As a typical application of the Internet of Things (IoT), smart home systems facilitate home setup where appliances and devices can be controlled automatically and remotely from anywhere with an Internet connection. Devices within a smart home system are usually correlated according to the automation rules/programs preconfigured by system owners. However, attackers can exploit these complex correlations among devices to conduct indirect attacks, making it challenging for owners to locate the root cause of a security incident and identify compromised devices. In this article, we propose SmartTracer, an anomaly-driven provenance analysis approach based on interdevice correlation extraction and tracing. Specifically, we extract correlations from the smart home system’s automation setup and physical interaction configuration. We define a unified dependency graph to describe the event causality among devices based on the event correlation and device run-time states. We then present an identification algorithm to profile trigger-action sequences from the abnormal run-time dependency graph and identify root cause nodes of anomalies. We prototype our approach and evaluate it on a self-developed testbed. The experiment results show that SmartTracer effectively provides a complete and precise provenance analysis for attacks exploited by the execution chains of automation. SmartTracer can generate a dependency graph for around 100 automation rules in 0.03 s and identify anomalies within 0.14 s.

Collaborative physical layer authentication (CPLA), which leverages spatial diversity, holds promise for enhancing the performance of feature-based physical layer authentication. However, some existing CPLA schemes simply aggregate the local information of collaborators to make final judgments and rarely consider the involvement of malicious collaborators. In this paper, we propose an impression-weighted based local decision aggregation scheme for detecting spoofing attacks in the presence of malicious collaborators. Specifically, the authenticator continually evaluates the authentication capabilities of collaborators by verifying the accuracy of local decisions and then synthesizes their long-term capabilities into impressions using a fuzzy membership function. These impression values will be dynamically updated upon completion of each authentication task. Moreover, a reinforcement learning scheme is employed to find the optimal threshold for authentication in a dynamic environment. Simulation results validate the high robustness and effectiveness of our proposed approach, guaranteeing the CPLA system's reliable operation.

Machine learning (ML)-based physical layer authentication (PLA) has attracted much attention since neural networks can be constructed to identify channel characteristics in complex wireless environments. This enables high-authentication performance and lightweight deployment in the Internet of Things (IoTs). Due to the booming growth of IoT connections, the workload of the central authenticator increases significantly. As a result, resource-constrained terminals are unable to independently handle the computationally complex ML task. Therefore, cooperative PLA (CoPLA), which introduces multiple supervised nodes as task-sharing entities, is emerged as a promising solution to address this concern. However, in existing CoPLA studies, some critical issues have been overlooked. For example, the consideration of which collaborative nodes are eligible or best suited for cooperation to maximize the authentication gains. Moreover, the security threats posed by untrusted collaborators are equally challenging. In this article, we propose a federated learning (FL)-based CoPLA scheme that utilizes a group of edge devices to jointly build an authenticator. This ensures privacy preservation and higher robustness. To figure out the optimal collaborator selection in CoPLA, an adaptive search procedure via reinforcement learning (RL) is customized. Furthermore, we introduce a lightweight reputation estimation method to evaluate each collaborator’s credibility, thereby uncovering underperforming devices or hidden internal attackers. Finally, simulations and real-world experiments are carried out. The results show that the authentication accuracy of our scheme is 9.52% higher than that of blind cooperation. And, it outperforms other existing CoPLA schemes in terms of time efficiency and robustness.

Bitcoin first proposed the Nakamoto consensus that applies proof of work into the blockchain structure to build a trustless append-only ledger. The Nakamoto consensus solves the distributed consistency problem in the public network but wastes too much computing power. Instead of consuming computing resources, many improved consensus schemes address this problem by leveraging miners’ storage resources. However, these schemes fail to let miners store data constantly and usually rely on a dealer to assign data, which is hard to build a reliable decentralized storage system. In this article, we first design a variant consensus algorithm named Proof of Continuous Work (PoCW) with a storage-related incentive mechanism. Miners can accumulate mining advantage by continuously submitting proofs of storage. Then, we present a hash ring-based data allocation algorithm using the blockchain’s state. Combined with both of them, we build a reliable blockchain-based storage system without relying on any third parties. The theoretical analysis and simulation results demonstrate that the proposed system has higher reliability than those existing systems, and we also give practical suggestions about system parameters. Finally, we discuss additional benefits that our system brings.

Users enjoy the convenience of watching videos on smart devices. However, video watching records can be exposed without users’ knowledge and be exploited to infer private information. In this paper, we design and implement a new side-channel attack system, namedvideo aficionado, which can identify video watching information without violating any access control policies on Android. Our system only needs to collect power consumption data of a video playing app, which does not require explicit user permission. The collected data is sent to a remote server, where noise is cleaned and identified by a multi-layer perceptron (MLP) trained classifier. We evaluate our proposed system through a set of carefully designed experiments. Experimental results demonstrate that our system can make an identification with 74.5 percent accuracy on average for each 20-second power measurement segment out of 3918 segments collected from 20 videos. To the best of our knowledge, video aficionado is the first real-time power consumption-based video identification system on smart devices.

This article analyzes AlphaZero-type algorithms quantitatively from the viewpoint of local and global optimal sequences of play on a 7×7 board. Through targeted evaluation of the AI agent, the authors reveal the strategic, that is, winrate-dominated, nature of such algorithms, and expose thereby certain inherent obstacles against optimal play. Possible remedies are then explored, leading to techniques that may help further quantitative analysis of those algorithms and for the search for optimal solutions, on 7×7 as well as larger boards.

Crowdsourcing is a promising technology to accomplish a complex task via eliciting services from a large group of contributors. Recent observations indicate that the success of crowdsourcing has been threatened by the malicious behaviors of the contributors. In this paper, we analyze the attack problem using an iterated prisoner's dilemma (IPD) game and propose a reward-penalty expected payoff algorithm based on zero-determinant (ZD) strategies to reward a worker's cooperation or penalize its defection in order to entice the final cooperation. Both theoretical analysis and simulation studies are performed, and the results indicate that the proposed algorithm has the following two attractive characteristics: 1) the requestor can incentivize the worker to become cooperative without any long-term extra cost; and 2) the proposed algorithm is fair so that the requestor cannot arbitrarily penalize an innocent worker to increase its payoff even though it can dominate the game. To the best of our knowledge, we are the first to adopt the ZD strategies to stimulate both players to cooperate in an IPD game. Moreover, our proposed algorithm is not restricted to solve only the problem of crowdsourcing dilemma - it can be employed to tackle any problem that can be formulated into an IPD game.

Peer-to-peer (P2P) services such as mobile P2P transmissions and resource sharing, provide efficient methods to deliver data without the deployment of any central server. Nevertheless, the free-riding phenomenon inherit in such services presses a need for incentive mechanisms to stimulate contributions of data transmissions or sharing. As a result, it is imperative to answer the following questions: whether, and if so to what extent, an incentive mechanism can invoke such contributions? To answerthese questions, we employ an n-player continuous quantum game model to analyze the general extrinsic incentive mechanisms as well as the reputation-based incentive mechanisms, a typical class of extrinsic incentive mechanisms. We focus on studying the extrinsic incentive mechanisms in this paper due to their wide scope of applications stemming from the fact that they promote cooperative behaviors by offering rewards rather than depending on the internal bounds (e.g., social ties) among peers, which may not always exist between any pair of peers. To the best of our knowledge, we are the first to analyze the extrinsic incentive mechanisms for P2P services from a quantum game perspective. Such a perspective is adopted because the extended strategy space in the quantum game broadens the range for searching optimal strategies and the introduction of entanglement makes the proposed analytical frameworks more practical due to the consideration of the peers' relationships imposed by the rewards in extrinsic incentive mechanisms. Our quantum game-based analytical framework is generic because it is compatible with classic game-based schemes. The analytical results can provide a straightforward insight on evaluating the potential of the extrinsic incentive mechanisms and can serve as important references for designing new extrinsic incentive mechanisms.

Smart city is a key component in Internet of Things, so it has attracted much attention. The emergence of mobile crowd sensing (MCS) systems enables many smart city applications. In an MCS system, sensing tasks are allocated to a number of mobile users. As a result, the sensing related context of each mobile user plays a significant role on service quality. However, some important sensing context is ignored in the literature. This motivates us to propose a context-aware multiarmed bandit (C-MAB) incentive mechanism to facilitate quality-based worker selection in an MCS system. We evaluate a worker's service quality by its context (i.e., extrinsic ability and intrinsic ability) and cost. Based on our proposed C-MAB incentive mechanism and quality evaluation design, we develop a modified Thompson sampling worker selection (MTS-WS) algorithm to select workers in a reinforcement learning manner. MTS-WS is able to choose effective workers because it can maintain accurate worker quality information by updating evaluation parameters according to the status of task accomplishment. We theoretically prove that our C-MAB incentive mechanism is selection efficient, computationally efficient, individually rational, and truthful. Finally, we evaluate our MTS-WS algorithm on simulated and real-world datasets in comparison with some other classic algorithms. Our evaluation results demonstrate that MTS-WS achieves the highest cumulative utility of the requester and social welfare.

Smart cyber-physical systems (CPSs) include Internet of things (IoT), smart grids, smart cities, smart transportation, and smart "Anything" (e.g., homes and hospitals).ese systems require different levels of security and protection based the sensitivity of their data.Nonetheless, we are living in a world where cyber attacks, privacy violations, phishing scams, and data breaches have become commonplace.Smart CPSs are also subject to security violations and privacy breaches, which stem from the vulnerabilities of existing computers and communications technologies.In addition, as smart CPSs get more complex, more vulnerabilities will emerge.Hackers will be able to launch increasingly sophisticated attacks in the future due to the ever-shi ing cyber physical landscape.Hence, innovative research is needed for security assurance and privacy preservation in smart CPSs for new architectural models, system designs, and cryptographical protocols.In this special issue, we received submissions from both academia and industry in the relevant fields.Following a strict review process, we accepted papers for this special issue.Each of the papers was peer-reviewed by at least three experts in the field.In the following, we provide a brief introduction to each paper.ere are four papers aiming to design and analyze security schemes and privacy preserving strategies for IoT applications.e paper titled "Function-Aware Anomaly Detection Based on Wavelet Neural Network for Industrial Control Communication" proposed a function-aware anomaly detection approach to detect these cyber intrusions and anomalies.Next, the authors of the paper titled "A Compatible OpenFlow Platform for Enabling Security Enhancement in

Friendly jamming is an unconventional approach to secure wireless communications. Specifically, a friendly jammer transmits jamming signals to an eavesdropper while a legitimate transmitter is sending data. The jamming signals only interfere with the eavesdropper, and thus, prevent data from being disclosed to unintended parties. Mainstream jamming schemes adopt a continuous jamming strategy (CJS), where the jammer is required to constantly transmit jamming signals in the entire duration of the legitimate transmission. In certain scenarios, however, the CJS may lead to excessive jamming, and cause a waste of energy and the degradation of jamming efficiency. To address the drawbacks of the CJS, we propose the concept of an intermittent jamming strategy (IJS), where a jammer alternates between jamming and non-jamming modes during the legitimate transmission. In this paper, we study the feasibility of the IJS for physical layer security. We first introduce a new metric to jointly measure security requirements and energy costs. Next, we formulate and solve an optimization problem with respect to the jamming duration proportion and the jamming power. Finally, we verify the feasibility of the IJS through extensive simulation experiments under different modulation methods.

Cooperative jamming is deemed as a promising physical layer-based approach to secure wireless transmissions in the presence of eavesdroppers. In this paper, we investigate cooperative jamming in a two-tier 5G heterogeneous network (HetNet), where the macrobase stations (MBSs) at the macrocell tier are equipped with large-scale antenna arrays to provide space diversity and the local base stations (LBSs) at the local cell tier adopt non-orthogonal multiple access (NOMA) to accommodate dense local users (LUs). In the presence of imperfect channel state information, we propose three robust secrecy transmission algorithms that can be applied to various scenarios with different security requirements. The first algorithm employs robust beamforming (RBA) that aims to optimize the secrecy rate of a marcouser (MU) in a macrocell. The second algorithm provides robust power allocation (RPA) that can optimize the secrecy rate of an LU in a local cell. The third algorithm tackles a robust joint optimization (RJO) problem across tiers that seek the maximum secrecy sum rate of a target MU and a target LU robustly. We employ convex optimization techniques to find feasible solutions to these highly non-convex problems. The numerical results demonstrate that the proposed algorithms are highly effective in improving the secrecy performance of a two-tier HetNet.

BACKGROUND: Global maritime trade plays an important role in the modern transportation industry. It brings significant economic profit along with bioinvasion risk. Species translocate and establish in a non-native area through ballast water and biofouling. Aiming at aquatic bioinvasion issue, people proposed various suggestions for bioinvasion management. Nonetheless, these suggestions only focus on the chance of a port been affected but ignore the port's ability to further spread the invaded species. RESULTS: To tackle the issues of the existing work, we propose a biosecurity triggering mechanism, where the bioinvasion risk of a port is estimated according to both the invaded risk of a port and its power of being a stepping-stone. To compute the invaded risk, we utilize the automatic identification system data, the ballast water data and marine environmental data. According to the invaded risk of ports, we construct a species invasion network (SIN). The incoming bioinvasion risk is derived from invaded risk data while the invasion risk spreading capability of each port is evaluated by s-core decomposition of SIN. CONCLUSIONS: We illustrate 100 ports in the world that have the highest bioinvasion risk when the invaded risk and stepping-stone bioinvasion risk are equally treated. There are two bioinvasion risk intensive regions, namely the Western Europe (including the Western European margin and the Mediterranean) and the Asia-Pacific, which are just the region with a high growth rate of non-indigenous species and the area that has been identified as a source for many of non-indigenous species discovered elsewhere (especially the Asian clam, which is assumed to be the most invasive species worldwide).

The concept of smart grid gained tremendous attention among researchers and utility providers in recent years. How to establish a secure communication among smart meters, utility companies, and the service providers is a challenging issue. In this paper, we present a communication architecture for smart grids and propose a scheme to guarantee the security and privacy of data communications among smart meters, utility companies, and data repositories by employing decentralized attribute based encryption. The architecture is highly scalable, which employs an access control Linear Secret Sharing Scheme (LSSS) matrix to achieve a role‐based access control. The security analysis demonstrated that the scheme ensures security and privacy. The performance analysis shows that the scheme is efficient in terms of computational cost.

Crowdsourcing is a promising paradigm to accomplish a complex task via eliciting services from a large group of contributors. However, recent observations indicate that the success of crowdsourcing is being threatened by the malicious behaviors of the contributors. In this paper, we analyze the malicious attack problem using an iterated prisoner's dilemma (IPD) game and propose a zero-determinant (ZD) strategy based scheme by rewarding a worker's cooperation or penalizing the defection for enticing his final cooperation. Both theoretical analysis and simulation study indicate that the proposed algorithm has two attractive characteristics: 1) the requestor can incentivize the worker to keep on cooperating by only increasing the short-term payment; and 2) the proposed algorithm is fair, so the requestor cannot arbitrarily penalize an innocent worker to increase her payoff even though she can dominate the game. To the best of our knowledge, we are the first to use the ZD strategy to stimulate both players to cooperate in an IPD game. Moreover, our proposed algorithm is not restricted to solve the problem of the malicious crowdsourcing - it can be employed to tackle any problem that can be formulated by an IPD game.

Crowdsourcing applications are vulnerable to malicious behaviors, posing serious threats to their adoption and large deployment. Based on the notion that the requestor (i.e., the crowdsourcer) can block malicious behaviors via leveraging the market power through task allocation and pricing, we propose two novel frameworks based on the mechanism design game theory (i.e., the reverse game theory). To the best of our knowledge, we are the first to exploit the market power and to apply the mechanism design game theory in thwarting malicious behaviors in crowdsourcing. The first proposed framework is built on a requestor-dominant mechanism design game (Rd-MDG), where the game rule is determined solely by the requestor. The second proposed framework is based on the worker-assisted mechanism design game (WaMDG), where the worker (i.e., the contributor) can assist the requestor to determine the game rules by offering advices. These two frameworks have the following salient features: i) neither of them requires the workers to reveal their private information; ii) the game rules of each framework are designed to be able to force the workers to calculate their best strategies based on their actual private information; iii) our theoretical analysis shows that equilibriums exist for both frameworks; and iv) our extensive simulation results demonstrate that these two frameworks can thwart malicious behaviors by driving the workers with a higher attack intent into obtaining lower utilities.

Personalized applications often provide their functionality by extracting sensitive data from users. Such a strategy brings potential threats to users' privacy because malicious applications may sell users' sensitive data to third-parties for economic interests. The state-of-the-art literature addresses the privacy issue mainly from a technical perspective. In this paper, we take a different angle in which the main players involving privacy leakage are studied from a connected perspective rather than an isolated one. More specifically, we propose the concept of application ecosystem, which consists of user, application, and adversary (malicious third-party) as entities. Our aim is to analyze the tension forces inside the application ecosystem and their impacts on the behavior of each player, which can serve as a theoretical basis for designing effective and efficient privacy preservation solutions from a management level. Another outstanding trait of our analysis is the adoption of quantum game theory to model the application ecosystem, which is suitable because the important property of entanglement in quantum games can be employed to well depict the inner tension forces among the user, application, and adversary. This makes us take an important step towards understanding the complexity of decision-making from rational individuals. To the best of our knowledge, we are the first to quantize the privacy leakage issue. The simulation results quantitatively demonstrate how the mutual restrictions among all players determine their strategies and hence the development of the application ecosystem.

In this study, the authors investigate the problem of jammer selection (JS) for enhancing the secrecy goodput in a cooperative cognitive radio network with the multiple‐input–multiple‐output capability. First, they propose an optimal stopping theory‐based JS scheme in the presence of a single eavesdropper. The proposed scheme can accommodate the cases of beamforming or non‐beamforming jamming signals. Furthermore, in the presence of multiple eavesdroppers, they develop a random JS scheme with the beamforming design. Their theoretical analysis and simulation results demonstrate that the proposed schemes can effectively improve the secrecy goodput.

In this paper, we investigate the problem of jammer selection for securing Cooperative Cognitive Radio Networks (CCRNs) with the Multiple-Input Multiple- Output (MIMO) capability. In the CCRN under our consideration, there exist a pair of Primary Users (PUs), a relay node, a number of Secondary User (SU) pairs, and an eavesdropper. The PUs need to select a pair of SUs as jammers to interfere with the eavesdropper so as to preserve the secrecy of their wireless communications. To address this problem, we propose an Optimal Stopping based Jammer Selection (OSJS) scheme. Specifically, OSJS examines the primary secrecy capacity for each candidate SU pair in a sequential order. The first SU pair that makes the primary secrecy capacity higher than an optimal threshold is selected as the jammers. The optimal threshold is calculated based on the distribution function of the primary secrecy capacity. We derive the distribution function from the chi-square distribution function of the Signal-to-Noise Ratio (SNR) under the MIMO channel conditions. Since our OSJS scheme does not have to check all the candidate SU pairs, much time can be saved for data transmissions. Our rigorous analysis and simulation results demonstrate that our proposed scheme can achieve secure communications with improved network throughput.

Global broadcasting is a fundamental problem in wireless multi-hop networks. In this paper, we propose two distributed deterministic algorithms for global broadcasting based on the Signal-to-Interference-plus-Noise-Ratio (SINR) model. In both algorithms, an arbitrary node can become the source node, and the rest of the nodes are divided into different layers according to their distance to the source node. A broadcast message is propagated from the source node to all the other nodes in a layer by layer fashion. Our first proposed algorithm (named TEGB) selects a Maximal Independent Set (MIS) for each layer. Subsequently, multiple subsets of the MIS are carefully selected so as to allow the most concurrent transmissions. Our theoretical analysis shows that TEGB has the time complexity of O(D log n), where n is the total number of nodes in the network and D is the diameter of the network. Compared with the popular algorithm DetGenBroadcast proposed in the work of Jurdzinski et al.(2013), TEGB has a logarithmic improvement in running time. Furthermore, we develop the second algorithm (named TBGB) to reduce the number of duplicated broadcast messages at each layer. To be specific, TBGB attempts to form a unidirectional spanning tree of the network. On the spanning tree, only the non-leaf nodes transmit the broadcast message. Therefore, the redundant broadcasts in the same layer are eliminated. Our theoretical analysis shows that TBGB has the time complexity of O(DΔ log n), where Δ is the maximum node degree.

As a promising technology, crowdsourcing aims to accomplish a complex task via eliciting services from a large group of workers. However, recent observations indicate that the success of crowdsourcing is being hindered by the malicious behaviors of the workers. In this paper, we analyze the attack problem using an iterated prisoner's dilemma (IPD) game and propose an zero-determinant (ZD) strategy based algorithm. Simulation results demonstrate that the requestor can incentivize the worker to keep on cooperating.

This paper focuses on designing a distributed medium access control algorithm for fairly sharing network resources among contending stations in an 802.11 wireless network. Because the notion of fairness is not universal and there lacks a rigorous analysis on the relationships among the four types of most popular fairness criteria, we first mathematically prove that there exist certain connections between these types of fairness criteria. We then propose an efficient medium access algorithm that aims at achieving time fairness and throughput enhancement in a fully distributed manner. The core idea of our proposed algorithm lies in that each station needs to select an appropriate contention window size so as to fairly share the channel occupancy time and maximize the throughput under the time fairness constraint. The derivation of the proper contention window size is addressed rigorously. We evaluate the performance of our proposed algorithm through an extensive simulation study, and the evaluation results demonstrate that our proposed algorithm leads to nearly perfect time fairness, high throughput, and low collision overhead.

No abstract available.

This paper focuses on designing a distributed medium access control algorithm that aims at achieving time fairness among contending stations and throughput maximization in an 802.11 wireless LAN. The core idea of our proposed algorithm lies in that each station needs to select an appropriate contention window size so as to fairly share the channel occupancy time and maximize the throughput under the time fairness constraint. The derivation of the proper contention window size is presented rigorously. We evaluate the performance of our proposed algorithm through an extensive simulation study, and the evaluation results demonstrate that our proposed algorithm leads to nearly perfect time fairness, high throughput, and low collision overhead.

In this paper, we propose a novel free-rider detection scheme for IEEE 802.11 wireless networks. In our proposed scheme, various characteristics extracted from different layers in the TCP/IP stack are exploited to detect a free-rider. Specifically, these characteristics are combined and applied to a simple but powerful probabilistic-based classifier. To the best of our knowledge, our scheme is the first to target the detection of a ``mercurial'' free-rider. In addition, it does not require additional hardware support or changes to the current IEEE 802.11 standards so as to implement our proposed scheme. A comprehensive evaluation study is conducted to examine the performance of our proposed scheme. The evaluation results demonstrate that the proposed scheme is able to effectively detect mercurial free-riders under different network settings.

We transform the 3D underwater sensor network (USN) localization problem into its 2D counterpart by employing sensor depth information and a simple projection technique. We first prove that a nondegenerative projection preserves network localizability. We then prove that given a network and a constant k, all of the geometric k-lateration localization methods are equivalent. Based on these results, we design a purely distributed bilateration localization scheme for 3D USNs termed as underwater sensor positioning (USP). Through extensive simulations, we show that USP has the following nice features: (1) improved localization capabilities over existing 3D methods, (2) low storage and computation requirements, (3) predictable and balanced communication overhead, and (4) robustness to errors from the underwater environment.

We develop a rate adaptation scheme for 802.11 networks termed SRC that is based on a novel combination of sequential hypothesis testing and short-term loss ratios. The underlying design of SRC represents a fundamental departure from previous rate adjustment strategies that employ fixed-size observation windows and seemingly-intuitive rate increase guidelines. Through extensive simulation results, SRC is shown to be robust to dynamic characteristics of the wireless channel and to significantly increase network throughput over existing mainstream rate adaptation solutions. SRC does not require any type of specialized hardware or modifications to the existing 802.11 standard.

We study the localization problem in sparse 3D underwater sensor networks. Considering the fact that depth information is typically available for underwater sensors, we transform the 3D underwater positioning problem into its two- dimensional counterpart via a projection technique and prove that a non-degenerative projection preserves network localizability. We further prove that given a network and a constantk, all of the geometrick-lateration localization methods are equivalent. Based on these results, we design a purely distributed localization framework termed USP. This framework can be applied with any ranging method proposed for 2D terrestrial sensor networks. Through theoretical analysis and extensive simulation, we show that USP preserves the localizability of the original 3D network via a simple projection and improves localization capabilities when bilateration is employed. USP has low storage and computation requirements, and predictable and balanced communication overhead.

We develop a practical and comprehensive hybrid rogue access point (AP) detection framework for commodity Wi- Fi networks. It is the first scheme that combines the distributed wireless media surveillance and the centralized wired end socket level traffic "fingerprinting" The former is designed not only to detect various types of rogue APs, but also to discover suspicious activities so as to prevent the adversaries from turning victim APs into rogue devices. Moreover, the socket level traffic fingerprinting helps our frame work to achieve a finer granularity on rogue AP detection among the existing schemes. This framework has the following nice properties: i) it requires neither specialized hardware nor modification to existing standards; ii) the proposed mechanism greatly improves the rogue AP detection probability so that network resilience is improved; iii) it provides a cost-effective solution to Wi-Fi network security enhancement by incorporating free but mature software tools; iv) it can protect the network from adversaries capable of using customized equipment and/or violating the IEEE 802.11 standard; v) its open architecture allows extra features to be easily added on in the future. Our analysis and evaluation demonstrate that this hybrid rogue AP protection framework is capable of reliably revealing rogue devices and preempting potential attacks.

Key pre-distribution has been claimed to be the only viable approach for establishing shared keys between neighboring sensors after deployment for a typical sensor network. However, none of the proposed key pre-distribution schemes simultaneously achieves good performance in terms of scalability in network size, key-sharing probability between neighboring sensors, memory overhead for keying information storage, and resilience against node capture attacks. In this paper, we propose SBK, an in-situ self-configuring framework to bootstrap keys in large-scale sensor networks. SBK is fundamentally different compared to all key pre-distribution schemes. It requires no keying information pre-deployment. In SBK, sensors differentiate their roles as either service nodes or worker nodes after deployment. Service sensors construct key spaces, and distribute keying information in order for worker sensors to bootstrap pairwise keys. An improved scheme, iSBK, is also proposed to speed up the bootstrapping procedure. We conduct both theoretical analysis and simulation study to evaluate the performances of SBK and iSBK. To the best of our knowledge, SBK and iSBK are the only key establishment protocols that simultaneously achieve good performance in scalability, key-sharing probability, storage overhead, and resilience against node capture attacks.

We examine a widely accepted myth about passive listening in wireless networks, and give a detailed description of how to achieve real "passive listening." Then we develop a lightweight intrusion management system called LIMS for commodity Wi-Fi networks. Our system employs novel techniques to increase network resilience to passive and active attacks that could reveal the WEP/WPA-PSK shared key. LIMS has the following nice properties: i) it requires neither specialized hardware nor modification to existing security protocols (e.g, WEP and WPA); ii) the proposed mechanism can be integrated with an access point in a plugin manner; iii) it provides a cost-effective security enhancement to Wi-Fi networks by incorporating free but mature software tools; iv) it has the ability to prevent a certain class of DoS attacks.

Motivated by the observation that channel assignment for multiradio multi-channel mesh networks should support both unicast and local broadcast 1, should be interference-aware, and should result in low overall switching delay, high throughput, and low overhead, we propose two flexible localized channel assignment algorithms based on s-disjunct superimposed codes. These algorithms support the local broadcast and unicast effectively, and achieve interference-free channel assignment under certain conditions. In addition, under the primary interference constraints 2, the channel assignment algorithm for unicast can achieve 100 % throughput with a simple scheduling algorithm such as the maximal weight independent set scheduling, and can completely avoid hidden/exposed terminal problems under certain conditions. Our algorithms make no assumptions on the underlying network and therefore are applicable to a wide range of MR-MC mesh network settings. We conduct extensive theoretical performance analysis to verify our design.

We first give a comprehensive taxonomy of rouge access points (APs), which includes a new class of rouge APs never addressed in the literature before. Then, we propose an efficient rogue AP protection system termed as RAP for commodity Wi-Fi networks. In RAP, novel techniques are introduced to detect rouge APs and to improve network resilience. Our system has the following nice properties: i) it requires neither specialized hardware nor modification to existing standards; ii) the proposed mechanism can be integrated with an AP in a plugin manner; iii) it provides a cost-effective security enhancement to Wi-Fi networks by incorporating free but mature software tools; iv) it can protect the network from adversaries capable of using customized equipment and violating the IEEE 802.11 standard.

Wireless sensor networks (WSNs) are characterized by resource constraints and large scalability. Many applications of WSNs require secure communication, a crucial component especially in hostile environments. However, the low computational capability and small storage budget within sensors render many popular public-key-based cryptographic systems impractical. Symmetric key cryptography, on the other hand, is attractive due to its efficiency. Nevertheless, establishing a shared key for communicating parties is a challenging problem. In this paper, we propose and analyze an in situ PAirwise Key bootstrapping scheme (iPAK) for large-scale WSNs. Our theoretical analysis and simulation study demonstrate that iPAK can achieve a high key-sharing probability between neighboring sensors and a strong resilience against node-capture attacks at the cost of low storage overhead.

The Internet Engineering Task Force has developed Mobile IP to handle the mobility of Internet hosts at the network layer. Mobile IP, however, suffers from a number of drawbacks such as high handover latency, packet loss, and conflict with network security solutions. We describe and evaluate the performance of SIGMA (seamless IP diversity based generalized mobility architecture). SIGMA utilizes IP diversity to achieve the seamless handover of a mobile host, and is designed to solve many of the drawbacks of Mobile IP. Various aspects of the performance of SIGMA and Mobile IPv6 enhancements have been compared. Criteria for performance evaluation include handover latency, packet loss, throughput, and network friendliness.

A key issue impacting the performance of multi-hop wireless networks is wireless interference among neighboring nodes. In this paper, we study the impact of interference on mean delay and available bandwidth residing at wireless nodes and present a novel interference aware metric, named network allocation vector count (NAVC). The design of NAVC as a metric for the AODV routing protocols, as well as a metric for transmit power control are described in detail. Our simulations demonstrate the poor performance of minimum hop-counts routing protocols, and confirm that NAVC based routing protocol can greatly improve performance. The average throughput increases by up to 29% for UDP CBR traffic. For scenarios of densely deployed nodes, the throughput improvement is often a factor near two, suggesting that NAVC will become more useful as networks grow larger and paths become longer. These approaches are essential for emerging applications such as sensor networks where interference is heavy and bandwidth is limited.

Mobile IP has been developed to handle mobility of Internet hosts at the network layer. Mobile IP (MIP), however, suffers from a number of drawbacks such as requirement of infrastructure change, high handover latency, high packet loss rate, and conflict with network security solutions. In this paper, we describe and evaluate the performance of SIGMA, a Seamless IP diversity-based Generalized Mobility Architecture. SIGMA utilizes multihoming to achieve seamless handover of mobile hosts, and is designed to solve many of the drawbacks of MIP, including requirement for changes in infrastructure. We first evaluate the signaling cost of SIGMA and compare with that of hierarchical Mobile IPv6 (an enhancement of Mobile IP) by analytical modeling, followed by comparison of handover performance of SIGMA and Mobile IPv6 enhancements. Criteria for performance evaluation include handover latency, packet loss, throughput, and network friendliness. Our results indicate that in most cases SIGMA has a lower signaling cost than Hierarchical Mobile IPv6. Moreover, for a typical network configuration, SIGMA has a higher handover performance over Mobile IP. Copyright © 2005 John Wiley & Sons, Ltd.