JEFF FAIRBANKS

Title: Identifying ATT&CK® Tactics in Android Malware Control Flow Graph Through Graph Representation Learning and Interpretability.

Thesis Adviser: Dr. Dale Hamilton, Dr. Kevin McCarty

Malware affects millions of machines, causing havoc to those it reaches. The dangers and negative impact that malware has inflicted push researchers to find a way to mitigate its effects. Labeling malware within the anti-malware services becomes a challenge in finding the correct Tactics, Techniques, and Procedures (TTP) that each malware implements. The Control Flow Graph (CFG) describes the structure of a program during its execution; this is how a program flows. In reference to malware, it represents the flow of all the internal and external function calls. The current research proposes a novel approach to locating ATT&CK® TTP in a CFG by applying Machine Learning Classifiers on Android Malware. Through these methods, the approach associates the TTP, given by the ATT&CK® Framework with a subgraph of an Android malware CFG. Using Graph Neural Network and SIR-GN node representation learning approach, this methodology processes the CFG and creates a model that classifies the associated TTP. Furthermore, the explanation technique SHapley Additive exPlanations (SHAP), a model agnostic game-theoretic approach to explain any machine learning model’s output and identify the subgraph in the CFG connected with the specific TTP, is implemented. Preliminary experiments indicate approximately 89% accuracy in classifying such techniques.

Jeffrey’s research has been published three times, making him a 3-time peer-reviewed published author. Jeff also presented his research at the SigmaXi, AAAI, and IEEE BigData Conferences. Jeffrey Plans to attend a full-ride scholarship to Penn State to pursue his Ph.D.

KAMDEN BROTHERS

Title: Improving Wildland Fire Burn Extent Using Machine Learning to Determine Burnt Pixels Hidden by Trees

Thesis Adviser: Dr. Dale Hamilton

Using a support vector machine (SVM) on imagery obtained from small unmanned aircraft systems (sUAS) has been an efficient and fairly accurate method to calculate burn extent. One problem that needs to be addressed is that the vegetation underneath a tree cannot be seen in drone imagery and will be misclassified due to the tree crown which is obscuring the surface vegetation in the image. This research makes the assumption that if a tree is completely surrounded by burnt pixels, then the vegetation under the tree is burnt as well. An SVM was used to locate burn pixels and a mask region- based convolutional neural network (Mask R-CNN) was used to locate clusters of pixels that represent a tree crown. A program was created to located tree pixel clusters which were completely surrounded in the image by pixels that had previously been classified as burned by the SVM and included the cluster of tree crown pixels as being within the extent of the burn. These methods yielded the best results on fires which had a clear distinction between burn pixels, unburned pixels, and tree crowns. These new methods created will help to calculate a more accurate burn extent from an image to help forest managers rehabilitate burnt forests.

SAMUEL JONES

Title: Wildland Fire Tree Mortality Mapping from Hyperspatial Imagery Using Machine Learning.

Thesis Adviser: Dr. Dale Hamilton

The use of small unmanned aircraft systems (sUAS) for obtaining wildland imagery has enabled the production of more accurate data regarding the effects of fire on forested land. This increase in precision enables accurate detection of trees from hyperspatial imagery, and thus the calculation of canopy cover. When pre-fire data is compared with post-fire data from existing canopy cover products such as the LANDFIRE project, a measure of tree mortality, which is a measure of burn severity, can be calculated from the difference between the two. A mask region-based convolutional neural network (MR-CNN) was trained to classify trees as groups of pixels from a hyperspatial orthomosaic. The tree classification is summarized at 30m in a canopy cover raster. Canopy reduction allows the mapping of burn severity while also identifying where surface, passive, and active crown fire occurred within the observed region. The calculated canopy cover derived from hyperspatial imagery was found to be significantly more accurate when compared with LANDFIRE canopy cover in all observed regions. The hyperspatially derived canopy cover reflected visual observations from respective sUAS imagery and ground truthing.

ENOCH LEVANDOVSKY

Title: Mapping Burn Extent of Very Large Wildland Fires from Satellite Imagery Using Machine Learning Trained from Localized Hyperspatial Imagery.

Thesis Adviser: Dr. Dale Hamilton

Many wildland fire researchers struggle to get an accurate of burn acreage estimate of a wildland fire due to technology limitations. The effort of the research is to aid wildland fire researchers towards determining the accuracy of mapping out wild land fire using satellite imagery. This research used sUAS wildland fire imagery to determine how accuracy of wildland fire detection is impacted when comparing hyperspatial to sUAS imagery resampled to satellite scale resolution in. This project made the assumption that sUAS burn extent data was accurate. This assumption allowed for the resampled training data, using fuzzy logic control, to be used as accurate satellite resolution training data. The results showed that even though the resolution of imagery significantly drops, the accuracy of the burn extent remains relatively high throughout fires. Although sUAS imagery is deemed to be more accurate given its resolution, acquiring satellite imagery is much more time efficient, cost efficient, and has a consistent history of clean data which serves as a great alternative towards mapping out wildland fire compared to sUAS imagery. This thesis answered the question of how accuracy is impacted when using satellite imagery in replace for sUAS imagery in the case of wildland fires.

ALEESHA CHAVEZ

Title: Application of a Robotic Turf Mower.

Thesis Adviser: Dr. Dale Hamilton

Traditionally turf fields are mowed two times a week, and cost up to 80 dollars an acre a month, which annually ends up costing a turf company 30,000 dollars and up. Turf companies have to deal with high labor costs, keeping up with maintenance of machinery, and spending precious time on lawn upkeep. A need exists for more efficient ways for companies to mow. The purpose of the project was to create a robotic turf mower that can cleanly mow acres of grass at a time, with no human help, and then to look into the potential benefits and applications of using a robotic mower for turf fields and other large grass fields, instead of mower operated by man. Initial efforts were focused on programming development on a prototype robot model provided by GCR (Green Cut Robotics) Company. Results show promise in precise lawn mowing capabilities with pre-determined coordinates for accurate and straight-line lawn mowing. Further work will need to be done for cases when the GPS has no signal, and for the robot to have the capability of motion detection. Results strongly support the full functionality of a robotic mower that a turf company money and time by cutting operation costs, and having the capability to move outside the turf field domain.

JARRET SHEEHAN

Title: Application developed to detect anomalies from data generated by a network.

Thesis Adviser: Dr. Kevin McCarty

Northwest Nazarene University’s network generates a large amount of data every single day. The amount of labor to manually parse through all of that data would take 4 people working 40 hours a week to keep up with the logs. The intention of this project is to train a neural network to automatically parse through the network logs and notify the network team of any anomaly it comes across. First a set of metadata was created from network logs retrieved from NNU’s networking team. Next a parser was built in java to take the logs and parse them into a database built in Microsoft SQL Server. Last a neural network was trained on the retrieved network logs. This network is built using Google’s Python Tensorflow software. Once the neural network finds an anomaly it will send an alert to the networking team.

ETHAN MCPHERSON

Title: Mobile application for sending and tracking basketball workouts while a player is in the off season.

Thesis Adviser: Dr. Dale Hamilton

Mobile devices are becoming more prominent in the world, due to their easy accessibility. In the world of sports, this means that nearly every athlete has access to a smartphone when they go to work out. This project is intended to help collegiate athletes reach their full potential for sport specific workouts, as well as strength and conditioning. The main problem that this project sought to solve was the ability for both the IOS and Android platforms to have a place where they would receive the same information with no disconnect, eliminating a need for athletes to use a certain platform. The next largest task was to give coaches the ability to send workouts to players on their roster. Finally, the last part of this project was to create a way for players to track their personal workouts to see their growth in the off season. Future work includes data calculations to give workout suggestions to athletes and help them improve their game even further.