Approved for release; distribution is unlimited / Computer network operations (CNO) can be considered a relatively new phenomenon being encount modern warfare. Computer network operation is comprised of three components, computer network attack computer network exploitation (CNE), and computer network defense (CND). Computer network attack is def operations to disrupt, deny, degrade, or destroy information resident in computer networks, or the computers and ne themselves. Computer network exploitation is the intelligence collection and enabling operations to gather data from adversary automated information systems (AIS) or networks. Finally, computer network defense are those me internal to the protected entity, taken to protect and defend information, computers, and networks from disruption, degradation, or destruction. No longer is warfare limited to the use of kinetic weapons and conventional methods of war. Computer network operations have become an integral part of our adversary's arsenal and more attention must be paid to the effects of CNO activities, particularly CNA and CNE being conducted by our adversaries. Of the many states suspected of conducting active CNO activities against the United States and other nations, none warrants more attention than North Korea. This thesis presents the development of methodology using information available from open sources. This work is intended to prove that a useful methodology for assessing the CNO capabilities and limitations of North Korea can be developed using only open source information. / Lieutenant, United States Navy

Approved for public release, distribution unlimited / Wireless Local Area Networks (WLANs) are quickly becoming popular in daily life. Users are adopting the latest technology to save time and costs. In addition, WLANs are providing high-speed network access to the users. There are security concerns with WLANs that must be considered when deploying them over critical infrastructure, such as military and administrative government LANs. The IEEE 802.11 wireless standard specifies both an authentication service and encryption protocol, but research has demonstrated that these protocols are severely flawed. The IEEE has established a new workgroup, the IEEE 802.11i, to address all the security vulnerabilities of the 802.11 security protocol. The workgroup proposed using the IEEE 802.1X Port-Based Network Access Control Standard as an interim measure to meet the security requirements of the WLANs and to maintain the confidentiality, authenticity, and availability of the data until the workgroup is finished with the new specifications. Using an open-source test-bed for evaluating DoS attacks on WLANs, this research demonstrates four different DoS attacks that verify the weaknesses of the IEEE 802.1X protocol. Solutions are provided to mitigate the effects of such DoS attacks. / Lieutenant Junior Grade, Turkish Navy

Host-based intrusion-prevention systems are recently popular technologies which protect computer systems from malicious attacks. Instead of merely detecting exploits, the systems attempt to prevent the exploits from succeeding on the host they protect. This research explores the threats that have led to the development of these systems and the techniques many use to counter those problems. We then evaluate two current intrusion-prevention products (McAfee Entercept and the Cisco Security Agent) as to their success in preventing exploits. Our tests used live viruses, worms, Trojan horses, and remote exploits which were turned loose on an isolated two-computer network. We make recommendations about deployment of the two products based on the results of our own testing.

Open dissemination of the Trusted Computing Exemplar (TCX) project is needed. This dissemination must include methods to provide secure web access to project material, integrity verification of data, and group-based access controls. Because previously developed dissemination systems do not meet these requirements, a hybrid web-based dissemination system is necessary. The development of the TCX Dissemination System requirements involved the analysis of assumptions, threats, policies, and security objectives for the system and its environment based on the Common Criteria methodology. The requirements yielded a design specification that included a dissemination application that uses XML capabilities for redaction and preparation of releasable materials. This led to the creation of an initial implementation to satisfy a subset of the TCX dissemination requirements. Future work was identified for a subsequent implementation that fulfills additional project requirements. The complete implementation of the dissemination environment described in this thesis will provide a seamless dissemination interface for the TCX project. The Dissemination System provides an example of how controlled information can be organized and made available on the web. When combined with TCX project results, it supports the assured information sharing objectives of the Department of Defense Global Information Grid vision. / US Navy (USN) author.

The performance aspect and security capabilities of the Embedded Firewall (EFW) system are studied in this thesis. EFW is a host-based, centrally controlled firewall system consisting of network interface cards and the "Policy Server" software. A network consisting of EFW clients and a Policy Server is set up in the Advanced Network Laboratory at the Naval Postgraduate School. The Smartbits packet generator is used to simulate realistic data transfer environment. The evaluation is performed centered on two main categories: performance analysis and security capability tests. TTCP program and a script written in TCL are used to perform throughput and packet loss tests respectively. The penetration and vulnerability tests are conducted in order to analyze the security capabilities of EFW. Symantec Personal Firewall is used as a representative application firewall for comparing test results. Our study shows that EFW has better performance especially in connections with high amounts of encrypted packets and more effective in preventing insider attacks. However, current implementation of EFW has some weaknesses such as not allowing sophisticated rules that application firewalls usually do. We recommend that EFW be used as one of the protection mechanisms in a system based on the defense-in-depth concept that consists of application firewalls, intrusion detection systems and gateway protocols.

Sample Entropy examines changes in the normal distribution of network traffic to identify anomalies. Normalized Information examines the overall probability distribution in a data set. Random Forests is a supervised learning algorithm which is efficient at classifying highlyimbalanced data. Anomalies are exceedingly rare compared to the overall volume of network traffic. The combination of these methods enables low-bandwidth anomalies to easily be identified in high-bandwidth network traffic. Using only low-dimensional network information allows for near real-time identification of anomalies. The data set was collected from 1999 DARPA intrusion detection evaluation data set. The experiments compare a baseline f-score to the observed entropy and normalized information of the network. Anomalies that are disguised in network flow analysis were detected. Random Forests prove to be capable of classifying anomalies using the sample entropy and normalized information. Our experiment divided the data set into five-minute time slices and found that sample entropy and normalized information metrics were successful in classifying bad traffic with a recall of .99 and a f-score .50 which was 185% better than our baseline.

Approved for public release, distribution unlimited / This thesis will focus on academia, specifically the Naval Postgraduate School, and its requirement to implement an education program that allows facilitators to properly inform future students on the gradual implementation of Internet Protocol version 6 (IPv6) technology while phasing out Internet Protocol version 4 (IPv4) from the current curriculum as the transition to IPv6 progresses. The DoD's current goal is to complete the transition of all DoD networks from IPv4 to IPv6 by fiscal year 2008. With this deadline quickly approaching, it is imperative that a plan to educate military and DoD personnel be implemented in the very near future. It is my goal to research and suggest a program that facilitators can use that will show the similarities, changes, advantages, and challenges that exist for the transition. / US Marine Corps (USMC) author.

The study of multicomputer interconnection networks is an important area of research in parallel processing. We introduce vertex-symmetric Hamming-group graphs as a model to design a wide variety of network topologies including the hypercube network.

Approved for public release; distribution is unlimited / The next step in the evolution of services provided on an intranet or the internet will be distributed or distance learning with collaboration among peers. Currently, this is done on a one-to-one basis. To expand to a one-tomany collaboration environment, there needs to be a server distributing the multimedia content without creating additional network traffic even though many users are accessing or viewing the multimedia content. Multicasting allows many users to view multimedia content without creating additional network traffic. There is a server providing multimedia content to a multicast address so users may access it. This thesis defines metrics and conducts a comparison of different servers capable of distributing multimedia content using the multicasting protocol. / Lieutenant, United States Navy

Approved for public release; distribution is unlimited / This research concerns information security and computer-network defense. It addresses how to handle the information of log files and intrusion-detection systems to recognize when a system is under attack. But the goal is not the usual one of denying access to the attacker but providing a justification for deceptive actions to fool the attacker. We implemented a simple demonstration of how two different kinds of open-source intrusion-detection systems can efficiently pool data for this purpose. / Lieutenant Commander, Brazilian Navy