abstract: Most existing security decisions for both defending and attacking are made based on some deterministic approaches that only give binary answers. Even though these approaches can achieve low false positive rate for decision making, they have high false negative rates due to the lack of accommodations to new attack methods and defense techniques. In this dissertation, I study how to discover and use patterns with uncertainty and randomness to counter security challenges. By extracting and modeling patterns in security events, I am able to handle previously unknown security events with quantified confidence, rather than simply making binary decisions. In particular, I cope with the following four real-world security challenges by modeling and analyzing with pattern-based approaches: 1) How to detect and attribute previously unknown shellcode? I propose instruction sequence abstraction that extracts coarse-grained patterns from an instruction sequence and use Markov chain-based model and support vector machines to detect and attribute shellcode; 2) How to safely mitigate routing attacks in mobile ad hoc networks? I identify routing table change patterns caused by attacks, propose an extended Dempster-Shafer theory to measure the risk of such changes, and use a risk-aware response mechanism to mitigate routing attacks; 3) How to model, understand, and guess human-chosen picture passwords? I analyze collected human-chosen picture passwords, propose selection function that models patterns in password selection, and design two algorithms to optimize password guessing paths; and 4) How to identify influential figures and events in underground social networks? I analyze collected underground social network data, identify user interaction patterns, and propose a suite of measures for systematically discovering and mining adversarial evidence. By solving these four problems, I demonstrate that discovering and using patterns could help deal with challenges in computer security, network security, human-computer interaction security, and social network security. / Dissertation/Thesis / Doctoral Dissertation Computer Science 2014

Computer applications can be described as largely rigid structures within which an information seeker must navigate in search of information - each screen, each transaction having underlying unique code. The larger the application, the higher the number of lines of code and the larger the size of the application executable. This study suggests an alternative pattern based approach, an approach driven by the information seeker. This alternative approach makes use of value embedded in intelligent patterns to assemble rules and logic constituents, numerous patterns aggregating to form a "virtual screen" based on the need of the information seeker. Once the information need is satisfied, the atomic rules and logic constituents dissipate and return to a base state. These same constituents are available, are reassembled and form the succeeding "virtual screen" to satisfy the following request. Metaphors are used to introduce current information solutions, where events are initiated and driven by physical constructs built using monolithic instruction sets. The metaphor approach is then expanded, illustrating how metaphors can be used to communicate an understanding between two likeminded intellects - this illustrates how spatial artifacts are used to carry intellectual value across the intellectual divide, from the one (intellectual source) to the other (intellectual target). At this point, the pattern based concept is introduced. This is where value, an intellectual appreciation hidden within spatiality, can be exploited towards the delivery of information. The pattern based approach makes use of multiple pattern "instances" to deliver functionality - each pattern instance has a specific embedded value. Numbers of these patterns aggregate to drive the formation of a "virtual screen" built using patterns, each pattern referencing and associating (physical) atomic logic and spatial constituents. This is analogous to painting a picture using removable dots. The dots can be used to describe a fish, and then, once appreciation has been completed, the image is destroyed and the dots are returned to the palette. These same dots can later be reapplied to present the picture of a dog, if that is requested by the information seeker. In both pictures the same "dots" are applied and reused. The form of the fish and dog are retained as value embedded within the patterns, the dots are building blocks aligned using instructions within the patterns. This study classifies existing application solutions as belonging to the Artifact-Pattern-Artifact (APA) group, and the pattern based approach belonging to the Pattern-Artifact-Pattern (PAP) group. An overview and the characteristics of each are presented. The document concludes by presenting the results obtained when using a prototype developed using the PAP approach. / Thesis (M.Sc. (Information Technology))--North-West University, Vaal Triangle Campus, 2008.

Computer applications can be described as largely rigid structures within which an information seeker must navigate in search of information - each screen, each transaction having underlying unique code. The larger the application, the higher the number of lines of code and the larger the size of the application executable. This study suggests an alternative pattern based approach, an approach driven by the information seeker. This alternative approach makes use of value embedded in intelligent patterns to assemble rules and logic constituents, numerous patterns aggregating to form a "virtual screen" based on the need of the information seeker. Once the information need is satisfied, the atomic rules and logic constituents dissipate and return to a base state. These same constituents are available, are reassembled and form the succeeding "virtual screen" to satisfy the following request. Metaphors are used to introduce current information solutions, where events are initiated and driven by physical constructs built using monolithic instruction sets. The metaphor approach is then expanded, illustrating how metaphors can be used to communicate an understanding between two likeminded intellects - this illustrates how spatial artifacts are used to carry intellectual value across the intellectual divide, from the one (intellectual source) to the other (intellectual target). At this point, the pattern based concept is introduced. This is where value, an intellectual appreciation hidden within spatiality, can be exploited towards the delivery of information. The pattern based approach makes use of multiple pattern "instances" to deliver functionality - each pattern instance has a specific embedded value. Numbers of these patterns aggregate to drive the formation of a "virtual screen" built using patterns, each pattern referencing and associating (physical) atomic logic and spatial constituents. This is analogous to painting a picture using removable dots. The dots can be used to describe a fish, and then, once appreciation has been completed, the image is destroyed and the dots are returned to the palette. These same dots can later be reapplied to present the picture of a dog, if that is requested by the information seeker. In both pictures the same "dots" are applied and reused. The form of the fish and dog are retained as value embedded within the patterns, the dots are building blocks aligned using instructions within the patterns. This study classifies existing application solutions as belonging to the Artifact-Pattern-Artifact (APA) group, and the pattern based approach belonging to the Pattern-Artifact-Pattern (PAP) group. An overview and the characteristics of each are presented. The document concludes by presenting the results obtained when using a prototype developed using the PAP approach. / Thesis (M.Sc. (Information Technology))--North-West University, Vaal Triangle Campus, 2008.