Publications

Refine Results

(Filters Applied) Clear All

Generating client workloads and high-fidelity network traffic for controllable, repeatable experiments in computer security

Published in:
13th Int. Symp. on Recent Advances in Intrusion Detection, 14 September 2010, pp. 218-237.

Summary

Rigorous scientific experimentation in system and network security remains an elusive goal. Recent work has outlined three basic requirements for experiments, namely that hypotheses must be falsifiable, experiments must be controllable, and experiments must be repeatable and reproducible. Despite their simplicity, these goals are difficult to achieve, especially when dealing with client-side threats and defenses, where often user input is required as part of the experiment. In this paper, we present techniques for making experiments involving security and client-side desktop applications like web browsers, PDF readers, or host-based firewalls or intrusion detection systems more controllable and more easily repeatable. First, we present techniques for using statistical models of user behavior to drive real, binary, GUI-enabled application programs in place of a human user. Second, we present techniques based on adaptive replay of application dialog that allow us to quickly and efficiently reproduce reasonable mock-ups of remotely-hosted applications to give the illusion of Internet connectedness on an isolated testbed. We demonstrate the utility of these techniques in an example experiment comparing the system resource consumption of a Windows machine running anti-virus protection versus an unprotected system.
READ LESS

Summary

Rigorous scientific experimentation in system and network security remains an elusive goal. Recent work has outlined three basic requirements for experiments, namely that hypotheses must be falsifiable, experiments must be controllable, and experiments must be repeatable and reproducible. Despite their simplicity, these goals are difficult to achieve, especially when dealing...

READ MORE

An algorithm to identify robust convective weather avoidance polygons in en route airspace

Published in:
ATIO 2010: 10th AIAA Aviation Technology Integration and Operations Conf., 13-15 September 2010.

Summary

The paper describes an algorithm for constructing convective weather avoidance polygons. The algorithm combines weather avoidance fields (WAF) from the en route convective weather avoidance model (CWAM) with edges automatically detected in the echo tops field, clustering, convex hull fitting and wind data to build weather avoidance polygons. Results for 2 case days with significantly different weather patterns were classified and studied.
READ LESS

Summary

The paper describes an algorithm for constructing convective weather avoidance polygons. The algorithm combines weather avoidance fields (WAF) from the en route convective weather avoidance model (CWAM) with edges automatically detected in the echo tops field, clustering, convex hull fitting and wind data to build weather avoidance polygons. Results for...

READ MORE

Assessment and interpretation of en route Weather Avoidance Fields from the Convective Weather Avoidance Model

Published in:
ATIO 2010: 10th AIAA Aviation Technology Integration and Operations Conf., 13-15 September 2010.

Summary

This paper presents the results of a study to quantify the performance of Weather Avoidance Fields in predicting the operational impact of convective weather on en route airspace. The Convective Weather Avoidance Model identifies regions of convective weather that pilots are likely to avoid based upon an examination of the planned and actual flight trajectories in regions of weather impact. From this model and a forecast of convective weather from the Corridor Integrated Weather System a probabilistic Weather Avoidance Field can be provided to automated decision support systems of the future impact of weather on the air traffic control system. This paper will present three alternative spatial filters for the Convective Weather Avoidance Model, quantify their performance, address deficiencies in performance, and suggest potential improvements by looking at the ATC environment and common situational awareness between the cockpit and air traffic control.
READ LESS

Summary

This paper presents the results of a study to quantify the performance of Weather Avoidance Fields in predicting the operational impact of convective weather on en route airspace. The Convective Weather Avoidance Model identifies regions of convective weather that pilots are likely to avoid based upon an examination of the...

READ MORE

Benefits assessment methodology for an air traffic control tower advanced automation system

Published in:
ATIO 2010: 10th AIAA Aviation Technology Integration and Operations Conf., 13-15 September 2010.

Summary

This paper presents a benefits assessment methodology for an air traffic control tower advanced automation system called the Tower Flight Data Manager (TFDM), which is being considered for development by the FAA to support NextGen operations. The standard FAA benefits analysis methodology is described, together with how it has been tailored to the TFDM application to help inform the development process and the business case for system deployment. Parts of the methodology are illustrated through data analysis and modeling, and insights are presented to help prioritize TFDM capability development.
READ LESS

Summary

This paper presents a benefits assessment methodology for an air traffic control tower advanced automation system called the Tower Flight Data Manager (TFDM), which is being considered for development by the FAA to support NextGen operations. The standard FAA benefits analysis methodology is described, together with how it has been...

READ MORE

On estimating mid-air collision risk

Published in:
ATIO 2010: 10th AIAA Aviation Technology Integration and Operations Conf., 13-15 September 2010.

Summary

Many aviation safety studies involve estimating near mid-air collision (NMAC) rate. In the past, it has been assumed that the probability that an NMAC leads to a mid-air collision is 0.1, but there has not yet been a comprehensive study to serve as a basis for this estimate. This paper explains how to use existing encounter models, a flight simulation framework, three-dimensional aircraft wireframe models, and surveillance data to estimate mid-air collision risk. The results show that 0.1 is an overly conservative estimate and that the true rate is likely to be an order of magnitude lower.
READ LESS

Summary

Many aviation safety studies involve estimating near mid-air collision (NMAC) rate. In the past, it has been assumed that the probability that an NMAC leads to a mid-air collision is 0.1, but there has not yet been a comprehensive study to serve as a basis for this estimate. This paper...

READ MORE

Machine learning in adversarial environments

Published in:
Mach. Learn., Vol. 81, No. 2, November 2010, pp. 115-119.

Summary

Whenever machine learning is used to prevent illegal or unsanctioned activity and there is an economic incentive, adversaries will attempt to circumvent the protection provided. Constraints on how adversaries can manipulate training and test data for classifiers used to detect suspicious behavior make problems in this area tractable and interesting. This special issue highlights papers that span many disciplines including email spam detection, computer intrusion detection, and detection of web pages deliberately designed to manipulate the priorities of pages returned by modern search engines. The four papers in this special issue provide a standard taxonomy of the types of attacks that can be expected in an adversarial framework, demonstrate how to design classifiers that are robust to deleted or corrupted features, demonstrate the ability of modern polymorphic engines to rewrite malware so it evades detection by current intrusion detection and antivirus systems, and provide approaches to detect web pages designed to manipulate web page scores returned by search engines. We hope that these papers and this special issue encourages the multidisciplinary cooperation required to address many interesting problems in this relatively new area including predicting the future of the arms races created by adversarial learning, developing effective long-term defensive strategies, and creating algorithms that can process the massive amounts of training and test data available for internet-scale problems.
READ LESS

Summary

Whenever machine learning is used to prevent illegal or unsanctioned activity and there is an economic incentive, adversaries will attempt to circumvent the protection provided. Constraints on how adversaries can manipulate training and test data for classifiers used to detect suspicious behavior make problems in this area tractable and interesting...

READ MORE

Traffic Management Advisor (TMA) weather integration

Published in:
MIT Lincoln Laboratory Report ATC-364

Summary

TCAS behavior in New England airspace is being monitored and analyzed, making use of an omni-directional 1030/1090 MHz receiver. The receiver system, located in Lexington, MA, and operated by M.I.T. Lincoln Laboratory, is used to record Resolution Advisories (RAs). Omni-directional receptions make it possible to examine the air-to-air messages exchanged between aircraft for coordination of RAs. Omni-directional reception rates are also being studied. THe results indicated the percentage of aircraft that are TCAS equipped and the percentage of received signals that originate from TCAS and other systems. A third aspect of the program evaluates the availablity of 1090 MHz Extended Squitter data for use in collision avoidance systems. Data is recorded continuously, and the busiest periods are selected for focused attention.
READ LESS

Summary

TCAS behavior in New England airspace is being monitored and analyzed, making use of an omni-directional 1030/1090 MHz receiver. The receiver system, located in Lexington, MA, and operated by M.I.T. Lincoln Laboratory, is used to record Resolution Advisories (RAs). Omni-directional receptions make it possible to examine the air-to-air messages exchanged...

READ MORE

Collision avoidance for unmanned aircraft using Markov Decision Processes

Summary

Before unmanned aircraft can fly safely in civil airspace, robust airborne collision avoidance systems must be developed. Instead of hand-crafting a collision avoidance algorithm for every combination of sensor and aircraft configuration, we investigate the automatic generation of collision avoidance algorithms given models of aircraft dynamics, sensor performance, and intruder behavior. By formulating the problem of collision avoidance as a Markov Decision Process (MDP) for sensors that provide precise localization of the intruder aircraft, or a Partially Observable Markov Decision Process (POMDP) for sensors that have positional uncertainty or limited field-of-view constraints, generic MDP/POMDP solvers can be used to generate avoidance strategies that optimize a cost function that balances flight-plan deviation with collision. Experimental results demonstrate the suitability of such an approach using four different sensor modalities and a parametric aircraft performance model.
READ LESS

Summary

Before unmanned aircraft can fly safely in civil airspace, robust airborne collision avoidance systems must be developed. Instead of hand-crafting a collision avoidance algorithm for every combination of sensor and aircraft configuration, we investigate the automatic generation of collision avoidance algorithms given models of aircraft dynamics, sensor performance, and intruder...

READ MORE

Wind-shear system cost-benefit analysis

Author:
Published in:
Lincoln Laboratory Journal, Vol. 18, No. 2, August 20, pp. 47-68.

Summary

Mitigating thunderstorm wind-shear threats for aircraft near the ground has been an important issue since the 1970s, when several fatal commercial aviation accidents were attributed to wind shear. Updating the knowledge base for airport wind-shear exposure and effectiveness of detection systems has become critical to the Federal Aviation Administration as they consider options for aging systems and evaluations of new systems.
READ LESS

Summary

Mitigating thunderstorm wind-shear threats for aircraft near the ground has been an important issue since the 1970s, when several fatal commercial aviation accidents were attributed to wind shear. Updating the knowledge base for airport wind-shear exposure and effectiveness of detection systems has become critical to the Federal Aviation Administration as...

READ MORE

GROK: a practical system for securing group communications

Published in:
NCA 2010, 9th IEEE Int. Symp. on Network Computing and Applications, 15 July 2010, pp. 100-107.

Summary

We have designed and implemented a general-purpose cryptographic building block, called GROK, for securing communication among groups of entities in networks composed of high-latency, low-bandwidth, intermittently connected links. During the process, we solved a number of non-trivial system problems. This paper describes these problems and our solutions, and motivates and justifies these solutions from three viewpoints: usability, efficiency, and security. The solutions described in this paper have been tempered by securing a widely-used group-oriented application, group text chat. We implemented a prototype extension to a popular text chat client called Pidgin and evaluated it in a real-world scenario. Based on our experiences, these solutions are useful to designers of group-oriented systems specifically, and secure systems in general.
READ LESS

Summary

We have designed and implemented a general-purpose cryptographic building block, called GROK, for securing communication among groups of entities in networks composed of high-latency, low-bandwidth, intermittently connected links. During the process, we solved a number of non-trivial system problems. This paper describes these problems and our solutions, and motivates and...

READ MORE