Defense Notices

With the exponential growth of cyber-physical systems (CPSs), new security challenges have emerged. Various vulnerabilities, threats, attacks, and controls have been introduced for the new generation of CPS. However, there lacks a systematic review of the CPS security literature. In particular, the heterogeneity of CPS components and the diversity of CPS systems have made it difficult to study the problem with one generalized model. As the first component of this dissertation, existing research on CPS security is studied and systematized under a unified framework. Smart cars, as a CPS application, was further explored under the proposed framework and new attacks are identified and addressed.

The Control Area Network (CAN bus) is a prevalent serial communication protocol adopted in industrial CPS, especially in small and large vehicles, ships, planes, and even in drones, radar systems, and submarines. Unfortunately, the CAN bus was designed without any security considerations. We then propose and demonstrate a stealthy targeted Denial of Service (DoS) attack against CAN. Experimentations show that the attack is effective and superior to attacks of the same category due to its stealthiness and ability to avoid detection from current countermeasures.

Two controls are proposed to defend against various spoofing and DoS attacks on CAN. The first one aims to minimize the attack using ID-Hopping mechanism such that CAN arbitration IDs are randomized so an attacker would not be able to target them. ID-Hopping raises the bar for attackers by randomizing the expected patterns in CAN network. Such randomization hinders the attacker's ability to launch targeted DoS attacks. Based on the evaluation on the testbed, the randomization mechanism, ID-Hopping, holds a promising solution for targeted DoS, and reverse engineering CAN IDs, which CAN networks are most vulnerable to. The second countermeasure is a novel CAN firewall that aims to prevent an attacker from launching a plethora of untraditional attacks on CAN that existing solutions do not adequately address.  The firewall is placed between a potential attacker’s node and the rest of the CAN bus. Traffic is controlled bidirectionally between the main bus and the attacker’s side so that only benign traffic can pass to the main bus. This ensures that an attacker cannot arbitrarily inject malicious traffic into the main bus. Demonstration and evaluation of the attack and firewall were conducted by a bit-level analysis, i.e., “Bit banging”, of CAN’s traffic. Results show that the firewall successfully prevents the stealthy targeted DoS attack, as well as, other recent attacks. To evaluate the proposed attack and firewall, a testbed was built that consists of BeagleBone Black and STM32 Nucleo-144 microcontrollers to simulate real CAN traffic.

Finally, a design of an Intrusion Detection System (IDS) is proposed to complement the firewall. It utilizes the proposed firewall to add situational awareness capabilities to the bus’s security posture and detect and react to attacks that might bypass the firewall based on certain rules.

Present day manufacturers have invented different memory technologies with distinct bandwidth, energy and cost tradeoffs. Systems with such heterogeneous memory technologies can only achieve the best performance and power characteristics by appropriately partitioning process data on OS pages and placing OS pages in the right memory areas. To achieve effective data partitioning and placement we need to first understand how programs access memory and how those patterns change at various stages (phases) of program execution. The goal of this work is to build a framework, design experiments and conduct analysis to understand overall memory usage patterns across many programs.

We use Intel’s Pin dynamic binary translation and instrumentation system for this work. Our Pin based framework instruments programs at run-time to collect data regarding memory allocations, de-allocations, reads and writes, which we then analyze using our specialized scripts. We collect and analyze information including page access counts, hot page ratio, memory read and write access patterns and how that varies in different program phases. We also analyze the similarities regarding memory behavior between distinct phases during program execution. We also study memory behavior both with cache and without cache to understand how caches affect the memory access behavior. 

A learning map is an unweighted directed graph containing relationships between discrete skills and concepts with edges defining the prerequisite hierarchy. They arose as a means of connecting student instruction directly to standards and curriculum and are designed to assist teachers in lesson planning and evaluating student response. As learning maps gain popularity there is an increasing need for teachers to quickly evaluate which nodes have been mastered by their students. Psychometrics is a field focused on measuring student performance and includes the development of processes used to link a student's response to multiple choice questions directly to their understanding of concepts. This dissertation focuses on developing modeling and visualization capabilities to enable efficient analysis of data pertaining to student understanding generated by psychometric techniques.

Such analysis naturally includes that done by classroom teachers. Visual solutions to this problem clearly indicate the current understanding of a student or classroom in such a way as to make suggestions that can guide future learning. In response to these requirements we present various experimental approaches which augment the original learning map design with targeted visual variables. Particular attention is given to variable selection and their effect on the usability of the resulting graphics.

As well as looking forward, we also consider methods by which data visualization can be used to evaluate and improve existing teaching methods. We present several graphics based on modelling student progression as information flow. These methods rely on conservation of data to increase edge information, reducing the load carried by the nodes and encouraging path comparison.

Finally, we propose a means of combining features of key experimental approaches to design a single graphic capable of meeting both the predictive and validation requirements. We also propose several methods to measure the effectiveness and correctness of the final design.

This work proposes several advanced predictive switching algorithms and modulation methods for power electronics converters based on model predictive control (MPC) paradigm. The proposed methods retain the advantages of conventional MPC methods in programing the nonlinear effects of the converter into the design calculations to improve the overall dynamic performance and steady state operation of the system. Besides, the proposed methods provide a fixed switching frequency operation of the system, which results in regulating the system objectives with minimized ripple. In the first part of this work, a new modulation based MPC technique is proposed. The proposed method provides flexibility to prioritize different objectives of the system against each other using weighting factors. To further evaluate the merits of the proposed method, it has been used to control modular multilevel converters (MMCs) in voltage-source-converter high-voltage-DC (VSC-HVDC) systems. The proposed method minimizes the line total harmonic distortion (THD), circulating current ripple and steady-state error.  Furthermore, a new Finite-Control-Set MPC (FCS-MPC) method for controlling MMCs with minimized computational burden is proposed that doesn’t employ weighting factors to control different system objectives.

Furthermore, a Modulated MPC (MMPC) based control system for a Z-source Inverter (ZSI) based Permanent Magnet Synchronous Motor (PMSM) drive system is proposed. The Proposed method uses two separate MMPC loops for the Z-source network and PMSM control.  For the Z-source network, a cascaded MMPC control scheme has been proposed and for the PMSM, a novel MMPC controller is proposed that predicts the future value of PMSM current vectors, selects specific current vectors that minimize a certain cost function the most, and performs modulation between them.

Finally, a torque ripple minimization method for a PMSM drive system that utilizes a modified quasi-Z-source (qZS) inverter which provides a wider range of capabilities for inverter input voltage control is proposed. It also allows for modification of the traditional switching sequence selection scheme when using the Space Vector Modulation (SVM) for switching. The provided flexibilities are leveraged to develop a control system that minimizes the torque ripples during PMSM operation while satisfying conventional control objectives such as shaft speed control.

A model predictive controlled power electronics interface (PEI) based on impedance source inverter for photovoltaic (PV) applications is proposed in this dissertation. The proposed system has the capability of operation in both grid-connected and islanded mode. Firstly, a model predictive based maximum power point tracking (MPPT) method is proposed for PV applications based on single stage grid-connected Z-source inverter (ZSI). This technique predicts the future behavior of the PV side voltage and current using a digital observer that estimates the parameters of the PV module. The proposed method adaptively updates the perturbation size in the PV voltage using the predicted model of the system to reduce oscillations and increase convergence speed. The experimental results demonstrate fast dynamic response to changes in solar irradiance level, small oscillations around maximum power point at steady-state, and high MPPT efficacy. 

The second part of this dissertation focuses on the dual-mode operation of the proposed PEI based on ZSI with capability to operate in islanded and grid-connected mode. The transition from islanded to grid-connected mode and vice versa can cause significant deviation in voltage and current due to mismatch in phase, frequency, and amplitude of voltages. The proposed controller using MPC offers seamless transition between the two modes of operations. The proposed direct decoupled active and reactive power control in grid‑connected mode enables the dual-mode ZSI to behave as a power conditioning unit for ancillary services.

The final part of this dissertation focuses on the low voltage ride through (LVRT) capability of the proposed PV systems during grid faults such as voltage sag.  In normal grid condition mode, the maximum available power from the PV panels is injected into the grid. In this mode, the system can provide reactive power compensation as a power conditioning unit for ancillary services from DG systems to main ac grid. In case of grid faults, the proposed system changes the behavior of reactive power injection into the grid for LVRT operation according to the grid requirements. Thus, the proposed controller for ZSI is taking into account both the power quality issues and reactive power injection under abnormal grid conditions. 

Modern programming languages treat resources as normal values. The static semantics of resources in such 

languages does not match their runtime semantics. In this thesis, we tackle the resource management problem 

by making resources first class citizens in the language, and concentrating on sharing or separation of resources.

We design and implement QuB (pronounced: cube), a Curry-Howard interpretation of logic of bunched implications (BI). 

We distinguish two kinds of values—restricted and unrestricted—and two kinds of function implications— sharing and separating. 

The restricted values model resources while the unrestricted values model program objects that do not contain any resources. 

Sharing functions denote that functions share resources with its arguments, while separating functions denote that functions do not 

share resources with its arguments. We show how the use of monads with sharing and separating functions helps in modeling 

patterns, such as exception handling, that are difficult to express in linear languages, .

Understanding ice dynamics and ice basal conditions is important because of their impacts on sea level rise. Radio echo sounding has been extensively used for characterizing the ice sheets. The radar reflectivity of the ice bed is of special importance because it can discriminate frozen and thawed ice beds. The knowledge of spatial distribution of basal water is crucial in explaining the flow velocity and stability of glaciers and ice sheets. Basal echo reflectivity used to identify the areas of basal melting can be calculated by compensating ice bed power for geometric losses, rough interface losses, system losses and englacial attenuation.

Two important outlet glaciers of Greenland, Petermann glacier and Jakobshavn isbrae have been losing a lot of ice mass in recent years, and are therefore studied to derive its basal conditions from airborne radar surveys in this thesis.

The ice surface and bed roughness of these glaciers are estimated using Radar Statistical Reconnaissance (RSR) method, and validated using roughness derived from NASA’s Airborne Topographic Mapper (ATM) and Ku band altimeter. Englacial attenuation is modelled using Schroeder’s variable attenuation method. After compensating for these losses, the basal reflectivity for the two glaciers is estimated, and validated using cross over analysis, geophysics, hydraulic potential, abruptive index and coherence index.

The areas of basal melting i.e. areas with higher reflectivity are identified. Petermann glacier is found to have alternate frozen and thawed regions explaining the process of ice movement by friction and freezing. Due to the lack of topographic pinning the glacier is subject to higher ice flow speed. Jakobshavn glacier has several areas of basal melting scattered in the catchment area with most concentration near the glacier front which is likely due to surface water infiltration into ice beds via moulins and sinks. The ice bed channels and retrograde slope of this glacier is also important in routing subglacial water and ice mass. The basal conditions of these two glaciers presented in this study can help in modelling the behavior of these glaciers in the future.

Remote Sensing of snow covered sea ice in melting Polar Regions has become crucial in estimating the results of increased global warming and to overcome the Earth’s energy imbalance. And to accurately map the snow models over sea ice, it has become essential to build radar systems that has increased sensitivity and to use post processing techniques that enhance the performance. The Center for Remote Sensing of Ice Sheets (CReSIS) at KU has developed ultra-wideband snow radar system that operates over 2-18 GHz frequency range to effectively measure the snow thickness including very thin snow cover and map the snow-ice and snow-ice interfaces precisely. Synthetic Aperture Radar (SAR) processing is one of the post processing technique employed to further increase the sensitivity of the radar in terms of resolution and SNR. In this thesis, a time domain correlation SAR technique which is essentially a matched filter application is described and implemented. It is verified initially with an ideal simulated point target data and then with point target data collected by the snow radar system over sea-ice. It is also shown how noise is multiplied with increasing synthetic aperture length. The effect of aircraft motion non-linearities on SAR processing are also studied at different altitudes. To overcome the effect of non-linearities and multiplicative noise, a multilooking SAR processing is proposed and explained. This is then applied to the field data collected by the snow radar in 2016 and 2017 over sea ice and observed that the SNR and azimuth resolution are improved by 40 dB. The optimum parameters like SAR aperture length and the number of looks are extracted based on the results of SAR processing on various data sets. Finally, a comparison of SAR application to low and high altitude data sets collected in 2016 over the same region is also provided. 

Two possible radar application spaces are explored through the exploitation of high-dimensional nonrecurrent FM-noise waveforms. The first involving a simultaneous dual-polarized emission scheme that provides good separability with respect to co- and cross-polarized terms and the second mimicking the passive actuation of the human eye with a MIMO emission. A waveform optimization scheme denoted as pseudo-random optimized (PRO) FM has been shown to generate FM-noise radar waveforms that are amenable to high power transmitters. Each pulse is generated and optimized independently and possesses a non-repeating FM-noise modulation structure. Because of this the range sidelobes of each pulse are unique and thus are effectively suppressed given enough coherent integration.

The PRO-FM waveform generation scheme is used to create two independent sets of FM-noise waveforms to be incorporated into a simultaneous dual-polarized emission; whereby two independent PRO-FM waveforms will be transmitted simultaneously from orthogonal polarization channels. This effectively creates a polarization diverse emission. The random nature of these waveforms also reduce cross-correlation effects that occur during simultaneous transmission on both channels. This formulation is evaluated using experimental open-air measurements to demonstrate the effectiveness of this high-dimensional emission.

This research aims to build upon previous work that has demonstrated the ability to mimic fixational eye movements (FEM) employed by the human eye. To implement FEM on a radar system, a MIMO capable digital array must be utilized in conjunction with spatial modulation beamforming. Successful imitation of FEM will require randomized fast-time beamsteering from a two-dimensional array. The inherent randomness associated with FEM will be paired with the PRO-FM waveforms to create an emission possessing randomness in the space and frequency domains, called the FEM radar (FEMR). Unlike traditional MIMO, FEMR emits a coherent and time-varying beam. Simulations will show the inherent enhancement to spatial resolution in two-dimensional space (azimuth and elevation) relative to standard beamforming using only the matched filter to process returns.

Mobile Ad-hoc Networks (MANETs) due to their highly dynamic nature pose a great challenge in designing new protocols. Because these networks are infrastructure independent, routing protocol design and efficiency becomes essential in the functioning of these networks. There are many protocols proposed in the past and many are under development now. But the new or existing protocols are to be compared against each other and analyzed under realistic conditions including, but not limited to transmission range, mobility patterns, of the nodes in the network. This project is an endeavor to provide an unbiased comparison of AODV, DSDV, DSR, and OLSR under different mobility models with varying densities and dynamicity. The mobility models compared in this work include steady-state random waypoint, Gauss-Markov, and Levy walk.