Defense Notices

Information security is plagued with increasingly sophisticated and persistent threats to communication networks. The development of new threat tools or vulnerability exploits often outpaces advancements in network security detection systems. As a result, detection systems often compensate by over reporting partial detections of routine network activity to security analysts for further review. Such alarms seldom contain adequate forensic data for analysts to accurately validate alerts to other stakeholders without lengthy investigations. As a result, security analysts often ignore the vast majority of network security alarms provided by sensors, resulting in security breaches that may have otherwise been prevented. 

Security Information and Event Management (SIEM) software has been introduced recently in an effort to enable data correlation across multiple sensors, with the intent of producing a lower number of security alerts with little forensic value and a higher number of security alerts that accurately reflect malicious actions. However, the normalization frameworks found in current SIEM systems do not accurately depict modern threat activities. As a result, recent network security research has introduced the concept of a "kill chain" model designed to represent threat activities based upon patterns of action, known indicators, and methodical intrusion phases. Such a model was hypothesized by many researchers to result in the realization of the desired goals of SIEM software. 

The focus of this thesis is the implementation of a "kill chain" framework within SIEM software. A novel "Kill chain" model was developed and implemented within a commercial SIEM system through modifications to the existing SIEM database. These modifications resulted in a new log ontology capable of normalizing security sensor data in accordance with modern threat research. New SIEM correlation rules were developed using the novel log ontology compared to existing vendor recommended correlation rules using the default model. The novel log ontology produced promising results indicating improved detection rates, more descriptive security alarms, and a lower number of false positive alarms. These improvements were assessed to provide improved visibility and more efficient investigation processes to security analysts ultimately reducing the mean time required to detect and escalate security incidents. 

Waveform generation is crucial in a radar system operation. There is a recent need for an 8 channel transmitter with high bandwidth chirp signals (100 MHz – 600 MHz). As such, a waveform generator (WFG) hardware module is required for this purpose. The WFG houses 4 Direct Digital Synthesizers (DDS), and an ALTERA Cyclone V FPGA that acts as its controller. The DDS of choice is the AD9915, because its Digital to Analog Converter can be clocked at a maximum rate of 2.5 GHz, allowing plenty of room to produce the high bandwidth and high frequency chirp signals desired, and also because it supports synchronization between multiple AD9915s. 

The brains behind the DDS operations are the FPGA and the radar software developed in NI LabVIEW. These two aspects of the digital systems grants the WFG highly configurable waveform capabilities. The configurable inputs that can be controlled by the user include: number of waveforms in a playlist, start and stop frequency (bandwidth of chirp signal), zero-pi mode, and waveform amplitude and phase control. 

The FPGA acts as a DDS controller that directly configures and control the DDS operations, while also managing and synchronizing the operations of all DDS channels. This project details largely the development of such a controller, named Multichannel Waveform Generator (MWFG) Controller, and the necessary modifications and development in the NI LabVIEW software, so that they complement each other.

An automatic Color detection system checks for the sequence of colored wires in electric cables which are ready to get crimped together. The system inspects for flat connectors with differs in type and number of wires.This is managed in an automatic way with a self learning system without any requirement of manual input from the user to load new data to the machine. The system is coupled to a connector crimping machine and once the system learns the actual sample of cable order , it automatically inspects each cable assembled by the machine. There are three methodologies based on which this automatic detection takes place 1) A self learning system 2) An algorithm for wire segmentation to extract colors from the captured images 3) An algorithm for color recognition to cope up with wires with different illuminations and insulation .The main advantage of this system is when the cables are produced in large batches ,it provides high level of accuracy and prevents false negatives in order to guarantee defect free production.

Bibtex is a tool to edit and manage bibliographical references in a document.Researchers face a common problem that they have one copy of their bibliographical reference databases for a specific project and a master bibliographical database file that holds all their bibliographical references. Syncing these two files is an arduous task as one has to search and modify each reference record individually. Most of the bibtex tools available either provide help in maintaining bibtex bibliographies in different file formats or searching for references in web databases but none of them provide a way to synchronize the fields of the same reference record in the two different bibtex database files. 
The intention of this project is to create an application that helps academicians to keep their bibliographical references in two different databases in sync. We have created a python widget application that employs the Tkinter library for GUI and unQLite database for data storage. This application is integrated with Github allowing users to modify bibtex files present on Github. 

Analysis of large benchmark programs can be very difficult because of their changes in memory state for every run and with billions of instructions the simulation of a whole program in general can be extremely slow. The solution for this is to simulate only some selected regions which are the most representative parts of a program, So that we can focus our analysis and optimizations on those particular regions which represent more part of the execution of a program. In order to accomplish that, we use intel’s pintool, a binary instrumentation framework which performs program analysis at run time, simpoint to get the most representative regions of a program and pinplay for the reproducible analysis of the program. This project uses these frameworks to simulate and analyze programs to provide various statistics about the memory allocations, memory reference traces, allocated memory usage across the most representative regions of the program and also the cache simulations of the representative regions.

Multicarrier modulation using Orthogonal Frequency Division Multiplexing (OFDM) is a best fit candidate for the next generation long-haul optical transmission systems, offering high degree of spectral efficiency and easing the compensation of linear impairments such as chromatic dispersion and polarization mode dispersion, at the receiver. Optical OFDM comes in two flavors – coherent optical OFDM (CO-OFDM) and direct detection optical OFDM (DD-OFDM), each having its own share of pros and cons. CO-OFDM is highly robust to fiber impairments and imposes a relaxation on the electronic component bandwidth requirements, but requires narrow linewidth lasers, optical hybrids and local oscillators. On the other hand DD-OFDM has relaxed laser linewidth requirement and low complexity receiver making it an attractive multicarrier system. However, DD-OFDM system suffers from signal-signal beat interference (SSBI), caused by mixing among the sub-carriers in the photo detector, which deteriorates the system performance. Previously, to mitigate the effect of SSBI, a guard band was used between optical carrier and data sideband. In this project, we experimentally demonstrate a linearly field modulated virtual single sideband OFDM (VSSB-OFDM) transmission with direct detection and digitally compensate for the SSBI using an iterative SSBI compensation algorithm. 
Semiconductor optical amplifiers (SOA), with their small footprint, ultra-high gain bandwidth, and ease of integration, are attracting the attention of optical telecommunication engineers for their use in high speed transmission systems as inline amplifiers. However, the SOA gain saturation induced nonlinearities cause pulse distortion and induce nonlinear cross talk effects such as cross gain modulation especially in Wavelength Division Multiplexed systems. In this project, we also evaluate the performance of iterative SSBI compensation in an optical OFDM system, in the presence of these SOA induced nonlinearities. 

The choice of congestion control algorithm has an impact on the performance of a network. The congestion control algorithm should be selected and implemented based on the network scenario in order to achieve better results. Congestion control in high speed networks and networks with large BDP is proved to be more critical due to the high amount of data at risk. There are problems in achieving better throughput with conventional TCP in the above mentioned scenario. Over the years conventional TCP is modified to pave way for TCP variants that could address the issues in high speed networks. TCP Illinois is one such protocol for high speed networks. It is a hybrid version of a congestion control algorithm as it uses both packet loss and delay information to decide on the window size. The packet loss information is used to decide on whether to increase or decrease the congestion window and delay information is used to assess the amount of increase or decrease that has to be made.

The sheets-db library is a Haskell binding to Google Sheets API. sheets-db allows Haskell users to utilize google spread sheets as a light weight database. It provides various functions to create, read, update and delete rows in spreadsheets along with a way to construct simple structured queries. 

The Erlang delay formula for dimensioning different networks is used to calculate the probability of congestion. Testing the accuracy of a probability of congestion found using the Erlang formula against the simulation for probability of packet loss is demonstrated in this project. The simulations are done when TCP traffic is applied through one bottleneck node. Three different source traffic models having small number of flows is considered. Simulations results for three different source traffic models is shown in terms of probability of packet loss and load supplied to the topology. Various traffic parameters are varied in order to show the impact on the probability of packet loss and to compare with the Erlang prediction for probability of congestion.

Efficient use of the vast spectrum offered by fiber-optic links by an end user with relatively small bandwidth requirement is possible by partitioning a high speed signal in a wavelength channel into multiple low-rate subcarriers. Multicarrier systems not only ensure efficient use of optical and electrical components, but also tolerate transmission impairments. The purpose of this research is to experimentally understand and minimize the impact of mixing among subcarriers in Radio-Over-Fiber (RoF) and direct detection systems, involving a nonlinear component such as a semiconductor optical amplifier. We also analyze impact of clipping and quantization on multicarrier signals and compare electrical bandwidth utilization of two popular multiplexing techniques in orthogonal frequency division multiplexing (OFDM) and Nyquist modulation. 
For an OFDM-RoF system, we present a novel technique that minimizes the RF domain signal-signal beat interference (SSBI), relaxes the phase noise requirement on the RF carrier, realizes the full potential of the optical heterodyne technique, and increases the performance-to-cost ratio of RoF systems. We demonstrate a RoF network that shares the same RF carrier for both downlink and uplink, avoiding the need of an additional RF oscillator in the customer unit. 
For direct detection systems, we first experimentally compare performance degradations of coherent optical OFDM and single carrier Nyquist pulse modulated systems in a nonlinear environment. We then experimentally evaluate the performance of signal-signal beat interference (SSBI) compensation technique in the presence of semiconductor optical amplifier (SOA) induced nonlinearities for a multicarrier optical system with direct detection. We show that SSBI contamination can be removed from the data signal to a large extent when the optical system operates in the linear region, especially when the carrier-to-signal power ratio is low.