Craig Scott

Network intrusion visualization with NIVA, an intrusion detection visual analyzer with haptic integration

The explosive growth of malicious activities on worldwide communication networks, such as the Internet, has highlighted the need for efficient intrusion detection systems. The efficiency of traditional intrusion detection systems is limited by their inability to effectively relay relevant information due to their lack of interactive/immersive technologies. We explore several network visualization techniques geared towards intrusion detection on small and large-scale networks. We also examine the use of haptics in network intrusion visualization. By incorporating concepts from electromagnetics, fluid dynamics, and gravitational theory, we show that haptic technologies can provide another dimension of information critical to the efficient visualization of network intrusion data. Furthermore, we explore the applicability of these visualization techniques in conjunction with commercial network intrusion detectors. Finally, we present a network intrusion visualization application with haptic integration, NIVA which allows the analyst to interactively investigate as well as efficiently detect structured attacks across time and space using advanced interactive three-dimensional displays.

Methodology for evaluating the effectiveness of intrusion detection in tactical mobile ad-hoc networks

Tactical mobile ad-hoc networks encompass a multitude of security vulnerabilities that are vastly different from their traditional wired counterparts. The wide-open distributed nature of the network environment leaves it susceptible to stealthy and coordinated attacks designed to access sensitive data, disrupt network communication, or consume resources. Intrusion detection algorithms and approaches are well-known. However, it is uncertain if these approaches are effective in a mobile ad-hoc environment where resources such as bandwidth are limited. To address this problem the Tactical Environment Assurance Laboratory (TEALab) was established to provide an environment for characterizing tactical battlefield ad-hoc networks experiencing intrusive behaviors. This paper presents a methodology for evaluating the effectiveness of intrusion detection in a tactical ad-hoc environment. The methodology includes generating representative network event data with and without network attacks, running attacks with widely available intrusion detection systems, and evaluating the behavior of the IDS in an ad-hoc environment.

Network intrusion visualization with NIVA, an intrusion detection visual and haptic analyzer

The rapid growth of malicious activities on worldwide communication networks, such as the Internet, has highlighted the need for efficient intrusion detection systems. The efficiency of traditional intrusion detection systems is limited, in part, by their inability to relay effectively relevant information due to their lack of interactive/immersive technologies. In this paper, we explore several network visualization techniques geared toward intrusion detection on small- and large-scale networks. We also examine the use of haptics in network intrusion visualization. By incorporating concepts from electromagnetics, fluid dynamics, and gravitational theory, we show that haptic technologies can provide another dimension of information critical to the efficient visualization of network intrusion data. Furthermore, we explore the applicability of these visualization techniques in conjunction with commercial network intrusion detectors. Finally, we present a network intrusion visualization application with haptic integration, NIVA, which allows the analyst to interactively investigate as well as efficiently detect structured attacks across time and space using advanced interactive three-dimensional displays.

Improving and Expanding Engineering Education in the Middle East and Africa Using Mobile Learning Technology and Innovative Pedagogy

Recent innovations in inexpensive and portable laboratory instruments have enabled new pedagogical approaches in the teaching of theoretical concepts and design practices in electrical engineering (EE). Faculty members at six universities in the USA have pioneered the use of these new tools to incorporate hands-on experimental activities into existing lecture courses. This has led to restructured EE courses with a focus on student-centered learning and not instructor-centered lectures. The goal of this effort has been to evaluate whether a more student-centered learning environment can stimulate a deeper understanding of EE principles and increase student engagement. The use of hands-on experiments started with an introductory electric circuits course and has expanded into physics, biology, and higher level EE courses. Several modes of instruction using this technology and pedagogy have been implemented at different institutions. In the blended approach, the classroom experience is a combination of lectures and hands-on activities using the mobile laboratory instruments to reinforce theoretical concepts. For the second instructional model, the inverted or flipped classroom, students are expected to read material at home, prior to their investigation of the concepts via hands-on activities in the classroom. A third model uses the portable laboratory instruments to complete hands-on activities outside of the classroom as homework problems, design projects, and/or a nontraditional laboratory component.

Dynamic XML deployment of geospatial peer nodes

This research provides an automated methodology for dynamic geographical deployment of enterprise and mobile applications. The process of achieving deployment involves utilization of a three dimensional XML peer node descriptor (3DP2P-XML). The 3DP2P-XML file descriptor generates enterprise beans, Web services, and mobile clients. Geocoding and wireless device application programming interfaces (APIs) leverage the 3DP2P-XML structured paradigm. Geospatial boundary conditions and statistical data determine the topology of peer node distribution.

A Graph Alorithm Based Approach to Recovery and Failover in Tactical Manets

The objective of the attack recognition effort is to develop inference and correlation technologies that can detect complex multi-stage attacks in mobile adhoc networks (MANET) environments where the reliance on centralized mechanisms or fixed relationships is unattainable. This work is supported by the Army Research Laboratory (ARL) Collaborative Technology Alliance (CTA). Technical Area 4 encompasses tactical information protection involving attack recognition and event dissemination where attack recognition is the focus of this study. Previous work has shown the ability to recognize malicious activity using a variety of statistical or fuzzy inference techniques. This research focuses on the next course of action after an attack takes place. This paper reports on an ongoing research effort to add the capability of a network to recover from an attack. This capability is based on the use of modified algorithms traditionally found in graph theory by an intelligent agent based framework. The agent-based framework is a collection of cooperative agents capable of raw packet data collection, comparison of metadata to a knowledge base, and the production of a decision

Integrity Monitoring of Digital Elevation Models using Corner Edge Detection of Accumulated X-Band Radials

Synthetic vision systems (SVS) provides pilots with displays of stored geo-spatial data representing terrain, obstacles and cultural features. This system has the potential to improve flight safety by providing situational awareness and reducing the likelihood of controlled flight into terrain (CFIT). In order to enable the safe use of SVS at low altitudes, real-time range-to-terrain measurements may be necessary to ensure integrity of terrain data for civil aviation applications. This paper describes an integrity monitor which uses a novel approach to check the consistency between a terrain elevation profile synthesized from an X-band weather radar (WxR) sensor and the profile given in a digital elevation model (DEM). Features, in the form of edge locations and associated curvature strengths, are extracted and placed in a graph representation. A comparison is performed on the relationships that are drawn from the node attributes using the approximate graph matching technique in order to confirm the integrity of the terrain dataset. Terrain scans from NASAs integrated intelligent flight deck (IIFD) program are used to validate the proposed integrity monitoring approach

Three dimensional Peer-2-Peer (3DP2P) networks

The research provides a computational approach for dynamic allocation of geometric coordinates within a 3DP2P network topology. Deployment of Internet and mobile applications within the network will be achieved with the utilization of a 3D-XML peer node descriptor (3DP2P-XML). The 3DP2P-XML file descriptor generates and deploys enterprise beans, web services, and mobile clients. Boundary conditions and statistical data determine the peer node distribution. The application will demonstrate the procedure for generating network coordinates. The coordinates correlate IP and URL addresses to a metric space. The technique uses a Riemann sum to estimate the number of nodes, volume, and surface boundaries of the 3D-P2P mesh network. The resulting algorithm creates a minimum 3D spanning tree with coordinate indexes. The multi-hop network is visualized as a 3D bouquet of computer nodes.

Implementing a shadow detection algorithm for synthetic vision systems in reconfigurable hardware

The integrity monitor for synthetic vision systems provides pilots with a consistency check between stored Digital Elevation Models (DEM) and real-time sensor data. This paper discusses the implementation of the Shadow Detection and Extraction (SHADE) algorithm in reconfigurable hardware to increase the efficiency of the design. The SHADE algorithm correlates data from a weather radar and DEM to determine occluded regions of the flight path terrain. This process of correlating the weather radar and DEM data occurs in two parallel threads which are then fed into a disparity checker. The DEM thread is broken up into four main sub-functions: 1) synchronization and translation of GPS coordinates of aircraft to the weather radar, 2) mapping range bins to coordinates and computing depression angles, 3) mapping state assignments to range bins, and 4) shadow region edge detection. This correlation must be done in realtime; therefore, a hardware implementation is ideal due to the amount of data that is to be processed. The hardware of choice is the field programmable gate array because of programmability, reusability, and computational ability. Assigning states to each range bin is the most computationally intensive process and it is implemented as a finite state machine (FSM). Results of this work are focused on the implementation of the FSM.

Electron-beam-induced current study of gallium nitride and diamond materials

The continual need for microelectronic devices that operate under severe electronic and environmental conditions (high temperature, high frequency, high power, and radiation tolerance) has sustained research in wide bandgap semiconductor materials. The properties suggest these wide bandgap semiconductor materials have tremendous potential for military and commercial applications. High frequency bipolar transistors and field effect transistors, diodes, and short wavelength optical devices have been proposed using these materials. Although research efforts involving the study of transport properties in GaN and diamond have made significant advances, much work is still needed to improve the material quality so that the electrophysical behavior of device structures can be further understood and exploited. Electron beam induced current (EBIC) measurements can provide a method of understanding the transport properties in GaN and diamond. This technique basically consists of measuring the current or voltage transient response to the drift and diffusion of carriers created by a short-duration pulse of radiation. This method differs from other experiemental techniques because it is based on a fast transient electron beam created from a high- speed, laser-pulsed photoemission system.