ITC/USA 2013 Conference Proceedings / The Forty-Ninth Annual International Telemetering Conference and Technical Exhibition / October 21-24, 2013 / Bally's Hotel & Convention Center, Las Vegas, NV / The transition of telemetry from link-based to network-based architectures opens these systems to new security risks. Tools such as intrusion detection systems and vulnerability scanners will be required for emerging telemetry networks. Intrusion detection systems protect networks against attacks that occur once the network boundary has been breached. An intrusion detection model was developed in the Wireless Networking and Security lab at Morgan State University. The model depends on network traffic being filtered into traffic streams. The streams are then reduced to vectors. The current state of the network can be determined using Viterbi analysis of the stream vectors. Viterbi uses the output of the Hidden Markov Model to find the current state of the network. The state information describes the probability of the network being in predefined normal or attack states based on training data. This output can be sent to a network administrator depending on threshold levels. In this project, a penetration-testing tool called Metasploit was used to launch attacks against systems in an isolated test bed. The network traffic generated during an attack was analyzed for use in the MSU intrusion detection model.

Locomotion automation is a very challenging and complex problem to solve. Besides the obvious navigation problems, there are also problems regarding the environment in which navigation has to be performed. Terrains with obstacles such as rocks, steps or high inclinations, among others, pose serious difficulties to normal wheeled vehicles. The flexibility of legged locomotion is ideal for these types of terrains but this alternate form of locomotion brings with it its own challenges to be solved, caused by the high number of degrees of freedom inherent to it. This problem is usually computationally intensive, so an alternative, using simple and hardware amenable bio-inspired systems, was studied. The goal of this thesis was to investigate if using a biologically inspired learning algorithm, integrated in a fully biologically inspired system, can improve its performance on irregular terrain by adapting its gait to deal with obstacles in its path. At first, two different versions of a learning algorithm based on unsupervised reinforcement learning were developed and evaluated. These systems worked by correlating different events and using them to adjust the behaviour of the system so that it predicts difficult situations and adapts to them beforehand. The difference between these versions was the implementation of a mechanism that allowed for some correlations to be forgotten and suppressed by stronger ones. Secondly, a depth from motion system was tested with unsatisfactory results. The source of the problems are analysed and discussed. An alternative system based on stereo vision was implemented, together with an obstacle detection system based on neuron and synaptic models. It is shown that this system is able to detect obstacles in the path of the robot. After the individual systems were completed, they were integrated together and the system performance was evaluated in a series of 3D simulations using various scenarios. These simulations allowed to conclude that both learning systems were able to adapt to simple scenarios but only the one capable of forgetting past correlations was able to adjust correctly in the more complex experiments.

Approved for public release; distribution is unlimited. / The goal of this research was to use Monte Carlo simulations to further develop the model that describes transport imaging by including a more realistic description of the generation region created by the incident electrons. Monte Carlo simulation can be used to determine the energy distribution in bulk materials due to the interaction with incident electrons. In the simulation, the incident electrons undergo both elastic and inelastic scattering events. Through these events, the energy of the electrons is transferred to the target materials. This deposited energy can generate electron-hole pairs and then, via recombination, photons. In the experimental work, these photons are measured by a CCD camera connected to an optical microscope in a scanning electron microscope (SEM). Monte Carlo simulations were performed for a range of target materials and compared to the luminescence distributions measured experimentally. The simulated energy distributions are always spatially narrower than the optical image from the SEM. We propose possible explanations that need to be evaluated: the relationship between deposited energy and final electron distributions in the target material and photon recycling, in which locally generated photons are reabsorbed to produce a wider luminescence distribution. Further experiments are proposed to identify the limiting factors determining the minimum luminescence distribution.

Low-Power Lossy Networks (LLNs) are a type of Internet of Things (IoT) meshnetwork that collaboratively interact and perform various tasks autonomously. TheRouting Protocol for Low-power and Lossy Network (RPL) is the most used rout-ing protocol for LLNs. Recently, we have been witnessing a tremendous increasein attacks on Internet infrastructures using IoT devices as a botnet (IoT botnet).This thesis focuses on two parts: designing an ML-based IDS for 6LoWPAN, andgenerating a new larger labeled RPL attack dataset by implementing various non-attack and attack IoT network scenarios in the Cooja simulator. The collected rawdata from simulations is preprocessed and labeled to train the Machine Learningmodel for Intrusion Detection System (IDS). We used Deep Neural Network (DNN),Random Forest Classifier (RFC), and Support Vector Machines with Radial-BasisFunction kernel (SVM-RBF) learning algorithms to detect attack in RPL based IoTmesh networks. We achieved a high accuracy (96.7%) and precision (95.7%) usingthe RFC model. The thesis also reviewed the possible placement strategy of IDSfrom cloud to edge.

Supervisory Control and Data Acquisition (SCADA) systems are computer-based process control systems that interconnect and monitor remote physical processes. There have been many real world documented incidents and cyber-attacks affecting SCADA systems, which clearly illustrate critical infrastructure vulnerabilities. These reported incidents demonstrate that cyber-attacks against SCADA systems might produce a variety of financial damage and harmful events to humans and their environment. This dissertation documents four contributions towards increased security for SCADA systems. First, a set of cyber-attacks was developed. Second, each attack was executed against two fully functional SCADA systems in a laboratory environment; a gas pipeline and a water storage tank. Third, signature based intrusion detection system rules were developed and tested which can be used to generate alerts when the aforementioned attacks are executed against a SCADA system. Fourth, a set of features was developed for a decision tree based anomaly based intrusion detection system. The features were tested using the datasets developed for this work. This dissertation documents cyber-attacks on both serial based and Ethernet based SCADA networks. Four categories of attacks against SCADA systems are discussed: reconnaissance, malicious response injection, malicious command injection and denial of service. In order to evaluate performance of data mining and machine learning algorithms for intrusion detection systems in SCADA systems, a network dataset to be used for benchmarking intrusion detection systemswas generated. This network dataset includes different classes of attacks that simulate different attack scenarios on process control systems. This dissertation describes four SCADA network intrusion detection datasets; a full and abbreviated dataset for both the gas pipeline and water storage tank systems. Each feature in the dataset is captured from network flow records. This dataset groups two different categories of features that can be used as input to an intrusion detection system. First, network traffic features describe the communication patterns in a SCADA system. This research developed both signature based IDS and anomaly based IDS for the gas pipeline and water storage tank serial based SCADA systems. The performance of both types of IDS were evaluates by measuring detection rate and the prevalence of false positives.

This thesis investigates ion-molecule reaction studies with the use of an apparatus with a cryogenic 22-pole RF ion trap. In the introduction, we explain the suitability of an ion trap technique for measurements with conditions replicating interstellar medium. We created a technical draft by which we propose an upgrade of ion optics in a region between a mass analyser and a detector. The draft consists of a set of electrostatic electrodes. The proper effect on the ion optics was theoretically tested by multiple simulations in a programmed model of the detection system. We installed the set of electrodes into the apparatus. The new configuration was optimized by using an algorithm for finding extremes of a function. Finally, we tested the upgraded apparatus on a study of an ion- molecule reaction. The new configuration shows stability and greater control over the trajectory of an ion beam. The study's results are being prepared for publication in an impacted journal. 1

No

An in-vehicle intrusion detection system (IV-IDS) is one of the protection mechanisms used to detect cyber attacks on electric or autonomous vehicles where anomaly-based IDS solution have better potential at detecting the attacks especially zero-day attacks. Generally, the IV-IDS generate false alarms (falsely detecting normal data as attacks) because of the difficulty to differentiate between normal and attack data. It can lead to undesirable situations, such as increased laxness towards the system, or uncertainties in the event-handling following a generated alarm. With the help of sophisticated Artificial Intelligence (AI) models, the IDS improves the chances of detecting attacks. However, the use of such a model comes at the cost of decreased interpretability, a trait that is argued to be of importance when ascertaining various other valuable desiderata, such as a model’s trust, causality, and robustness. Because of the lack of interpretability in sophisticated AI-based IV-IDSs, it is difficult for humans to trust such systems, let alone know what actions to take when an IDS flags an attack. By using tools found in the area of eXplainable AI (XAI), this thesis aims to explore what kind of explanations could be produced in accord with model predictions, to further increase the trustworthiness of AI-based IV-IDSs. Through a comparative survey, aspects related to trustworthiness and explainability are evaluated on a custom, pseudo-global, visualization-based explanation (”VisExp”), and a rule based explanation. The results show that VisExp increase the trustworthiness,and enhanced the  explainability of the AI-based IV-IDS.

Continuous welding is one of the prominent techniques used in producing seamless piping used in many applications such as the mining and the oil and gas industries. Weld defects cause significant loss of time and money in the piping production industry. Therefore, there is a need for effective online weld defects detection systems. A laser-based weld defects detection (LBWDD) system has been developed by the industrial partner. However, the current LBWDD system can only detect some geometrically based weld defects, but not material inhomogeneity such as voids, impurities, inclusions, etc. The main objective of this study is to assess the predictability of a thermal imaging-based weld defects detection system (TIBWDD) using an IR camera that can be integrated with the current LBWDD system. The aim of the integrated detection system is to be able to detect a wider range of weld defects. A test rig has been designed and used to carry out a set of emissivity (ε) calculation experiments considering three different materials – Aluminum 5154 (Al), Stainless Steel 304L (SS), and Low Carbon Steel A131 (LCS) with two surface finishes 0.25 μm (FM) and 2.5 μm (RM), which are relevant to pipe welding operations. Al showed least change in ε varying from 0.162 to 0.172 for FM samples and from 0.225 to 0.250 for RM samples from 50°C to 550°C. LCS showed highest change in ε varying from 0.257 – 0.918 for FM samples and from 0.292 to 0.948 for RM samples. SS showed a consistent increase in ε for both FM and RM samples. Experimental and numerical analysis have been carried out mimicking two sets of possible weld defects investigating defect size, Dh, and distance between effect and sample surface, δ. Results showed that the δ based defects that are located within 3 mm can be detected by the IR camera. Defects with Dh = 1. 5 mm can be detected by the IR camera with and without glass wool. Laser welding simulations using 2D and 3D Gaussian heat source models have been carried out to assess the predictability of a set of possible weld defects. The heat source models have been validated using experimental data. Three sets of defects were considered representing material-based inhomogeneity, step and inclined misalignment defects. For material-based inhomogeneity in thin plates all defects located at 1.25 mm from the surface are found detectable as ΔT (temperature difference obtained on surface) > ΔTmin (detectability limit of TIBWDD system). For inhomogeneity defects in thick plates, except defects of 2.5 mm in square size all other defects were found detectable as ΔT > ΔTmin. All step misalignment defects were detected for thin and thick plates. In the case of inclined misalignment defects, for thin plates, the misalignment error in the thin plate had to be at least 0.275 mm to be detected. In the case of thick plates, the misalignment error had be at least 0.375 mm to be detected. Overall, results of the present study confirm that thermal imaging can be successfully used in detecting material-based and geometry-based weld defects. / Thesis / Master of Applied Science (MASc)

Background. Web applications are a more significant part of our digital experience, and the number of users keeps continuously growing. Social media alone accounts for more than half of the world’s population. Therefore these applications have become a lucrative target for attackers, and we have seen several attacks against them. One such example saw attackers manage to compromise a twitter account [15], leading to false information being published, causing the New York stock exchange to drop 150 points, erasing 136 billion dollars in equity market value. There are methods to protect web applications, such as web application firewalls or content security policies. Still, another candidate for defending these applications is Host-based Intrusion Detection Systems (HIDS). This study aims to assess the efficiency of these HIDS when defending against web applications. Objectives. The main objective of the thesis is to create an efficiency evaluating model for a HIDS when protecting web applications. Additionally, we will test two open-source HIDS against web applications built to emulate a vulnerable environment and measure these HIDS efficiencies with the model mentioned above. Methods. To reach the objectives of our thesis, a literature review regarding what metrics to evaluate the efficiency of a HIDS was conducted. This allowed us to construct a model for which we evaluated the efficiency of our selected HIDS. In this model, we use 3 categories, each containing multiple metrics. Once completed, the environment hosting our vulnerable applications and their HIDS was set up, followed by the attacks of the applications. The data generated by the HIDS gave us the data required to make our efficiency evaluation which was performed through the lens of the previously mentioned model. Results. The result shows a low overall efficiency from the two HIDS when regarding the category attack detection. The most efficient of the two could be determined. Of the two evaluated, Wazuh and Samhain; we determined Wazuh to be the more efficient HIDS. We identified several components required to improve their attack detection. Conclusions. Through the use of our model, we concluded that the HIDS Wazuh had higher efficiency than the HIDS Samhain. However both HIDS had low performances regarding their ability to detect attacks. Some specific components need to be implemented within these systems before they can reliably be used for defending web applications.