This PDF file contains the front matter associated with SPIE Proceedings Volume 11013, including the Title Page, Copyright information, Table of Contents, Author and Conference Committee lists.

Intelligence production in the Intelligence Community (IC) suffers from inadequate collaboration, poor information sharing, and lack of visibility into a complex production process, resulting in intelligence reports that are not aligned to the user’s needs. This exacerbates decision-making problems by preventing critical data from reaching the appropriate staff, which prevents commanders from achieving their desired mission requirements due to incomplete or inadequate information. Using Object-Based Production, Adaptive Process Management, and Entity Management technologies, a new wiki-like capability was created that provides a wiki’s ease of use and understanding while addressing weaknesses such as lack of multi-level security, no enforcement of IC publishing standards, and lack of product currency―providing an IC-aligned intelligence production solution addressing the above needs.

The amount of network traffic and host log data collected by the commercial and government organizations to maintain their security is growing every day due to proliferation of cyber sensors and security appliances. However, these huge amounts of data can no longer be stored efficiently or processed in real time. Security analysts need to make decisions about what data is most effective for current and novel attack detection, what data may be relevant to analyze in forensic mode, and what data can be aggregated and discarded without significant degradation to the enterprise security. Making these decisions manually, and reasoning about both utility of attack detection and the cost of data management, is infeasible. In this paper, we will present a model for developing a plan for data collection and archiving that adapts the sensor and storage state configuration to the analytical systems available in the organization, threats detected by those systems over time, and capacity and cost of collection and storage resources. Our planning model computes the sensor state and data archiving actions via approximate variational inference, decomposing the planning problem into perception, learning, and control, which enables tractable plan construction and incremental updates.

We present and evaluate the idea of auto-generating training data for network application classification using a rule-based expert system on two-dimensions of the feature space. That training data is then used to learn classification of network applications using other dimensions of the feature space. The rule-based expert system uses transport layer port number conventions (source port, destination port) from the Internet Assigned Numbers Authority (IANA) to classify applications to create the labeled training data. A classifier can then be trained on other network ow features using this auto-generated training data. We evaluate this approach to network application classification and report our findings. We explore the use of the following classifiers: K-nearest neighbors, decision trees, and random forests. Lastly, our approach uses data solely at the ow-level (in NetFlow v5 records) thereby limiting the volume of data that must be collected and/or stored.

This article aims to provide the reader with a clear understanding of a subdiscipline in artificial intelligence, Deep Neural Networks. In addition to this, we cover a set of proposed Domain Specific Architectures, Accelerators, that are optimized for these types of computations. In optimizing these computations, we are able to reduce data transfers by keeping data at the processing unit in their individual register files thus increasing energy efficiency per computation.

These last years, we have witnessed considerable improvements in machine learning and deep learning. Many advanced techniques are now based on deep neural networks. Although many software libraries are available, the development of deep neural networks requires a good level of mathematical knowledge and high programming skills. In this work, we present a visual tool to help simplify the programming of deep learning networks. The developed framework DeepViP is comprised of a node editor that provides users with a toolbox representing different types of neural layers. It allows the connection between the different blocks and the configuration of important hyper parameters of each layer. Thus, speeding-up experimentation with different architectures. Additionally, the developed solution offers users the possibility to generate a python script of the designed network that can be run using specific libraries such as keras or tensorflow.

Fabricated information is easily distributed throughout social media platforms and the internet. This allows incorrect and embellished information to misinform and manipulate the public in service of an attacker's goals. Falsified information – also commonly known as "fake news" – has been around for centuries. In modern day, it presents a unique challenge because of the difficulty of tracing news items origin, when spread electronically. Fake news can affect voting patterns, political careers, businesses’ new product launches, and countless other information consumption processes. This paper proposes a method that uses machine learning to identify “Fake News” stories. The conditional probability that a story is fake is calculated, given the presence of feature predictors inside a news story. A concise summary of the qualitative methods used to study Fake News stories is presented. This is followed by a discussion of computational social science and machine learning methods that can be used to train and tune a classifier to detect fake news. Some of the main linguistic trends, identified in social media platforms, that are associated with fake news are identified. A larger integrated system that can be used to identify and mitigate the impact of falsified content is also proposed.

Fabricated news stories that contain false information but are presented as factually accurate (commonly known as ‘fake news’) have generated substantial interest and media attention following the 2016 U.S. presidential election. While the full details of what transpired during the election are still not known, it appears that multiple groups used social media to spread false information packaged in fabricated news articles that were presented as truthful. Some have argued that this campaign had a material impact on the election. Moreover, the 2016 U.S. presidential election is far from the only campaign where fake news had an apparent role. In this paper, work on a counter-fake-news research effort is presented. In the long term, this project is focused on building an indications and warnings systems for potentially deceptive false content.

As part of this project, a dataset of manually classified legitimate and deceptive news articles was curated. The key criteria for classifying legitimate and deceptive articles, identified by the manual classification project, are identified and discussed. The identified criteria can be embodied in a natural language processing system to perform illegitimate content detection. The criteria include the document’s source and origin, title, political perspective, and several key content characteristics. This paper presents and evaluates the efficacy of each of these characteristics and their suitability for legitimate versus illegitimate classification. The paper concludes by discussing the use of these characteristics as input to a customized naïve Bayesian probability classifier, the results of the use of this classifier and future work on its development.

Heterogeneous computing and heterogeneous clouds refer to emerging architectures to build a variety of processors including CPUs, GPUs, FPGAs, and more specialized processing elements into an interconnected mesh environment to provide an ideal processing capability for a variety of complex tasks and data types. The concept expands to cover edge computing enabling preprocessing, data selection, and data conditioning/labeling to enhance the overall outcome. The combination of processors will be augmented by a variety of interconnect and memory architectures and configurations leading to customizable settings and flows meeting the changing needs of data and customers. This variety of environments, tasks, and interconnects creates a new landscape that greatly varies from our standard computing infrastructure therefore reducing our expertise in identifying threats based on network, memory, and processing based on trends resulting in an unknown trust level. The goal is to build and operate a heterogeneous platform that provides dynamic resource assignments and capability elasticity to meet standard and surge needs in an environment that provides data security, isolation and attribution. Access control also becomes an essential element of the new environment.

The performance shortcomings of multipurpose compute engines have stirred recent excitement in specialized processors, preempted by GPUs. Simultaneously, computational complexity theory NP ‘hard’ problems scaling as O(n^k) require new hardware solutions. This presents an opportunity for photonic information processors (PIP) building on photonic integration through recent foundry developments. The value proposition for PIPs exist via optical parallelism, small capacitive charging of OE devices, 10’s of ps short propagation delays, a natural convolution via optical interference, and an O(n)-scaling Fourier transform. Based on a recently developed photonic NxN router, here we present two photonic processors; a) the residual arithmetic nanophotonic computer (RANC), and b) a reconfigurable graph processor, the latter being a computing-in-switching (CIS) paradigm. PIPs operate with time-of-flight, once the processor is configured (e.g. setting phase), which is on the order of 10-100 ps given the mm-scale photonic integration footprints. This high bandwidth, however challenges the electronic-optic I/O bottleneck. To address this, we further discuss an optical front-end DAC with <100 ps delay.

Quantum sensing is an important application of Quantum Information (QI) techniques and usually entangled Qubits are used for this task. The sensor sensitivity depends on QI metrics like Shannon Mutual Information (SMI). In this work we present a mathematical model for calculating 1-Qutrit SMI and compare that with 1-Qubit SMI. Qutrit in cascade configuration is found to have higher SMI and so it a better Quantum Sensor for constant fields.

OpenTap is a network traffic analysis tool tailored to remotely capture statistics from an Openflow switch. We have modified OpenTap for low latency packet capture of metadata which can be used for remote security analysis. We demonstrate the utility of this tool by capturing metadata from a quantum information testbed. Specifically, the testbed transmits photon data to a desktop using packets which OpenTap captures. We used a servo motor to periodically block the beam to create 20ms dips in the photon intensity, and then measured this intensity using two methods: via the metadata captured by OpenTap, and via the photon timestamps gathered by the quantum information testbed. Every photon intensity dip detected by the quantum information testbed was also detected using just the metadata; this indicates OpenTap can be used for remote real-time security analysis using packet metadata.

In a resource-constrained, contested environment, computing resources need to be aware of possible size, weight, and power (SWaP) restrictions. SWaP-aware computational efficiency depends upon optimization of computational resources and intelligent time versus efficiency tradeoffs in decision making. In this paper we address the complexity of various optimization strategies related to low SWaP computing. Due to these restrictions, only a small subset of less complicated and fast computable algorithms can be used for tactical, adaptive computing.

The battlefield of the future is projected to include regions with high-densities of small, networked devices. As a step toward developing decentralized, multi-path routing protocols for these scenarios, we consider the geometric problem of assembling a geographic representation of the network based solely on information about relative positions of local neighbors. We present two algorithms to be used in series. 1. The assembly of the network from relative positions only. 2. The determination of the geographic extents of the network, and the position of each node within those extents. With this information, the nodes can then assemble a position-based routing protocol, such as the Ad Hoc On-Demand Distance Vector (AODV) routing protocol. We further consider the effects of positional noise on the accuracy of the constructed geography.

Hardware assisted operating systems have their origins in microprogramming from the early 1970’s. In 2014, Renesas marketed a hardware based operating system in the R-IN32M microprocessor. It is time for cybersecurity to consider the security benefits of moving hypervisor and OS features into hardware. A trusted computing base architecture using a hardware state machine separation kernel is the future of cybersecurity. In this paper, we will research a hardware state machine as the trusted computing base. A traditional operating system provides security for applications software. We are interested in a state machine monitor to secure the execution of instructions and provide separation kernel features.

This work develops a principled approach for coordinating decentralized systems that can exchange information, issue and service requests, and perform outcome-focused actions together. It harnesses the resiliency and robustness offered by blockchain frameworks to enable sustained activity in the presence a diverse set of failure modes, operating constraints, and changing task requirements. We accomplish this through the Tactical Distributed Ledger, a distributed computer that can accommodate a wide range of sensors, agents, vehicles, and devices to create a decentralized system. We have used this framework to deploy a multi-participant system that combines sensing, vehicle mobility, and situational awareness to perform coordinated activities in a simulated city environment. The key mechanism that enables this interaction is a robust auction framework implemented on top of a smart contract blockchain system. This paper details the design, components, and features of the auction system.

Blockchain technologies and smart contracts were considered for their potential to provide tremendous benefits as decision support tools to the next generation of warfighters. An investigative team focused on novel security-enhanced information gathering and decision support Artificial-Intelligence (AI) based software agents that will serve as decision support co-pilots when commanders are developing real-time multi-domain orders of battle. As a core construct for this architecture, smart contracts allow for the governance of these systems to be time-bound and/or condition-bound. This disruptive technology propels progress made with distributed multi-agent systems with the numerous security benefits of blockchain technologies. Methods for implementing intelligent computing agents that follow and execute the logic embedded in a contract model will provide a transparent record of agents, chain of trust and chain of custody on the blockchain. This paper will explore mechanisms for maintaining a hierarchy of smart contracts allowing reasoning and decision support over different aspects of the overall command structure. Finally, the potential for maintaining multiple levels of classification across communication channels for platforms tasked with collection and reconnaissance missions will explored.

A distributed autonomous learning framework was developed by DAX LLC (Distributed Autonomous Everything) with the goal of revolutionizing what is known as the “eLearning Industry”. Although some online platforms share DAX’s vision for disrupting, democratizing, and improving accessibility to the online educational ecosystem, they do not offer the same level of security, adaptability, and appeal to the emerging computing technologies community as DAX. DAX’s learning framework is built upon its own private blockchain with user-guided adaptation through a suite of distributed applications. This sophisticated architecture serves to protect the student’s identity, provides verifiability of trust of historical records, and provides transparency of achievement for a given student encryption key. The inherent security of the private blockchain ensures computer hackers (or nefarious students) aren’t poisoning or “gaming” the system. The world is rapidly evolving and internet access creates a changing landscape for traditional education systems. DAX recognizes the need for educational systems to evolve beyond being solely centers of knowledge to becoming the enablers of information sharing and immersive learning. The distributed autonomous classroom concept presented herein is a novel eLearning concept designed to continue to evolve to meet the ever-changing demands of the globally connected, technologically savvy, student of tomorrow.

The benefits of blockchain technology are evident in the banking industry as the underlying technology for cryptocurrencies. Recently, research has been focused on novel, non-cryptocurrency uses of blockchain for other industries such as national defense. Application of these technologies in military use cases requires special consideration of the limitations inherent to tactical military operations, namely the network communication technologies. In this work we explore the performance of blockchain technologies on network environments representative of those available in Department of Defense (DoD) tactical operations. Our experimentation with the Ethereum blockchain on a mobile network emulation reveals a series of verbose blockchain network communication protocols as well as a heavy reliance on Transmission Control Protocol (TCP) for block transfer and synchronization that may limit the effectiveness of blockchain on current DoD mobile ad hoc networks.

Advancement in the areas of high performance computing and computational sciences have facilitated the generation of an enormous amount of research data by computational scientists - the volume, velocity and variability of Big 'Research' Data has increased across all disciplines. An immersive and non-immersive analytics platform capable of handling extreme-scale scientific data will enable scientists to visualize unwieldy simulation data in an intuitive manner and guide the development of sophisticated and targeted analytics to obtain usable information. Our immersive and non-immersive visualization work is an attempt to provide computational scientists with the ability to analyze the extreme-scale data generated. The main purpose of this paper is to identify different characteristics of a scientific data analysis process to provide a general outline for the scientists to select the appropriate visualization systems to perform their data analytics. In addition, we will include some of the details on how to how the immersive and non-immersive visualization hardware and software are setup. We are confident that the findings in our paper will provide scientists with a streamlined and optimal visual analytics workflow.

Communication, power efficiency and data storage are core needs of an IoT environment. Communication protocols for low power wide area networks (LPWAN) are a growing field of research, and require of innovative approaches to provide data chronological logging and security while preserving the all-data all-the-time-connected (ADAT2C) paradigm. In this paper we propose a theoretical and practical IoT design using LoRaWAN protocol and Hyperledger Fabric network. The former defines a power efficient, and enroll secure network of end-node devices; and the later provides a secure immutable chronological data ledger with permission policies. The proposed hybrid network implements a role-integration of devices to improve resources, a request on-demand certificate credentials for each endnode, anomaly detection algorithm and a quarantine channel mechanism for defense on replica attacks.

It is estimated, that the number of connected Internet of Things (IoT) devices around the world could increase dramatically, with expectations ranging from 25 billion to 50 billion devices in 2025. As the IoT area is wider and wider and the number of connected IoT devices is higher every day, it appears that the issue of security is more up to date. The paper deals with LoRaWAN and Sigfox networks belonging to the LPWAN (Low Power Wide Area Network) category, where we focus on detection of the end device movement in a network based on the qualitative parameters of a radio signal. The result of this work is a software solution to notice the owner of the end device about the location change. As a testbed, we use LoRaWAN network, which is part of the infrastructure covering the area of Czech Republic. For Sigfox solution we use the public network provided by SimpleCell company and own solution to show actual parameters with which base station received messages. Detection serves as a measure against an attacker performing a spoofing attack or the physical movement of a statically-located end device activated by authentication methods. Based on the experimental simulation of the attacker's behavior, we have summed up the attack into individual points, according to which we subsequently constructed a countermeasure principle in the form of detection. This principle was applied to an algorithm that could be integrated into the gateway in case of LoRaWAN network and implemented as a separate element for Sigfox solution.

Edge computing is emerging as a new paradigm to allow processing data near the edge of the network, where the data is typically generated and collected. This enables critical computations at the tactical edge in applications such as Internet of Battlefield Things (IoBT), in which an increasing number of devices (sensors, cameras, health monitoring devices, etc.) collect data that needs to be processed through computationally intensive algorithms with stringent reliability, security and latency constraints. Our key tool is the theory of coded computation, which advocates mixing data in computationally intensive tasks by employing erasure codes and offloading these tasks to other devices for computation. Coded computation is recently gaining interest, thanks to its higher reliability, smaller delay, and lower communication costs. In this paper, we develop a private and rateless adaptive coded computation (PRAC) algorithm by taking into account (i) the privacy requirements of IoBT applications and devices, and (ii) the heterogeneous and time-varying resources of edge devices. We show that PRAC outperforms known secure coded computing methods when resources are heterogeneous. We provide theoretical guarantees on the performance of PRAC and its comparison to baselines. Moreover, we confirm our theoretical results through simulations.

Imagine if a city could connect its entire infrastructure to truly become a “smart” city, like the ones portrayed in science fiction movies and books. In China, Alibaba launched ET City Brain in Hangzhou, connecting Hangzhou’s traffic grid, police and emergency vehicles and systems, and public transportation systems to create a more efficient city by utilizing data from street cameras, social media, Wi-Fi probes, cell phone carriers, and more. In addition to ET City Brain, Alibaba is also working to develop Medical Brain, Environmental Brain, and Industrial Brain. Combined, these projects would create an all-encompassing smart city.

In addition to these projects, China also has various social-ranking technologies, ultimately creating social accountability, and incentive to follow the law and act in the interest of the government.

Although the benefits of an interconnected city are great, there are many concerns to consider. From a technical perspective, one must worry about potential attacks on and shortcomings of such a system, including, but not limited to: the failure of a centralized system, a DDOS or ransomware attack, over-reliance on algorithms, an attack on training data, and data breaches. From a policy standpoint, data privacy laws could create large road blocks, and the questions of who is responsible for the data at hand and how it is being used also rest to create huge problems. This paper explores how projects like this are possible in China, but not in America, and the different concerns that come along with such projects.

The modern-day Cyber field continues to be plagued with innumerable forms of malware that are created on a massive scale. The ever-changing nature of malware threats combined with the obfuscation techniques used by attackers creates the need for effective methods of malware classification. As of 2018, an average of one million new forms of malware are created world-wide each day, which raises the question of how to combat these attacks. While most antiviruses scan the integrity and composition of files in the system, we propose a new approach to Cyber Defense. As a replacement for standard file scans, we advocate the conversion of the malware binary into a grayscale image for classification and visualization. As discovered by previous research, different types of malware families tend to display similar characteristics and binary patterns between the various malware files in each family. Since there are similarities between the various files of malware in each family, the idea arose to augment these groups with synthetic data generated from a Generative Adversarial Network (GAN). The idea of a constant stream of generated malware leads to the hypothesis that by adding synthetic data based on each family to each family the images are generated from will create a higher learning rate from the Deep Convolutional Neural Network (DCNN). Various architectures of the DCNN will be used as assessments that benchmark each architectures’ learning rate before and after the augmentation.

Blockchain offers the ability to create distributed databases that can be trusted, even if some actors on the network may be malicious. We consider the problem of reducing the read overhead of a ledger built using blockchains as part of the IDASH 2018 competition. In this scenario, we have multiple nodes granted to access a server. The goal is to store the activity logs of the nodes accessing the server in a secure fashion, using a blockchain-based ledger. To increase search speed, we propose splitting the ledger into groups based on expected search terms, and storing each group on a separate blockchain. By doing so, a search for all records of a specific type is transformed from a linear search on all records, to a linear search on a small subset of records. In our solution, this increases search efficiency by a factor of 8, at the cost of increasing storage overhead by a factor of 4. The system can be adjusted based on what types of searches are expected to reduce this overhead.

We consider the setting of a master server who possesses confidential data (genomic, medical data, etc.) and wants to run linear regression on this data, as part of a machine learning algorithm for example. The master wants to distribute these computations to untrusted workers who have volunteered or are incentivized to help with this task. However, the data must be kept private (in an information theoretic sense) and not revealed to the individual workers. The workers may be busy and will take a random time to finish the task assigned to them. We are interested in reducing the aggregate delay experienced by the master. A known solution is to use a linear secret sharing scheme to divide the data into secret shares on which the workers can compute. However, classical codes can provide straggler mitigation assuming a worst-case scenario of a fixed number of stragglers. We introduce a new family of codes called Staircase codes that allow flexibility in the number of stragglers up to a given maximum, and universally achieve the information theoretic limit on the download cost by the Master, leading to latency reduction. Under the shifted exponential model, we find upper and lower bounds on the Master's mean waiting time. We derive the distribution of the Master's waiting time, and its mean, for systems with up to two stragglers. We show that Staircase codes always outperform classical secret sharing codes. For instance, Staircase codes can lead to up to $59%$ reduction in delay compared to classical secret sharing codes. We validate our results with extensive implementation on Amazon EC2 clusters.