Today cybersecurity is becoming a major concern for all of society. Companies can lose billions of dollars because of cyberattacks. States need to keep the vital infrastructure of the country running and must prepare for cyberwar against cyberterrorism and other states. And finally, everyone can also suffer a cyberattack, like credit card stealing, ransomware asking for money, etc. In this tensed context, botnets and Remote Access Trojan are emerging as one of the major threats against cybersecurity.  In this master thesis we will focus on Command & Control (C&C) architectures, which can be used as a first step on a network, to compromise it entirely afterwards. To do so, the malware used to put in place the C&C architecture must first bypass all antivirus protections, and then establish a connection with a C&C server. This master thesis will be about the automation of the deployment of such architecture, which should be stealth enough to bypass the common protections.  This master thesis took part at Wavestone company, which performs cybersecurity audits. After a brief presentation of Wavestone, we will first explain why a C&C architecture is very useful for auditors (and consequently for cybercriminals as well), and what steps will be taken to achieve this project. Then, we will focus on the history and the functioning of botnets: botnets are indeed the most common use of C&C architecture. Afterwards, we will focus on the detection of a C&C architecture, to understand what challenges the implementation will have to meet. Finally, we will present an implementation that was made during the thesis of an end-to-end C&C scenario, based on an open software called SilentTrinity, and corresponding to the needs of the auditors. / I dag är cybersäkerhet en viktig fråga för hela samhället. Företag kan förlora miljarder dollar på grund av cyberattacker. Stater måste hålla landets vitala infrastruktur igång och måste förbereda sig för cyberkrig mot cyberterrorism och andra stater. Och slutligen kan alla också drabbas av en cyberattack, som t.ex. kreditkortsstöld, utpressningstrojaner som ber om pengar osv. I detta spända sammanhang framstår botnät och Remote Access Trojan som ett av de största hoten mot cybersäkerheten.  I denna masteruppsats kommer vi att fokusera på Command & Control-arkitekturer, som kan användas som ett första steg i ett nätverk för att sedan kompromettera det helt och hållet. För att göra detta måste den skadliga kod som används för att sätta C&C-arkitekturen på plats först kringgå alla antivirusskydd och sedan upprätta en anslutning till en C&C-server. Denna masteruppsats kommer att handla om automatiseringen av införandet av en sådan arkitektur, som ska vara tillräckligt smygande för att kringgå de vanligaste skydden.  Denna masteruppsats deltog vid företaget Wavestone, som utför cybersäkerhetsrevisioner. Efter en kort presentation av Wavestone kommer vi först att förklara varför en C&C-arkitektur är mycket användbar för revisorer (och följaktligen även för cyberkriminella), och vilka steg som kommer att tas för att genomföra detta projekt. Därefter kommer vi att fokusera på botnets historia och funktion: botnets är faktiskt den vanligaste användningen av C&C-arkitektur. Därefter kommer vi att fokusera på upptäckten av en C&C-arkitektur för att förstå vilka utmaningar som genomförandet måste möta. Slutligen kommer vi att presentera ett genomförande som gjordes under avhandlingen av ett C&C-scenario från början till slut, baserat på en öppen programvara som heter SilentTrinity, och som motsvarar revisorernas behov.

In today's technology based society the rapid proliferation of new machines and systems that would have been undreamed of only a few short years ago has become a way of life. Developments and advances especially in the areas of digital electronics and micro-circuitry have spawned subsequent technology based improvements in transportation, communications, entertainment, automation, the armed forces, and many other areas that would not have been possible otherwise. This rapid "explosion" of new capabilities and ways of performing tasks has been motivated as often as not by the philosophy that if it is possible to make something better or work faster or be more cost effective or operate over greater distances then it must inherently be good for the human operator. Taken further, these improvements typically are envisioned to consequently produce a more efficient operating system where the human operator is an integral component. The formal concept of human-system interface design has only emerged this century as a recognized academic discipline, however, the practice of developing ideas and concepts for systems containing human operators has been in existence since humans started experiencing cognitive thought. An example of a human system interface technology for communication and dissemination of written information that has evolved over centuries of trial and error development, is the book. It is no accident that the form and shape of the book of today is as it is. This is because it is a shape and form readily usable by human physiology whose optimal configuration was determined by centuries of effort and revision. This slow evolution was mirrored by a rate of technical evolution in printing and elsewhere that allowed new advances to be experimented with as part of the overall use requirement and need for the existence of the printed word and some way to contain it. Today, however, technology is advancing at such a rapid rate that evolutionary use requirements have no chance to develop along side the fast pace of technical progress. One result of this recognition is the establishment of disciplines like human factors engineering that have stated purposes and goals of systematic determination of good and bad human system interface designs. However, other results of this phenomenon are systems that get developed and placed into public use simply because new technology allowed them to be made. This development can proceed without a full appreciation of how the system might be used and, perhaps even more significantly, what impact the use of this new system might have on the operator within it. The U.S. Army has a term for this type of activity. It is called "stove-piped development". The implication of this term is that a system gets developed in isolation where the developers are only looking "up" and not "around". They are thus concerned only with how this system may work or be used for its own singular purposes as opposed to how it might be used in the larger community of existing systems and interfaces or, even more importantly, in the larger community of other new systems in concurrent development. Some of the impacts for the Army from this mode of system development are communication systems that work exactly as designed but are unable to interface to other communications systems in other domains for battlefield wide communications capabilities. Having communications systems that cannot communicate with each other is a distinct problem in its own right. However, when developments in one industry produce products that humans use or attempt to use with products from totally separate developments or industries, the Army concept of product development resulting from stove-piped design visions can have significant implication on the operation of each system and the human operator attempting to use it. There are many examples that would illustrate the above concept, however, one that will be explored here is the Army effort to study, understand, and optimize its command and control (C2) operations. This effort is at the heart of a change in the operational paradigm in C2 Tactical Operations Centers (TOCs) that the Army is now undergoing. For the 50 years since World War II the nature, organization, and mode of the operation of command organizations within the Army has remained virtually unchanged. Staffs have been organized on a basic four section structure and TOCs generally only operate in a totally static mode with the amount of time required to move them to keep up with a mobile battlefield going up almost exponentially from lower to higher command levels. However, current initiatives are changing all that and while new vehicles and hardware systems address individual components of the command structures to improve their operations, these initiatives do not necessarily provide the environment in which the human operator component of the overall system can function in a more effective manner. This dissertation examines C2 from a system level viewpoint using a new paradigm for systematically examining the way TOCs operate and then translating those observations into validated computer simulations using a methodological framework. This paradigm is called COmputer Modeling Paradigm And Simulation of Systems (COMPASS). COMPASS provides the ability to model TOC operations in a way that not only includes the individuals, work groups and teams in it, but also all of the other hardware and software systems and subsystems and human-system interfaces that comprise it as well as the facilities and environmental conditions that surround it. Most of the current literature and research in this area focuses on the concept of C2 itself and its follow-on activities of command, control, communications (C3), command, control, communications, and computers (C4), and command, control, communications, computers and intelligence (C4I). This focus tends to address the activities involved with the human processes within the overall system such as individual and team performance and the commander's decision-making process. While the literature acknowledges the existence of the command and control system (C2S), little effort has been expended to quantify and analyze C2Ss from a systemic viewpoint. A C2S is defined as the facilities, equipment, communications, procedures, and personnel necessary to support the commander (i.e., the primary decision maker within the system) for conducting the activities of planning, directing, and controlling the battlefield within the sector of operations applicable to the system. The research in this dissertation is in two phases. The overall project incorporates sequential experimentation procedures that build on successive TOC observation events to generate an evolving data store that supports the two phases of the project. Phase I consists of the observation of heavy maneuver battalion and brigade TOCs during peacetime exercises. The term "heavy maneuver" is used to connotate main battle forces such as armored and mechanized infantry units supported by artillery, air defense, close air, engineer, and other so called combat support elements. This type of unit comprises the main battle forces on the battlefield. It is used to refer to what is called the conventional force structure. These observations are conducted using naturalistic observation techniques of the visible functioning of activities within the TOC and are augmented by automatic data collection of such things as analog and digital message traffic, combat reports generated by the computer simulations supporting the wargame exercise, and video and audio recordings where appropriate and available. Visible activities within the TOC include primarily the human operator functions such as message handling activities, decision-making processes and timing, coordination activities, and span of control over the battlefield. They also include environmental conditions, functional status of computer and communications systems, and levels of message traffic flows. These observations are further augmented by observer estimations of such indicators as perceived level of stress, excitement, and level of attention to the mission of the TOC personnel. In other words, every visible and available component of the C2S within the TOC is recorded for analysis. No a priori attempt is made to evaluate the potential significance of each of the activities as their contribution may be so subtle as to only be ascertainable through statistical analysis. Each of these performance activities becomes an independent variable (IV) within the data that is compared against dependent variables (DV) identified according to the mission functions of the TOC. The DVs for the C2S are performance measures that are critical combat tasks performed by the system. Examples of critical combat tasks are "attacking to seize an objective", "seizure of key terrain", and "river crossings'. A list of expected critical combat tasks has been prepared from the literature and subject matter expert (SME) input. After the exercise is over, the success of these critical tasks attempted by the C2S during the wargame are established through evaluator assessments, if available, and/or TOC staff self analysis and reporting as presented during after action reviews. The second part of Phase I includes datamining procedures, including neural networks, used in a constrained format to analyze the data. The term constrained means that the identification of the outputs/DV is known. The process was to identify those IV that significantly contribute to the constrained DV. A neural network is then constructed where each IV forms an input node and each DV forms an output node. One layer of hidden nodes is used to complete the network. The number of hidden nodes and layers is determined through iterative analysis of the network. The completed network is then trained to replicate the output conditions through iterative epoch executions. The network is then pruned to remove input nodes that do not contribute significantly to the output condition. Once the neural network tree is pruned through iterative executions of the neural network, the resulting branches are used to develop algorithmic descriptors of the system in the form of regression like expressions. For Phase II these algorithmic expressions are incorporated into the CoHOST discrete event computer simulation model of the C2S. The programming environment is the commercial programming language Micro Saintä running on a PC microcomputer. An interrogation approach was developed to query these algorithms within the computer simulation to determine if they allow the simulation to reflect the activities observed in the real TOC to within an acceptable degree of accuracy. The purpose of this dissertation is to introduce the COMPASS concept that is a paradigm for developing techniques and procedures to translate as much of the performance of the entire TOC system as possible to an existing computer simulation that would be suitable for analyses of future system configurations. The approach consists of the following steps: • Naturalistic observation of the real system using ethnographic techniques. • Data analysis using datamining techniques such as neural networks. • Development of mathematical models of TOC performance activities. • Integration of the mathematical into the CoHOST computer simulation. • Interrogation of the computer simulation. • Assessment of the level of accuracy of the computer simulation. • Validation of the process as a viable system simulation approach. / Ph. D.

Climate change is currently one of the most pressing environmental concerns globally and in South Africa. South Africa is especially vulnerable to the effects of climate change because of the country’s socio-economic context, water scarcity, unique geography and climate sensitive biodiversity. South Africa’s road transport and energy sectors are among others major contributors to climate change. The traditional command and control measures designed to mitigate climate change in South Africa’s road transport and energy sectors do not suffice on their own, there is a need for tax-based fiscal measures to assist in mitigating climate change in these sectors. Tax-based fiscal measures offer certain unique climate change mitigation capabilities, therefore numerous tax-based fiscal measures are already in place in South Africa’s road transport and energy sectors. The development of new taxbased fiscal measures should be encouraged and existing tax-based fiscal measures can and should be refined and extended to enhance their climate change mitigation efficacy. / LLM (Environmental Law and Governance), North-West University, Potchefstroom Campus, 2011

Climate change is currently one of the most pressing environmental concerns globally and in South Africa. South Africa is especially vulnerable to the effects of climate change because of the country’s socio-economic context, water scarcity, unique geography and climate sensitive biodiversity. South Africa’s road transport and energy sectors are among others major contributors to climate change. The traditional command and control measures designed to mitigate climate change in South Africa’s road transport and energy sectors do not suffice on their own, there is a need for tax-based fiscal measures to assist in mitigating climate change in these sectors. Tax-based fiscal measures offer certain unique climate change mitigation capabilities, therefore numerous tax-based fiscal measures are already in place in South Africa’s road transport and energy sectors. The development of new taxbased fiscal measures should be encouraged and existing tax-based fiscal measures can and should be refined and extended to enhance their climate change mitigation efficacy. / LLM (Environmental Law and Governance), North-West University, Potchefstroom Campus, 2011

International Telemetering Conference Proceedings / October 25-28, 1993 / Riviera Hotel and Convention Center, Las Vegas, Nevada / The performance and cost effectiveness of em bedded processing has greatly enhanced the personal computer's (PC) capability, particularly when used for real-time satellite data acquisition, telemetry processing, command and control operations. Utilizing a transputer based parallel architecture, a modular, reusable, and scalable control system is attainable. The synergism between the personal computer and embedded processing results in efficient, low cost desktop workstations up to 1000 MIPS of performance.

International Telemetering Conference Proceedings / November 04-07, 1991 / Riviera Hotel and Convention Center, Las Vegas, Nevada / The Gulf Range Drone Control Upgrade System (GRDCUS) Mobile Control System (GMCS) is an integral part of the test ranges located on the Gulf of Mexico. This paper begins with a brief overview of the current Gulf Range systems. These systems consist of five major components: ground stations, ground computer systems, data link/transponders, consoles, and software. The GMCS van contains many of these components to provide a stand-alone range capability for remote operations. This paper describes the development and assembly of the GMCS van and focuses on the on-board computer systems, consoles, and data link technology. An overall system engineering approach was used during GMCS development and is highlighted through the use of rapid prototyping. This methodology and the lessons learned are presented in the paper. Suggestions for future applications are considered.

International Telemetering Conference Proceedings / October 25-28, 1999 / Riviera Hotel and Convention Center, Las Vegas, Nevada / In recent years the telemetry community has encountered a growing demand for bandwidth from users and a corresponding loss of spectrum. The Advanced Range Telemetry (ARTM) Program has responded to this situation with an initiative to develop, demonstrate, and improve the management and control of telemetry resources using demand assigned multiple access (DAMA) techniques. This initiative has proceeded along two paths. The first path is in the development of an expert system to facilitate the scheduling of telemetry missions and the deconfliction of their frequencies. This system emphasizes the graphical manipulation of mission data and uses a genetic algorithm to search for an optimal set of mission frequencies. The second path is the development of a bidirectional command and control link to remotely control and configure the frequency of a telemetry link. This link uses the simple network management protocol (SNMP) over a wireless Internet Protocol (IP) network implemented with Digital Communications Network System (DCNS) units.

Being able to interact with video streams can be both fun, educational and provide help during disaster situations. However, to achieve the best user experience the interaction must be seamless. This thesis presents the design and implementation of an interface for a media player that allows for users to view multiple video streams of the same event from different geographical positions and angles. The thesis first describes the system design and methods used to implement this kind of media player and explains how to achieve a seemingly good and, to a higher extent, enjoyable video streaming experience. Second, an algorithm is developed for placing each video stream object on the interface's geographic-based map automatically. These objects are placed to ensure the relative positions of the objects compared to the real world. The end result of this project is a proof-of-concept media player which enables a user to see an overview over a geographical streaming area. Presented with the relative location of each stream to the point of interest the player allows the user to click on that stream and switch to viewing the recordings from that point of view. While the resulting player is not yet seamless, the result of this project shows the command-and-control center as initially envisioned. Implementing seamless, uninterrupted, switching between the video streams is outside the scope of this thesis. However, as demonstrated and argued in the thesis, the work done here and the developed software code will allow for easy integration of more advanced prefetching algorithms in future and parallel works.

Approved for public release, distribution unlimited / This research will be used to evaluate the feasibility of robotically, or remotecontrolled firefighting nozzles aboard air-capable ships. A numerical model was constructed and analyzed, using the program CFD-ACE, of a fire hose stream being deflected by the influence of a crosswind, tailwind, or headwind. The model is intended to predict the reach of the fire hose stream, indicate the distribution pattern, and estimate the volume of fire fighting agent available at the end of the stream. Preliminary results for a two fluid cross flow model have been obtained. / US Navy (USN) author.

Approved for public release; distribution is unlimited. / The United States is embarking on a course of designing and fielding a Ballistic Missile Defense System (BMDS) to protect the US and her citizenry against ballistic missile attacks. The BMDS will need a Command and Control, Battle Management, and Communications (C2BMC) organization/system to support military and national decision makers in times of crisis. The C2BMC must also be able to react quickly once a missile event has occurred. This thesis will cover the doctrinal issues with merging Theater Missile Defense (TMD) and the National Missile Warning System into one system, how the Unified Command Plan affects missile defense efforts, the lessons learned from Desert Storm, and presents alternative chains of command that might allow the BMDS to engage threat missiles in a timely and efficient manner. Preliminary findings indicate that a 'flattened' chain of command for missile defense forces seems to be a positive starting point for the initial deployment of the BMDS. / Lieutenant Commander, United States Navy