Traditional static network addressing allows attackers the incredible advantage of taking time to plan and execute attacks against a network. To counter, Moving Target IPv6 Defense (MT6D) provides a network host obfuscation technique that dynamically obscures network and transport layer addresses. Software driven implementations have posed many challenges, namely, constant code maintenance to remain compliant with all library and kernel dependencies, less than optimal throughput, and the requirement for a dedicated general purpose hardware. The work of this thesis presents Network Security Processor and Hardware Engine for MT6D (HE-MT6D) to overcome these challenges. HE-MT6D is a soft core Intellectual Property (IP) block developed in full Register Transfer Level (RTL) and is the first hardware-oriented design of MT6D. Major contributions of HE-MT6D include the complete separation of the data and control planes, development of a nonlinear Complex Instruction Set Computer (CISC) Network Security Processor for in-flight packet modification, a specialized Packet Assembly language, a configurable and a parallelized memory search through tag-based Hybrid Content Addressable Memory (HCAM) L1 write-through cache, full RTL Network Time Protocol version 4 hardware module, and a modular crypto engine. HE-MT6D supports multiple nodes and provides 1,025% throughput performance increase over earlier C-based MT6D at 863 Mbps with full encapsulation and decapsulation, and it matches bare wire throughput performance for all other traffic. The HE-MT6D IP block can be configured as an independent physical gateway device, built as embedded Application Specific Integrated Circuit (ASIC), or serve as a System on Chip (SoC) integrated submodule. / Master of Science / Traditional static network addressing allows attackers the incredible advantage of taking time to plan and execute attacks against a network. One approach to counter this effect is dynamic addressing through Moving Target Defense, which the Department of Homeland Security Cyber Security Division (CSD) designated as one of the fourteen primary Technical Topic Areas for securing federal networks and the larger Internet. A specific application for Internet Protocol version 6 (IPv6) networks is Moving Target IPv6 Defense (MT6D). This provides tunneling and dynamic cryptographic network address translation, where new addresses are cryptographically generated every few seconds. The work of this thesis presents a Network Security Processor and Hardware Engine for MT6D (HE-MT6D). HE-MT6D is the first hardware-oriented implementation of MT6D developed in full Register Transfer Level (RTL) logic and provides 1,025% performance increase over earlier C-based MT6D at 863 Mbps full duplex throughput. It also provides support for multiple nodes. The HE-MT6D Intellectual Property (IP) block is modular for maximum flexibility towards system deployment: it can be configured as an independent physical gateway device, built as embedded Application Specific Integrated Circuit (ASIC), or serve as a System on Chip (SoC) integrated submodule.

Since 2009, Moving Target Defense (MTD) has become a new paradigm of defensive mechanism that frequently changes the state of the target system to confuse the attacker. This frequent change is costly and leads to a trade-off between misleading the attacker and disrupting the quality of service. Optimizing the MTD activation frequency is necessary to develop this defense mechanism when facing realistic, multi-step attack scenarios. Attack modeling formalisms based on DAG are prominently used to specify these scenarios. It represents the attack goal in the root of a tree that is recursively refined into subgoals to show the different ways the attacker can compromise the system. According to some specific models, the tree is augmented with countermeasures, time, costs, or probabilities. Our contribution is a new DAG-based formalism for MTDs and its translation into a Price Timed Markov Decision Process to find the best activation frequencies against the attacker’s time/cost-optimal strategies. For the first time, MTD activation frequencies are analyzed in a state-of-the-art DAG-based representation. Moreover, this is the first paper that considers the specificity of MTDs in the automatic analysis of attack modeling formalisms. Finally, we present some experimental results using UPPAAL STRATEGO to demonstrate its applicability and relevance. / Sedan 2009 har Moving Target Defense (MTD) blivit ett nytt paradigm av defensiv mekanism som ofta ändrar målsystemets tillstånd för att förvirra angriparen. Denna frekventa förändring är kostsam och leder till en avvägning mellan att vilseleda angriparen och att störa målsystemets tillförlitlighet. Att optimera MTD-aktiveringsfrekvensen är nödvändigt för att utveckla denna försvarsmekanism när man står inför realistiska attackscenarier i flera steg. Attackmodelleringsformalismer baserade på DAG är de främst använda metoderna för att specificera dessa scenarier. Metoden representer attackmålet i roten av ett träd som rekursivt förfinas till delmål för att visa de olika sätt som angriparen kan äventyra systemet. Enligt vissa specifika modeller är trädet utökat med motåtgärder, tid, kostnader eller sannolikheter. Vårt bidrag är en ny DAG-baserad formalism för MTD:er och dess översättning till en Price Timed Markov Decision Process för att hitta de bästa aktiveringsfrekvenserna mot angriparens tids-/kostnadsoptimala strategier. För första gången analyseras MTD-aktiveringsfrekvenser i en toppmodern DAG-baserad representation. Dessutom är detta det första rapporten som överväger specificiteten hos MTD:er i den automatiska analysen av attackmodelleringsformalismer. Slutligen presenterar vi några experimentella resultat med UPPAAL STRATEGO för att visa dess tillämpbarhet och relevans.

The detection of weak, ground-moving targets can be improved through effective utilization of additional target signal energy collected over an extended dwell time. The signal model used in conventional radar processing limits integration of signal energy over an extended dwell. Two solutions that consider the complexity of the extended-dwell signal model and effectively combine signal energy collected over a long dwell are presented. The first solution is a single-channel algorithm that provides an estimate of the optimal detector to maximize output signal-to-interference-plus-noise ratio for the extended dwell time signal. Rather than searching for the optimal detector in an intractably large filter bank that contains all combinations of phase components, the single-channel algorithm projects dictionary entries against the data to estimate the signal’s linear and nonlinear phase components sequentially with small, phase-specific dictionaries in a multistage process. When used as the detector, the signal model formed from the estimated phase components yields near optimal performance for a wide range of target parameters for dwell times up to four seconds. In comparison, conventional radar processing methods are limited to an integration time of approximately 100 milliseconds. The second solution is a multichannel, multistage algorithm based on element-space pre-Doppler space-time-adaptive processing with two modifications that make it suitable for detection of weak targets whose energy is collected over an extended dwell time. The multichannel solution detects targets with lower radial velocities at significantly lower signal-to-noise ratios (SNRs) than conventional radar processing methods. The decrease in required input SNR for the multichannel solution as compared to conventional methods nearly doubles the detection range for a typical target of interest. Future related research includes extension of these concepts to other radar applications and investigation of algorithm performance for the multiple-target scenario.

Thesis (MScEng (Electrical and Electronic Engineering))--University of Stellenbosch, 2010. / ENGLISH ABSTRACT: The thesis details the design, construction and experimental evaluation of 30W, 35W and 250W L-Band LDMOS Radar amplifiers. Each amplifier module contains an integrated high speed power supply in order to optimize RF pulse repeatability and to improve radar MTI factor (Moving Target Indication.) As part of the work, a pulsed RF measurement system for measuring the dynamic I-V curves of a power FET was developed. Work was also done on low impedance S-parameter measurement test fixtures for the characterisation of power FETs. These measurement systems generated design information which was used in the development of the L-Band power amplifiers / AFRIKAANSE OPSOMMING: Hierdie tesis beskryf die ontwerp, bou en experimentele evaluering van „n 30W, 35W en 250W L-band LDMOS radarversterker. Elke versterker bevat ook „n geintegreerde hoë-spoed kragbron om optimum RF pulsherhaalbaarheid te verseker en die radar se „MTI (Moving Target Indication)‟ te verbeter. „n RF-pulsmetingstelsel is ook ontwikkel om die dinamiese I-V kurwes van „n hoë-krag FET te meet. Verder is daar ook gewerk aan „n toetsopstelling vir lae-impedansie S-parameters om hoë-krag FETs te karakteriseer. Hierdie toetsopstelling is gebruik om ontwerpsdata te genereer wat gebruik is in die ontwerp van die L-band kragversterkers.

Intercepter une cible en mouvement est un défi spatiotemporel relevé par de nombreuses espèces animales. Ici, nous nous sommes intéressés à la capture fovéale lors de l’orientation saccadique du regard vers une cible visuelle mobile chez le singe vigile. La théorie actuelle propose que l’interception saccadique fasse intervenir deux voies neuronales. Une première voie acheminerait, via le colliculus supérieur profond (CSp), un signal de position échantillonnée au générateur saccadique. La seconde, via le cervelet, fournirait une commande supplémentaire sur la base des signaux de mouvement visuel. Une étude comportementale a été réalisée afin d’analyser la dynamique de l’influence de ces signaux sur la trajectoire saccadique et a permis de mettre en évidence une influence continue. Dans une seconde étude, nous avons testé la robustesse du système oculomoteur à une perturbation spatiotemporelle inattendue (par microstimulation électrique du CSp) et montré la présence de saccades de correction précises. L’ensemble de nos résultats plaide pour une représentation continue du but des saccades d’interception. / Intercepting a visual moving target is a spatiotemporal challenge for the brain achieved by various species. Here, we investigated the foveal capture of a moving target by saccadic gaze shifts in the awake monkey. The current theory proposes that the saccadic interception involves two neural pathways. A first pathway would convey to the saccade burst generator a sampled target position signal through the superior colliculus (SC). The second one, through the cerebellum, would convey an additional command on the basis of motion-related signals. A behavioral experiment was performed to analyze the influence of motion-related signals on the saccade dynamics and allowed showing a continuous influence. In a second study, we tested the robustness of the oculomotor system to an unexpected spatiotemporal perturbation (by electrical microstimulation in the deep SC) and showed the presence of accurate correction saccades. Our results argue for a continuous representation of the saccade goal.

Thesis--School of Advanced Airpower Studies, Maxwell Air Force Base, Ala., 1997-98. / Title from title screen (viewed Oct. 10, 2003). "October 1999." Includes bibliographical references.

Synthetic aperture radar (SAR) is an imaging technique based on the radio reflectivity of the target being imaged. SAR instruments offer many advantages over optical imaging due to the ability to form coherent images in inclement weather, at night, and through ground cover. High resolution is achieved in azimuth through a synthesized aperture much larger than the physical antenna of the imaging device. Consequently, proper focusing requires accurate information about the relative motion between the antenna phase center and the scene. Any unknown target velocity, acceleration, rotation, or vibration will introduce errors in the image. This work addresses a novel method of focusing a moving target in a SAR image through the estimation of various motion parameters. The target azimuth position is determined through monopulse radar, at which point range velocity and acceleration are estimated across a series of overlapping sub-apertures. Cross-range velocity is then estimated through a search to optimize an image quality metric such as entropy or contrast. A final focused image is then generated based on this velocity vector. Methods of extending this work for a single phase center system are considered. This technique is demonstrated with real radar data from an experimental system, and the performance of this technique is compared both subjectively and with a variety of image metrics to the MITRE keystone technique. Finally, extensions to this current line of research are considered. / text

Synthetic aperture radar (SAR) was first invented in the early 1950s as the remote surveillance instruments to produce high resolution 2D images of the illuminated scene with weather-independent, day-or-night performance. Compared to the Real Aperture Radar (RAR), SAR is synthesising a large virtual aperture by moving a small antenna along the platform path. Typical SAR imaging systems are designed with the basic assumption of a static scene, and moving targets are widely known to induce displacements and defocusing in the formed images. While the capabilities of detection, states estimation and imaging for moving targets with SAR are highly desired in both civilian and military applications, the Ground Moving Target Indication (GMTI) techniques can be integrated into SAR systems to realise these challenging missions. The state-of-the- art SAR-based GMTI is often associated with multi-channel systems to improve the detection capabilities compared to the single-channel ones. Motivated by the fact that the SAR imaging is essentially solving an optimisation problem, we investigate the practicality to reformulate the GMTI process into the optimisation form. Furthermore, the moving target sparsities and underlying similarities between the conventional GMTI processing and sparse reconstruction algorithms drive us to consider the compressed sensing theory in SAR/GMTI applications. This thesis aims to establish an end-to-end SAR/GMTI processing framework regularised by target sparsities based on multi-channel SAR models. We have explained the mathematical model of the SAR system and its key properties in details. The common GMTI mechanism and basics of the compressed sensing theory are also introduced in this thesis. The practical implementation of the proposed framework is provided in this work. The developed model is capable of realising various SAR/GMTI tasks including SAR image formation, moving target detection, target state estimation and moving target imaging. We also consider two essential components, i.e. the data pre-processing and elevation map, in this work. The effectiveness of the proposed framework is demonstrated through both simulations and real data. Given that our focus in this thesis is on the development of a complete sparsity-aided SAR/GMTI framework, the contributions of this thesis can be summarised as follows. First, the effects of SAR channel balancing techniques and elevation information in SAR/GMTI applications are analysed in details. We have adapted these essential components to the developed framework for data pre-processing, system specification estimation and better SAR/GMTI accuracies. Although the purpose is on enhancing the proposed sparsity-based SAR/GMTI framework, the exploitation of the DEM in other SAR/GMTI algorithms may be of independent interest. Secondly, we have designed a novel sparsity-aided framework which integrates the SAR/GMTI missions, i.e. SAR imaging, moving target and background decomposition, and target state estimation, into optimisation problems. A practical implementation of the proposed framework with a two stage process and theoretically/experimentally proven algorithms are proposed in this work. The key novelty on utilising optimisations and target sparsities is explained in details. Finally, a practical algorithm for moving target imaging and state estimation is developed to accurately estimate the full target parameters and form target images with relocation and refocusing capabilities. Compared to the previous processing steps for practical applications, the designed algorithm consistently relies on the exploitation of target sparsities which forms the final processing stage of the whole pipeline. All the developed components contribute coherently to establish a complete sparsity driven SAR/GMTI processing framework.

Doctor of Philosophy / Computing and Information Sciences / Scott A. DeLoach / The static nature of cyber systems gives attackers a valuable and asymmetric advantage - time. To eliminate this asymmetric advantage, a new approach, called Moving Target Defense (MTD) has emerged as a potential solution. MTD system seeks to proactively change system configurations to invalidate the knowledge learned by the attacker and force them to spend more effort locating and re-locating vulnerabilities. While it sounds promising, the approach is so new that there is no standard definition of what an MTD is, what is meant by diversification and randomization, or what metrics to define the effectiveness of such systems. Moreover, the changing nature of MTD violates two basic assumptions about the conventional attack surface notion. One is that the attack surface remains unchanged during an attack and the second is that it is always reachable. Therefore, a new attack surface definition is needed. To address these issues, I propose that a theoretical framework for MTD be defined. The framework should clarify the most basic questions such as what an MTD system is and its properties such as adaptation, diversification and randomization. The framework should reveal what is meant by gaining and losing knowledge, and what are different attack types. To reason over the interactions between attacker and MTD system, the framework should define key concepts such as attack surface, adaptation surface and engagement surface. Based on that, this framework should allow MTD system designers to decide how to use existing configuration choices and functionality diversification to increase security. It should allow them to analyze the effectiveness of adapting various combinations of different configuration aspects to thwart different types of attacks. To support analysis, the frame- work should include an analytical model that can be used by designers to determine how different parameter settings will impact system security.

abstract: Today the information technology systems have addresses, software stacks and other configuration remaining unchanged for a long period of time. This paves way for malicious attacks in the system from unknown vulnerabilities. The attacker can take advantage of this situation and plan their attacks with sufficient time. To protect our system from this threat, Moving Target Defense is required where the attack surface is dynamically changed, making it difficult to strike. In this thesis, I incorporate live migration of Docker container using CRIU (checkpoint restore) for moving target defense. There are 460K Dockerized applications, a 3100% growth over 2 years[1]. Over 4 billion containers have been pulled so far from Docker hub. Docker is supported by a large and fast growing community of contributors and users. As an example, there are 125K Docker Meetup members worldwide. As we see industry adapting to Docker rapidly, a moving target defense solution involving containers is beneficial for being robust and fast. A proof of concept implementation is included for studying performance attributes of Docker migration. The detection of attack is using a scenario involving definitions of normal events on servers. By defining system activities, and extracting syslog in centralized server, attack can be detected via extracting abnormal activates and this detection can be a trigger for the Docker migration. / Dissertation/Thesis / Masters Thesis Computer Science 2017