conference paper
published journal article
published journal article
published journal article
Wireless communication is being used as an enabling technology with traditional fixed traffic control systems in this transitional era toward Intelligent Transportation Systems (ITS). Unfortunately, major security concerns have arisen with respect to ever-increasing complexity and interconnectivity, and a noticeable lack of attention for security in these systems. Addressing concerns is a colossal challenge as it requires thorough development and formal analysis of a system model with respect to security. To tackle this challenge, we present a novel formal attack modeling and impact analysis methodology based on the Link Queue Model (LQM) of traffic flow inside a double ring road network, which is equivalent to a grid network with homogeneous links. We develop attack models as functions of tampered traffic control settings (e.g., green time ratios, cycle length, retaining ratios) with outputs equivalent to mobility impacts on the traffic network (e.g., time until system reaches state convergence, asymptotic average network flow). Further, for a given attack model, we define and identify vulnerable states: states that are critical to protect because they lead to negative impacts under the given attack model. Using our methodology we found that for certain vulnerable states, after only a few cycles of tampered control settings an attacker could cause a real impact of 1.5x speed-up in gridlock state convergence or 37%-99% drop in the asymptotic average flow rate. These results imply potentially drastic financial costs for cities and all involved drivers if similar attacks were performed on a real traffic control system. (C) 2020 Elsevier Ltd. All rights reserved.
published journal article
published journal article
Performance indcators are quantitative measures that enable managers and policymakers to monitor the current position of an agency and outline strategies to improve performance. Because public services have many different dimensions of performance, a large number of performance indicators are normally used. In this paper a conceptual model is used to help select a few performance indicators that represent all the important performance concepts. Data were obtained from a national sample of 311 urban bus transit systems in the first year that data were reported under Section 15 of the Urban Mass Transportation Act of 1965, as amended. The steps in the performarice-evaluatlon procedure Involve defining a conceptual model of performance and designing a balancod set of performance indicators that represent all performance concepts. Factor analysis is then used to select the indicators that best represent all dimensions of performance. This smell, representative set of performance Indicators is used to analyze performance and to establish peer-group rankings.
published journal article
conference paper
In recent years, PowerShell is increasingly reported to appear in a variety of cyber attacks ranging from advanced persistent threat, ransomware, phishing emails, cryptojacking, financial threats, to fileless attacks. However, since the PowerShell language is dynamic by design and can construct script pieces at different levels, state-of-the-art static analysis based PowerShell attack detection approaches are inherently vulnerable to obfuscations. To overcome this challenge, in this paper we design the first effective and light-weight deobfuscation approach for PowerShell scripts. To address the challenge in precisely identifying the recoverable script pieces, we design a novel subtree-based deobfuscation method that performs obfuscation detection and emulation-based recovery at the level of subtrees in the abstract syntax tree of PowerShell scripts. Building upon the new deobfuscation method, we are able to further design the first semantic-aware PowerShell attack detection system. To enable semantic-based detection, we leverage the classic objective-oriented association mining algorithm and newly identify 31 semantic signatures for PowerShell attacks. We perform an evaluation on a collection of 2342 benign samples and 4141 malicious samples, and find that our deobfuscation method takes less than 0.5 seconds on average and meanwhile increases the similarity between the obfuscated and original scripts from only 0.5% to around 80%, which is thus both effective and light-weight. In addition, with our deobfuscation applied, the attack detection rates for Windows Defender and VirusTotal increase substantially from 0.3% and 2.65% to 75.0% and 90.0%, respectively. Furthermore, when our deobfuscation is applied, our semantic-aware attack detection system outperforms both Windows Defender and VirusTotal with a 92.3% true positive rate and a 0% false positive rate on average.
conference paper
The objective of this study is to propose an alternative methodology to model and forecast network traffic for planning applications in small and medium-sized communities where resources debilitate the development and applications of 4-step models. The major thrust of the proposed approach is that model estimation and forecasting are each accomplished through an O-D estimation using the Path Flow Estimator that allows for the use of various planning and field data such as land uses (converted to zonal trip production and attraction), traffic counts, and target O-D table as estimation constraints. The proposed procedure is applied with empirical data from a small community, the City of St. Helena in California to demonstrate how it can be implemented in practice.
conference paper