Results for “Attack Tree Goal”

DOE OSTI2017

Silverline Final Technical Report

Explore the source record for details and available documents.

97 MATHEMATICS AND COMPUTING↗

DOE OSTI2022

Operation Upshot-Knothole

A thundering boom and sheet of fire announced a dramatic, once in a lifetime event – the firing of a nuclear projectile from a 280 mm cannon. Travelling seven miles downrange, the projectile detonated 500 feet over the Nevada Test Site’s Frenchman Flat with a force of fifteen kilotons. Although the test was successful, the massive cannon, designed for tactical battlefield use, had a critical flaw. It was too large and cumbersome for mobile combat. The cannon test, codenamed Grable, was part of Operation Upshot-Knothole, the fourth test series conducted in Nevada. Beginning with the Annie test on March 17, 1953, and concluding with the Climax test on June 4th, the Operation consisted of three airdrops, seven tower detonations, and the one artillery shot. As with previous Nevada tests, the demarcation between the weapon development series, Upshot, and the DOD effects tests, Knothole, was blurred. All eleven tests generated data in support of weapon development as well as tactical battlefield applications. During Upshot-Knothole, the University of California Radiation Laboratory (UCRL), conducted its first ever tests, Ruth and Ray. Although neither test was successful, these failures, along with another a year later at Operation Castle, provided the new laboratory with design data leading to future successful tests. The Federal Civil Defense Administration (FCDA) participated in a test series with the general goal of preparing for societal recovery from a nuclear attack. Known as Operation Doorstep, the FCDA’s experiments evaluated the effects of a nuclear attack on food supplies, housing and urban structures, and even a copse of trees transplanted from nearby Mt. Charleston. A contingent of the press witnessed test Annie from an outcropping of rocks, subsequently named News Nob. The presence of the news media, along with the FCDA’s participation, marked a fundamental change in the Nevada test program - a change that that now included the general populace, whose survival was, of course, the rationale for testing. The Department of Defense continued and expanded its Desert Rock exercises of troop exercises, helicopter operations, and evaluation of blast damage to military aircraft, tanks, and guns. Annie, Nancy, Badger, Simon, Encore, and Grable involved larger numbers of personnel than the other five shots. Below is an edited and condensed account of Desert Rock activities compiled by the Defense Threat Reduction Agency.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗

DOE OSTI2022

Shifting Left for Machine Learning: An Empirical Study of Security Weaknesses in Supervised Learning-based Projects

Context: Supervised learning-based projects (SLPs), i.e., software projects that use supervised learning algorithms, such as decision trees are useful for performing classification-related tasks. Yet, security weaknesses, such as the use of hard-coded passwords in SLPs, can make SLPs susceptible to security attacks. A characterization of security weaknesses in SLPs can help practitioners understand the security weaknesses that are frequent in SLPs and adopt adequate mitigation strategies. Objective: The goal of this paper is to help practitioners se-curely develop supervised learning-based projects by conducting an empirical study of security weaknesses in supervised learning-based projects. Methodology: We conduct an empirical study by quantifying the frequency of security weaknesses in 278 open source SLPs. Results: We identify 22 types of security weaknesses that occur in SLPs. We observe ‘use of potentially dangerous function’ to be the most frequently occurring security weakness in SLPs. Of the identified 3,964 security weaknesses, 23.79 % and 40.49 % respectively, appear for source code files used to train and test models. We also observe evidence of co-location, e.g., instances of command injection co-locates with instances of potentially dangerous function. Conclusion: Based on our findings, we advocate for a shift left approach for SLP development with security-focused code reviews, and application of security static analysis.

Bhuiyan, Farzana Ahamed↗