New architectures and topologies continue to be investigated to address the growing demands and challenges faced by Data Center Networks (DCN) - the communications backbone of the datacenter. We believe that novel techniques that leverage the high redundancy and symmetricity in DCN topologies can significantly simplify DCN protocols and operations and improve DCN performance. We adopted the folded-Clos topology to investigate a novel Multi-Root Meshed Tree Protocol (MR-MTP) and compared its performance to the popular protocol suite adopted in folded-Clos topologies, namely the Border Gateway Protocol (BGP) with Equal Cost Multipath Protocol (ECMP) with and without Bidirectional Forwarding Detection (BFD). We studied the convergence time, packet loss, control overhead and blast radius after an interface failure, introduced in multiple points. Our studies conducted on the FABRIC testbed provide strong validation that novel techniques that leverage the DCN structures can indeed simplify DCN protocol operations and improve performance.

The lack of quality datasets is a critical problem that limits machine learning experimentation in the areas of intelligent networks and security. Datasets are often a poor fit, insufficient for experiment needs, out of date or simply inaccessible. To address these issues we present the RIT dataset collections. These two collections consist of balanced and unbalanced capture files, topology diagrams and scenario descriptions. The network capture files in the collection are available in text and pcapng formats. The base network collection also contains image files created from the packet capture data samples. These formats offer researchers an unparalleled opportunity to benchmark a wider variety of machine learning models. The balanced training and validation datasets contain 5,000 and 500 samples for each of fourteen classes. Classes include TCP and UDP variations, layer 3 protocols such as the Address Resolution Protocol and layer 2 management protocols such as spanning tree. The base collection includes five other curated but unbalanced test sets. Expanding on the original fourteen classes, typical network activities are captured in the second set of uncurated files. The security collection includes capture files, topology diagrams and the associated scenario descriptions. The current collection consists of Man in the Middle (MITM) attacks, TCP port scans and Active Directory (AD) enumeration attacks. Additional datasets and their topology diagrams continue to be added to the collections. The repository also provides some multi-layer perceptron and convolutional neural network model classification accuracy values for comparison. The dataset collections are publicly available via RIT Scholar-works and the following DOIs: www.doi.org/10.57673/gccis-yg55 and www.doi.org/10.57673/gccis-qj60

In this article, we investigate the performance of DCN protocols evaluated on the FABRIC testbed. We developed automation tools for use on FABRIC to assist in DCN topology establishment, configuring devices with desired protocol suites, setting up test cases, and collecting results to assess multiple performance metrics.

Data-driven Business Intelligence process improvements demand proactive digital vulnerability discovery and exploitation enumeration. These risk discovery and analyses practices are commonly known as penetration tests (pentests), and have emerged as requirement for most organizations under many compliance regimes such as the global Payment Card Industry Data Security Standard (PCI-DSS) and the federal Gramm-Leach Bliley Act (GLBA) in the United States. Though a growing body of research addresses the utility of pentests as a valuable Business Intelligence method, pentest outputs are not standardized and require time-consuming generation and ingestion before they can provide inputs to Business Intelligence Systems. In this study, we examined several pentest reports and propose a standardized schema for output generation in a common format that is easy for Business Intelligence Systems to ingest. We propose that this improvement will allow more rapid delivery of accurate risk information to executives, managers, and information technology professionals. The thirteen elements of our standardized schema represent the first attempt at building a pentest dimensional model, which could further ease the translation of cybersecurity risk information into business impact analyses and organizational risk registers.

The goal is to raise awareness and encourage learning cybersecurity principles by making competitions appealing to a wider audience. In an effort to make events compelling, attractive, and watchable, the researchers will develop systems to support visualizations and make the transactions between teams in different cybersecurity competitions easy to comprehend. In informing and educating the audience on the intricacies of the competition through engaging visualizations, cybersecurity competitions will be opened up to a world beyond just participants. In doing so, we can potentially attract new talent into the field. Our team seeks to make prototype visualizations for key actions in various student cybersecurity competitions and assess spectator understanding of key principles of the competition.

When disasters happen, the speed with which first responders and emergency personnel can contact and be contacted by the people affected by the disaster during the first minutes or hours is critical. Early communications can make the difference between life and death. During a disaster communications infrastructure of the affected area is likely to be compromised. This project proposes an inexpensive, rapidly deployable cloud of autonomous drones, each coupled with a micro-cellular base station that deploys from a transportable deployment module. The goal is to temporarily restore communications for both first responders to communicate amongst themselves as well as for the rest of the impacted population.

This paper describes an open-source project called RATCHET whose goal is to create software that can be used by large groups of people to construct attack trees. The value of an attack tree increases when the attack tree explores more scenarios. Crowdsourcing an attack tree reduces the possibility that some options might be overlooked. RATCHET has been tested in classroom settings with positive results. This paper gives an overview of RATCHET and describes some of the features that we plan to add. Keywords—crowdsourcing, attack tree, security, attack surface

We describe the recent developments of an open-source project called RATCHET that can be used by groups of users to collectively construct attack trees. We present the RATCHET framework as well as a model for testing and evaluation of the produced attack trees. RATCHET has been tested in classroom settings with positive results and this paper presents the plans for expanding its outreach to the community at large and building attack trees through crowdsourcing. This paper gives an overview of RATCHET and an introduction to its use.

Mobile devices have enjoyed unprecedented growth in the last decade. As devices become more ubiquitous and users place more sensitive data on their devices, the amount of mobile malware in the wild has grown. In order to protect mobile device users and their data, mobile security solutions have been brought to market for consumer and enterprise users. The limited success observed in protecting devices so far warrants a redoubled effort to develop effective mobile device security solutions. The research presented in this paper represents the ongoing result of malware analysis for the Android platform by combining code review and behavioral testing. The data collected from these processes suggests the need to implement several security techniques not currently found in Android. To the benefit of users and developers, most of these techniques are coded into Android and provide comprehensive protection with minimal user intervention.

Android malware growth has been increasing dramatically as well as the diversity and complicity of their developing techniques. Machine learning techniques have been applied to detect malware by modeling patterns of static features and dynamic behaviors of malware. The accuracy rates of the machine learning classifiers differ depending on the quality of the features. We increase the quality of the features by relating between the apps' features and the features that are required to deliver its category's functionality. To measure the benign app references, the features of the top rated apps in a specific category are utilized to train a malware detection classifier for that given category. Android apps stores such as Google Play organize apps into different categories. Each category has its distinct functionalities which means the apps under a specific category are similar in their static and dynamic features. In other words, benign apps under a certain category tend to share a common set of features. On the contrary, malicious apps tend to have abnormal features, which are uncommon for the category that they belong to. This paper proposes category-based machine learning classifiers to enhance the performance of classification models at detecting malicious apps under a certain category. The intensive machine learning experiments proved that category-based classifiers report a remarkable higher average performance compared to non-category based.

Investigating network covert channels in smartphones has become increasingly important as smartphones have recently replaced the role of traditional computers. Smartphones are subject to traditional computer network covert channel techniques. Smartphones also introduce new sets of covert channel techniques as they add more capabilities and multiple network connections. This work presents a new network covert channel in smartphones. The research studies the ability to leak information from the smartphones applications by reaching the cellular voice stream, and it examines the ability to employ the cellular voice channel to be a potential medium of information leakage through carrying modulated speech-like data covertly. To validate the theory, an Android software audio modem has been developed and it was able to leak data successfully through the cellular voice channel stream by carrying modulated data with a throughput of 13 bps with 0.018% BER. Moreover, Android security policies are investigated and broken in order to implement a user-mode rootkit that opens the voice channels by stealthily answering an incoming voice call. Multiple scenarios are conducted to verify the effectiveness of the proposed covert channel. This study identifies a new potential smartphone covert channel, and discusses some security vulnerabilities in Android OS that allow the use of this channel demonstrating the need to set countermeasures against this kind of breach.

According to various news sources, rogue cellular towers referred to as “IMSI catchers” have been deployed across the nation. An academic interest has been taken in determining what information can be acquired when a mobile device associates with one of these towers. These towers focus on manipulating authentication methods to pose as a legitimate GSM tower. Through the use of software defined radios, and open source software an inexpensive GSM protocol-based cell tower was deployed to determine what, if any, security vulnerabilities exist in the current mobile network infrastructure.

As the use and prevalence of mobile technology increases so too does the importance of effective security for these devices. In particular, sensitive user information must be protected, which includes protecting against any covert channels that would allow such information to be compromised. This paper will examine a new covert channel capable of circumventing existing application-level protections on the Android operating system (OS). The authors will also show that this channel is capable of achieving significantly higher throughput than similar, previously discovered channels, which necessitates the implementation of additional security protections and controls at the operating system level.

The number of mobile device malware has been increasing drastically last several years. When attempting to detect malware within a device, it is difficult to draw a clear line between malicious and normal activities. Even useful applications naturally result in data transfer from a mobile device to a remote server and a malware detection mechanism based solely on information flow might consider this as data leakage. Therefore one should also consider the surrounding context of an application to make a better decision on whether it is malicious or not. In this current research, a dynamic analysis approach is taken which monitors and measures the runtime behavior and logs from the mobile application. In particular, a concept of user awareness (UA) is proposed which represents a degree of intent with which an application tries to hide its activities from a user. This extended analysis measurement, combined with dataflow-based analysis, will help make a more accurate decision with less false positives.

Loop free frame forwarding in layer 2 switched networks that use meshed topologies to provision for link and path redundancy is a continuing challenge. The challenge is addressed through special protocols at layer 2 that build logical trees over the physically meshed topologies, along which frames can be forwarded. The first such protocol was based on the spanning tree. The spanning tree protocol (STP) had high convergence times subsequent to topology changes. Rapid STP and IETF RFC 5556 Transparent Interconnection of Lots of Links (TRILL) on Router Bridges (RBridges) were then developed to reduce the convergence times. RSTP continued to use the spanning tree while TRILL adopted link state routing to support a tree from every switch. TRILL introduces high processing complexity into layer 2 networks. In this article a new meshed tree algorithm (MTA) and a loop avoidance protocol based on the MTA, namely the meshed tree protocol (MTP) are discussed. The MTA allows constructing several overlapping trees from a single root switch. This speeds up convergence to link failures. The MTP proposes a simple numbering scheme to implement meshed trees – thus, the processing complexity is low. The specification for the MTP is currently an ongoing IEEE standard Project 1910.1. In this article the operational details of MTP are presented and its performance evaluated and compared with RSTP. KeywordsLoop Avoidance, Switched Networks, Meshed Trees Protocol, Link Failure and Recovery

Loop free forwarding is a continuing challenge in switched networks that require link and path redundancy. Solutions to overcome looping frames are addressed by special protocols at layer 2, which block ports in the bridges to build a logical spanning tree for frame forwarding. However, due to the continuing convergence issues in the Spanning Tree algorithm, IETF RFC 5556 Transparent Interconnection of Lots of Links on RBridges (router bridges) and IEEE 802.1aq Shortest Path Bridging both use link state routing techniques to build Dijkstra trees from every switch. Both techniques have the expense of higher processing complexity. In this paper, a novel meshed tree algorithm (MTA) is investigated to address convergence issues faced by STA while also avoiding the complexity of Link State routing. The MTA based protocol is compared with Rapid Spanning Tree Protocol using OPNET simulations. The significant reduction in convergence time combined with the simplicity in implementation indicates that the Meshed Tree Protocol would be superior candidate to resolve looping issues in switched networks.

This paper focuses on the design and development of a game-based forensics course. This course uses the game-based learning (GBL) approach that builds the game in a real computing environment that has direct access to actual forensics tools from a forensics machine and the evidence from a suspect machine. Interactive visualizations will be used to help students to understand the intangible and inaccessible abstract concepts such as deleted/hidden/encrypted/over-written digital evidence.