Abstract Researchers typically increase training data to improve neural net predictive capabilities, but this method is infeasible when data or compute resources are limited. This paper extends previous research that used long short-term memory–fully convolutional networks to identify aircraft engine types from publicly available automatic dependent surveillance-broadcast (ADS-B) data. This research designs two experiments that vary the amount of training data samples and input features to determine the impact on the predictive power of the ADS-B classification model. The first experiment varies the number of training data observations from a limited feature set and results in 83.9% accuracy (within 10% of previous efforts with only 25% of the data). The findings show that feature selection and data quality lead to higher classification accuracy than data quantity. The second experiment accepted all ADS-B feature combinations and determined that airspeed, barometric pressure, and vertical speed had the most impact on aircraft engine type prediction.

Abstract Successful missions in the field often rely upon communication technologies for tactics and coordination. One middleware used in securing these communication channels is Data Distribution Service (DDS) which employs a publish-subscribe model. However, researchers have found several security vulnerabilities in DDS implementations. DDS-Cerberus (DDS-C) is a security layer implemented into DDS to mitigate impersonation attacks using Kerberos authentication and ticketing. Even with the addition of DDS-C, the real-time message sending of DDS also needs to be upheld. This paper extends our previous work to analyze DDS-C’s impact on performance in a use case implementation. The use case covers an artificial intelligence (AI) scenario that connects edge sensors across a commercial network. Specifically, it characterizes how DDS-C performs between unmanned aerial vehicles (UAV), the cloud, and video streams for facial recognition. The experiments send a set number of video frames over the network using DDS to be processed by AI and displayed on a screen. An evaluation of network traffic using DDS-C revealed that it was not statistically significant compared to DDS for the majority of the configuration runs. The results demonstrate that DDS-C provides security benefits without significantly hindering the overall performance.

Abstract Securing distributed device communication is critical because the private industry and the military depend on these resources. One area that adversaries target is the middleware, which is the medium that connects different systems. This paper evaluates a novel security layer, DDS-Cerberus (DDS-C), that protects in-transit data and improves communication efficiency on data-first distribution systems. This research contributes a distributed robotics operating system testbed and designs a multifactorial performance-based experiment to evaluate DDS-C efficiency and security by assessing total packet traffic generated in a robotics network. The performance experiment follows a 2:1 publisher to subscriber node ratio, varying the number of subscribers and publisher nodes from three to eighteen. By categorizing the network traffic from these nodes into either data message, security, or discovery+ with Quality of Service (QoS) best effort and reliable, the mean security traffic from DDS-C has minimal impact to Data Distribution Service (DDS) operations compared to other network traffic. The results reveal that applying DDS-C to a representative distributed network robotics operating system network does not impact performance.

Sequence pattern mining (SPM) seeks to find multiple items that commonly occur together in a specific order. One common assumption is that the relevant differences between items are captured through creating distinct items. In some domains, this leads to an exponential increase in the number of items. This paper presents a new SPM, Sequence Mining of Temporal Clusters (SMTC), that allows item differentiation through attribute variables for domains with large numbers of items. It also provides a new technique for addressing interleaving, a phenomena that occurs when two sequences occur simultaneously resulting in their items alternating. By first clustering items temporally and only focusing on sequences after the temporal clusters are established, it sidesteps the traditional interleaving issues. SMTC is evaluated on a digital forensics dataset, a domain with a large number of items and frequent interleaving. Its results are compared with Discontinuous Varied Order Sequence Mining (DVSM) with variables added (DVSM-V). By adding variables, both algorithms reduce the data by 96 percent, and identify 100 percent of the events while keeping the false positive rate below 0.03 percent. SMTC mines the data in 20 percent of the time it takes DVSM-V and provides a lower false positive rate even at higher similarity thresholds.

Wireless networks are particularly vulnerable to spoofing and route poisoning attacks due to the contested transmission medium. Recent works investigate physical layer features such as received signal strength or radio frequency fingerprints to localize and identify malicious devices. In this paper we demonstrate a novel and complementary approach to exploiting physical layer differences among wireless devices that is more energy efficient and invariant with respect to the environment. Specifically, we exploit subtle design differences among transceiver hardware types. Transceivers fulfill the physical-layer aspects of wireless networking protocols, yet specific hardware implementations vary among manufacturers and device types. In this paper we demonstrate that precise manipulation of the physical layer header prevents a subset of transceiver types from receiving the manipulated packet. By soliciting acknowledgments from wireless devices using a small number of packets with manipulated preambles and frame lengths, a response pattern identifies the true transceiver class of the device under test. Herein we demonstrate a transceiver taxonomy of six classes with greater than 99 percent accuracy, irrespective of environment. We successfully demonstrate wireless multi-factor authentication, intrusion detection, and transceiver type fingerprinting through preamble manipulation.

Information system security risk, defined as the product of the monetary losses associated with security incidents and the probability that they occur, is a suitable decision criterion when considering different information system architectures. Risk assessment is the widely accepted process used to understand, quantify, and document the effects of undesirable events on organizational objectives so that risk management, continuity of operations planning, and contingency planning can be performed. One technique, the Cyberspace Security Econometrics System (CSES), is a methodology for estimating security costs to stakeholders as a function of possible risk postures. In earlier works, we presented a computational infrastructure that allows an analyst to estimate the security of a system in terms of the loss that each stakeholder stands to sustain, as a result of security breakdowns. Additional work has applied CSES to specific business cases. The current state-of-the-art of CSES addresses independent events. In typical usage, analysts create matrices that capture their expert opinion, and then use those matrices to quantify costs to stakeholders. This expansion generalizes CSES to the common real-world case where events may be dependent.

The current mechanics of cyber incident notification within the United States Air Force rely on a broadcast “push” of incident information to the affected community of interest. This process is largely ineffective because when the notification arrives at each unit, someone has to make a decision as to who should be notified within their unit. Broadcasting the notification to all users creates noise for those who do not need the notification, increasing the likelihood of ignoring future notifications. Selectively sending notifications to specific people without a priori knowledge of who might be affected results in missing users who need to know. Neither of these approaches addresses the passing of notifications to downstream entities whose missions may be affected by the incident. In this paper, we propose a modular, scalable, cyber incident notification system concept that makes use of a “publish and subscribe” architecture to assure the timeliness and relevance of incident notification. Mission stakeholders subscribe to the status of mission critical information resources (external and internal) and publish their own mission capability allowing other units to maintain real-time awareness of their own dependencies. We contend that this architecture is a significant improvement over current methods by making direct connections between mission stakeholders and their dependencies and eliminating multiple levels of human processing, thereby reducing noise and ensuring relevant information gets to the right people.

Virtually all modern organizations have embedded information systems into their core business processes as a means to increase operational efficiency, improve decision making quality, and minimize costs. Unfortunately, this dependence can place an organization's mission at risk if the confidentiality, integrity, or availability of a critical information resource has been lost or degraded. Within the military, this type of incident could ultimately result in serious consequences including physical destruction and loss of life. To reduce the likelihood of this outcome, personnel must be informed about cyber incidents, and their potential consequences, in a timely and relevant manner so that appropriate contingency actions can be taken. In this paper, we identify criteria for improving the relevance of incident notification, propose the use of case-based reasoning (CBR) for contingency decision support, and identify key design considerations for implementing a CBR system used to deliver relevant notification following a cyber incident.

In the boundless digital world and global society of the Internet, anonymity and privacy are becoming increasingly important issues. Many anonymous networking protocols have been proposed and numerous empirical investigations over these networks analyzed; however, no known taxonomies exist for consumers to quickly and easily identify which anonymity properties are offered by the disparate wired and wireless anonymous networks. This paper proposes a novel tree-based taxonomy (TBT) which allows the consumer to choose a desired classical or state-of-the-art anonymity protocol depending upon their specific network environment and anonymity requirements. The two key anonymity properties of unidentifiability and unlinkability and various network types are explored. This paper highlights the expanding definition of anonymity and aids consumer and researcher classification of state-of-the-art technological privacy-preserving anonymous networks.

With the aim to preserve privacy over a communications network, a plethora of anonymous protocols have been proposed along with many empirical investigations into specific adversary attacks over those networks. However, no known taxonomies exist that address anonymity in the diverse set of both wired and wireless anonymous communications networks. This paper proposes such a novel cubic taxonomy which explores the three key components of anonymity property, adversary capability, and network type. This taxonomy expands the definition of anonymity and aids in the advancement of state-of-the-art technological privacy-preserving mechanisms in anonymous networks against any adversary.

Identity capabilities are being modernized through biometric technology and systems. With maturing biometrics in full, rapid development, a higher accuracy of identity verification is required. Improvements to the security of biometric verification systems is provided through higher accuracy; ultimately reducing fraud, theft, and loss of resources from unauthorized personnel. With trivial biometric systems, a higher acceptance threshold to obtain higher accuracy rates increased false rejection rates and user unacceptability. However, maintaining the higher accuracy rate enhances the security of the system. Through the methods presented in this paper, higher accuracy rates are obtained without lowering the acceptance threshold, therefore improving the security level, false rejection rates, and user acceptability. An area of biometrics with a paucity of research is template aging, specifically in regards to facial aging. This paper presents methods of modeling and predicting facial template aging based on matching score analysis. A novel foundational framework for facial template aging is presented and provides a methodological framework. The groundwork discusses new techniques used in the template aging framework, to include the ldquoerror score matrixrdquo and ldquodecay error estimaterdquo concepts. The matching scores are calculated using commercially available facial matching algorithms/SDKs against publicly available facial databases. Improved performance error rates while maintaining or improving upon the overall matching and/or rejection levels is accomplished with the new framework. Using such scores, prediction of a timeframe if or when an individual needs to be re-enrolled with a new template is feasible.

With the aim to preserve privacy over a communications network, a plethora of anonymous protocols have been proposed along with many empirical investigations into specific adversary attacks over those networks. However, few formal methods have been adequately developed and applied towards anonymous systems with the goal of modeling how an adversary reasons about anonymity. Indeed, many analyses assume a passive, global adversary but fail to provide a rigorous approach to defining and modeling anonymity concepts to ensure information and data assurance as is customary when formally proving other security aspects of a system. Hence, this paper proposes the possibilistic anonymity logical model (PALM) for capturing the knowledge and reasoning ability of an adversary in an anonymous network.

The use of computers and communication technologies to enhance command and control (C2) processes has yielded enormous benefits in military operations. Commanders are able to make higher quality decisions by accessing a greater number of information resources, obtaining more frequent updates from their information resources, and by correlation between, and across, multiple information resources to reduce uncertainty in the battlespace. However, these benefits do not come without a cost. The reliance on technology results in significant operational risk that is often overlooked and is frequently underestimated. In this research-in-progress paper, we discuss our initial findings in our efforts to improve the defensive cyber battle damage assessment process within US Air Force networks. We have found that the lack of a rigorous, well-documented, information asset-based risk management process results in significant uncertainty and delay when assessing the impact of an information incident.

It is well known that n-detection test sets are effective to detect unmodeled defects and improve the defect coverage. However, in these sets, each of the n-detection test patterns has the same importance on the overall test set performance. In other words, the test pattern that detects a fault for the first time plays the same important role as the test pattern that detects that fault for the (n)-th time. In this paper, we propose a linear programming-based optimal test pattern selection method which aims at reducing the overall defect part level (DPL). Using resistive bridge faults as surrogates, our experimental results on ISCAS85 circuits demonstrate the proposed test pattern selection method achieves higher defect coverage than traditional n-detection method.

Recent probabilistic test generation approaches have proven that detecting single stuck-at-faults multiple times is effective at reducing the defective part level (DPL). Unfortunately, these test generation strategies increase the number of test patterns. In this paper, we present a novel linear programming-based method to accelerate the optimal selection of test sets to minimize the defective part level based upon the MPG-D model. Our experimental results show that the proposed method is on average 300 times faster than the existing test pattern selection method.

Deterministic observation and random excitation of fault sites during the ATPG process dramatically reduces the overall defective part level. However, multiple observations of each fault site lead to increased test set size and require more tester memory. In this paper we propose a new ATPG algorithm to find a near-minimal test pattern set that detects faults multiple times and achieves excellent defective part level. This greedy approach uses 3-value fault simulation to estimate the potential value of each vector candidate at each stage of ATPG. The result shows generation of a close to minimal vector set is possible only using dynamic compaction techniques in most cases. Finally, a systematic method to trade-off between defective part level and test size is also presented.

Uses data collected from benchmark circuit simulations to examine the relationship between the tests which detect stuck-at faults and those which detect bridging surrogates. We show that the coefficient of correlation between these tests approaches zero as the stuck-at fault coverage approaches 100%. An enhanced version of the MPG-D model, which is based upon the number of detections of each site in a logic circuit, is shown to be superior to stuck-at fault coverage-based defective part level prediction. We then compare the accuracy of both predictors for an industrial circuit tested using two different test pattern sequences.

Predicting the final value of the defective part level after the application of a set of test vectors is not a simple problem. In order for the defective part level to decrease, both the excitation and observation of defects must occur. This research shows that the probability of exciting an as yet undetected defect does indeed decrease exponentially as the number of observations increases. In addition, a new defective part level model is proposed which accurately predicts the final defective part level (even at high fault coverages) for several benchmark circuits and which continues to provide good predictions even as changes are made an the set of test patterns applied.

If many potential defects exist at each site in an integrated circuit, then as the number of applied test patterns increases, the number of defects which remain undetected decreases monotonically. Modeling this rate of decline in defective part level is a non-trivial problem. We show that the number of times each site is observed serves as a significantly superior basis for modeling this phenomenon when contrasted with the number of faults detected. This "site observation-based" predictor not only increases the accuracy of defective part level prediction, it also provides the first quantitative method for comparing the effectiveness of various ATPG strategies to reduce the defective part level.

For many years, non-target detection experiments have been simulated by using AND/OR bridges or gross delay faults as surrogates. For example, the defective part level can be estimated based upon surrogate detection when test patterns target stuck-at faults in the circuit. For the first time, test pattern generation techniques that attempt to maximize non-target defect detection have been used to test a real, 100% scanned, commercial chip consisting of 75 K logic gates. In this experiment, the defective part level for REDO-based patterns was 1,288 parts per million lower than that achieved by DC stuck-at based patterns generated using today's state of the art tools and techniques.