This Master's thesis deals with the design and development of tools for generating a synthetic dataset for traffic analysis purposes. The first part contains a brief introduction to the vehicle detection and rendering methods. Blender and the set of scripts are used to create highly customizable training images dataset and synthetic videos from a single photograph. Great care is taken to create very realistic output, that is suitable for further processing in field of traffic analysis. Produced images and videos are automatically richly annotated. Achieved results are tested by training a sample car detector and evaluated with real life testing data. Synthetic dataset outperforms real training datasets in this comparison of the detection rate. Computational demands of the tools are evaluated as well. The final part sums up the contribution of this thesis and outlines some extensions of the tools for the future.

V rámci této práce byl navržen a implementován systém pro analýzu dopravy z videa. Tento system umožňuje detekovat, sledovat a klasifikovat automobily. Systém je schopný detekovat pruhy z pohybu projíždějících automobilů a také je možné určit, zdali daný automobil jede v protisměru. Rychlost projíždějících automobilů je také měřena. Pro funkčnost systému není vyžadován žadný manuální vstup nebo kalibrace kamery, jelikož kamera je plně automacky zkalibrována pomocí úběžníků. Navržený systém pracuje s velkou přesností detekce, sledování a klasifikace automobilů a také rychlost automobilů je měřena s~malou chybou. Systém je schopný pracovat v reálném čase a je aktuálně využíván pro nepřetržité online sledování dopravy. Největším přínosem této práce je plně automatické měření rychlostí projíždějích vozidel.

This master thesis deals with the design and implementation of a tool for malware detection using DNS traffic analysis. Text of the thesis is divided into theoretical and practical part. In theoretical part the reader will be acknowledged with the domain of malware and botnet detection. Consequently, various options and methods of malware detection will be described. Practical part of the thesis contains description of malware detection tool architecture as well as key aspects of its implementation. Moreover, the emphasis is being placed on testing and experiments. The result of the thesis is a tool, written in python, for malware detection using DNS traffic analysis, that uses a combination of several methods of detection.

The aim of this thesis is to create a cloud application for traffic analysis without knowing anything about the system. The only input is address of the web camera pointing at traffic. This application is build on existing solution which is further enhanced. New modules for removing obstacles (such as lamppost covering part of the road) and splitting overlapping cars were added. The whole cloud solution consists of multiple components which communicates by HTTP messages and are controlled by web interface.

An important part of maintaining network security is collecting and processing information about cyber threats, both from network operator's own detection tools and from third parties. A commonly used type of such information are lists of network entities (IP addresses, domains, URLs, etc.) which were identified as malicious. However, in many cases, the simple binary distinction between malicious and non-malicious entities is not sufficient. It is beneficial to keep other supplementary information for each entity, which describes its malicious activities, and also a summarizing score, which evaluates its reputation numerically. Such a score allows for quick comprehension of the level of threat the entity poses and allows to compare and sort entities. The goal of this work is to design a method for such summarization. The resulting score, called Future Maliciousness Probability (FMP score), is a value between 0 and 1, assigned to each suspicious network entity, expressing the probability that the entity will do some kind of malicious activity in a near future. Therefore, the scoring is based of prediction of future attacks. Advanced machine learning methods are used to perform the prediction. Their input is formed by previously received alerts about security events and other relevant data related to the entity. The method of computing the score is first described in a general way, usable for any kind of entity and input data. Then a more concrete version is presented for scoring IPv4 address by utilizing alerts from an alert sharing system and supplementary data from a reputation database. This variant is then evaluated on a real world dataset. In order to get enough amount and quality of data for this dataset, a part of the work is also dedicated to the area of security analysis of network data. A framework for analysis of flow data, NEMEA, and several new detection methods are designed and implemented. An open reputation database, NERD, is also implemented and described in this work. Data from these systems are then used to evaluate precision of the predictor as well as to evaluate selected use cases of the scoring method.

This paper aims to develop and validate an efficient method for delineation of public transit analysis zones (PTTAZ), particularly for origin-destination (OD) matrix prediction for transit operation planning. Existing methods have a problem in reflecting the level of spatial precision, travel characteristics, travel demand growth, access to transit stations, and most importantly, the direction of transit routes. This study proposes a new methodology to redelineate existing traffic analysis zones (TAZ) to create PTTAZ in order to allocate travel demand to transit stops. We aim to achieve an accurate prediction of the OD matrix for public transportation (PT). The matrix should reflect the passenger accessibility in the socioeconomic and socio-spatial characterization of PTTAZ and minimize intrazonal trips. The proposed methodology transforms TAZ-based to PTTAZ-based data with sequential steps through multiple statistical methods. In short, the generation of PTTAZ establishes homogeneous sub-zones representing the relationship between passenger flow, network structure, land use, population, socio-economic characteristics, and, most importantly, existing bus transit infrastructure. To validate the proposed scheme, we implement the framework for India’s Vishakhapatnam bus network and compare the results with the household survey. The results show that the PTTAZ-based OD matrix represents a realistic scenario for PT demand.

The increase in truck traffic on highways has brought many problems and challenges to transportation planning and traffic operation, including traffic congestion, transportation system deficiency (insufficient truck parking, etc.), safety, infrastructure deterioration, environmental impacts (air quality and noise), economic development, and so forth. Along with the increase in truck traffic, the need for developing a statewide truck freight demand model has grown so that a state can estimate truck traffic at any point on its highways. The most significant hurdle to including freight transportation in the transportation modeling process is that most of the demand forecasting methodologies currently available were developed for passenger trips, not freight trips. This type of modeling methodology usually makes an assumption that freight trips follow the same behavioral mechanism as passenger trips. In order to overcome the weakness of using a typical four-step demand forecasting modeling process, the concept of commodity flow models (CFMs) can be used to develop a truck freight flow model. It is widely accepted that focusing on the freights enables CFMs to capture more accurately the fundamental economic mechanisms that drive freight movements. The type of commodity being carried is one of the most important characteristics of truck movements, and it is sometimes a challenge to obtain such information from the carriers. Thus, lately, the integration of the freight flow modeling and land use modeling has emerged as an alternate tool to estimate freight movements than the previously developed models. In this study, county-level multiple regression models relating land use to commodity flow were developed using a geographical information system and statistics. Then, a statistical/mathematical statewide commodity flow distribution model was developed by using a physical friction factor (physical distance), a statistical friction factor (Euclidean distance), and economic factors (differences of population and difference of employment among the counties). The commodity flow distributed among truck traffic analysis zones (TTAZs) by the statewide commodity flow distribution model were converted to truck trips and the resulting truck trips were assigned to Utah's truck routes using the all-or-nothing assignment procedure of TransCAD and a genetic algorithm. Truck freight data from the US Census Bureau's Commodity Flow Surveys, which have become available to the public for free via the Internet, enabled the development of a commodity flow based statewide truck freight demand model. It was found that the integration of the freight flow and land use data could be a practical method for modeling tuck traffic demand on state-wide truck routes although the current level of data availability on commodity flow and land use data still constrains the full capability of this type of modeling.

The increase in cybercrime and cyber-warfare has spurred the cat-and-mouse game of finding and attacking vulnerable devices on government or private company networks. The devices attacked are often forgotten computers that run operating systems with known exploits. Finding these devices are crucial for both an attacker and defender since they may be the only weak link on the network. Device discovery on a network using probing or active fingerprinting methods results in extra traffic on the network, which may strain fragile networks and generates suspect traffic that may get flagged as intrusive. Using passive OS fingerprinting allows an actor to listen in and classify active devices on a network. This thesis shows the features that can be exploited for OS fingerprinting and discusses the importance of TLS payload and time-based features. We also present a data collection strategy that could be utilized for simulating multiple OSs and collecting new datasets. We found that the TLS attributes such as cipher suites play an important role in distinguishing between OS versions.

No description available.

Approved for public release, distribution is unlimited / The performance of network management tools for SONET/SDH networks subject to the load conditions is studied and discussed in this thesis. Specifically, a SONET network which consists of four CISCO ONS 15454s, managed by a CISCO Transport Manager, is set up in the Advanced Network Laboratory of the Naval Postgraduate School. To simulate a realistic data transfer environment for the analysis, Smartbits Avalanche software is deployed to simulate multiple client-server scenarios in the SONET network. Traffic from the management channel is then captured using a packet sniffer. Queuing analysis on the captured data is performed with particular emphasis on properties of self-similarity. In particular, the Hurst parameter which determines the captured traffic's degree of self-similarity is estimated using the Variance-Index plot technique. Link utilization is also derived from the computation of first-order statistics of the captured traffic distribution. The study shows that less management data was exchanged when the SONET network was fully loaded. In addition, it is recommended that CTM 4.6 be used to manage not more than 1552 NEs for safe operation. The results presented in this thesis will aid network planners to optimize the management of their SONET/SDH networks. / Civilian, Ministry of Defense, Singapore