The current generation of network vulnerability detection software uses databases of known vulnerabilities and scans target networks for these weaknesses. The results can be voluminous and difficult to assess. Thus, the success of this technology has created a need for software to aid in network vulnerability analysis. Although research has shown the effectiveness of automated attack graph generation tools in displaying potential attack paths in a network, research involving the performance of these tools has been limited. Using empirical testing, we have collected quantitative data using CAULDRON, an attack graph generation tool developed at George Mason University, on a collection of simulated networks. By defining our model to include sets of nodes, which allow connectivity from all nodes to all nodes in the set; the number of nodes present in each set, the number of connections between sets; and the number of vulnerabilities per node as our variables, we are able to observe the performance impact on CAULDRON of connectivity and the increased presence of vulnerabilities in our networks. The effect of these variables on processing time and memory usage is presented and can be used as a metric to assess the scalability of this tool within various customer environments.

There are two main purposes to this thesis study. First, we will deploy the principles of software development that we have learned through the Software Engineering track here at NPS and test its validity through the development of a real world system. This system will be a completely self sustaining prototype of a web design containing both the front end and back end requirements. Second, we will conduct a study of Human Computer Interaction (HCI) through the design and usability testing of a new interactive uniform regulations manual. All military services currently possess their own individual uniform regulations specific to each service. This system, although it will be specific to the United States Marine Corps, can be used as a model for any other service as well as any international military desiring a similar solution to the inherent problems associated with current manuals. The new system will address all aspects currently outlined in the regulations. This regulation will be used by all US civilians and military service members to whom the current manual is now relevant. Although we fully intend to deliver a finished product to the Marine Corps for their official use, the true value to us as students is in the process of developing and testing this new system. The knowledge learned here will benefit us in any future system design or development projects.

Software Visualization can play a significant role in our fight against Software's inherent complexity. Despite all efforts made so far, Software Visualization tools have not succeeded to be a part of Software Engineers everyday practice. We believe that a properly defined taxonomy that will provide a framework for discussion, analysis and research guidance by offering a systematic and systemic overview of the area, covering all the concerns and challenges, is a starting point for a new approach for the field. After analyzing existing taxonomies and exploring existing tools, we approach Software Visualization as an interface between humans and software and we propose a multi-layered framework that incorporates all the concerns and the challenges of our field, in a neat, systematic and expandable way that can also serve as a roadmap for a research area and that can promote communication of existing and new ideas.

As software systems increase in size and complexity, so does the need to predict and control scope, schedule, and costs. The United States General Accountability Office has acknowledged weaknesses in the software acquisition process. Industry data indicates that improving the software development process can have significant effect on a project team's ability to generate products within planned scope, schedule, and cost estimates. This thesis focus is on software maintenance, one phase of the Army's acquisition process, to demonstrate that stronger management practices are needed to make better predictions and assessments in those areas. Two software maintenance projects were evaluated for success in project management performance against CMMI practices. This research results in a set of recommendations and predicted benefits are provided for use by the organization as input to the next process improvement effort. / US Army (USA) author.

This thesis addresses software evolution from the perspective of standards interoperability. We address the issue of how to apply contemporary software safety assurance standards to legacy safety-critical systems, with the aim of recertifying the legacy systems to the contemporary standards. The application of RTCA DO-178B Software Considerations in Airborne Systems and Equipment Certification to modified legacy software is the primary focus of this thesis. We present a model to capture the relationships between pre- and post-modification software and standards. The proposed formal model is then applied to the requirements for RTCA DO-178B and MIL-STD-498 as representative examples of contemporary and legacy software standards. The results provide guidance on how to achieve airworthiness certification for modified legacy software, whilst maximizing the use of software products from the previous development.

Due to their unique characteristics, military domains contain various peculiarities that directly or indirectly and favourably or unfavourably impact the development of software products. Observations of systems development in the Brazilian Navy for many years have shown that systems are developed and delivered usually with many delays, and during development there are many changes to the requirements initially elicited. Since many authors in the software engineering literature agree that problems in requirements account for more than 70% of total system development failures, it seemed to be logical that any effort to solve the problems encountered in the military environment should start focusing on the requirements area. Currently several techniques and approaches already exist that support the execution of activities in this phase. With this abundance of techniques, it becomes a difficult task for the analysts to select the best technique in a given circumstance. To support the selection of these techniques, several frameworks were also created, each one guided by a respective group of influencing factors. This study examined, in a detailed manner, these techniques and frameworks, and noticed that there are still issues to be addressed to guide the selection of elicitation techniques, especially in a complex environment such as the military one. To elicit these issues an exploratory qualitative research was performed. The results showed that social issues rather than technical ones were the main concern in the domain under study. Issues such as hierarchy and high staff turnover interfere in the requirements process but are yet not addressed. The findings of the qualitative research are the first contribution of the thesis. Based on these results this research proposed a novel framework for requirements elicitation within the context of a military environment taking into account social and technical factors, which is the second contribution of the thesis. Such a framework was developed following Conflict Theory from sociology. This framework organized a selection of techniques based on possible solutions to conflicts. Finally, the solution was evaluated to assess its efficacy. This evaluation was based on qualitative and quantitative research. Based on the evaluation results the framework was updated.

Approved for public release; distribution is unlimited / Software is often developed under a process that can at best be described as ad hoc. While it is possible to develop quality software under an ad hoc process, formal processes can be developed to help increase the overall quality of the software under development. The application of these processes allows for an organization to mature. The software maturity level, and process improvement, of an organization can be measured with the Capability Maturity Model. The scope of this work is to use organizationally improved software processes on a small scale software product developed by the U.S. Army . The goal is to establish process improvement based on the Capability Maturity Model. / Civilian, United States Army TACOM

Approved for public release; distribution is unlimited / Today, intrusion detection systems provide for detecting intrusive patterns of interaction. Although the responses of such systems are typically limited to primitive actions, they can be supplemented with deception-based strategies. We propose a generic software architecture combining intrusion detection and deceptive response capabilities in a uniform structure. Detecting and responding to attacks are realized via runtime instrumentation of kernel-based modules. The architecture provides for dynamically adjusting system performance to maintain continuity and integrity of both legitimate services and security activities. / Lieutenant Junior Grade, Turkish Navy

In this thesis, two methods are developed in an aid to help users capture valuable design information and knowledge and reuse them. They are the design pattern recovery (DPR) method and pattern-based redocumentation (PBR) method. The DPR method is for matching up metrics of patterns with patterns themselves in order to capture valuable design information. Patterns are used as a container for storing the information. Two new metrics, i.e., p-value and s-value are introduced. They are obtained by analysing product metrics statistically. Once patterns have been detected from a system, the system can be redocumented using these patterns. Some existing XML (extensible Markup Language) technologies are utilised in order to realise the PRB method. Next, a case study is carried out to validate the soundness and usefulness of the DPR method. Finally, some conclusions drawn from this research are summarised, and further work is suggested for the researchers in software engineering.

With integration of geospatial information system into a conventional information system a basic disaster response information system is implemented. The result is a report on various useful technologies and software engineering methodologies that could be utilized to implement a preliminary system, which in turn clarifies many uncertainties and surprises that are typical of many such systems. The foundations of my project include the Unified Process of software development, the relational data models, the decision tree technique, class design principles such as the MVC pattern.