Defense Notices

Fraud from insiders costs an estimated $3.7 trillion annually. Current fraud prevention and detection methods that include analyzing network logs, computer events, emails, and behavioral characteristics have not been successful in reducing the losses. The proposed Occupational Fraud Prevention and Detection Model uses existing data from the field of digital forensics along with text clustering algorithms, machine learning, and a growing hierarchical self-organizing map model to predict insider threats based on computer usage behavioral characteristics.

The proposed research leverages research results from information security, software engineering, data science and information retrieval, context searching, search patterns, and machine learning to build and employ a database server and workstations to support 50+ terabytes of data representing entire hard drives from work computers. Forensic software FTK and EnCase are used to generate disk images and test extraction results. Primary research tools are built using modern programming languages. The research data is derived from disk images obtained from actual investigations when fraud was asserted and other disk images when fraud was not asserted.

The research methodology includes building a data extraction tool that is a disk level reader to store the disk, partition, and operating system data in a relational database. An analysis tool is also created to convert the data into information representing usage patterns including summarization, normalization, and redundancy removal. We build a normalizing tool that uses machine learning to adjust the baselines for company, department, and job deviations.  A prediction component is developed to derive insider threat scores reflecting the anomalies from the adjusted baseline. The resulting product will allow identification of the computer users most likely to commit fraud so investigators can focus their limited resources on the suspects.

Our primarily plan to evaluate and validate our research results is via empirical study, statistical evaluation and benchmarking with tests of precision and recall from a second set of disk images.

The compiled native code generated by a just-in-time (JIT) compiler in managed language virtual machines (VM) is placed in a region of memory called the code cache. Code cache management (CCM) in a VM is responsible to find and evict methods from the code cache to maintain execution correctness and manage program performance for a given code cache size or memory budget. Effective CCM can also boost program speed by enabling more aggressive JIT compilation, powerful optimizations, and improved hardware instruction cache and I-TLB performance.

Though important, CCM is an overlooked component in VMs. We find that the default CCM policies in Oracle’s production-grade HotSpot VM perform poorlyeven at modest memory pressure. We develop a detailed simulation-based framework to model and evaluate the potential efficiency of many different CCM policies in a controlled and realistic, but VM-independent environment. We make the encouraging discovery that effective CCM policies can sustain high program performance even for very small cache sizes.

Our simulation study provides the rationale and motivation to improve CCM strategies in existing VMs. We implement and study the properties of several CCM policies in HotSpot. We find that in spite of working within the bounds of the HotSpot VM’s current CCM sub-system, our best CCM policy implementation in HotSpot improves program performance over the default CCM algorithm by 39%, 41%, 55%, and 50% with code cache sizes that are 90%, 75%, 50%, and 25% of the desired cache size, on average.

In the age of data collection and as we search for knowledge, over time numerous techniques have been developed and used to capture, manipulate, and to process data to acquire the hidden correlations, relations, patterns, and mappings that one may not be able to see. Computers as machines with the help of improved algorithms have proven to provide Artificial Intelligence (AI) by applying models to predict outcomes within an acceptable margin of error. Through performance metrics applied using Data Mining and Machine Learning models to predict human vision disorders, we are able to see promising models. AI techniques used in this work include an improved version of C.45 called C.48, Neuro-Networks, K-Nearest-Neighbor, Random Forest, Support Vector Machines, AdaBoost, among many. The best predictive models were determined that could be applied to the diagnosis of vision disorders, focusing on Strabismus, the need for patient referral to a specialist.

With the advancement of Internet, increasing portions of people's social and communicative activities now take place in the digital world. The growth and popularity of online social networks have tremendously facilitate the online interaction and information exchange. More people now rely online information for news, opinions, and social networking. As the representative of online social-collaborative platforms, online review systems has enabled people to share information effectively and efficiently. A large volume of user generated content is produced daily, which allows people to make reasonable judgments about the quality of service or product of an unknown provider. However, the freedom and ease of of publishing information online has made these systems no longer the sources of reliable information. Not only does biased and misleading information exist, financial incentives drive individual and professional spammers to insert deceptive reviews to manipulate review rating and content. What's worse, advanced Artificial Intelligence has made it possible to generate realistic-looking reviews automatically. In this proposal, we present our work of measuring the credibility of information in online review systems. We first propose to utilize the social relationships and rating deviations to assist the computation of trustworthiness of users. Secondly, we propose a content-based trust propagation framework by extracting the opinions expressed in review content.  The opinion extraction approach we used was a supervised-learning based methods, which has flexibility limitations. Thus, we propose a enhanced framework that not only automates the opinion mining process, but also integrates social relationships with review content. Finally, we propose our study of the credibility of machine-generated reviews.

A face detection and recognition system is a biometric identification mechanism which compared to other methods is shown to be more important both theoretically and practically. In principle, the biometric identification methods use a wide range of techniques such as machine learning, computer vision, image processing, pattern recognition and neural networks. A face recognition system consists of two main components, face detection and recognition. 
In this dissertation a face detection and recognition system using color images with multiple faces is designed, implemented, and evaluated. In color images, the information of skin color is used in order to distinguish between the skin pixels and non-skin pixels, dividing the image into several components. Neural networks and deep learning methods has been used in order to detect skin pixels in the image. In order to improve system performance, bootstrapping and parallel neural networks with voting have been used. Deep learning has been used as another method for skin detection and compared to other methods. Experiments have shown that in the case of skin detection, deep learning and neural networks methods produce better results in terms of precision and recall compared to the other methods in this field. 
The step after skin detection is to decide which of these components belong to human face. A template based method has been modified in order to detect the faces. The designed algorithm also succeeds if there are more than one face in the component. A rule based method has been designed in order to detect the eyes and lips in the detected components. After detecting the location of eyes and lips in the component, the face can be detected.
After face detection, the faces which were detected in the previous step are to be recognized. Appearance based methods used in this work are one of the most important methods in face recognition due to the robustness of the algorithms to head rotation in the images, noise, low quality images, and other challenges. Different appearance based methods have been designed, implemented and tested. Canonical correlation analysis has been used in order to increase the recognition rate.

A system is said to be trusted if it can be unambiguously identified and observed as behaving in accordance with expectations. Remote attestation is a mechanism to establish trust in a remote system.
Remote attestation requires measurement systems that can sample program state from a wide range of applications, each of which with different program features and expected behavior. Even in cases where applications are similar in purpose, differences in attestation critical structures and program variables render any one measurer incapable of sampling multiple applications. Furthermore, any set of behavioral expectations vague enough to match multiple applications would be too weak to serve as a rubric to establish trust in any one of them. As such, measurement functionality must be tailored to each and every critical application on the target system.
Establishing behavioral expectations and customizing measurement systems to gather meaningful data to evidence said expectations is difficult. The process requires an expert, typically the application developer or a motivated appraiser, to analyze the application's source in order to detail program behavioral expectations critical for establishing trust and to identify critical program structures and variables that can be sampled to evidence said trust. This effort required to customize measurement systems manually prohibits widespread adoption of remote attestation in trusted computing.
We propose automatic generation of expected outcomes and synthesis of measurement policies for a configurable general purpose measurer to enable large scale adoption of remote attestation for trusted computing. As such, we mitigate the cost incurred by existing systems that require manual measurement specification and design by an expert sufficiently skilled and knowledgeable regarding the target application and the methods for evidencing trust in the context of remote attestation.

A model predictive controlled power electronics interface (PEI) based on impedance source inverter for photovoltaic (PV) applications is proposed in this work. The proposed system has the capability of operation in both grid-connected and islanded mode. Firstly, a model predictive based maximum power point tracking (MPPT) method is proposed for PV applications based on single stage grid-connected Z-source inverter (ZSI). This technique predicts the future behavior of the PV side voltage and current using a digital observer that estimates the parameters of the PV module. Therefore, by predicting a priori the behavior of the PV module and its corresponding effects on the system, it improves the control efficacy. The proposed method adaptively updates the perturbation size in the PV voltage using the predicted model of the system to reduce oscillations and increase convergence speed. The operation of the proposed method is verified experimentally. The experimental results demonstrate fast dynamic response to changes in solar irradiance level, small oscillations around maximum power point at steady-state, and high MPPT effectiveness from low to high solar irradiance level. The second part of this work focuses on the dual-mode operation of the proposed PEI based on ZSI with capability to operate in islanded and grid-connected mode. The transition from islanded to grid-connected mode and vice versa can cause significant deviation in voltage and current due to mismatch in phase, frequency, and amplitude of voltages. The proposed controller using MPC offers seamless transition between the two modes of operations. The main predictive controller objectives are direct decoupled power control in grid-connected mode and load voltage regulation in islanded mode. The proposed direct decoupled active and reactive power control in grid connected mode enables the dual-mode ZSI to behave as a power conditioning unit for ancillary services such as reactive power compensation. The proposed controller features simplicity, seamless transition between modes of operations, fast dynamic response, and small tracking error in steady state condition of controller objectives. The operation of the proposed system is verified experimentally.

Graph is an extremely useful representation of a wide variety of practical systems in data analysis. Recently, with the fast accumulation of stream data from various type of networks, significant research interests have arisen on spectral clustering for network streams (or evolving networks). Compared with the general spectral clustering problem, the data analysis of this new type of problems may have additional requirements, such as short processing time, scalability in distributed computing environments, and temporal variation tracking. 

However, to design a spectral clustering method to satisfy these requirements certainly presents non-trivial efforts. There are three major challenges for the new algorithm design. The first challenge is online clustering computation. Most of the existing spectral methods on evolving networks are off-line methods, using standard eigensystem solvers such as the Lanczos method. It needs to re-compute solutions from scratch at each time point. The second challenge is the parallelization of algorithms. To parallelize such algorithms is non-trivial since standard eigen solvers are iterative algorithms and the number of iterations cannot be predetermined. The third challenge is the very limited existing work. In addition, there exists multiple limitations in the existing method, such as computational inefficiency on large similarity changes, the lack of sound theoretical basis, and the lack of effective way to handle accumulated approximate errors and large data variations over time. 

In this thesis, we proposed a new online spectral graph clustering approach with a family of three novel spectrum approximation algorithms. Our algorithms incrementally update the eigenpairs in an online manner to improve the computational performance. Our approaches outperformed the existing method in computational efficiency and scalability while retaining competitive or even better clustering accuracy. We derived our spectrum approximation techniques GEPT and EEPT through formal theoretical analysis. The well-established matrix perturbation theory forms a solid theoretic foundation for our online clustering method. In addition, we discussed our preliminary work on approximate graph mining with evolutionary process, non-stationary Bayesian Network structure learning from non-stationary time series data, and Bayesian Network structure learning with text priors imposed by non-parametric hierarchical topic modeling.

Multiple-Input Multiple-Output (MIMO) systems with large-scale transmit antenna arrays, often called massive MIMO, is a very promising direction for 5G due to its ability to increase capacity and enhance both spectrum and energy efficiency. To get the benefit of massive MIMO system, accurate downlink channel state information at the transmitter (CSIT) is essential for downlink beamforming and resource allocation. Conventional approaches to obtain CSIT for FDD massive MIMO systems require downlink training and CSI feedback. However, such training will cause a large overhead for massive MIMO systems because of the large dimensionality of the channel matrix. In this research proposal, we propose an efficient downlink beamforming method to address the challenging of downlink training overhead. First, we design an efficient downlink beamforming method based on partial CSI. By exploiting the relationship between uplink (UL) DoAs and downlink (DL) DoDs, we derive an expression for estimated downlink DoDs, which will be used for downlink beamforming. Second, we derive an efficient downlink beamforming method based on downlink CSIT estimated at the BS. By exploiting the sparsity structure of downlink channel matrix, we develop an algorithm that select the best features from the measurement matrix to obtain efficient CSIT acquisition that can reduce the downlink training overhead compared with the conventional LS/MMSE estimators. In both cases, we compare the performance of our proposed beamforming method with traditional method in terms of downlink achievable rate and simulation results show that our proposed method outperform the traditional beamforming method.