Thesis (Ph.D.)--University of Central Florida, 2009. / Adviser: Lin Huff-Corzine. Includes bibliographical references (p. 194-201).

No description available.

Malware continues to be one of the primary tools employed by attackers. It is used in attacks ranging from click fraud to nation state espionage. Malware infects hosts over the network through drive-by downloads and social engineering. These infected hosts communicate with remote command and control (C&C) servers to perform tasks and exfiltrate data. Malware's reliance on the network provides an opportunity for the detection and annotation of malicious communication. This thesis presents four main contributions. First, we design and implement a novel incident investigation system, named WebWitness. It automatically traces back and labels the sequence of events (e.g., visited web pages) preceding malware downloads to highlight how users reach attack pages on the web; providing a better understanding of current attack trends and aiding in the development of more effective defenses. Second, we conduct the first systematic study of modern web based social engineering malware download attacks. From this study we develop a categorization system for classifying social engineering downloads and use it to measure attack properties. From these measurements we show that it is possible to detect the majority of social engineering downloads using features from the download path. Third, we design and implement ExecScent, a novel system for mining new malware C&C domains from live networks. ExecScent automatically learns C&C traffic models that can adapt to the deployment network's traffic. This adaptive approach allows us to greatly reduce the false positives while maintaining a high number of true positives. Lastly, we develop a new packet scheduling algorithm for deep packet inspection that maximizes throughput by optimizing for cache affinity. By scheduling for cache affinity, we are able to deploy our systems on multi-gigabit networks.

Drive-by download is a sort of network attack which uses different techniques to plant malicious codes in their computers. It makes the traditional intrusion detection systems and firewalls nonfunctional in the reason that those devices could not detect web-based threats. The Crawler-based approach has been proposed by many studies to discover drive-by download sites. However, the Crawler-based approach could not simulate the real user behavior of web browsing when drive-by download attack happens. Therefore, this study proposes a new approach to detect drive-by download by sniffing HTTP flow. This study uses reputation system to improve the efficiency of client honeypots, and adjusts client honeypots to process the raw data of HTTP flow. In the experiment conducted in real network environment, this study show the performance of a single client honeypot could reach average 560,000 HTTP success access log per day. Even in the peak traffic, this mechanism reduced the process time to 22 hours, and detected drive-by download sites that users were actually browsing. Reputation system in this study is applicable to varieties of domain names because it does not refer to online WHOIS database. It established classification model on machine learning in 12 features. The correct classification rate of the reputation system applied in this study is 90.9%. Compared with other Reputation System studies, this study not only extract features from DNS A-Type but also extract features from DNS NS-Type. The experiment results show the Error Rate of the new features from DNS NS-Type is only 19.03%.

Because of the convenience of the Internet, we rely closely on the Internet to do information searching and sharing, forum discussion, and online services. However, most of the websites we visit are developed by people with limited security knowledge, and this condition results in many vulnerabilities in web applications. Unfortunately, hackers have successfully taken advantage of these vulnerabilities to inject malicious JavaScript into compromised web pages to trigger drive-by download attacks. Based on our long time observation of malicious web pages, malicious web pages have unusual behavior for evading detection which makes malicious web pages different form normal ones. Therefore, we propose a client-side malicious web page detection mechanism named Web Page Checker (WPC) which is based on anomaly behavior tracing and analyzing to identify malicious web pages. The experimental results show that our method can identify malicious web pages and alarm the website visitors efficiently.

In the fall of 2004, the High Speed Autonomous Vehicle Team, a group of 16 students took on the goal of converting a vehicle to drive-by-wire status. The main goal of this project was to convert a Cadillac SRX donated by General Motors, to fully by-wire control. This thesis presents the HSAVT brake-by-wire and the steer-by-wire solution. In addition, the results of a literary search on drive-by-wire systems are presented. The results of the project proved that the team came up with a solid, effective drive-by-wire vehicle and that the project met all of the primary goals of the project. / Master of Science

L'incroyable développement du World Wide Web a permis la création de nouveaux métiers, services, ainsi que de nouveaux moyens de partage de connaissance. Le web attire aussi des malfaiteurs, qui le considèrent comme un moyen pour gagner de l'argent en exploitant les services et la propriété d'autrui. Cette thèse propose une étude des sites web compromis et malicieux sous plusieurs axes d'analyse. Même si les attaques web peuvent être de nature très compliquées, on peut quasiment toujours identifier quatre acteurs principaux dans chaque cas. Ceux sont les attaquants, les sites vulnérables hébergés par des fournisseurs d'hébergement, les utilisateurs (souvent victimes des attaques), et les sociétés de sécurité qui parcourent Internet à la recherche de sites web compromis à être bloqués. Dans cette thèse, nous analysons premièrement les attaques web du point de vue des hébergeurs, en montrant que, même si des outils gratuits permettent de détecter des signes simples de compromission, la majorité des hébergeurs échouent dans cette épreuve. Nous passons en suite à l'analyse des attaquants et des leurs motivations, en étudiant les attaques web collectés par des centaines de sites web vulnérables. Ensuite, nous étudions le comportement de milliers de victimes d'attaques web, en analysant leurs habitudes pendant la navigation, pour estimer s'il est possible de créer des "profils de risque", de façon similaire à ce que les compagnies d'assurance font aujourd'hui. Enfin, nous adoptons le point de vue des sociétés de sécurité, en proposant une solution efficace pour la détection d'attaques web convoyées par sites web compromis / The incredible growth of the World Wide Web has allowed society to create new jobs, marketplaces, as well as new ways of sharing information and money. Unfortunately, however, the web also attracts miscreants who see it as a means of making money by abusing services and other people's property. In this dissertation, we perform a multidimensional analysis of attacks involving malicious or compromised websites, by observing that, while web attacks can be very complex in nature, they generally involve four main actors. These are the attackers, the vulnerable websites hosted on the premises of hosting providers, the web users who end up being victims of attacks, and the security companies who scan the Internet trying to block malicious or compromised websites. In particular, we first analyze web attacks from a hosting provider's point of view, showing that, while simple and free security measures should allow to detect simple signs of compromise on customers' websites, most hosting providers fail to do so. Second, we switch our point of view on the attackers, by studying their modus operandi and their goals in a distributed experiment involving the collection of attacks performed against hundreds of vulnerable web sites. Third, we observe the behavior of victims of web attacks, based on the analysis of their browsing habits. This allows us to understand if it would be feasible to build risk profiles for web users, similarly to what insurance companies do. Finally, we adopt the point of view of security companies and focus on finding an efficient solution to detecting web attacks that spread on compromised websites, and infect thousands of web users every day

The ability to drive a car is an important skill for individuals with a spinal cord injury to maintain a high quality of life, particularly their freedom and independence. However, driving with a physical disability often requires the installation of an adaptive driving system to control steering, gas, and braking. The two main types of adaptive driving controls are mechanical and electrical, also known as drive by wire (DBW). DBW controls work by converting electric signals to mechanical actuators. Driving simulators are useful tools for adaptive driving systems because they allow users to test different control devices, to practice driving without the dangers of being on the road, and can be used as a safe way to evaluate disabled drivers. This study focused on the development of a dynamic driving simulator using DBW controls because many studies focus on mechanical controls and not DBW controls and often use static simulators. The simulator was developed using the Computer Assisted Rehabilitation Environment (CAREN) virtual reality system. The CAREN system (Motek Medical, Amsterdam, Netherlands) includes a six degree of freedom (DOF) motion base, an optical motion capture system, a sound system, and a 180-degree projection screen. The two DBW controls, a lever device to control the gas and brake and a small wheel device to control steering, sent an electric signal to a Phidget microcontroller board, which interfaced with the CAREN system. Several different driving scenarios were created and imported into CAREN's D-Flow software. A program was developed in D-Flow to control the scene and motion of the platform appropriately based on the DBW controls via the Phidget. The CAREN system dynamically controlled the motion platform based on the user's input. For example, if the user applied the brake suddenly, the user felt a deceleration from the motion platform moving backwards. Human testing was performed and through the use of a survey, feedback about the system was obtained. Changes were made to the simulator using the feedback obtained and further testing showed that those changes improved the simulator. The driving simulator showed the capability to provide dynamic feedback and, therefore, may be more realistic and beneficial than current static adaptive driving simulators. The dynamic adaptive driving simulator developed may improve driving training and performance of persons with spinal cord injuries. Future work will include more human testing. The dynamic feedback provided through the system's moving platform and virtual camera movement will be optimized in order to perform similarly to a real car. Testing will also be completed with and without the dynamics from the moving platform to see how this type of feedback affects the user's driving ability in the virtual environment.

IEEE 802.11 PHY supports multiple transmission rates according to multiple different modulations and coding schemes. Each WiFi station selects its own transmission rate according to its own algorithm; in particular, the IEEE 802.11 standards do not specify the bit-rate selection method. Although many adaptive bit-rate selection algorithms have been proposed, there is limited research and evaluation on the performance of such algorithms for roadside networks, especially in cases with multi-vehicle roadside multi-vehicular WiFi networks. In this thesis we propose an opportunistic highest bit-rate algorithm, Opportunistic Highest Bit-Rate Multi-Vehicular WiFi Networks (OHBR-MVN), specifically for roadside multi-vehicular WiFi networks. Our proposal is based on three key characteristics of such networks: (1) vehicles will drive closer to, and eventually pass, the roadside WiFi station, experiencing a progressively better transmission environment; (2) the vast majority of data transmitted in single-vehicle drive-by downloading scenarios occurs at the maximum transmission rate; (3) vehicles that transmit at less than the maximum rate do so at the expense of those that could send more data at a higher transmission rate. We therefore believe that transmitting only at the highest possible bit-rate is the preferred algorithm for such networks. Further, this approach keeps the bit-rate selection extremely simple, avoiding the complexity and resulting problems of adaptive approaches. Through a series of experiments that compare the throughput of both fixed and adaptive bit-rate selection algorithms we show that our approach yields both higher throughput and better fairness characteristics, while being significantly simple, and thus more robust.

IEEE 802.11 PHY supports multiple transmission rates according to multiple different modulations and coding schemes. Each WiFi station selects its own transmission rate according to its own algorithm; in particular, the IEEE 802.11 standards do not specify the bit-rate selection method. Although many adaptive bit-rate selection algorithms have been proposed, there is limited research and evaluation on the performance of such algorithms for roadside networks, especially in cases with multi-vehicle roadside multi-vehicular WiFi networks. In this thesis we propose an opportunistic highest bit-rate algorithm, Opportunistic Highest Bit-Rate Multi-Vehicular WiFi Networks (OHBR-MVN), specifically for roadside multi-vehicular WiFi networks. Our proposal is based on three key characteristics of such networks: (1) vehicles will drive closer to, and eventually pass, the roadside WiFi station, experiencing a progressively better transmission environment; (2) the vast majority of data transmitted in single-vehicle drive-by downloading scenarios occurs at the maximum transmission rate; (3) vehicles that transmit at less than the maximum rate do so at the expense of those that could send more data at a higher transmission rate. We therefore believe that transmitting only at the highest possible bit-rate is the preferred algorithm for such networks. Further, this approach keeps the bit-rate selection extremely simple, avoiding the complexity and resulting problems of adaptive approaches. Through a series of experiments that compare the throughput of both fixed and adaptive bit-rate selection algorithms we show that our approach yields both higher throughput and better fairness characteristics, while being significantly simple, and thus more robust.