This PDF file contains the front matter associated with SPIE Proceedings Volume 8019, including the Title Page, Copyright information, Table of Contents, and the Conference Committee listing.

Malware spread via Internet is a great security threat, so studying their behavior is important to identify and classify them. Using SSDT hooking we can obtain malware behavior by running it in a controlled environment and capturing interactions with the target operating system regarding file, process, registry, network and mutex activities. This generates a chain of events that can be used to compare them with other known malware. In this paper we present a simple approach to convert malware behavior into activity graphs and show some visualization techniques that can be used to analyze malware behavior, individually or grouped.

Effective visual analysis of computer network defense (CND) information is challenging due to the volume and complexity of both the raw and analyzed network data. A typical CND is comprised of multiple niche intrusion detection tools, each of which performs network data analysis and produces a unique alerting output. The state-of-the-practice in the situational awareness of CND data is the prevalent use of custom-developed scripts by Information Technology (IT) professionals to retrieve, organize, and understand potential threat events. We propose a new visual analytics framework, called the Oak Ridge Cyber Analytics (ORCA) system, for CND data that allows an operator to interact with all detection tool outputs simultaneously. Aggregated alert events are presented in multiple coordinated views with timeline, cluster, and swarm model analysis displays. These displays are complemented with both supervised and semi-supervised machine learning classifiers. The intent of the visual analytics framework is to improve CND situational awareness, to enable an analyst to quickly navigate and analyze thousands of detected events, and to combine sophisticated data analysis techniques with interactive visualization such that patterns of anomalous activities may be more easily identified and investigated.

A variety of anomaly detection algorithms have been applied to surveillance tasks for detecting threats with some success. However, it is not clear which anomaly detection algorithms should be used for domains such as ground-based maritime video surveillance. For example, recently introduced algorithms that use local density techniques have performed well for some tasks, but they have not been applied to ground-based maritime video surveillance. Also, the reasons for the performance differences of anomaly detection algorithms on problems of varying difficulty are not well understood. We address these two issues by comparing families of global and local anomaly detection algorithms on tracks extracted from ground-based maritime surveillance videos. Obtaining maritime anomaly data can be difficult or even impractical. Therefore, we use a generative approach to vary and control the difficulty of anomaly detection tasks and to focus on borderline and difficult situations in our empirical comparison studies. We report that global algorithms outperform local algorithms when tracks have large and unstructured variations, while they perform equally well when the tracks have only minor variations.

This paper addresses the problem of color image quality assessment. The paper presents a novel image/ video quality metrics, Color-SSIM (color-based structural similarity index), based on CIELAB color model. The main drawback of the SSIM algorithm in the spatial domain is that it is highly sensitive to the translation, rotation and scaling of images. This problem can be solved by applying SSIM to the individual channels of a color image in CIELAB color space and by combining the results from the individual channels into a weighted vector mean. Experimental results show that proposed quality metric is highly correlated with the experimental data collected through subjective experiments.

This paper describes the ongoing development of the TERRA(TM) (Timeline Editing for Real-time Review and Analysis) application by Waterfall Solutions Ltd. (WS), which is a high-throughput video analytics tool designed to be highly flexible to user requirements. One of the known pitfalls associated with video analytics is the lack of sufficient user interaction within existing systems, often leading to system unreliability due to an unacceptably high level of false alarms. Therefore, instead of aiming to produce a fully automated system, TERRA(TM) emphasises the importance of having a human user in the loop, and consequently concentrates on providing information in the most intuitive and efficient a manner possible.

The officer-in-charge deploying the security personnel to protect a large infrastructure meets a complex decision problem if multiple threats have to be handled simultaneously: Limited surveillance resources have to be optimally allocated to the many affected sectors in order to provide the safest threat state for the infrastructure as a whole over time. This contribution presents an interactive resource management system providing decision support for optimally deploying surveillance resources. For this purpose, the user interface displays a risk map of the infrastructure's current threat situation together with a recommendation of the currently optimal resource allocation. Thereby, the resource allocation recommendation is obtained by solving a CMDP model of an infrastructure's global threat situation. An evaluation of the CMDP-based decision support shows that displaying both resource allocation recommendation and risk map enables the participants to handle threat scenarios more cost-saving, and additionally causes less workload and higher acceptance among the participants.

For monitoring network traffic, there is an enormous cost in collecting, storing, and analyzing network traffic datasets. Data mining based network traffic analysis has a growing interest in the cyber security community, but is computationally expensive for finding correlations between attributes in massive network traffic datasets. To lower the cost and reduce computational complexity, it is desirable to perform feasible statistical processing on effective reduced datasets instead of on the original full datasets. Because of the dynamic behavior of network traffic, traffic traces exhibit mixtures of heavy tailed statistical distributions or overdispersion. Heavy tailed network traffic characterization and visualization are important and essential tasks to measure network performance for the Quality of Services. However, heavy tailed distributions are limited in their ability to characterize real-time network traffic due to the difficulty of parameter estimation. The Entropy-Based Heavy Tailed Distribution Transformation (EHTDT) was developed to convert the heavy tailed distribution into a transformed distribution to find the linear approximation. The EHTDT linearization has the advantage of being amenable to characterize and aggregate overdispersion of network traffic in realtime. Results of applying the EHTDT for innovative visual analytics to real network traffic data are presented.

This paper discusses the decomposition of hostile intentions into abnormal behaviors. A list of such behaviors has been compiled for the specific case of public transport. Some of the deviant behaviors are hard to observe by people, as they are in the midst of the crowd. Examples are deviant walking patterns, prohibited actions such as taking photos and waiting without taking the train. We discuss our visual analytics algorithms and demonstrate them on CCTV footage from the Amsterdam train station.

The appearance of a material viewed in millimeter wavelength is a function of its reflectivity and absorptivity. These optical properties can be derived from measurement of the complex dielectric constant. Knowledge of the imaginary component is particularly important to assess the brightness of transparent or semi-transparent materials, in which the return from the back surface contributes to the overall reflection. The method presented here is well-suited to determine the dielectric constant of small samples of low-loss materials, and uses a modification of the dielectric-post resonator technique in which the sample fits into a larger, solid post fixture. The measurement frequency varies only slightly among different sample materials because the electromagnetic properties of the resonance are largely set by the supporting fixture. The method can be used to measure liquids and powders, as well as solid materials. The design and electromagnetic theory of the resonant technique are described, and the precision is discussed in context of sample measurements.

As the development of active millimeter wave imaging systems continues, it is necessary to validate materials that simulate the expected response of explosives. While physics-based models have been used to develop simulants, it is desirable to image both the explosive and simulant together in a controlled fashion in order to demonstrate success. To this end, a millimeter wave contrast phantom has been created to calibrate image grayscale while controlling the configuration of the explosive and simulant such that direct comparison of their respective returns can be performed. The physics of the phantom are described, with millimeter wave images presented to show successful development of the phantom and simulant validation at GHz frequencies.

The Raman spectra of triacetone triperoxide (TATP) and its fully deuterated isotopologue (d₁₈-TATP) have been measured. Density functional theory calculations were performed using the EDF2/6-311++G** and B3LYP/6-311++G** methods/basis set to predict the Raman spectra of both the parent and deuterated isotopologues. The predicted isotopic shifts were used to identify frequency shifts in the experimental results and tentative assignments have been made for 10 fundamental vibrational modes of d₁₈-TATP.

Georgia Tech has investigated methods for the detection and tracking of personnel in a variety of acquisition environments. This research effort focused on a detailed phenomenological analysis of human physiology and signatures with the subsequent identification and characterization of potential observables. As a fundamental part of this research effort, Georgia Tech collected motion capture data on an individual for a variety of walking speeds, carrying loads, and load distributions. These data formed the basis for deriving fundamental properties of the individual's motion and supported the development of a physiologically-based human motion model. Subsequently this model aided the derivation and analysis of motion-based observables, particularly changes in the motion of various body components resulting from load variations. This paper will describe the data acquisition process, development of the human motion model, and use of the model in the observable analysis. Video sequences illustrating the motion data and modeling results will also be presented.

Georgia Tech has investigated methods for the detection and tracking of personnel in a variety of acquisition environments. This research effort focused on a detailed phenomenological analysis of human physiology and signatures with the subsequent identification and characterization of potential observables. Both aspects are needed to support the development of personnel detection and tracking algorithms. As a fundamental part of this research effort, Georgia Tech collected motion capture data on an individual for a variety of walking speeds, carrying loads, and load distributions. These data formed the basis for deriving fundamental properties of the individual's motion and the derivation of motionbased observables, and changes in these fundamental properties arising from load variations. Analyses were conducted to characterize the motion properties of various body components such as leg swing, arm swing, head motion, and full body motion. This paper will describe the data acquisition process, extraction of motion characteristics, and analysis of these data. Video sequences illustrating the motion data and analysis results will also be presented.

In this paper, we address the issues involved in detecting and classifying people walking and jogging/running. When the people are walking, sensors observe the signals for a longer period compared to the case in which people are jogging. To identify fast-moving people, one must make the decision based on the few telltale signals generated by a person jogging: a higher impact of a foot on the ground, which can be monitored by seismic sensors; the panting noise observed through an acoustic sensor; or a higher Doppler from an ultrasonic sensor, to name few. First, we investigate the phenomenology associated with seismic signals generated by a person walking and jogging. Then, we analyze ultrasonic signatures to distinguish the characteristics associated with them. Finally, we develop the algorithms to detect and classify people walking and jogging. These algorithms are tested on data collected in an outdoor environment.

This paper describes recent advances with our earlier developed Personal Dead-reckoning (PDR) system for GPS-denied environments. The PDR system uses a foot-mounted Inertial Measurement Unit (IMU) that also houses a three axismagnetometer. In earlier work we developed methods for correcting the drift errors in the accelerometers, thereby allowing very accurate measurements of distance traveled. In addition, we developed a powerful heuristic method for correcting heading errors caused by gyro drift. The heuristics exploit the rectilinear features found in almost all manmade structures and therefore limit this technology to indoor use only. Most recently we integrated a three-axis magnetometer with the IMU, using a Kalman Filter. While it is well known that the ubiquitous magnetic disturbances found in most modern buildings render magnetometers almost completely useless indoors, these sensors are nonetheless very effective in pristine outdoor environments as well as in some tunnels and caves. The present paper describes the integrated magnetometer/IMU system and presents detailed experimental results. Specifically, the paper reports results of an objective test conducted by Firefighters of California's CAL-FIRE. In this particular test, two firefighters in full operational gear and one civilian hiked up a two-mile long mountain trail over rocky, sometimes steeply inclined terrain, each wearing one of our magnetometer-enhanced PDR systems but not using any GPS. During the hour-long hike the average position error was about 20 meters and the maximum error was less than 45 meters, which is about 1.4% of distance traveled for all three PDR systems.

This paper describes the efforts toward the development of bio-inspired flow and acoustic sensor from fish. Anatomy study has indicated a basic transduction element is the hairy structure. This study describes the fabrication of sensing element that emulate the mechano-electrical transduction mechanism. These include the use of advanced lithographic technology for sensor electrode deposition. The sensor was polarized under high voltage gradient. Preliminary experimental evaluation indicates that the hairy structures are responsive to external excitations. Especially, the hairy structure made of the SDW method not only produces transduction component for mechano-electrical coupling, it is also rugged, sensitive and fracture resistant. The hairy structure also features directional sensitivity which could be used for acoustic field direction determination. The hairy structure is being further refined and will ultimately be integrated into develop bio-inspired flow and acoustic sensors.

The classification of firearms from their acoustic signatures has many potential benefits for a variety of military and security operations. Most approaches to acoustic gunshot classification can be characterized as frame based feature classification approaches, where the time-domain acoustic signal is partitioned into a set of frames from which characterizing features are extracted and used to classify the signals. Although this approach can be quite successful, performance is highly dependent upon the relationship between the selected frame size and the signals under consideration. In this work we consider a statistical model for time-domain gunshot signatures which eliminates the need for both data partitioning and the selection of characterizing features. Each class of acoustic signals is modeled as a hidden Markov model (HMM) with autoregressive (AR) source densities. Each AR model specifies a set of spectral and energy characteristics of the signal while the HMM characterizes the transitions between these states. The model is constructed using nonparametric Bayesian techniques to allow model inference to learn the number of states within the HMM and the AR order of each state density. The model thus selects the number of unique spectral components and the complexity of each of these components from the set of training data, limiting model over-fitting and eliminating the need to optimize performance over these parameters. We demonstrate that classification using the proposed statistical model performs comparably to existing techniques without requiring user specified features, thus allowing the same statistical models to be used on future datasets without modification.

Sniper positioning systems described in the literature use a two-step algorithm to estimate the sniper's location. First, the shockwave and the muzzle blast acoustic signatures must be detected and recognized, followed by an estimation of their respective direction-of-arrival (DOA). Second, the actual sniper's position is calculated based on the estimated DOA via an iterative algorithm that varies from system to system. The overall performance of such a system, however, is highly compromised when the first step is not carried out successfully. Currently available systems rely on a simple calculation of differences of time-of-arrival to estimate angles-of-arrival. This approach, however, lacks robustness by not taking full advantage of the array of sensors. This paper shows how the delay-and-sum beamforming technique can be applied to estimate the DOA for both the shockwave and the muzzle blast. The method has the twofold advantage of 1) adding an array gain of 10 logM, i.e., an increased SNR of 6 dB for a 4-microphone array, which is equivalent to doubling the detection range assuming free-field propagation; and 2) offering improved robustness in handling single- and multi-shots events as well as reflections by taking advantage of the spatial filtering capability.

The paper presents some practical aspects of sniper IR signature measurements. Description of particular signatures for sniper shot in typical scenarios has been presented. We take into consideration sniper activities in the open area as well as in urban environment. The measurements were made at field test ground. High precision laboratory measurements were also performed. Several infrared cameras were used during measurements to cover all measurement assumptions. Some of the cameras are measurement-class devices with high accuracy and frame rates. The registrations were simultaneously made in UV, NWIR, SWIR and LWIR spectral bands. The infrared cameras have possibilities to install optical filters for multispectral measurement. An ultra fast visual camera was also used for visible spectra registration. Exemplary sniper IR signatures for typical situation were presented. LWIR imaging spectroradiometer HyperCam was also used during the laboratory measurements and field experiments. The signatures collected by HyperCam were useful for the determination of spectral characteristics of shot.

The paper presents some aspects of muzzle flash detection using low resolution polycrystalline PbSe uncooled 32×32 detectors array. This system for muzzle flash detection works in MWIR (3 - 5 microns) region and it is based on VPD (Vapor Phase Deposition) technology. The low density uncooled 32×32 array is suitable for being used in low cost IR imagers sensitive in the MWIR band with frame rates exceeding 1.000 Hz. The FPA detector, read-out electronics and processing electronics (allowing the implementation of some algorithms for muzzle flash detection) has been presented. The system has been tested at field test ground. Results of detection range measurement with two types of optical systems (wide and narrow field of view) have been shown. The initial results of testing of some algorithms for muzzle flash detection have been also presented.

The nature of recent terrorist attacks and military conflicts as well as the necessity to protect bases, convoys and patrols gave serious impact to the development of more effective security systems. Widely-used so far concepts of perimeter protection with zone sensors will be replaced in the near future with multi-sensor systems. This kind of systems can utilize day/night cameras, IR uncooled thermal cameras as well as millimeter-wave radars detecting radiation reflected from target. Ranges of detection, recognition and identification for all targets depends on the parameters of the sensors used and the observed scene itself. Apart from the sensors the most important elements that influence the system effectiveness is intelligent data analysis and a proper data fusion algorithm. A multi-sensor protection system allows to achieve significant improvement of detection probability of intruder. The concept of data fusion in multi-sensor system has been introduced. It is based on image fusion algorithm which allows visualizing and tracking intruders under any conditions.

Results of dispersion experiments and dispersion modelling of explosives, drugs, and their precursors will be presented. The dispersion of chemicals evolving during preparation of home made explosives and a drug produced in an improvised manner in an ordinary kitchen has been measured. Experiments with concentration of hydrogen peroxide have been performed during spring and summer of 2009 and 2010 and further experiments with concentration of hydrogen peroxide, synthesis and drying of TATP and Methamphetamine are planned for the spring and summer of 2011. Results from the experiments are compared to dispersion modelling to achieve a better understanding of the dispersion processes and the resulting substances and amounts available for detection outside the kitchen at distances of 10-30 m and longer. Typical concentration levels have been determined as a function of environmental conditions. The experiments and modelling are made as a part of the LOTUS project aimed at detecting and locating the illicit production of explosives and drugs in an urban environment. It can be concluded that the proposed LOTUS system concept, using mobile automatic sensors, data transfer, location via GSM/GPS for on-line detection of illicit production of explosive or precursors to explosives and drugs is a viable approach and is in accordance with historical and today's illicit bomb manufacturing. The overall objective and approach of the LOTUS project will also be presented together with two more projects called PREVAIL and EMPHASIS both aiming at hindering or finding illicit production of home made explosives.

Wireless sensor networks have been proposed as promising candidates to provide automated monitoring, target tracking, and intrusion detection for border surveillance. In this paper, we demonstrate an ad-hoc wireless sensor network system for border surveillance. The network consists of heterogeneously autonomous sensor nodes that distributively cooperate with each other to enable a smart border in remote areas. This paper also presents energy-aware and sleeping algorithms designed to maximize the operating lifetime of the deployed sensor network. Lessons learned in building the network and important findings from field experiments are shared in the paper.

The use of multiple cooperative sensors for the detection of person borne IEDs is investigated. The purpose of the effort is to evaluate the performance benefits of adding multiple sensor data streams into an aided threat detection algorithm, and a quantitative analysis of which sensor data combinations improve overall detection performance. Testing includes both mannequins and human subjects with simulated suicide bomb devices of various configurations, materials, sizes and metal content. Aided threat recognition algorithms are being developed to test detection performance of individual sensors against combined fused sensors inputs. Sensors investigated include active and passive millimeter wave imaging systems, passive infrared, 3-D profiling sensors and acoustic imaging. The paper describes the experimental set-up and outlines the methodology behind a decision fusion algorithm-based on the concept of a "body model".

In this paper we discuss a rather surprising result of Bayesian inference analysis: performance of a broad variety of sensors depends not only on a sensor system itself, but also on CONOPS parameters in such a way that even an excellent sensor system can perform poorly if absolute probabilities of a threat (target) are lower than a false alarm probability. This result, which we call Bayesian paradox, holds not only for binary sensors as discussed in the lead author's previous papers, but also for a more general class of multi-target sensors, discussed also in this paper. Examples include: ATR (automatic target recognition), luggage X-ray inspection for explosives, medical diagnostics, car engine diagnostics, judicial decisions, and many other issues.

Electro-optical sensor systems are fairly commonplace on naval vessels. However, these sensor systems are usually implemented as stand-alone systems or are minimally integrated in shipboard combat management systems, and are mostly used as secondary sensors. Therefore, it is difficult to include these systems in generic command and control concepts; on board they remain an operator aid at best. To facilitate integration in the future, this paper proposes a model of a warship with only EO sensors as its primary sensor suite. The question of whether such a ship is sufficiently capable in a modern naval theater is addressed, as well as specific sensor design challenges and the command and control concepts needed in order to maximize the performance of the proposed vessel.

Next Generation EO/IR focal plane arrays using nanostructure materials are being developed for a variety of Defense and Homeland Security Sensor Applications. Several different nanomaterials are being evaluated for these applications. These include ZnO nanowires, GaN Nanowires and II-VI nanowires, which have demonstrated large signal to noise ratio as a wide band gap nanostructure material in the UV band. Similarly, the work is under way using Carbon Nanotubes (CNT) for a high speed detector and focal plane array as two-dimensional array as bolometer for IR bands of interest, which can be implemented for the sensors for homeland security applications. In this paper, we will discuss the sensor design and model predicting performance of an EO/IR focal plane array and Sensor that can cover the UV to IR bands of interest. The model can provide a robust means for comparing performance of the EO/IR FPA's and Sensors that can operate in the UV, Visible-NIR (0.4- 1.8μ), SWIR (2.0-2.5μ), MWIR (3-5μ), and LWIR bands (8-14μ). This model can be used as a tool for predicting performance of nanostructure arrays under development. We will also discuss our results on growth and characterization of ZnO nanowires and CNT's for the next generation sensor applications. We also present several approaches for integrated energy harvesting using nanostructure based solar cells and Nanogenerators that can be used to supplement the energy required for nanostructure based sensors.