Publications

Significant effort is placed on tuning the internal parameters of fuzzers to explore the state space, measured as coverage, of binaries. In this work, we investigate the effects of the external environment on the resulting coverage after fuzzing two binaries with AFL for 24 hours. Parameters such as scaling to multiple nodes, node saturation, and parallel file system type on HPC resources are controlled in order to maximize coverage. It will be shown that employing a parallel file system such as IBM's General Parallel File System offers an advantage for fuzzing operations, since it contains enhancements for performance optimization. When combined with scaling to two and four nodes, while simultaneously restricting the number of coordinated AFL tasks per node on the low end (10-50% of available physical cores), coverage may be enhanced within a shorter period of time. Thus, controlling the external environment is a useful effort.

Snippet is a collaborative source code auditing tool developed by Sandia National Laboratories, in conjunction with researchers from other government agencies and partners. As a tool for use by groups of auditors, Snippet showed the value of providing in-line annotations that captured the thoughts of auditors in such a way that teams of auditors could share their insights. Snippet users found that the annotation mechanisms improved the auditing process but were frustrated at having to learn another environment. To address this issue, collaborators made extensions to existing Integrated Development Environments (IDEs) to incorporate functionality that mimics Snippet's behaviors. This document is one of a pair of documents. The other document, "Snippet Open-Source Specification", goes into details about the history and reasoning behind the requirements made in this document. That document provides for a broader understanding of the motivations backing this document. This document provides the complete specification for collaborative annotation, and a characterization of each specification as required or recommended. Tools that implement these specifications will be considered Snippet compliant. The intent is that complete implementation of these specifications will enable seamless sharing of annotation information between disjoint tools.

Snippet is a collaborative software code auditing tool developed at Sandia National Laboratories (Sandia) in conjunction with several sponsoring government agencies to enable software analysts, individually or in groups, to non-destructively audit large codebases, share files and comments from those audits, and develop Snippet plugins for use with other text editing software applications. This specification defines the requirements and the reasoning behind the requirements for tools developed to be compatible with the technology and purpose of Snippet. A condensation of the requirements is given in the companion document, "Snippet Open-Source Specification Synopsis" also generated by Sandia National Laboratories. Snippet's approach to browsing through codebases is similar to a web browser navigating the internet.

Abstract not provided.

Abstract not provided.

Abstract not provided.

The development of tools for complex dynamic security systems is not a straight forward engineering task but, rather, a scientific task where discovery of new scientific principles and math is necessary. For years, scientists have observed complex behavior but have had difficulty understanding it. Prominent examples include: insect colony organization, the stock market, molecular interactions, fractals, and emergent behavior. Engineering such systems will be an even greater challenge. This report explores four tools for engineered complex dynamic security systems: Partially Observable Markov Decision Process, Percolation Theory, Graph Theory, and Exergy/Entropy Theory. Additionally, enabling hardware technology for next generation security systems are described: a 100 node wireless sensor network, unmanned ground vehicle and unmanned aerial vehicle.

Abstract not provided.

Traditionally law enforcement agencies have relied on basic measurement and imaging tools, such as tape measures and cameras, in recording a crime scene. A disadvantage of these methods is that they are slow and cumbersome. The development of a portable system that can rapidly record a crime scene with current camera imaging, 3D geometric surface maps, and contribute quantitative measurements such as accurate relative positioning of crime scene objects, would be an asset to law enforcement agents in collecting and recording significant forensic data. The purpose of this project is to develop a feasible prototype of a fast, accurate, 3D measurement and imaging system that would support law enforcement agents to quickly document and accurately record a crime scene.