally and only focusing on sequences after the temporal clusters are established, it sidesteps the traditional interleaving issues. SMTC is evaluated on a digital forensics dataset, a domain with a large number of items and frequent interleaving. Its results are compared with Discontinuous Varied Order Sequence Mining (DVSM) with variables added (DVSM-V). By adding variables, both algorithms reduce the data by 96 percent, and identify 100 percent of the events while keeping the false positive rate below 0.03 percent. SMTC mines the data in 20 percent of the time it takes DVSM-V and provides a lower false positive rate even at higher similarity thresholds.

The current mechanics of cyber incident notification within the United States Air Force rely on a broadcast “push” of incident information to the affected community of interest. This process is largely ineffective because when the notification arrives at each unit, someone has to make a decision as to who should be notified within their unit. Broadcasting the notification to all users creates noise for those who do not need the notification, increasing the likelihood of ignoring future notifications. Selectively sending notifications to specific people without a priori knowledge of who might be affected results in missing users who need to know. Neither of these approaches addresses the passing of notifications to downstream entities whose missions may be affected by the incident. In this paper, we propose a modular, scalable, cyber incident notification system concept that makes use of a “publish and subscribe” architecture to assure the timeliness and relevance of incident notification. Mission stakeholders subscribe to the status of mission critical information resources (external and internal) and publish their own mission capability allowing other units to maintain real-time awareness of their own dependencies. We contend that this architecture is a significant improvement over current methods by making direct connections between mission stakeholders and their dependencies and eliminating multiple levels of human processing, thereby reducing noise and ensuring relevant information gets to the right people.

Virtually all modern organizations have embedded information systems into their core business processes as a means to increase operational efficiency, improve decision making quality, and minimize costs. Unfortunately, this dependence can place an organization's mission at risk if the confidentiality, integrity, or availability of a critical information resource has been lost or degraded. Within the military, this type of incident could ultimately result in serious consequences including physical destruction and loss of life. To reduce the likelihood of this outcome, personnel must be informed about cyber incidents, and their potential consequences, in a timely and relevant manner so that appropriate contingency actions can be taken. In this paper, we identify criteria for improving the relevance of incident notification, propose the use of case-based reasoning (CBR) for contingency decision support, and identify key design considerations for implementing a CBR system used to deliver relevant notification following a cyber incident.

The proliferation of affordable RF communication devices has given every individual the capability to communicate voice and/or data worldwide. This has increased wireless user exposure and driven the need for improved security measures. While earlier works have primarily focused on detecting and mitigating spoofing at the MAC layer, there has been a shift toward providing protection at the PHY layer by exploiting RF characteristics that are difficult to mimic. This research investigates the use of RF "fingerprints" for classifying emissions by exploiting transient signal features to provide hardware-specific identification. Reliable transient detection is the most important step in the process and is addressed here using variance trajectory of instantaneous amplitude and instantaneous phase responses. Following transient detection performance characterization, power spectral density fingerprints are extracted and spectral correlation used for classification. For proof-of-concept demonstration, the overall detection and classification process is evaluated using experimentally collected 802.11a OFDM signals. Results show that amplitude-based transient detection is most effective. Classification performance is demonstrated using three devices with overall classification accuracy approaching 80% for 802.11a signals at SNRs greater than 6 dB.

A spectrally modulated, spectrally encoded (SMSE) framework is adopted for implementing code division multiple access (CDMA) with partial band interference suppression. SMSE signals are constructed within an architecture governed by cognitive radio (CR) principles and supported by software defined radio (SDR) implementation, a union referred to as CR- based SDR. Orthogonal frequency division multiplexing (OFDM) signals, a foundational part of future 4G systems, are collectively classified as SMSE because data modulation and encoding are applied in the spectral domain. Framework applicability was demonstrated for realistic 4G signals by illustrating consistency between resultant analytic SMSE expressions and published results. Framework implementability and flexibility is further demonstrated herein using more complex CDMA signal structures. Modeling and simulation results are presented for a form of multi-carrier CDMA using polyphase codes with adaptive spectral notching (interference avoidance). Collectively, the SMSE implementation of this system correlates very well with theoretical predictions for multiple access scenarios.

This paper applies a recently introduced general analytic framework for spectrally modulated and spectrally encoded (SMSE) signals to carrier interferometry (CI) signals. The SMSE framework mathematically incorporates the waveform adaptivity and diversity found in SMSE signals. Future fourth generation (4G) radios are likely to operate using cognitive principles whereby the system adapts to changing traffic loads, interfering signals, spectrum availability, and channel conditions. Because 4G architectures are contemplating the use of SMSE techniques to enable cognitive communications, a general analytic framework was recently introduced in which SMSE signals can be derived, analyzed, and implemented. This paper adopts this concise mathematical model and applies it to CI signals, including those that couple CI coding techniques with orthogonal frequency division multiplexing (OFDM), coded OFDM, or multi-carrier code division multiple access (MC-CDMA). As shown herein, the model may be implementable using adaptive software defined radio (SDR) techniques.

Spectral encoding is employed to provide interference avoidance and multiple access capability using M-ary phase shift keyed (MPSK) data modulation. Communication symbols are formed using composite phase modulation (independent data and coded multiple access) on selected spectral components and then inverse Fourier transforming to obtain time domain waveforms. This technique enables multiple access and adaptive channel interference suppression. One inherent advantage is analytic tractability of phase modulation components across domains which enables robust theoretical performance prediction with variation in multiple access phase value assignment. Detection and estimation is accomplished using conventional correlation receiver techniques and error performance is shown to be consistent with conventional MPSK signaling. Analytic and simulated results are provided for multiple access bit error performance and interference suppression demonstrated using randomly assigned, uniformly distributed multiple access phase values.