The 3D printing industry is rapidly growing and increasingly adopted across various sectors, including manufacturing, healthcare, and defense. However, the operational setup often involves hazardous environments, necessitating remote monitoring through cameras and other sensors, which opens the door to cyber-based attacks. In this paper, we show that an adversary with access to video recordings of the 3D printing process can reverse-engineer the underlying 3D print instructions. Our model tracks the printer nozzle's movements during the printing process and maps the corresponding trajectory into G-code instructions. Further, it identifies the correct parameters, such as feed rate and extrusion rate, leading us to be able to successfully perform IP theft. To validate the success of IP theft, we design an equivalence checker that quantitatively compares two sets of 3D print instructions, evaluating their similarity in producing objects that are alike in shape, external appearance, and internal structure. Our equivalence checker, unlike other simple distance-based metrics such as normalized mean square error, is rotational as well as translational invariant. This is necessary to capture shifts in the base/start position of the reverse-engineered instructions relative to the actual 3D print instructions that can happen due to different camera positions. Our model achieves an average accuracy of 90.87% and generates 30.20% fewer instructions compared to the current state-of-the-art methods that produce instructions that either lead to faulty or incorrect (in terms of difference in shape and internal structure) 3D prints. Additionally, we use our model to reverse-engineer the 3D print instructions from a video recording and print a fully-functional counterfeit object.

Maritime systems, including ships and ports, are critical components of global infrastructure, essential for transporting over 80% of the world's goods and supporting internet connectivity. However, these systems face growing cybersecurity threats, as shown by recent attacks disrupting Maersk, one of the world's largest shipping companies, causing widespread impacts on international trade. The unique challenges of the maritime environment--such as diverse operational conditions, extensive physical access points, fragmented regulatory frameworks, and its deeply interconnected structure--require maritime-specific cybersecurity research. Despite the sector's importance, maritime cybersecurity remains underexplored, leaving significant gaps in understanding its challenges and risks. To address these gaps, we investigate how maritime system operators perceive and navigate cybersecurity challenges within this complex landscape. We conducted a user study comprising surveys and semi-structured interviews with 21 officer-level mariners. Participants reported direct experiences with shipboard cyber-attacks, including GPS spoofing and logistics-disrupting ransomware, demonstrating the real-world impact of these threats. Our findings reveal systemic and human-centric issues, such as training poorly aligned with maritime needs, insufficient detection and response tools, and serious gaps in mariners' cybersecurity understanding. Our contributions include a categorization of threats identified by mariners and recommendations for improving maritime security, including better training, response protocols, and regulation. These insights aim to guide future research and policy to strengthen the resilience of maritime systems.

Smart contracts are fundamental pillars of the blockchain, playing a crucial role in facilitating various business transactions. However, these smart contracts are vulnerable to exploitable bugs that can lead to substantial monetary losses. A recent study reveals that over 80% of these exploitable bugs, which are primarily functional bugs, can evade the detection of current tools. Automatically identifying functional bugs in smart contracts presents challenges from multiple perspectives. The primary issue is the significant gap between understanding the high-level logic of the business model and checking the low-level implementations in smart contracts. Furthermore, identifying deeply rooted functional bugs in smart contracts requires the automated generation of effective detection oracles based on various bug features.To address these challenges, we design and implement PromFuzz, an automated and scalable system to detect functional bugs in smart contracts. In PromFuzz, we first propose a novel Large Language Model (LLM)-driven analysis framework, which leverages a dual-agent prompt engineering strategy to pinpoint potentially vulnerable functions for further scrutiny. We then implement a dual-stage coupling approach, which focuses on generating invariant checkers that leverage logic information extracted from potentially vulnerable functions. Finally, we design a bug-oriented fuzzing engine, which maps the logical information from the high-level business model to the low-level smart contract implementations, and performs the bug-oriented fuzzing on targeted functions. We evaluate PromFuzz from 4 perspectives on 5 ground-truth datasets and compare it with multiple state-of-the-art methods. The results show that PromFuzz achieves 86.96% recall and 93.02% F1-score in detecting functional bugs, marking at least a 50% improvement in both metrics over state-of-the-art methods. Moreover, we perform an in-depth analysis on 10 real-world DeFi projects and detect 30 zero-day bugs. Our further case studies, the risky first deposit bug and the AMM price oracle manipulation bug on real-world DeFi projects, demonstrate the serious risks of the exploitable functional bugs in smart contracts. Up to now, 24 zero-day bugs have been assigned CVE IDs. Our discoveries have safeguarded assets totaling $18.2 billion from potential monetary losses.

While fuzzing has demonstrated its effectiveness in exposing vulnerabilities within embedded firmware, the discovery of crashing test cases is only the first step in improving the security of these critical systems. The subsequent fault localization process, which aims to precisely identify the root causes of observed crashes, is a crucial yet time-consuming post-fuzzing work. Unfortunately, the automated root cause analysis on embedded firmware crashes remains an underexplored area, which is challenging from several perspectives: (1) the fuzzing campaign towards the embedded firmware lacks adequate debugging mechanisms, making it hard to automatically extract essential runtime information for analysis; (2) the inherent raw binary nature of embedded firmware often leads to over-tainted and noisy suspicious instructions, which provides limited guidance for analysts in manually investigating the root cause and remediating the underlying vulnerability. To address these challenges, we design and implement FirmRCA, a practical fault localization framework tailored specifically for embedded firmware. FirmRCA introduces an event-based footprint collection approach that leverages concrete memory accesses in the crash reproducing process to aid and significantly expedite reverse execution. Next, to solve the complicated memory alias problem, FirmRCA proposes a history-driven method by tracking data propagation through the execution trace, enabling precise identification of deep crash origins. Finally, FirmRCA proposes a novel strategy to highlight key instructions related to the root cause, providing practical guidance in the final investigation. To demonstrate the efficacy of FirmRCA, we evaluate it with both synthetic and real-world targets, including 41 crashing test cases across 17 firmware images. The results show that FIRMRCA can effectively (92.7% success rate) identify the root cause of crashing test cases within the top 10 instructions. Compared to state-of-the-art works, FIRMRCA demonstrates its superiority in 27.8% improvement in full execution trace analysis capability, polynomial-level acceleration in overall efficiency and 73.2% higher success rate within the top 10 instructions in effectiveness.

The Controller Area Network (CAN) is a pivotal communication protocol extensively utilized in vehicles, aircraft, factories, and diverse cyber-physical systems (CPSs). The extensive CAN security literature resulting from decades of wide usage may create an impression of thorough scrutiny. However, a closer look reveals its reliance on a specific threat model with a limited range of abilities. Notably, recent works show that this model is outdated and that a more potent and versatile model could soon become the norm, prompting the need for a new defense paradigm. Unfortunately, the security impact of this emerging model on CAN systems has not received sufficient attention, and the defense systems addressing it are almost nonexistent. In this paper, we introduce ERACAN, the first comprehensive defense system against this new threat model. We first begin with a threat analysis to ensure that ERACAN comprehensively understands this model's capabilities, evasion tactics, and propensity to enable new attacks or enhance existing ones. ERACAN offers versatile protection against this spectrum of threats, providing attack detection, classification, and optional prevention abilities. We implement and evaluate ERACAN on a testbed and a real vehicle's CAN bus to demonstrate its low latency, real-time operation, and protective capabilities. ERACAN achieves detection rates of 100% and 99.7%+ for all attacks launched by the conventional and the enhanced threat models, respectively.

Trusted Execution Environments (TEEs) embedded in IoT devices provide a deployable solution to secure IoT applications at the hardware level. By design, in TEEs, the Trusted Operating System (Trusted OS) is the primary component. It enables the TEE to use security-based design techniques, such as data encryption and identity authentication. Once a Trusted OS has been exploited, the TEE can no longer ensure security. However, Trusted OSes for IoT devices have received little security analysis, which is challenging from several perspectives: (1) Trusted OSes are closed-source and have an unfavorable environment for sending test cases and collecting feedback. (2) Trusted OSes have complex data structures and require a stateful workflow, which limits existing vulnerability detection tools.To address the challenges, we present SyzTrust, the first state-aware fuzzing framework for vetting the security of resource-limited Trusted OSes. SyzTrust adopts a hardware-assisted framework to enable fuzzing Trusted OSes directly on IoT devices as well as tracking state and code coverage non-invasively. SyzTrust utilizes composite feedback to guide the fuzzer to effectively explore more states as well as to increase the code coverage. We evaluate SyzTrust on Trusted OSes from three major vendors: Samsung, Tsinglink Cloud, and Ali Cloud. These systems run on Cortex M23/33 MCUs, which provide the necessary abstraction for embedded TEEs. We discovered 70 previously unknown vulnerabilities in their Trusted OSes, receiving 10 new CVEs so far. Furthermore, compared to the baseline, SyzTrust has demonstrated significant improvements, including 66% higher code coverage, 651% higher state coverage, and 31% improved vulnerability-finding capability. We report all discovered new vulnerabilities to vendors and open source SyzTrust.

Currently, the development of IoT firmware heavily depends on third-party components (TPCs) to improve development efficiency. Nevertheless, TPCs are not secure, and the vulnerabilities in TPCs will influence the security of IoT firmware. Existing works pay less attention to the vulnerabilities caused by TPCs, and we still lack a comprehensive understanding of the security impact of TPC vulnerability against firmware. To fill in the knowledge gap, we design and implementFirmSec, which leverages syntactical features and control-flow graph features to detect the TPCs in firmware, and then recognizes the corresponding vulnerabilities. Based onFirmSec, we present the first large-scale analysis of the security risks raised by TPCs on 34,136 firmware images. We successfully detect 584 TPCs and identify 128,757 vulnerabilities caused by 429 CVEs. Our in-depth analysis reveals the diversity of security risks in firmware and discovers some well-known vulnerabilities are still rooted in firmware. Besides, we explore the geographical distribution of vulnerable devices and confirm that the security situation of devices in different regions varies. Our analysis also indicates that vulnerabilities caused by TPCs in firmware keep growing with the boom of the IoT ecosystem. Further analysis shows 2,478 commercial firmware images have potentially violated GPL/AGPL licensing terms.

ICPS software and hardware suffer from low update frequency, making it easier for insiders to bypass external defenses and launch concealed destructive attacks. To address these concerns, we design a device fingerprinting method based on multi-physical features, augmenting current intrusion detection techniques in the ICPS environment. In this article, we use the sorting system as an example, demonstrating that the proposed device fingerprinting technology has generality in the intrusion detection of ICPS control flow. Specifically, we first formalize the physical model of the sorting system to analyze the critical device features. Then, we extract these physical features from the sensor data collected in a physical testbed. Utilizing featurized data, we train a classifier that generates fingerprints in real-time in the production environment. Moreover, we develop a differential detection model based on device fingerprints to discover stealthy insider attacks efficiently. We evaluate the proposed method in a real-world testbed. Experiment results show that the detecting performance of classifiers approaches 100% when the the number of component types is small.

Online Microlending, a new financial service, focuses on small loans without any sort of collateral. It provides more flexible and quicker funding for borrowers, as well as higher interest rates of return. For platforms that provide such services, an essential task is to adequately evaluate each loan’s risk so as to minimize the possible financial loss. However, there exists a special group of borrowers, namelyfraud-agents, who gain illegal profits from inciting other borrowers to cheat, i.e., they help the high-risk borrowers evade the risk evaluation by crafting fake personal information. The existence of fraud-agents poses a severe threat to the risk management systems and results in a huge financial loss for lending platforms. In this article, we present the first machine learning-based solution to detect fraud-agents in online microlending. The key challenge of this decade-long problem is that it is unclear how to construct effective features from multiple behavior logs such as phone call history, address book, loan history and activity logs of borrowers. To address this problem, we first conduct an empirical study on over 600K borrowers to gain some insights on the adversarial behaviors of fraud-agents comparing to normal borrowers and benign-agents. Based on the study, we are able to design a total of 26 features, falling into four groups, for fraud agent detection. Then, we propose a two-stage detection model to address the challenge of limited number of labeled fraud agent examples. The evaluation results show that our method can achieve a precision of 94.30%. We deploy our method on a real large online microlending platform with 11,953,273 borrowers, and we identify 29,727 fraud-agents from them. The domain experts from the platform confirm that 95.59% of them are real fraud-agents, and have added them to the platform’s internal blacklist. We further conduct a measurement study on those fraud-agents to share deeper insights on their adversarial behaviors.

The energy allocation strategy is one of the most popular techniques in fuzzing to improve code coverage and vulnerability discovery. The core intuition is that fuzzers should allocate more computational energy to the seed files that have high efficiency to trigger unique paths and crashes after mutation. Existing solutions usually define several properties, e.g., the execution speed, the file size, and the number of the triggered edges in the control flow graph, to serve as the key measurements in their allocation logics to estimate the potential of a seed. The efficiency of a property is usually assumed to be the same across different programs. However, we find that this assumption is not always valid. As a result, the state-of-the-art energy allocation solutions with static energy allocation logics are hard to achieve desirable performance on different programs.

As the core of IoT devices, firmware is undoubtedly vital. Currently, the development of IoT firmware heavily depends on third-party components (TPCs), which significantly improves the development efficiency and reduces the cost. Nevertheless, TPCs are not secure, and the vulnerabilities in TPCs will turn back influence the security of IoT firmware. Currently, existing works pay less attention to the vulnerabilities caused by TPCs, and we still lack a comprehensive understanding of the security impact of TPC vulnerability against firmware. To fill in the knowledge gap, we design and implement FirmSec, which leverages syntactical features and control-flow graph features to detect the TPCs at version-level in firmware, and then recognizes the corresponding vulnerabilities. Based on FirmSec, we present the first large-scale analysis of the usage of TPCs and the corresponding vulnerabilities in firmware. More specifically, we perform an analysis on 34,136 firmware images, including 11,086 publicly accessible firmware images, and 23,050 private firmware images from TSmart. We successfully detect 584 TPCs and identify 128,757 vulnerabilities caused by 429 CVEs. Our in-depth analysis reveals the diversity of security issues for different kinds of firmware from various vendors, and discovers some well-known vulnerabilities are still deeply rooted in many firmware images. We also find that the TPCs used in firmware have fallen behind by five years on average. Besides, we explore the geographical distribution of vulnerable devices, and confirm the security situation of devices in several regions, e.g., South Korea and China, is more severe than in other regions. Further analysis shows 2,478 commercial firmware images have potentially violated GPL/AGPL licensing terms.

One intriguing property of adversarial attacks is their “transferability” – an adversarial example crafted with respect to one deep neural network (DNN) model is often found effective against other DNNs as well. Intensive research has been conducted on this phenomenon under simplistic controlled conditions. Yet, thus far there is still a lack of comprehensive understanding about transferability-based attacks (“transfer attacks”) in real-world environments.To bridge this critical gap, we conduct the first large-scale systematic empirical study of transfer attacks against major cloud-based MLaaS platforms, taking the components of a real transfer attack into account. The study leads to a number of interesting findings which are inconsistent to the existing ones, including: (i) Simple surrogates do not necessarily improve real transfer attacks. (ii) No dominant surrogate architecture is found in real transfer attacks. (iii) It is the gap between posterior (output of the softmax layer) rather than the gap between logit (so-called κ value) that increases transferability. Moreover, by comparing with prior works, we demonstrate that transfer attacks possess many previously unknown properties in real-world environments, such as (i) Model similarity is not a well-defined concept. (ii) L2norm of perturbation can generate high transferability without usage of gradient and is a more powerful source than L∞norm. We believe this work sheds light on the vulnerabilities of popular MLaaS platforms and points to a few promising research directions.1

Despite their tremendous success in various machine learning tasks, deep neural networks (DNNs) are inherently vulnerable to adversarial examples, which are maliciously crafted inputs to cause DNNs to misbehave. Intensive research has been conducted on this phenomenon in simple tasks (e.g., image classification). However, little is known about this adversarial vulnerability for object detection, a much more complicated task, which often requires specialized DNNs and multiple additional components. In this paper, we present DetectSec, a uniform platform for robustness analysis of object detection models. Currently, DetectSec implements 13 representative adversarial attacks with 7 utility metrics and 13 defenses on 18 standard object detection models. Leveraging DetectSec, we conduct the first rigorous evaluation of adversarial attacks on the state-of-the-art object detection models. We analyze the impact of the factors including DNN architecture and capacity on the model robustness. We show that many conclusions about adversarial attacks and defenses in image classification tasks do not transfer to object detection tasks, for example, the targeted attack is stronger than the untargeted attack for two-stage detectors. Our findings will aid future efforts in understanding and defending against adversarial attacks in complicated tasks. In addition, we compare the robustness of different detection models and discuss their relative strengths and weaknesses. The platform DetectSec will be open source as a unique facility for further research on adversarial attacks and defenses in object detection tasks.

Sepsis is a major public concern due to its high mortality, morbidity, and financial cost. There are many existing works of early sepsis prediction using different machine learning models to mitigate the outcomes brought by sepsis. In the practical scenario, the dataset grows dynamically as new patients visit the hospital. Most existing models, being "offline" models and having used retrospective observational data, cannot be updated and improved dynamically using the new observational data. Incorporating the new data to improve the offline models requires retraining the model, which is very computationally expensive. To solve the challenge mentioned above, we propose an Online Artificial Intelligence Experts Competing Framework (OnAI-Comp) for early sepsis detection using an online learning algorithm called Multi-armed Bandit. We selected several machine learning models as the artificial intelligence experts and used average regret to evaluate the performance of our model. The experimental analysis demonstrated that our model would converge to the optimal strategy in the long run. Meanwhile, our model can provide clinically interpretable predictions using existing local interpretable model-agnostic explanation technologies, which can aid clinicians in making decisions and might improve the probability of survival.

Fuzzing is a technique of finding bugs by executing a target program recurrently with a large number of abnormal inputs. Most of the coverage-based fuzzers consider all parts of a program equally and pay too much attention to how to improve the code coverage. It is inefficient as the vulnerable code only takes a tiny fraction of the entire code. In this article, we design and implement an evolutionary fuzzing framework called V-Fuzz, which aims to find bugs efficiently and quickly in limited time for binary programs. V-Fuzz consists of two main components: 1) a vulnerability prediction model and 2) a vulnerability-oriented evolutionary fuzzer. Given a binary program to V-Fuzz, the vulnerability prediction model will give a prior estimation on which parts of a program are more likely to be vulnerable. Then, the fuzzer leverages an evolutionary algorithm to generate inputs which are more likely to arrive at the vulnerable locations, guided by the vulnerability prediction result. The experimental results demonstrate that V-Fuzz can find bugs efficiently with the assistance of vulnerability prediction. Moreover, V-Fuzz has discovered ten common vulnerabilities and exposures (CVEs), and three of them are newly discovered.

Following the principle of to set one's own spear against one's own shield, we study how to design adversarial completely automated public turing test to tell computers and humans apart (CAPTCHA) in this article. We first identify the similarity and difference between adversarial CAPTCHA generation and existing hot adversarial example (image) generation research. Then, we propose a framework for text-based and image-based adversarial CAPTCHA generation on top of state-of-the-art adversarial image generation techniques. Finally, we design and implement an adversarial CAPTCHA generation and evaluation system, called aCAPTCHA, which integrates 12 image preprocessing techniques, nine CAPTCHA attacks, four baseline adversarial CAPTCHA generation methods, and eight new adversarial CAPTCHA generation methods. To examine the performance of aCAPTCHA, extensive security and usability evaluations are conducted. The results demonstrate that the generated adversarial CAPTCHAs can significantly improve the security of normal CAPTCHAs while maintaining similar usability. To facilitate the CAPTCHA security research, we also open source the aCAPTCHA system, including the source code, trained models, datasets, and the usability evaluation interfaces.

Recent work proposed to improve the security of CPSs by authenticating the CPS devices through the device operation times in the response packets from the devices, due to the strong correlation between the timing fingerprints and the physics of the devices. Although such a technique may be effective in defending against naive attackers, an advanced attacker may monitor the operation of the CPS before launching a device physics aware mimicry attack. In this paper, we show how the spoofed response packets can be crafted by an attacker to deceive the CPS device authentication method based on the device operation times. Specifically, we use the timing and physical measurements embedded in the packets to reconstruct the devices in the physical system, which can be used to spoof response packets corresponding to the actual model and configuration of the devices in the CPS. We demonstrate the performance of our technique in realistic testbeds with real devices. Finally, we propose an upgraded defense mechanism that may be used against such mimicry attacks.

One intriguing property of deep neural networks (DNNs) is their vulnerability to adversarial examples – those maliciously crafted inputs that deceive target DNNs. While a plethora of defenses have been proposed to mitigate the threats of adversarial examples, they are often penetrated or circumvented by even stronger attacks. To end the constant arms race between attackers and defenders, significant efforts have been devoted to providing certifiable robustness bounds for DNNs, which ensures that for a given input its vicinity does not admit any adversarial instances. Yet, most prior works focus on the case of symmetric vicinities (e.g., a hyperrectangle centered at a given input), while ignoring the inherent heterogeneity of perturbation direction (e.g., the input is more vulnerable along a particular perturbation direction). To bridge the gap, in this article, we propose the concept ofasymmetric robustnessto account for the inherent heterogeneity of perturbation directions, and presentAmoeba1, an efficient certification framework for asymmetric robustness. Through extensive empirical evaluation on state-of-the-art DNNs and benchmark datasets, we show that compared with its symmetric counterpart, the asymmetric robustness bound of a given input describes its local geometric properties in a more precise manner, which enables use cases including (i) modeling stronger adversarial threats, (ii) interpreting DNN predictions, and makes it a more practical definition of certifiable robustness for security-sensitive domains.

The Internet of Things (IoT) has become ubiquitous and greatly affected peoples’ daily lives. With the increasing development of IoT devices, the corresponding security issues are becoming more and more challenging. Such a severe security situation raises the following questions that need urgent attention: What are the primary security threats that IoT devices face currently? How do vendors and users deal with these threats? In this article, we aim to answer these critical questions through a large-scale systematic study. Specifically, we perform a ten-month-long empirical study on the vulnerability of 1,362,906 IoT devices varying from six types. The results show sufficient evidence that N-days vulnerability is seriously endangering the IoT devices: 385,060 (28.25 percent) devices suffer from at least one N-days vulnerability. Moreover, 2669 of these vulnerable devices may have been compromised by botnets. We further reveal the massive differences among five popular IoT search engines:Shodan[1],Censys[2], [3],Zoomeye[4],Fofa[5], andNTI[6]. To study whether vendors and users adopt defenses against the threats, we measure the security of MQTT [7] servers, and identify that 12740 (88 percent) MQTT servers have no password protection. Our analysis can serve as an important guideline for investigating the security of IoT devices, as well as advancing the development of a more secure environment for IoT systems.

Rapid prototyping makes additive manufacturing (or 3D printing) useful in critical application domains such as aerospace, automotive, and medical. The rapid expansion of these applications should prompt the examination of the underlying security of 3D printed objects. In this paper, we present Mystique, a novel class of stealthy attacks on printed objects that leverage the fourth dimension of emerging 4D printing technology to introduce embedded logic bombs through manufacturing process manipulation. Mystique enables visually benign objects to behave maliciously upon the activation of the logic bomb during operation. It leverages the manufacturing process to embed a physical logic bomb that can be triggered with specific stimuli to change the physical and mechanical properties of the printed objects. These changes in properties can potentially cause catastrophic operational failures when the objects are used in critical applications such as drones, prosthesis, or medical applications.

Certifiable robustness, the functionality of verifying whether the given region surrounding a data point admits any adversarial example, provides guaranteed security for neural networks deployed in adversarial environments. A plethora of work has been proposed to certify the robustness of feed-forward networks, e.g., FCNs and CNNs. Yet, most existing methods cannot be directly applied to recurrent neural networks (RNNs), due to their sequential inputs and unique operations.

If a trader could predict price changes in the stock market better than other traders, she would make a fortune. Similarly in the electricity market, a trader that could predict changes in the electricity load, and thus electricity prices, would be able to make large profits. Predicting price changes in the electricity market better than other market participants is hard, but in this paper, we show that attackers can manipulate the electricity prices in small but predictable ways, giving them a competitive advantage in the market.

STereoLithography (STL) files describe the geometry of objects to be printed in additive manufacturing. Previous studies have shown that the STL files that describe functional objects can be attacked such that the objects appear normal during inspection, but fail during operation. Such attacks lead to damage to systems that use the objects and possibly loss of life. The detection of any defects caused due to the attacks nowadays is limited to the quality control process after the objects are manufactured.We present a Trusted Integrity Verifier (TIV) to detect such attacks on 3D printed objects in the early stage of the manufacturing process. These type of new attacks cannot be detected by traditional software security mechanisms since they only focus on the printers and do not consider the inputs (STL design files) to the printer. Early detection of attacks prevents from printing malicious objects resulting in saving time, resources and manufacturing efforts. TIV detects malicious STL files using multidisciplinary approaches unlike the traditional integrity verification techniques. TIV develops a void detection module based on computer vision techniques to identify the internal defects such as voids. Some of these features could be from the design and some could be due to the attack. To differentiate the malicious features from the design features, TIV develops safety verification module based on a numerical method. TIV's safety verification module is used to differentiate the malicious features from the design features by calculating the load bearing mechanical stress on the objects. These mechanical stresses are compared to the safety operational conditions to determine if the printed object will break or fail during its normal operation.To illustrate TIV's generality and scalability, we conducted a large-scale analysis on 16,000 real-world 3D print STL files. TIV verified the STL files successfully as either safe or malicious with high accuracy of 92% for object classification and 96.5% for void detection.

We propose NSYNC, a practical framework to compare side-channel signals for real-time intrusion detection in Additive Manufacturing (AM) systems. The motivation to develop NSYNC is that we find AM systems are asynchronous in nature and there is random variation in timing in a printing process. Although this random variation, referred to as time noise, is very small compared with the duration of a printing process, it can cause existing Intrusion Detection Systems (IDSs) to fail. To deal with this problem, NSYNC incorporates a dynamic synchronizer to find the timing relationship between two signals. This timing relationship, referred to as the horizontal displacement, can not only be used to mitigate the adverse effect of time noise on calculating the (vertical) distance between signals, but also be used as indicators for intrusion detection. An existing dynamic synchronizer is Dynamic Time Warping (DTW). However, we found in experiments that DTW not only consumes an excessive amount of computational resources but also has limited accuracy for processing side-channel signals. To solve this problem, we propose a novel dynamic synchronizer, called Dynamic Window Matching (DWM), to replace DTW. To compare NSYNC against existing IDSs, we built a data acquisition system that is capable of collecting six different types of side-channel signals and performed a total of 302 benign printing processes and a total of 200 malicious printing processes with two printers. Our experiment results show that existing IDSs leveraging side-channel signals in AM systems can only achieve an accuracy from 0.50 to 0.88, whereas our proposed NSYNC can reach an accuracy of 0.99.

IoT devices are abnormally prone to diverse errors due to harsh environments and limited computational capabilities. As a result, correct error handling is critical in IoT. Implementing correct error handling is non-trivial, thus requiring extensive testing such as fuzzing. However, existing fuzzing cannot effectively test IoT error-handling code. First, errors typically represent corner cases, thus are hard to trigger. Second, testing error-handling code would frequently crash the execution, which prevents fuzzing from testing following deep error paths.In this paper, we propose IFIZZ, a new bug detection system specifically designed for testing error-handling code in Linux-based IoT firmware. IFIZZ first employs an automated binary-based approach to identify realistic runtime errors by analyzing errors and error conditions in closed-source IoT firmware. Then, IFIZZ employs state-aware and bounded error generation to reach deep error paths effectively. We implement and evaluate IFIZZ on 10 popular IoT firmware. The results show that IFIZZ can find many bugs hidden in deep error paths. Specifically, IFIZZ finds 109 critical bugs, 63 of which are even in widely used IoT libraries. IFIZZ also features high code coverage and efficiency, and covers 67.3% more error paths than normal execution. Meanwhile, the depth of error handling covered by IFIZZ is 7.3 times deeper than that covered by the state-of-the-art method. Furthermore, IFIZZ has been practically adopted and deployed in a worldwide leading IoT company. We will open-source IFIZZ to facilitate further research in this area.

Securing cyber-physical systems (CPS) against malicious attacks is of paramount importance because these attacks may cause irreparable damages to physical systems. Recent studies have revealed that control programs running on CPS devices suffer from both control-oriented attacks (e.g., code-injection or code-reuse attacks) and data-oriented attacks (e.g., non-control data attacks). Unfortunately, existing detection mechanisms are insufficient to detect runtime data-oriented exploits, due to the lack of runtime execution semantics checking. In this work, we propose Orpheus, a new security methodology for defending against data-oriented attacks by enforcing cyber-physical execution semantics. We first present a general method for reasoning cyber-physical execution semantics of a control program (i.e., causal dependencies between the physical context/event and program control flows), including the event identification and dependence analysis. As an instantiation of Orpheus, we then present a new program behavior model, i.e., the event-aware finite-state automaton (eFSA). eFSA takes advantage of the event-driven nature of CPS control programs and incorporates event checking in anomaly detection. It detects data-oriented exploits if a specific physical event is missing along with the corresponding event dependent state transition. We evaluate our prototype's performance by conducting case studies under data-oriented attacks. Results show that eFSA can successfully detect different runtime attacks. Our prototype on Raspberry Pi incurs a low overhead, taking 0.0001s for each state transition integrity checking, and 0.063s~0.211s for the cyber-physical contextual consistency checking.

Web search queries reveal extensive sensitive information about users’ interests and preferences to the search engines and eavesdroppers. Obfuscation-based private web search solutions automatically generate dummy queries and send the obfuscated queries to the search engine to hide users’ search intentions. Despite many obfuscation methods and tools have been developed, there is no practical system for evaluating their utility performance and the vulnerability against modern privacy attacks. In this article, we propose and develop OB-WSPES, a uniform evaluation system for obfuscation-based web search privacy, which allows researchers to conduct fair analysis and evaluation of existing or newly developed web search privacy protection/attack techniques. Leveraging OB-WSPES, we model the obfuscation activities and systematically implement and evaluate five obfuscation schemes and 10 modern web search attacks on the public AOL dataset. Our results demonstrate that, counter-intuitively, adding more fake queries to a user’s real data does not necessarily yield better privacy. The query utility of obfuscated queries declines with the increasing amount of dummy queries, while the application utility does not. We discuss the experimental results and point out the four important factors that affect the web search privacy and utility. Further, we propose possible directions for future research.

Despite their immense popularity, deep learning-based acoustic systems are inherently vulnerable to adversarial attacks, wherein maliciously crafted audios trigger target systems to misbehave. In this paper, we present SirenAttack, a new class of attacks to generate adversarial audios. Compared with existing attacks, SirenAttack highlights with a set of significant features: (i) versatile -- it is able to deceive a range of end-to-end acoustic systems under both white-box and black-box settings; (ii) effective -- it is able to generate adversarial audios that can be recognized as specific phrases by target acoustic systems; and (iii) stealthy -- it is able to generate adversarial audios indistinguishable from their benign counterparts to human perception. We empirically evaluate SirenAttack on a set of state-of-the-art deep learning-based acoustic systems (including speech command recognition, speaker recognition and sound event classification), with results showing the versatility, effectiveness, and stealthiness of SirenAttack. For instance, it achieves 99.45% attack success rate on the IEMOCAP dataset against the ResNet18 model, while the generated adversarial audios are also misinterpreted by multiple popular ASR platforms, including Google Cloud Speech, Microsoft Bing Voice, and IBM Speech-to-Text. We further evaluate three potential defense methods to mitigate such attacks, including adversarial training, audio downsampling, and moving average filtering, which leads to promising directions for further research.

The development of deep learning techniques has significantly increased the ability of computers to recognize CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart), thus breaking or mitigating the security of existing captcha schemes. To protect against these attacks, recent works have been proposed to leverage adversarial machine learning to perturb captcha pictures. However, they either require the prior knowledge of captcha solving models or lack adaptivity to the evolving behaviors of attackers. Most importantly, none of them has been deployed in practical applications, and their practical applicability and effectiveness are unknown.

In this paper, we study the privacy of online health data. We present a novel online health data De-Anonymization (DA) framework, named De-Health. Leveraging two real world online health datasets WebMD and HealthBoards, we validate the DA efficacy of De-Health. We also present a linkage attack framework which can link online health/medical information to real world people. Through a proof-of-concept attack, we link 347 out of 2805 WebMD users to real world people, and find the full names, medical/health information, birthdates, phone numbers, and other sensitive information for most of the re-identified users. This clearly illustrates the fragility of the privacy of those who use online health forums.

No abstract available.

Programmable logic controllers (PLCs) make up the majority of endpoints on industrial control system (ICS) networks and are the vital bridge between the cyber and physical worlds. Although these devices are critical, they are often insecure by design: communicating over unauthenticated protocols, failing to provide standard password protection, and using trivially spoofed checksums for detecting program changes instead of cryptographic hashes. Furthermore, extreme resource limitations, long life cycles, and strict downtime requirements make it difficult to patch existing devices in the field and virtually impossible to install any kind of endpoint protection. While these limitations have traditionally been considered a security weakness, they may also be leveraged for change and anomaly detection. Specifically, this research proposes to leverage these resource limitations for continuous behavior anomaly detection for the PLCs themselves, using program execution times to detect single-instruction changes to control programs from both the network and local access. The basic techniques are extended to include white box modeling for estimating rare execution behavior from source code, and proof-of-work functions are utilized to increase the techniques' resiliency against mimicry attacks.

As a large number of distributed devices are connected to the modern smart grid, the traditional centralized connectivity models fail to provide economic value. These models have relied on sending data to the cloud for processing and receiving commands to exert control actions, resulting in an “on-demand system” with high bandwidth, low latency, and an overload of data on the cloud. For realizing a decentralized system, there is a strong need to embed intelligence at the “edge of the network.” These intelligent devices, capable of sensing, local data processing, and exerting control actions, report only actionable information to the cloud, acting as an edge control node. The system can then function autonomously, without constant cloud inputs, tolerating longer delays in communication, and making the overall system ultralow cost. The global asset monitoring, management, and analytics platform is a novel ultralow-cost, secure platform that operates through a Bluetooth-based delay tolerant network. It relies on so-called “data mules” to bridge the last mile connectivity gap in an inherently secure way. Due to this model, the platform requires no in-country certifications, does not rely on a dedicated backhaul technology and is immune to technology migration. This architecture also addresses some gaps identified in traditional Internet of Things-based solutions in remote areas and sparse connectivity. A functional unit of the edge computing node has been built, taking into account various constraints like costs, customizations, data storage, cybersecurity, and power management. The platform has been built, deployed and has demonstrated distributed smart grid applications like power quality sensing, automated metering infrastructure, and utility asset monitoring.

In this paper, we study the impacts of non-Personal Identifiable Information (non-PII) on the privacy of graph data with attribute information (e.g., social networks data with users' profiles (attributes)), namely Structure-Attribute Graph (SAG) data, both theoretically and empirically. Our main contributions are two-fold: (i) we conduct the first attribute-based anonymity analysis for SAG data under both preliminary and general models. By careful quantification, we obtain the explicit correlation between the graph anonymity and the attribute information. We also validate our analysis through numerical and real world data-based evaluations and the results indicate that the non-PII can also lead to significant anonymity loss; and (ii) according to our theoretical analysis, we propose a new de-anonymization framework for SAG data, namely De-SAG, which takes into account both the graph structure and the attribute information to the best of our knowledge. By extensive experiments, we demonstrate that De-SAG can significantly improve the performance of state-of-the-art graph de-anonymization attacks. Our attribute-based anonymity analysis and de-anonymization framework are expected to provide data owners and researchers a more complete understanding on the privacy vulnerability of graph data, and thus shed light on future graph anonymization and de-anonymization research.

The future electrical grid, i.e., smart grid, is envisioned to use appliance-level control to provide sustainable power usage and flexible energy utilization. However, load trace monitoring for appliance-level control poses privacy concerns given that private behaviors can be inferred by electricity utilization levels. In this paper, we introduce a privacy-preserving and fine-grained power load data analysis mechanism Di-PriDA for appliance-level peak-time load balancing control in the smart grid. Di-PriDA achieved 3ε-differential privacy, which provided indistinguishable application power consumption data to protect against eavesdroppers. The proposed technique explores a new differential privacy problem: the distributed top-k problem without a trusted third party, and provides both rigorous provable privacy and an accuracy guarantee based on distributed differential privacy. We implement a prototype of Di-PriDA on an external microcontroller device used for smart meters, and evaluate its performance under two real-world power usage datasets, as well as a synthetic dataset through a combination of experiments and simulations. We find that Di-PriDA effectively achieves confidentiality for the appliance-level peak-time load balancing control while guaranteeing a good quality-of-service to the various stakeholders of the power grid.

Cyber-physical systems (CPS) have been deployed in many areas and have reached unprecedented levels of performance and efficiency. However, the security and privacy problems in CPS have not been properly addressed, e.g., the monitored source location can be inferred by an attacker, which can substantially undermine the reliability of CPS. Unfortunately, the existing techniques to protect against the leakage of the source location do not achieve an acceptable balance among the source location privacy, transmission delay, and energy consumption to guarantee high reliability. To address this issue, we propose an attacker location evaluation-based fake source scheduling (FSSE) for source location privacy in CPS to enhance the privacy level and maintain the system performance. The proposed FSSE contains two main phases. The first, backbone construction, is dependent on the probability of capture derived from the communication information of self and neighboring nodes. This phase aims to build a backbone to form a baseline with respect to the source location privacy and transmission delay. The second phase is fake message scheduling, which is established to provide a trade-off among privacy, transmission delay, and communication overhead in terms of the hypothesized location of the attacker by using stochastic processes. Through analysis and simulation, we demonstrate that the proposed method has a more stable privacy level and more efficient transmission delay and energy consumption than the three compared algorithms, i.e., phantom routing, tree-based diversionary routing, and dynamic fake source selection.

In this paper, we study the correlation of graph da-ta's anonymity, utility, and de-anonymity. Our main contributions include four perspectives. First, to the best of our knowledge, we conduct the first Anonymity-Utility-De-anonymity (AUD) correlation quantification for graph data and obtain close-forms for such correlation under both a preliminary mathematical model and a general data model. Second, we integrate our AUD quantification to SecGraph [31], a recently published Secure Graph data sharing/publishing system, and extend it to Sec-Graph+. Compared to SecGraph, SecGraph+ is an improved and enhanced uniform and open-source system for comprehensively studying graph anonymization, de-anonymization, and utility evaluation. Third, based on our AUD quantification, we evaluate the anonymity, utility, and de-anonymity of 12 real world graph datasets which are generated from various computer systems and services. The results show that the achievable anonymity/de-anonymity depends on multiple factors, e.g., the preserved data utility, the quality of the employed auxiliary data. Finally, we apply our AUD quantification to evaluate the performance of state-of-the-art anonymization and de-anonymization techniques. Interestingly, we find that there is still significant space to improve state-of-the-art de-anonymization attacks. We also explicitly and quantitatively demonstrate such possible improvement space.

The popularity of cloud hosting services also brings in new security chal- lenges: it has been reported that these services are increasingly utilized by miscreants for their malicious online activities. Mitigating this emerging threat, posed by such “bad repositories” (simply Bar), is challenging due to the different hosting strategy to traditional hosting service, the lack of direct observations of the repositories by those outside the cloud, the reluctance of the cloud provider to scan its customers’ repositories without their consent, and the unique evasion strategies employed by the adversary. In this paper, we took the first step toward understanding and detecting this emerging threat. Using a small set of “seeds” (i.e., confirmed Bars), we identified a set of collective features from the websites they serve (e.g., attempts to hide Bars), which uniquely characterize the Bars. These features were utilized to build a scanner that detected over 600 Bars on leading cloud platforms like Amazon, Google, and 150 K sites, including popular ones like , using them. Highlights of our study include the pivotal roles played by these repositories on malicious infrastructures and other important discoveries include how the adversary exploited legitimate cloud repositories and why the adversary uses Bars in the first place that has never been reported. These findings bring such malicious services to the spotlight and contribute to a better understanding and ultimately eliminating this new threat.

Historically, robotics systems have not been built with an emphasis on security. Their main purpose has been to complete a specific objective, such as to deliver the correct dosage of a drug to a patient, perform a swarm algorithm, or safely and autonomously drive humans from point A to point B. As more and more robotic systems become remotely accessible through networks, such as the Internet, they are more vulnerable to various attackers than ever before. To investigate remote attacks on networked robotic systems we have leveraged HoneyPhy, a physics-aware honeypot framework, to create the HoneyBot. The HoneyBot is the first software hybrid interaction honeypot specifically designed for networked robotic systems. By simulating unsafe actions and physically performing safe actions on the HoneyBot we seek to fool attackers into believing their exploits are successful, while logging all the communication to be used for attacker attribution and threat model creation. In this paper, we present the HoneyBot and discuss our proof of concept implementation. Our HoneyBot prototype swaps between physical actuation and using prebuilt models of sensor behavior for simulation at runtime given user input commands.

To keep password users from creating simple and common passwords, major websites and applications provide a password-strength measure, namely a password checker. While critical requirements for a password checker to be stringent have prevailed in the study of password security, we show that regardless of the stringency, such static checkers can leak information and actually help the adversary enhance the performance of their attacks. To address this weakness, we propose and devise the Dynamic Password Policy Generator, namely DPPG, to be an effective and usable alternative to the existing password strength checker. DPPG aims to enforce an evenly-distributed password space and generate dynamic policies for users to create passwords that are diverse and that contribute to the overall security of the password database. Since DPPG is modular and can function with different underlying metrics for policy generation, we further introduce a diversity-based password security metric that evaluates the security of a password database in terms of password space and distribution. The metric is useful as a countermeasure to well-crafted offline cracking algorithms and theoretically illustrates why DPPG works well.

In this paper, we study the correlation between passwords across different datasets which quantitatively explains the success of existing training-based password cracking techniques. We also study the correlation between a user's password and his/her social profile. This enabled us to develop the first social profile-aware password strength meter, namely SociaLShield. Our quantification techniques and SocialShield have meaningful implications to system administrators, users, and researchers, e.g., helping them quantitatively understand the threats posed by a password leakage incident, defending against emerging profile-based password attacks, and facilitating the research of countermeasures against existing and newly developed training-based password attacks. We validate our proposed quantification techniques and SocialShield through extensive experiments by leveraging real-world leaked passwords. Experimental results demonstrate that our quantification techniques are accurate in measuring correlation among different leaked datasets and that although SocialShield is light-weight, it is effective in defending against profile-based password attacks.

BulletProof Hosting (BPH) services provide criminal actors with technical infrastructure that is resilient to complaints of illicit activities, which serves as a basic building block for streamlining numerous types of attacks. Anecdotal reports have highlighted an emerging trend of these BPH services reselling infrastructure from lower end service providers (hosting ISPs, cloud hosting, and CDNs) instead of from monolithic BPH providers. This has rendered many of the prior methods of detecting BPH less effective, since instead of the infrastructure being highly concentrated within a few malicious Autonomous Systems (ASes) it is now agile and dispersed across a larger set of providers that have a mixture of benign and malicious clients. In this paper, we present the first systematic study on this new trend of BPH services. By collecting and analyzing a large amount of data (25 snapshots of the entire Whois IPv4 address space, 1.5 TB of passive DNS data, and longitudinal data from several blacklist feeds), we are able to identify a set of new features that uniquely characterizes BPH on sub-allocations and that are costly to evade. Based upon these features, we train a classifier for detecting malicious sub-allocated network blocks, achieving a 98% recall and 1.5% false discovery rates according to our evaluation. Using a conservatively trained version of our classifier, we scan the whole IPv4 address space and detect 39K malicious network blocks. This allows us to perform a large-scale study of the BPH service ecosystem, which sheds light on this underground business strategy, including patterns of network blocks being recycled and malicious clients being migrated to different network blocks, in an effort to evade IP address based blacklisting. Our study highlights the trend of agile BPH services and points to potential methods of detecting and mitigating this emerging threat.

In this paper, we conduct a large-scale study on the crackability, correlation, and security of 145 million real world passwords, which were leaked from several popular Internet services and applications. To the best of our knowledge, this is the largest empirical study that has been conducted. Specifically, we first evaluate the crackability of 145 million real world passwords against 6+ state-of-the-art password cracking algorithms in multiple scenarios. Second, we examine the effectiveness and soundness of popular commercial password strength meters (e.g., Google, QQ) and the security impacts of username/email leakage on passwords. Finally, we discuss the implications of our results, analysis, and findings, which are expected to help both password users and system administrators to gain a deeper understanding of the vulnerability of real passwords against state-of-the-art password cracking algorithms, as well as to shed light on future password security research topics.

The popularity of cloud hosting services also brings in new security challenges: it has been reported that these services are increasingly utilized by miscreants for their malicious online activities. Mitigating this emerging threat, posed by such "bad repositories" (simply Bar), is challenging due to the different hosting strategy to traditional hosting service, the lack of direct observations of the repositories by those outside the cloud, the reluctance of the cloud provider to scan its customers' repositories without their consent, and the unique evasion strategies employed by the adversary. In this paper, we took the first step toward understanding and detecting this emerging threat. Using a small set of "seeds" (i.e., confirmed Bars), we identified a set of collective features from the websites they serve (e.g., attempts to hide Bars), which uniquely characterize the Bars. These features were utilized to build a scanner that detected over 600 Bars on leading cloud platforms like Amazon, Google, and 150K sites, including popular ones like groupon.com, using them. Highlights of our study include the pivotal roles played by these repositories on malicious infrastructures and other important discoveries include how the adversary exploited legitimate cloud repositories and why the adversary uses Bars in the first place that has never been reported. These findings bring such malicious services to the spotlight and contribute to a better understanding and ultimately eliminating this new threat.

To adapt to the rapidly evolving landscape of cyber threats, security professionals are actively exchanging Indicators of Compromise (IOC) (e.g., malware signatures, botnet IPs) through public sources (e.g. blogs, forums, tweets, etc.). Such information, often presented in articles, posts, white papers etc., can be converted into a machine-readable OpenIOC format for automatic analysis and quick deployment to various security mechanisms like an intrusion detection system. With hundreds of thousands of sources in the wild, the IOC data are produced at a high volume and velocity today, which becomes increasingly hard to manage by humans. Efforts to automatically gather such information from unstructured text, however, is impeded by the limitations of today's Natural Language Processing (NLP) techniques, which cannot meet the high standard (in terms of accuracy and coverage) expected from the IOCs that could serve as direct input to a defense system. In this paper, we present iACE, an innovation solution for fully automated IOC extraction. Our approach is based upon the observation that the IOCs in technical articles are often described in a predictable way: being connected to a set of context terms (e.g., "download") through stable grammatical relations. Leveraging this observation, iACE is designed to automatically locate a putative IOC token (e.g., a zip file) and its context (e.g., "malware", "download") within the sentences in a technical article, and further analyze their relations through a novel application of graph mining techniques. Once the grammatical connection between the tokens is found to be in line with the way that the IOC is commonly presented, these tokens are extracted to generate an OpenIOC item that describes not only the indicator (e.g., a malicious zip file) but also its context (e.g., download from an external source). Running on 71,000 articles collected from 45 leading technical blogs, this new approach demonstrates a remarkable performance: it generated 900K OpenIOC items with a precision of 95% and a coverage over 90%, which is way beyond what the state-of-the-art NLP technique and industry IOC tool can achieve, at a speed of thousands of articles per hour. Further, by correlating the IOCs mined from the articles published over a 13-year span, our study sheds new light on the links across hundreds of seemingly unrelated attack instances, particularly their shared infrastructure resources, as well as the impacts of such open-source threat intelligence on security protection and evolution of attack strategies.

In this paper, we propose a structural importance-aware approach to quantify the vulnerability/de-anonymizability of graph data to structure-based De-Anonymization (DA) attacks [1][2][3][4]. Specifically, we quantify both the seed-based and the seed-free Relative De-anonymizability (RD) of graph data for both perfect DA (successfully de-anonymizing all the target users) and partial DA (where some DA error is tolerated) under a general data model. In our relative quantification, instead of treating all the users in graph data as structurally equivalent, we adaptively quantify their RD in terms of their structural importance. Leveraging 15 real world graph datasets, we validate the accuracy of our relative quantifications and compare them with state-of-the-art seed-based and seed-free quantification techniques. The results demonstrate that our structural importance-aware relative quantifications are more sound and precise when measuring graph data's real vulnerability/de-anonymizability.

Promotional infection is an attack in which the adversary exploits a website's weakness to inject illicit advertising content. Detection of such an infection is challenging due to its similarity to legitimate advertising activities. An interesting observation we make in our research is that such an attack almost always incurs a great semantic gap between the infected domain (e.g., a university site) and the content it promotes (e.g., selling cheap viagra). Exploiting this gap, we developed a semantic-based technique, called Semantic Inconsistency Search (SEISE), for efficient and accurate detection of the promotional injections on sponsored top-level domains (sTLD) with explicit semantic meanings. Our approach utilizes Natural Language Processing (NLP) to identify the bad terms (those related to illicit activities like fake drug selling, etc.) most irrelevant to an sTLD's semantics. These terms, which we call irrelevant bad terms (IBTs), are used to query search engines under the sTLD for suspicious domains. Through a semantic analysis on the results page returned by the search engines, SEISE is able to detect those truly infected sites and automatically collect new IBTs from the titles/URLs/snippets of their search result items for finding new infections. Running on 403 sTLDs with an initial 30 seed IBTs, SEISE analyzed 100K fully qualified domain names (FQDN), and along the way automatically gathered nearly 600 IBTs. In the end, our approach detected 11K infected FQDN with a false detection rate of 1.5% and over 90% coverage. Our study shows that by effective detection of infected sTLDs, the bar to promotion infections can be substantially raised, since other non-sTLD vulnerable domains typically have much lower Alexa ranks and are therefore much less attractive for underground advertising. Our findings further bring to light the stunning impacts of such promotional attacks, which compromise FQDNs under 3% of .edu, .gov domains and over one thousand gov.cn domains, including those of leading universities such as stanford.edu, mit.edu, princeton.edu, havard.edu and government institutes such as nsf.gov and nih.gov. We further demonstrate the potential to extend our current technique to protect generic domains such as .com and .org.

The popularity of long-tail search engine optimization (SEO) brings with new security challenges: incidents of long-tail keyword poisoning to lower competition and increase revenue have been reported. The emergence of cloud web hosting services provides a new and effective platform for long-tail SEO spam attacks. There is growing evidence that large-scale long-tail SEO campaigns are being carried out on cloud hosting platforms because they offer low-cost, high-speed hosting services. In this paper, we take the first step toward understanding how long-tail SEO spam is implemented on cloud hosting platforms. After identifying 3,186 cloud directories and 318,470 doorway pages on the leading cloud platforms for long-tail SEO spam, we characterize their abusive behavior. One highlight of our findings is the effectiveness of the cloud-based long-tail SEO spam, with 6% of the doorway pages successfully appearing in the top 10 search results of the poisoned long-tail keywords.

In this paper, we implement the first comprehensive quantification of the perfect de-anonymizability and partial de-anonymizability of real-world social networks with seed information under general scenarios, which provides the theoretical foundation for the existing structure-based de-anonymization attacks and closes the gap between de-anonymization practice and theory. Based on our quantification, we conduct a large-scale evaluation of the de-anonymizability of 24 real-world social networks by quantitatively showing the conditions for perfectly and partially de-anonymizing a social network, how de-anonymizable a social network is, and how many users of a social network can be successfully de-anonymized. Furthermore, we show that both theoretically and experimentally, the overall structural information-based de-anonymization attack can be more powerful than the seed-based de-anonymization attack, and even without any seed information, a social network can be perfectly or partially de-anonymized. Finally, we discuss the implications of this paper. Our findings are expected to shed on research questions in the areas of structural data anonymization and de-anonymization and to help data owners evaluate their structural data vulnerability before data sharing and publishing.

When people utilize social applications and services, their privacy suffers a potential serious threat. In this article, we present a novel, robust, and effective de-anonymization attack to mobility trace data and social data. First, we design a Unified Similarity (US) measurement, which takes account of local and global structural characteristics of data, information obtained from auxiliary data, and knowledge inherited from ongoing de-anonymization results. By analyzing the measurement on real datasets, we find that some data can potentially be de-anonymized accurately and the other can be de-anonymized in a coarse granularity. Utilizing this property, we present a US-based De-Anonymization (DA) framework, which iteratively de-anonymizes data with accuracy guarantee. Then, to de-anonymize large-scale data without knowledge of the overlap size between the anonymized data and the auxiliary data, we generalize DA to an Adaptive De-Anonymization (ADA) framework. By smartly working on two core matching subgraphs , ADA achieves high de-anonymization accuracy and reduces computational overhead. Finally, we examine the presented de-anonymization attack on three well-known mobility traces: St Andrews, Infocom06, and Smallblue, and three social datasets: ArnetMiner, Google+, and Facebook. The experimental results demonstrate that the presented de-anonymization framework is very effective and robust to noise. The source code and employed datasets are now publicly available at SecGraph [2015].

Routing is one of the most important and fundamental issues in cognitive radio networks (CRNs). However, most of the existing routing algorithms for CRNs either cannot fully take account of the spectrum dynamics or are resource aided which might introduce too much cost. Therefore, in this paper, we study to design an effective routing scheme with respect to induced latency and energy consumption for CRNs. Our main contributions are threefold. First, we propose a spectrum-aware semi-structure routing (SSR) framework which also incorporates power control for CRNs. By employing forwarding zones and routing zones, SSR can utilize the local real-time spectrum dynamics effectively and meanwhile guarantee the global routing performance. In addition, without sacrificing spectrum opportunities, SSR achieves energy efficiency by completing each data transmission with the lowest allowed working power. Second, aiming at closing the gap of lacking of analytical models for routing protocol performance [4] in CRNs, we propose a mathematical framework for SSR which includes a latency analytical model and an energy consumption analytical model. Under the dense scaling network distribution model, we demonstrate (i) the upper bound of the induced latency and scalability of SSR; and (ii) the optimality of SSR with respect to energy consumption, which is approximately optimal. Finally, extensive simulations are conducted to validate the performance of SSR. Simulation results indicate that SSR can utilize spectrum dynamics effectively and has better performance than state-of-the-art methods.

In this paper, we study the quantification, practice, and implications of structural data de-anonymization, including social data, mobility traces, and so on. First, we answer several open questions in structural data de-anonymization by quantifying perfect and (1 - ε)-perfect structural data de-anonymization, where ε is the error tolerated by a de-anonymization scheme. To the best of our knowledge, this is the first work on quantifying structural data de-anonymization under a general data model, which closes the gap between the structural data de-anonymization practice and theory. Second, we conduct the first large-scale study on the de-anonymizability of 26 real world structural data sets, including social networks, collaborations networks, communication networks, autonomous systems, peer-to-peer networks, and so on. We also quantitatively show the perfect and (1 - ε)-perfect de-anonymization conditions of the 26 data sets. Third, following our quantification, we present a practical attack [a novel single-phase cold start optimization-based de-anonymization (ODA) algorithm]. An experimental analysis of ODA shows that ~77.7%-83.3% of the users in Gowalla (196 591 users and 950 327 edges) and 86.9%-95.5% of the users in Google+ (4692 671 users and 90751 480 edges) are de-anonymizable in different scenarios, which implies that the structure-based de-anonymization is powerful in practice. Finally, we discuss the implications of our de-anonymization quantification and our ODA attack and provide some general suggestions for future secure data publishing.

In this paper, we introduce an open-source and modular password analysis and research system, PARS, which provides a uniform, comprehensive and scalable research platform for password security. To the best of our knowledge, PARS is the first such system that enables researchers to conduct fair and comparable password security research. PARS contains 12 state-of-the-art cracking algorithms, 15 intra-site and cross-site password strength metrics, 8 academic password meters, and 15 of the 24 commercial password meters from the top-150 websites ranked by Alexa. Also, detailed taxonomies and large-scale evaluations of the PARS modules are presented in the paper.

Voice chat and conferencing services may be assumed to be private and secure because of strong encryption algorithms applied to the video stream. We show that information leakage is occurring in video over IP traffic, including for encrypted payloads. It is possible to detect motion and scene changes, such as a person standing up or walking past a camera streaming live video. We accomplish this through analysis of network traffic metadata including arrival time between packets, packet sizes, and video stream bandwidth. Event detection through metadata analysis is possible even when common encryption techniques are applied to the video stream such as SSL or AES. We have observed information leakage across multiple codes and cameras. Through measurements of the x264 codec, we establish a basis for detectability of events via packet timing. Our laboratory experiments confirm that this event detection is possible and repeatable with commercial video streaming software.

Traditional two-dimensional (2D) and three-dimensional (3D) visualization tools for network security applications often employ a desktop, mouse, and keyboard setup of WIMP (Windows, Icons, Menus, and a Pointer) interfaces, which use a serial set of command inputs (e.g., click, rotate, zoom). However, research has shown that multiple inputs (e.g., Microsoft Kinect [8] and multi-touch monitors) could reduce the selection time of objects, resulting in a quicker response time than its traditional counterparts. In this work, we investigate these alternative user interfaces that are “natural” to the user for multiple inputs that reduce response time as a user navigates within a complex three-dimensional (3D) visualization for network security applications. Specifically, we introduce a visualization tool called InterSec, an interaction system prototype for interacting with 3D network security visualizations. InterSec helps developers build and manage gestures that require the coordination of multiple inputs across multiple interaction technologies. To our knowledge, InterSec is the first tool that proposes a system to reduce number of interactions within 3D visualizations for network security tools. Through our evaluation of live Honeynet data and a user study, the results reveal InterSec's ability to reduce the number of interactions to aid in 3D navigation in comparison to the mouse user interface.

As an objective reality, the social behavior pattern of Primary Users (PUs) has significant impacts on the design and management of the secondary network. However, most of the existing works overlook this fact by simplifying the spectrum whitespace assumption. In this paper, we study the joint routing and time-domain scheduling problem for Cognitive Radio Networks (CRNs) by considering the social behaviors of PUs. Our main contributions consist of four aspects. First, we analyze the social pattern of PUs based on two practical data traces. According to the obtained social pattern, the available spectrum whitespace is derived for SUs. Subsequently, in terms of previous analysis, we propose a centralized joint routing and time-domain scheduling framework with global provable ε-optimality (ε ∊ [0,1]) by employing the branch-and-bound technique, where ε indicates the expected closeness of our solution to the optimum solution. The solution of this centralized algorithm can serve as a theoretical benchmark for developing future routing and scheduling algorithms for CRNs. Third, we design a distributed primary behavior-aware routing and scheduling algorithm with local performance guarantee, where the routing and scheduling fairness, the available bandwidth, the potential interference, etc. are taken into account. Finally, simulation results confirm our assertion that primary behaviors have significant impacts on the spectrum whitespace, and demonstrate that primary-behavior-aware joint routing and scheduling design can utilize spectrum whitespace efficiently.

The existing works on analyzing/utilizing spectrum whitespace in Cognitive Radio Networks (CRNs) are either empirical studies lacking of theoretical guarantee, or local primary network information based inducing inaccurate analysis and estimation, or overlooking the spectrum whitespace details. Therefore, we propose to systematically analyze the spectrum whitespace in CRNs from a social network perspective. Our main contributions include four parts. First, we propose a novel metric named centrality score to measure the active weights of Primary Users (PUs) by considering each PU's topological importance in the primary network and the global primary network running and traffic information. Subsequently, based on the centrality scores of PUs, we derive the whitespace in CRNs under different social patterns of primary activities. Since we consider both the primary network topological structure and the global network running and traffic information, our whitespace analysis is more accurate compared with the existing works. Third, according to our whitespace analysis, we design a Virtual Backbone (VB) construction algorithm, which aims to improve the spectrum utilization efficiency in CRNs. Finally, we conduct extensive simulations to validate our whitespace analysis and the VB construction algorithm. The simulation results demonstrate that our social attributes based whitespace analysis can accurately characterize the whitespace in CRNs and the VB construction algorithm significantly improves the performance of the existing VB-based CRN protocols.

In this paper, we introduce GTID, a technique that can actively and passively fingerprint wireless devices and their types using wire-side observations in a local network. GTID exploits information that is leaked as a result of heterogeneity in devices, which is a function of different device hardware compositions and variations in devices' clock skew. We apply statistical techniques on network traffic to create unique, reproducible device and device type signatures, and use artificial neural networks (ANNs) for classification. We demonstrate the efficacy of our technique on both an isolated testbed and a live campus network (during peak hours) using a corpus of 37 devices representing a wide range of device classes (e.g., iPads, iPhones, Google Phones, etc.) and traffic types (e.g., Skype, SCP, ICMP, etc.). Our experiments provided more than 300 GB of traffic captures which we used for ANN training and performance evaluation. In order for any fingerprinting technique to be practical, it must be able to detect previously unseen devices (i.e., devices for which no stored signature is available) and must be able to withstand various attacks. GTID is a fingerprinting technique to detect previously unseen devices and to illustrate its resilience under various attacker models. We measure the performance of GTID by considering accuracy, recall, and processing time and also illustrate how it can be used to complement existing security mechanisms (e.g., authentication systems) and to detect counterfeit devices.

In this article, we illustrate that the boundary of a general-purpose node can be extended into the network by extracting information from network traffic generated by that general-purpose node to infer the state of its hardware components. This information is represented in a delay signature latent within the network traffic. In contrast, the traditional approach to determine the internal state of a node’s resources meant that a software application with internal processes had to be resident on the node. The aforementioned delay signature is the keystone that provides a correlation between network traffic and the internal state of the source node. We characterize this delay signature by (1) identifying the different types of assembly language instructions that source this delay and (2) describing how architectural techniques, such as instruction pipelining and caching, give rise to this delay signature. In theory, highly utilized nodes (due to multiple threads) will contain excessive context switching and contention for shared resources. One important shared resource is main memory, and excessive use of this resource by applications and internal processes eventually leads to a decrease in cache efficiency that eventually stalls the instruction pipeline. Our results support this theory; specifically, we have observed that excessive context switching in active applications increases the effective memory access time and wastes precious CPU cycles, thus adding additional delay to the execution of load, store, and other instructions. Because the operating system (OS) kernel accesses memory to send network packets, the delay signature is induced into network traffic in situations where user-level utilization is high. We demonstrate this theory in two case studies: (1) resource discovery in cluster grids and (2) network-based detection of bitcoin mining on compromised nodes.

In this paper, we study the quantification, practice, and implications of structural data (e.g., social data, mobility traces) De-Anonymization (DA). First, we address several open problems in structural data DA by quantifying perfect and (1-ε)-perfect structural data DA}, where ε is the error tolerated by a DA scheme. To the best of our knowledge, this is the first work on quantifying structural data DA under a general data model, which closes the gap between structural data DA practice and theory. Second, we conduct the first large-scale study on the de-anonymizability of 26 real world structural datasets, including Social Networks (SNs), Collaborations Networks, Communication Networks, Autonomous Systems, and Peer-to-Peer networks. We also quantitatively show the conditions for perfect and (1-ε)-perfect DA of the 26 datasets. Third, following our quantification, we design a practical and novel single-phase cold start Optimization based DA} (ODA) algorithm. Experimental analysis of ODA shows that about 77.7% - 83.3% of the users in Gowalla (.2M users and 1M edges) and 86.9% - 95.5% of the users in Google+ (4.7M users and 90.8M edges) are de-anonymizable in different scenarios, which implies optimization based DA is implementable and powerful in practice. Finally, we discuss the implications of our DA quantification and ODA and provide some general suggestions for future secure data publishing.

The future electrical grid, i.e., smart grid, will utilize appliance-level control to provide sustainable power usage and flexible energy utilization. However, load trace monitoring for appliance-level control poses privacy concerns with inferring private information. In this paper, we introduce a privacy-preserving and fine-grained power load data analysis mechanism for appliance-level peak-time load balance control in the smart grid. The proposed technique provides rigorous provable privacy and an accuracy guarantee based on distributed differential privacy. We simulate the scheme as privacy modules in the smart meter and the concentrator, and evaluate its performance under a real-world power usage dataset, which validates the efficiency and accuracy of the proposed scheme.

Mobile social services utilize profile matching to help users find friends with similar social attributes (e.g., interests, location, background). However, privacy concerns often hinder users from enabling this functionality. In this paper, we introduce S-MATCH, a novel framework for privacy-preserving profile matching based on property-preserving encryption (PPE). First, we illustrate that PPE should not be considered secure when directly used on social attribute data due to its key-sharing problem and information leakage problem. Then, we address the aforementioned problems of applying PPE to social network data and develop an efficient and verifiable privacy-preserving profile matching scheme. We implement both the client and server portions of S-MATCH and evaluate its performance under three real-world social network datasets. The results show that S-MATCH can achieve at least one order of magnitude better computational performance than the techniques that use homomorphic encryption.

Social networks are important mediums for communication,information dissemination, and influence spreading. Most of existing works focus on understanding the characteristics of social networks or spreading information through the 'word of mouth' effect of social networks. However, motivated by applications of alleviating social problems, such as drinking, smoking, addicting to gaming, and influence spreading problems, such as promoting new products, we propose a new optimization problem named the Minimum-sized Influential Node Set (MINS) selection problem, which is to identify the minimum-sized set of influential nodes, such that every node in the network could be influenced by these selected nodes no less than a threshold. Our contributions are threefold. First, we prove that, under the independent cascade model, MINS is NP-hard. Subsequently, we present a greedy approximation algorithm to address the MINS selection problem. Moreover, the performance ratio of the greedy algorithm is analyzed. Finally, to validate the proposed greedy algorithm, extensive experiments and simulations are conducted both on real world coauthor data sets and random graphs.

Data collection is a common operation of Wireless Sensor Networks (WSNs), of which the performance can be measured by its achievable network capacity. Most existing works studying the network capacity issue are based on the unpractical model called deterministic network model. In this paper, a more reasonable model, probabilistic network model, is considered. For snapshot data collection, we propose a novel Cell-based Path Scheduling (CPS) algorithm that achieves capacity of $(\Omega ({1/ 5\omega \ln n} \cdot W))$ in the sense of the worst case and order-optimal capacity in the sense of expectation, where $(n)$ is the number of sensor nodes, $(\omega)$ is a constant, and $(W)$ is the data transmitting rate. For continuous data collection, we propose a Zone-based Pipeline Scheduling (ZPS) algorithm. ZPS significantly speeds up the continuous data collection process by forming a data transmission pipeline, and achieves a capacity gain of $(N \sqrt{n}/ \sqrt{\log n} \ln n)$ or $(n/ \log n \ln n)$ times better than the optimal capacity of the snapshot data collection scenario in order in the sense of the worst case, where $(N)$ is the number of snapshots in a continuous data collection task. The simulation results also validate that the proposed algorithms significantly improve network capacity compared with the existing works.

A Connected Dominating Set (CDS) is used as a Virtual Backbone (VB) for efficient routing and broadcasting in Wireless Sensor Networks (WSNs). Currently, almost all existing works focus on constructing Minimum-sized CDS under the Deterministic Network Model (DNM). However, due to the existence of many probabilistic lossy links in WSNs, it is more practical to obtain a VB under the realistic Probabilistic Network Model (PNM). Moreover, load-balance factor cannot be neglected when constructing a VB to prolong network lifetime. Hence, in this paper, we propose a Multi-Objective Genetic Algorithm (MOGA) to construct a Load-Balanced Virtual Backbone under PNM (LBVBP). Through simulations, we demonstrate that our proposed methods extend network lifetime by 65% on average compared with the existing state-of-the-art approaches.

By using covert channels, a malicious entity can hide messages within regular traffic and can thereby circumvent security mechanisms. This same method of obfuscation can be used by legitimate users to transmit messages over hostile networks. A promising area for covert channels is wireless networks employing carrier sense multiple access with collision avoidance (CSMA/CA) (e.g., 802.11 networks). These schemes introduce randomness in the network that provides good cover for a covert timing channel. Hence, by exploiting the random back-off in distributed coordination function (DCF) of 802.11, we realize a relatively high bandwidth covert timing channel for 802.11 networks, called Covert-DCF. As opposed to many works in the literature focusing on theory and simulations, Covert-DCF is the first fully implemented covert timing channel for 802.11 MAC using off-the-self wireless cards. In this paper, we introduce the design and implementation of Covert-DCF that is transparent to the users of the shared medium. We also evaluate the performance of Covert-DCF and provide discussions on the feasibility of this technique in a real world scenario.

A great deal of research has been done in the last several years on information centric networking (ICN), where named data items, rather than end host identities, are the primary routable entities. Several prototypes have been proposed, but all face daunting concerns in the areas of performance, complexity, backwards compatibility, and user security and privacy. We propose a protocol which creates globally-unique data item names and embeds these names, plus associated metadata, into an IPv6 header. We then show how this allows the use of the IPsec suite of protocols to mitigate user privacy and security concerns. Next, we show that using RFC-compliant IPv6 datagrams as the named content allows content routing to be done using standard gateway protocols and also ensures backwards compatibility with unmodified networks. Lastly, we give an example of how the CLIP header's structure will simplify the design of automatic caches in the network.

As network attacks increase in complexity, network administrators will continue to struggle with analyzing security data immediately and efficiently. To alleviate these challenges, researchers are looking into various visualization techniques (e.g., two-dimensional (2D) and three-dimensional (3D)) to detect, identify, and analyze malicious attacks. This paper discusses the benefits of using a stereoscopic 3D parallel visualization techniques for network scanning, in particular, when addressing occlusion-based visualization attacks intended to confuse network administrators. To our knowledge, no 2D or 3D tool exists that analyzes these attacks. Hence, we propose a novel 3D Parallel coordinate visualization tool for advanced network scans and attacks called P3D. P3D uses flow data, filtering techniques, and state-of-the art 3D technologies to help network administrators detect distributed and coordinated network scans. Compared to other 2D and 3D network security visualization tools, P3D prevents occlusion-based visualization attacks (e.g., Windshield Wiper and Port Source Confusion attacks). We validate our tool with use-cases from emulated distributed scanning attacks. Our evaluation shows P3D allows users to extract new information about scans and minimize information overload by adding an extra dimension and awareness region in the visualization.

The nodes in wireless sensor networks (WSNs) utilize the radio frequency (RF) channel to communicate. Given that the RF channel is the primary communication channel, many researchers have developed techniques for securing that channel. However, the RF channel is not the only interface into a sensor. The sensing components, which are primarily designed to sense characteristics about the outside world, can also be used (or misused) as a communication (side) channel. In this paper, we characterize the side channels for various sensory components (i.e., light sensor, acoustic sensor, and accelerometer). While previous work has focused on the use of these side channels to improve the security and performance of a WSN, we seek to determine if the side channels have enough capacity to potentially be used for malicious activity. Specifically, we evaluate the feasibility and practicality of the side channels using today's sensor technology and illustrate that these channels have enough capacity to enable the transfer of common, well-known malware. The ultimate goal of this work is to illustrate the need for intrusion detection systems (IDSs) that not only monitor the RF channel, but also monitor the values returned by the sensory components.

Social networks are important mediums for spreading information, ideas, and influences among individuals. Most of existing research work focus on understanding the characteristics of social networks, investigating spreading information through the “word of mouth” effect of social networks, or exploring social influences among individuals and groups. However, most of existing work ignore negative influences among individuals or groups. Motivated by alleviating social problems, such as drinking, smoking, gambling, and influence spreading problems (e.g., promoting new products), we take both positive and negative influences into consideration and propose a new optimization problem, named the Minimumsized Positive Influential Node Set (MPINS) selection problem, to identify the minimum set of influential nodes, such that every node in the network can be positively influenced by these selected nodes no less than a threshold θ. Our contributions are threefold. First, we propose a new optimization problem MPINS, which is investigated under the independent cascade model considering both positive and negative influences. Moreover, we claim that MPIMS is NP-hard. Subsequently, we present a greedy approximation algorithm to address the MPINS selection problem. Finally, to validate the proposed greedy algorithm, extensive simulations are conducted on random Graphs representing small and large size networks.

Routing is one of the most important and fundamental issues in Cognitive Radio Networks (CRNs). In this paper, we propose an effective routing scheme. Our main contributions are threefold. First, we propose a spectrum-aware Semi-Structure Routing (SSR) framework which incorporates power control. By employing forwarding zones and routing zones, SSR can effectively utilize the local real-time spectrum dynamics and meanwhile guarantee the global routing performance. Second, considering the lack of analytical models for routing protocol performance [1] in CRNs, we analyze the upper bound of the induced latency and scalability of SSR. Finally, extensive simulation results are presented to validate the performance of SSR.

Cognitive Radio Networks (CRNs) introduce a new communication paradigm which enable unlicensed users to opportunistically access spectrum bands assigned to licensed users. Interestingly, the broadcast problem, which is one of the most fundamental operations in CRNs, has not been well studied. Existing works for the broadcast issue in CRNs are either heuristic solutions without performance guarantee or with performance far from the optimal solution. In this paper, we study the Minimum-Latency Broadcast Scheduling (MLBS) issue for CRNs. Our contributions are threefold. Firstly, we propose a Mixed Broadcasting Scheduling (MBS) algorithm under the Unit Disk Graph (UDG) model, denoted by MBS-UDG. MBSUDG finishes a broadcast task by employing mixed unicast and broadcast communication modes in two phases. We show that the latency performance of MBS-UDG is O(ħ+ΔT) when ΔT≤ 1/p, or O(ħ+log1-p1/(pΔT)) when ΔT> 1/p, where ħ and ΔTare the height and the maximum number of leaf nodes connected by a SU of the broadcasting tree, respectively, and p is the spectrum opportunity for a secondary communication. Furthermore, the redundancy performance of MBS-UDG is analyzed. Secondly, we extend MBS-UDG to a more general MBS algorithm under the protocol interference model and analyze its latency and redundancy performance. Finally, simulations are conducted to validate MBS, which indicate that MBS significantly improves existing algorithms with respect to both latency and redundancy.

As network attacks increase in complexity, the ability to quickly analyze security data and mitigate the effect of these attacks becomes a difficult problem. To alleviate these challenges, researchers are looking into various two-dimensional (2D) and three-dimensional (3D) visualization tools to detect, identify, and analyze malicious attacks. These visualization tools often require advanced knowledge in networking, visualization, and information security to operate, navigate, and successfully examine malicious attacks. Novice users, deficient in the required advanced knowledge, may find navigation within these visualization tools difficult. Furthermore, expert users may be limited and costly. We discuss the use of a modern recommender system to aid in navigating within a complex 3D visualization for network security applications. We developed a visualization module called NAVSEC, a recommender system prototype for navigating in 3D network security visualization tools. NAVSEC recommends visualizations and interactions to novice users. Given visualization interaction input from a novice user and expert communities, NAVSEC is instrumental in reducing confusion for a novice user while navigating in a 3D visualization. We illustrate NAVSEC with a use-case from an emulated stealthy scanning attack disguised as a file transfer with multiple concurrent connections. We show that using NAVSEC, a novice user's visualization converges towards a visualization used to identify or detect a suspected attack by an expert user. As a result, NAVSEC can successfully guide the novice user in differentiating between complex network attacks and benign legitimate traffic with step-by-step created visualizations and suggested user interactions.

Data collection is a common operation of wireless sensor networks (WSNs). The performance of data collection can be measured by its achievable network capacity. However, most existing works focus on the network capacity of unicast, multicast or/and broadcast. In this article, we study the snapshot/continuous data collection (SDC/CDC) problem under the physical interference model for randomly deployed dense WSNs. For SDC, we propose a Cell-Based Path Scheduling (CBPS) algorithm based on network partitioning. Theoretical analysis shows that its achievable network capacity is order-optimal. For CDC, a novel Segment-Based Pipeline Scheduling (SBPS) algorithm is proposed which combines the pipeline technique and the compressive data gathering technique. Theoretical analysis shows that SBPS significantly speeds up the CDC process and achieves a high network capacity.

We present the Secure SOurce-BAsed Loose Synchronization (SOBAS) protocol to securely synchronize the events in the network, without the transmission of explicit synchronization control messages. In SOBAS, nodes use their local time values as a one-time dynamic key to encrypt each message. In this way, SOBAS provides an effective dynamic en-route filtering mechanism, where the malicious data is filtered from the network. With SOBAS, we are able to achieve our main goal of synchronizing events at the sink as quickly, as accurately, and as surreptitiously as possible. With loose synchronization, SOBAS reduces the number of control messages needed for a WSN to operate providing the key benefits of reduced energy consumption as well as reducing the opportunity for malicious nodes to eavesdrop, intercept, or be made aware of the presence of the network. Albeit a loose synchronization per se, SOBAS is also able to provide $(7.24 \mu)$s clock precision given today's sensor technology, which is much better than other comparable schemes (schemes that do not employ GPS devices). Also, we show that by recognizing the need for and employing loose time synchronization, necessary synchronization can be provided to the WSN application using half of the energy needed for traditional schemes. Both analytical and simulation results are presented to verify the feasibility of SOBAS as well as the energy consumption of the scheme under normal operation and attack from malicious nodes.

ABSTRACT For wireless mobile multihop relay (MMR) networks, we have chosen orthogonal frequency division multiple access (OFDMA) and time division duplex as a multiple access scheme and a duplex communication technique, respectively. We have also selected nontransparent relay stations (nt‐RSs) as relay nodes to extend the MMR network coverage. Through the nt‐RSs, far‐off subscriber stations (SSs) or hidden SSs can communicate with a base station (BS) that is connected to backhaul networks. In these MMR networks, the way in which a BS and nt‐RSs use OFDMA resources (e.g., OFDMA symbols and subcarriers) and share them might reduce system capacity and network throughput. Therefore, we proposed a new adaptive OFDMA frame structure for both the BS and the nt‐RSs. The proposed scheme is the first approach that incorporates the adaptive technique for wireless MMR networks. Based on the proposed adaptive OFDMA frame structure, an adaptive OFDMA resource allocation for SSs within a BS as well as nt‐RSs was proposed. To derive the maximum OFDMA resource that nt‐RSs can be assigned and to synchronize access zones and relay zones between a superior station and its subordinate nt‐RSs, three properties are introduced: a data relay property, a maximum balance property, and a relay zone limitation property. In addition, we propose max‐min and proportional fairness schemes of the proposed adaptive frame structure. Our numerical analysis and simulations show that the proposed OFDMA allocation scheme performs better than the nonadaptive allocation scheme in terms of network throughput and fairness especially in the asymmetric distribution of subscriber stations between access zones and relay zones in the MMR networks. Copyright © 2011 John Wiley & Sons, Ltd.

Wireless sensor networks (WSNs) are used in a range of critical domains (e.g., health care, military, critical infrastructure) where it is necessary that the nodes be reprogrammed with a new or modified code image without removing them from the deployment area. Various protocols have been developed for the dissemination of code images between sensors in multi-hop WSNs, where these sensor nodes may have varying levels of link quality. However, the code dissemination process in these protocols is hindered by the nodes with poor link quality. This results in an increased number of retransmissions and code dissemination time. Also, in several of the techniques, the code dissemination process is not secure and can be eavesdropped or disrupted by a malicious wireless sensor node in the transmission range. In this paper, we propose a simple approach, Secure and Link-Quality Cognizant Image Distribution (SIMAGE), to enhance the existing code dissemination protocol using the available resources in the sensors. Specifically, our approach adapts to the varying link conditions via dynamic packet sizing to reduce the number of retransmissions and overall code dissemination time. Our approach also provides confidentiality and integrity to the code dissemination process by utilizing energy-efficient encryption and authentication mechanisms with RC4 and the CBC-MAC. We have evaluated SIMAGE in a network of real sensors and the results show that adjusting the packet size as a function of link quality reduces the retransmitted data by 93% and the image transmission time by 35% when compared to the existing code dissemination protocols. The trade-offs between reliability, security overhead, and overall transmission time for SIMAGE are also discussed.

Data collection, redistribution and retrieval are essential components of wireless sensor networks (WSNs). In dense WSN deployments, the sensor data are usually sent to a sink that can be reached through one or multiple hops. In the case where communications with the sink are disrupted due to various reasons, the data must be stored in the network for later retrieval. When considering in-network storage, we must redistribute the data among an energy-constrained network with sensors that have a low storage capacity. In previous works, the data redistribution problem has been studied, but the focus was only on the redistribution costs while the data retrieval costs (which have been analyzed in other works as an independent problem) were ignored. We recognize that these two problems should be studied in concert and therefore, in this paper, we combine both data redistribution and retrieval into a single problem. We propose a graph transformation, formulate the problem as a minimum cost flow optimization problem and use linear programming to find the optimal solution. Moreover, we introduce an algorithm named EDR2: energy-efficient data redistribution and retrieval. EDR2is a distributed energy-efficient algorithm for in-network storage and later retrieval in WSNs. To evaluate our solution on a large scale, we modeled different scenarios in a 400-node network, used the GNU Linear Programming Kit (GLPK) to obtain the optimal solutions, and ran simulations to find the solutions using our algorithm. Finally, we implemented EDR2using real sensors to demonstrate the feasibility of our algorithm. We compared EDR2with two heuristic algorithm and show that our approach is an energy-efficient solution for node selection when redistributing data in a WSN for eventual retrieval.

Data collection is a common operation of Wireless Sensor Networks (WSNs). The performance of data collection can be measured by its achievable network capacity. Most of the current works on the network capacity issue are based on the deterministic network model, which is not practical for real applications due to the “transitional region phenomenon” [22]. The probabilistic network model is actually a more practical one. In this paper, we investigate the achievable Snapshot/Continuous Data Collection (SDC/CDC) capacity for WSNs under the probabilistic network model. For SDC, we propose a novel Cell-based Multi-Path Scheduling (CMPS) algorithm, whose achievable network capacity is Ω(po/3ω · W) in the worst case and Ω(po/ω · W) in the average case, where pois the promising transmission threshold probability, ω is a constant, and W is the data transmitting rate over a wireless channel, i.e. the channel bandwidth, which are both order-optimal. For CDC, we propose a Zone-based Pipeline Scheduling (ZPS) algorithm. ZPS significantly speeds up the data collection process and achieves surprising network capacities for both the worst case and the average case. The simulation results also validate that the proposed algorithms significantly improve network capacity compared with the existing works.

Wireless Sensor Networks (WSNs) are deployed for monitoring in a range of critical domains (e.g., health care, military, critical infrastructure). Accordingly, these WSNs should be resilient to attacks. The current approach to defending against malicious threats is to develop and deploy a specific defense mechanism for a specific attack. However, the problem with this traditional approach to defending sensor networks is that the solution for the Jamming attack does not defend against other attacks (e.g., Sybil and Selective Forwarding). In reality, one cannot know a priori what type of attack an adversary will launch. This work addresses the challenges with the traditional approach to securing sensor networks and presents a comprehensive framework, Di-Sec, that can defend against all known and forthcoming attacks. At the heart of Di-Sec lies the monitoring core (M-Core), which is an extensible and lightweight layer that gathers statistics relevant for the defense mechanisms. The M-Core allows for the monitoring of both internal and external threats and supports the execution of multiple detection and defense mechanisms (DDMs) against different threats in parallel. Along with Di-Sec, a new user-friendly domain-specific language was developed, the M-Core Control Language (MCL). Using the MCL, a user can implement new defense mechanisms without the overhead of learning the details of the underlying software architecture (i.e., TinyOS, Di-Sec). Hence, the MCL expedites the development of sensor defense mechanisms by significantly simplifying the coding process for developers. The Di-Sec framework has been implemented and tested on real sensors to evaluate its feasibility and performance. Our evaluation of memory, communication, and sensing components shows that Di-Sec is feasible on today's resource-limited sensors and has a nominal overhead. Furthermore, we illustrate the basic functionality of Di-Sec by implementing and simultaneously executing DDMs for attacks at various layers of the communication stack (i.e., Jamming, Selective Forwarding, Sybil, and Internal attacks).

Network Disaster Recovery research has examined behavior of networks after disasters with an aim to restoring normal conditions. In addition to probable loss of connectivity, a disaster scenario can also lead to security risks. However, network security has been examined extensively under normal conditions, and not under conditions that ensue after disasters. Therefore, security issues should be addressed during the period of chaos after a disaster, but before operating conditions return to normal. Furthermore, security should be assured, while still allowing access to the network to enable public communication in order to assist in disaster relief efforts. In general, the desire to help with public assistance requires opening up access to the network, while security concerns add pressure to close down or limit access to the network. In this study, we show that the objectives of availability and confidentiality, two objectives that have not previously been considered together in disaster scenarios, can be simultaneously achieved. For our study, we evaluated six wireless devices with various network configurations, including a laptop, a Kindle Fire e-reader, an Android tablet, a Google Nexus phone, an IP camera, and an Apple TV, to approximate behaviors of a communication network under a disaster scenario. Actual data leakage was tracked and observed for these devices. To the best of our knowledge this has not previously been examined in a systematic manner for post-disaster scenarios. After illustrating the data leakage of various devices, we analyze the risk associated with the various types of leakage. Moving private traffic to a VPN would free the physical network for use as a public resource.

As the volume of network data continues to increase and networks become more complex, the ability to accurately manage and analyze data quickly becomes a difficult problem. Many network management tools already use two-dimensional (2D) and three-dimensional (3D) visualization techniques to help support decision-making and reasoning of network anomalies and activity. However, a poor user interface combined with the massive amount of data could obfuscate important network details. As a result, administrators may fail to detect and identify malicious network behavior in a timely manner. 3D visualizations address this challenge by introducing monocular and binocular visual cues to portray depth and to increase the perceived viewing area. In this work, we explore these cues for 3D network security applications, with a particular emphasis on binocular disparity or stereoscopic 3D. Currently, no network security tool takes advantage of the enhanced depth perception provided by stereoscopic 3D technologies for vulnerability assessment. Compared to traditional 3D systems, stereoscopic 3D helps improve the perception of depth, which can, in turn reduce the number of errors and increase response times of network administrators. Thus, we introduce a stereoscopic 3D visual Framework for Rendering Enhanced 3D Stereoscopic Visualizations for Network Security (FRE3DS). Our novel framework uses state-of-the art 3D graphics rendering to assist in 3D visualizations for network security applications. Moreover, utilizing our framework, we propose a new 3D Stereoscopic Vulnerability Assessment Tool (3DSVAT). We illustrate the use of 3DSVAT to assist in rapid detection and correlation of attack vulnerabilities in a subset of a modified local area network data set using the enhanced perception of depth in a stereoscopic 3D environment.

Wireless sensor networks (WSNs) are used for the monitoring of physical and environmental phenomena, and applicable in a range of different domains (e.g., health care, military, critical infrastructure). When using WSNs in a variety of real-world applications, security is a vital problem that should be considered by developers. As the development of security applications (SAs) for WSNs require meticulous procedures and operations, the software implementation process can be more challenging than regular applications. Hence, in an effort to facilitate the design, development and implementation of WSN security applications, we introduce the Monitoring Core (M-Core). The M-Core is a modular, lightweight, and extensible software layer that gathers necessary data including the internal and the external status of the sensor (e.g., information about ongoing communications, neighbors, and sensing), and provides relevant information for the development of new SAs. Similar to other software development tools, the M-Core was developed to facilitate the design and development of new WSN SAs on different platforms. Moreover, a new user-friendly domain-specific language, the M-Core Control Language (MCL), was developed to further facilitate the use of the M-Core and reduce the developer's coding time. With the MCL, a user can implement new SAs without the overhead of learning the details of the underlying sensor software architecture (e.g., TinyOS). The M-Core has been implemented in TinyOS-2.x and tested on real sensors (Tmote Sky and MicaZ). Using the M-Core architecture, we implemented several SAs to show that the M-Core allows easy and rapid development of security programs efficiently and effectively.

Abstract For extremely sensitive applications, it may be advantageous for users to transmit certain types of data covertly over the network. This provides an additional layer of security to that provided by the different layers of the protocol stack. In this paper we present a covert side channel that uses the 802.11 MAC rate switching protocol. The covert channel provides a general method to hide communications within currently deployed 802.11 LANs. The technique uses a one‐time password (OTP) algorithm to ensure high‐entropy randomness of the covert messages. We investigate how the covert side channel affects network throughput under various rate‐switching conditions with UDP‐based and TCP‐based application traffic. We also investigate the covertness of the covert side channel using standardized entropy. The theoretical analysis shows that the maximum covert channel bandwidth is 60 bps. The simulation results show that the impact on network throughput is minimal and increases slightly as the covert channel bandwidth increases. We further show that the channel has 100% accuracy with minimal impact on rate switching entropy for scenarios where rate switching normally occurs. Finally, we present two applications for the covert channel: covert authentication and covert WiFi botnets. Copyright © 2010 John Wiley & Sons, Ltd.

Wireless sensors are attached to all kinds of mobile devices/entities such as mobile phones, PDAs, vehicles, robots and animals. This generates Mobile Wireless Sensor Networks (MWSNs) with very dynamic topologies and loose connectivity that depend on mobility of the mobile devices. Data collection from these mobile sensors has become a great challenge considering volatile topologies, loose connectivity and limited buffer storage. This paper proposes a stochastic compressive data collection protocol for MWSNs named SMITE. SMITE consists of three parts: random collector election, stochastic direct transmission from common nodes to collectors when common nodes are in the collectors' transmission range, and angle transmission from collectors to the mobile sink when collectors gather enough data using a predictive method. The collectors use bloom filters to compress the received data. The protocol's performance is theoretically analyzed. The analytic results show that data from the common nodes can be gathered to the collectors with a high probability and gathered data on the collectors can also be forwarded to the mobile sink with a high probability. Simulations are carried out for performance evaluation. The simulation results show that SMITE significantly outperforms the state-of-the-art solutions such as DFT-MSN, SCAR and Sidewinder on the aspects of delivery ratio, transmission overhead, and time delay.

Covert communications have been used for many decades. Accordingly, when digital communications moved to the forefront it was natural that covert channels be proposed to operate over these networks. Covert channels are general purpose transmission mediums that can be used for good (e.g., an additional layer of security) or bad (e.g., to conduct various proximity-based attacks in wireless LANs). However, their use has been limited as a result of their low throughput. One area that is promising for covert channels is wireless networks. Specifically, those that employ carrier sense multiple access with collision avoidance (CSMA/CA) (e.g., 802.11 networks). These schemes introduce randomness in the network that provides good cover for a covert timing channel. In this paper, we propose a relatively high bandwidth covert timing channel for 802.11 networks (Covert DCF). We exploit the random backoff in the distributed coordinated function (DCF), used to avoid collisions, to provide cover for our covert timing channel. Covert DCF provides significant improvements over other recent covert channels in the area of throughput, while maintaining high accuracy and remaining undetectable. We are able to covertly achieve throughput of 1800 bps while maintaining 99% accuracy. This throughput is approximately 17 times faster than that of current covert timing channels. Covert DCF is robust in that it can adapt to various network conditions.

Data collection is a common operation of Wireless Sensor Networks (WSNs). The performance of data collection can be measured by its achievable network capacity. However, most existing works focus on the network capacity of unicast, multicast or/and broadcast, which are different communication modes from data collection, especially continuous data collection. In this paper, we study the Snapshot/Continuous Data Collection (SDC/CDC) problem under the Physical Interference Model (PhIM) for randomly deployed dense WSNs. For SDC, we propose a Cell-Based Path Scheduling (CBPS) algorithm based on network partitioning. Theoretical analysis shows that its achievable network capacity is Ω(W) (W is the data transmitting rate, i.e. bandwidth, over a channel), which is order-optimal. For CDC, we propose a novel Segment-Based Pipeline Scheduling (SBPS) algorithm that significantly speeds up the CDC process, and achieves a surprising network capacity, which is at least √(n/ log n) or n/log n times better than the current best result.

We present the details of a novel method for passive resource discovery in cluster grid environments, where resources constantly utilize internode communication. Our method offers the ability to nonintrusively identify resources that have available CPU cycles; this is critical for lowering queue wait times in large cluster grid networks. The benefits include: 1) low message complexity, which facilitates low latency in distributed networks, 2) scalability, which provides support for very large networks, and 3) low maintainability, since no additional software is needed on compute resources. Using a 50-node (multicore) test bed (DETERlab), we demonstrate the feasibility of our method with experiments utilizing TCP, UDP, and ICMP network traffic. We use a simple but powerful technique that monitors the frequency of network packets emitted from the Network Interface Card (NIC) of local resources. We observed the correlation between CPU load and the timely response of network traffic. A highly utilized CPU will have numerous, active processes which require context switching. The latency associated with numerous context switches manifests as a delay signature within the packet transmission process. Our method detects that delay signature to determine the utilization of network resources. Results show that our method can consistently and accurately identify nodes with available CPU cycles (<;70 percent CPU utilization) through analysis of existing network traffic, including network traffic that has passed through a switch (noncongested). Also, in situations where there is no existing network traffic for nodes, ICMP ping replies can be used to ascertain this resource information.

We propose a passive blackbox-based technique for determining the type of access point (AP) connected to a network. Essentially, a stimulant (i.e., packet train) that emulates normal data transmission is sent through the access point. Since access points from different vendors are architecturally heterogeneous (e.g., chipset, firmware, driver), each AP will act upon the packet train differently. By applying wavelet analysis to the resultant packet train, a distinct but reproducible pattern is extracted allowing a clear classification of different AP types. This has two important applications: (1) as a system administrator, this technique can be used to determine if a rogue access point has connected to the network; and (2) as an attacker, fingerprinting the access point is necessary to launch driver/firmware specific attacks. Extensive experiments were conducted (over 60GB of data was collected) to differentiate 6 APs. We show that this technique can classify APs with a high accuracy (in some cases, we can classify successfully 100% of the time) with as little as 100000 packets. Further, we illustrate that this technique is independent of the stimulant traffic type (e.g., TCP or UDP). Finally, we show that the AP profile is stable across multiple models of the same AP.

Given that transmission cost is significant in a Wireless Sensor Network (WSN), sending explicit keying control messages significantly increases the amount of energy consumed by each sensing device. Thus, in this paper, we address the issue of security for WSNs from a completely novel perspective. We present a technique to secure the network, without the transmission of explicit keying messages needed to avoid stale keys. Our protocol, the TIme-Based DynamiC Keying and En-Route Filtering (TICK) protocol for WSNs secures events as they occur. As opposed to current chatty schemes that incur regular keying message overhead, nodes use their local time values as a one-time dynamic key to encrypt each message. Further, this mechanism prevents malicious nodes from injecting false packets into the network. TICK is as a worst case twice more energy efficient than existing related work. Both an analytical framework and simulation results are presented to verify the feasibility of TICK as well as the energy consumption of the scheme under normal operation and attack from malicious nodes.

Understanding and analyzing the past and current behavior of the Internet will be instrumental in building tomorrow's more efficient and scalable networks (e.g., the future Internet). In this paper, we study the impact of Autonomous Systems (ASs) paths' end-to-end latency. Unfortunately, due to the diverse set of non-disclosed routing policies among ASs, packets belonging to a certain end-to- end connection may traverse different ASs, causing fluctuating AS paths. Fluctuation of AS paths has been studied in the literature directly from the core of the network. In this paper, we take a different approach to the analysis of the fluctuation, solely from the edge of the network. Specifically, from the end user's perspective, some AS paths may be optimal (or better) and some sub-optimal. Furthermore, there is not a unique definition for sub- optimality as it may be reflected with various measures (e.g., latency) depending on the application requirements and expectations. In this paper we analyze fluctuating AS path lengths (ASPLs) and investigate their impact on the end-to-end latency over the Internet at a greater scale than previous studies. This study was conducted using Scriptroute to probe various PlanetLab nodes. Our results show that all of the source nodes experienced some AS path differences and the ASPL values that the sources use greatly vary. At worst, some nodes experienced different paths over 70% of the time during our measurements. We observed that the largest difference in ASPLs on a particular connection was as high as 6 with an average of 2.5. Moreover, we present real cases where ASPL and latency values are related, inversely related, and not related at all. Finally, we provide a simple definition for suboptimality and analyze the collected data against this definition. We show that overall 82% of the fluctuating paths and 9% of all the traces between source-destination pairs faced sub-optimal AS paths.

IEEE 802.15.4 is a standard designed for low data rate wireless personal area networks (WPANs) intended to provide connectivity to mobile devices. Such devices have considerable storage, energy, and communication constraints. However, they can be used in a variety of applications like home/office automation, healthcare, environmental control and more. To extend the lifetime of the WPAN, we propose a backward compatible energy efficient 802.15.4 MAC protocol (DEEP) for beacon-enabled sensor networks. The implementation of DEEP requires modifications to the Superframe Guaranteed Time Slot (GTS) distribution. This modification optimizes the GTS distribution providing reduced energy consumption. We implemented the improvements to the IEEE 802.15.4 protocol using real sensor nodes in a wireless network. Specifically, we conducted an energy study of DEEP's acknowledgmentbased GTS descriptor distribution scheme and compared the results with the standard implementation. Experiments show that DEEP reduces energy consumption up to nearly 50% when 7 devices allocate guaranteed time slots descriptors during normal communication.

We propose a simple scheme for detecting selfish behavior achieved by manipulating the 802.11 Medium Access Control (MAC) protocol. Specifically, attacks that exploit the Distributed Coordination Function (DCF) parameters and data rate adaption scheme to maximize individual throughput pose a denial of service threat against protocol abiding nodes. We detect this malicious behavior by employing a combination of supervised and unsupervised learning techniques that monitor for disparities in the delay patterns of protocol-abiding and illegitimate traffic. Unlike existing approaches, detection is done on the wired side. We apply an anomaly-based categorization, which obviates the need to train on traces from different network instances. Since the approach is holistic and does not rely on a feature selection using individual parameters, the technique is free of adaptive cheating. Additionally, the accuracy of classification is independent of the number of terminals in the network, the number of colluding attackers, protocol, rate adaptation and higher layer transmission behavior. Simulations and experiments are used to validate our scheme.

Designing cost-efficient, secure network protocols for Wireless Sensor Networks (WSNs) is a challenging problem because sensors are resource-limited wireless devices. Since the communication cost is the most dominant factor in a sensor's energy consumption, we introduce an energy-efficient Virtual Energy-Based Encryption and Keying (VEBEK) scheme for WSNs that significantly reduces the number of transmissions needed for rekeying to avoid stale keys. In addition to the goal of saving energy, minimal transmission is imperative for some military applications of WSNs where an adversary could be monitoring the wireless spectrum. VEBEK is a secure communication framework where sensed data is encoded using a scheme based on a permutation code generated via the RC4 encryption mechanism. The key to the RC4 encryption mechanism dynamically changes as a function of the residual virtual energy of the sensor. Thus, a one-time dynamic key is employed for one packet only and different keys are used for the successive packets of the stream. The intermediate nodes along the path to the sink are able to verify the authenticity and integrity of the incoming packets using a predicted value of the key generated by the sender's virtual energy, thus requiring no need for specific rekeying messages. VEBEK is able to efficiently detect and filter false data injected into the network by malicious outsiders. The VEBEK framework consists of two operational modes (VEBEK-I and VEBEK-II), each of which is optimal for different scenarios. In VEBEK-I, each node monitors its one-hop neighbors where VEBEK-II statistically monitors downstream nodes. We have evaluated VEBEK's feasibility and performance analytically and through simulations. Our results show that VEBEK, without incurring transmission overhead (increasing packet size or sending control messages for rekeying), is able to eliminate malicious data from the network in an energy-efficient manner. We also show that our framework performs better than other comparable schemes in the literature with an overall 60-100 percent improvement in energy savings without the assumption of a reliable medium access control layer.

Resource discovery is an important problem in distributed computing, because the throughput of the system is directly linked to its ability to quickly locate available resources. Current solutions are undesirable for discovering resources in large computational clusters because they are intrusive, chatty (i.e., have per-node overhead), or maintenance-intensive. In this paper, we present a novel method that offers the ability to non-intrusively identify resources that have available memory; this is critical for memory-intensive cluster applications such as weather forecasting and computational chemistry. The prime benefits are fourfold: (1) low message complexity, (2) scalability, (3) load balancing, and (4) low maintainability. We demonstrate the feasibility of our method with experiments using a 50-node test-bed (DETERlab). Our technique allows us to establish a correlation between memory load and the timely response of network traffic from a node. Results show that our method can accurately (92%-100%) identify nodes with available memory through analysis of existing network traffic, including network traffic that has passed through a switch (non-congested).

Wireless sensor networks can be used for event warning applications. Till date, in most of the proposed schemes, the raw or aggregated sensed data are periodically sent to a data consuming center. However, with those schemes, the occurrence of an emergency event such as a fire is hardly reported timely, which is a strict requirement for event warning applications. In wireless sensor networks, it is also highly desired to conserve energy so that network lifetime can be maximized. Furthermore, to ensure the quality of surveillance, some applications require that if an event occurs, it needs to be detected by at least k sensors, where k is a user-defined parameter. In this work, we examine the Timely Energy-efficient k-Watching Event Monitoring (TEKWEM) problem and propose a scheme, which involves an event detection model and a warning delivery model, for monitoring composite events and delivering warnings to users. Theoretical analysis and simulation results are shown to validate the proposed scheme.

We present a covert side channel technique that uses the 802.11 MAC rate switching protocol as cover for covert authentication messages. Covert authentication prevents an attacker from knowing when a user is authenticating and protects user credentials from malicious software attacks. Similar to port knocking, a remote client sends authentication messages to an access point in order to access a protected service. The technique uses a one-time password algorithm to protect against replay attacks. We investigate how the covert side channel affects node throughput in mobile and non-mobile scenarios. We also investigate the covertness of the covert side channel using standardized entropy. The results show that the performance impact is minimal and increases slightly as the authentication frequency increases. We further show that we can authenticate with 100% accuracy with minimal impact on rate switching entropy.

Abstract Worldwide interoperability for microwave access (WiMAX), designed by the IEEE 802.16 standards group, is one of the most promising broadband wireless technologies with respect to delivering high‐speed connectivity in the last mile. A mesh network configuration was added for improved coverage and throughput. We describe security concerns for WiMAX mesh mode such as malicious sponsor nodes and privacy. We also seek to reduce the processing load as a result of the use of link encryption. We introduce two different types of attacks as a result of different types of malicious sponsor nodes. The first type of attack occurs when the malicious sponsor node has not actually joined the current mesh network but solicits new nodes to join the mesh network through it. The second type of attack occurs when the malicious node is a member of the mesh network and selectively drops data from its child nodes. To prevent the first attack, we propose a new security protocol that adds to the standard control messages a pair of secret authorization keys (AK). To handle the second attack, we propose a reputation‐based scheme that is specific to WiMAX mesh networks. We conduct a numerical analysis and simulations to highlight the strengths of the proposed schemes. The proposed reputation‐based scheme uses the MSH‐NCFG control message that is used in the WiMAX standard to send reputation information about nodes in the mesh network. Nodes that are joining the mesh network receive and process MSH‐NCFG messages and decide which sponsor node through which to join the network. We conduct a numerical analysis to determine the amount of time for reputation information to propagate through the mesh network, thus allowing joining nodes to avoid malicious sponsor nodes. The simulation results show that the proposed scheme can reduce the overall data drop rate in WiMAX mesh networks in the presence of the aforementioned attacks from malicious sponsor nodes. Copyright © 2009 John Wiley & Sons, Ltd.

Abstract Authentication over a network is an important and difficult problem. Accurately determining the authenticity of a node or user is critical in maintaining the security of a network. Our proposed technique covertly embeds a watermark, or identifying tag, within a data stream. By implementing this model on a LAN, WLAN, and VPN connection we show that this method is easily adaptable to a variety of networking technologies, and easily scalable. While our technique increases the time required for data to be transferred, we show that the throughput of the link during the brief authentication window is decreased by no more than 8 percent in a switched LAN, 11 percent in a WLAN, and 9 percent in a VPN. During our empirical analysis we were able to detect the watermark with 100 percent accuracy in a LAN, WLAN, and VPN environment. We also investigate the detectability of the covert channel, and show that this method produces a relatively stealthy covert channel. Copyright © 2008 John Wiley & Sons, Ltd.

Most of current anti-spam techniques, like the Bayesian anti-spam algorithm, primarily use lexical matching for filtering unsolicited bulk E-mails (UBE) and unsolicited commercial E-mails (UCE). However, precision of spam filtering is usually low when the lexical matching algorithms are used in real dynamic environments. For example, an E-mail of refrigerator advertisements is useful for most families, but it is useless for Eskimos. The lexical matching anti-spam algorithms cannot distinguish such processed E-mails that are junk to most people but are useful for others. We propose a Factors Hyperbolic Tree (FHT) based algorithm that, unlike the lexical matching algorithms, handles spam filtering in a dynamic environment by considering various relevant factors. The new Ranked Term Frequency (RTF) algorithm is proposed to extract indicators from E-mails that are related to environmental factors. Type-1 and Type-2 fuzzy logic systems are used to evaluate the indicators and determine whether E-mails are spam based on the environmental factors. Additionally, weights of factors in a FHT database are continuously updated according to dynamic conditional factors in a real environment. Simulation results show that the FHT algorithm filters out spam with high precision. Furthermore, the FHT algorithm is more efficient than other methods when it filters E-mails with complex influencing factors. The main contribution of this paper is that the FHT based algorithm can filter E-mails based on influencing factors instead of matched words to allow dynamic filtering of spam E-mails.

Free online tools such as search, email and mapping come with a hidden cost. Web users obtain such services by making micropayments of personal and organizational information to the Web service providers. Web companies use this information to create customized advertising and tailored user experiences. Individually, each transaction appears innocuous, but when aggregated, the result is often highly sensitive. The impact of AOL's inadvertent disclosure of 20 million nominally anonymized search queries underscores the pressing need for increasing Web privacy and raising user awareness of the problem. Rather than advocate extreme legal and policy measures to address the dilemma, this paper proposes an equitable self- monitoring solution. Self-monitoring allows individual users and large enterprises to regulate their Web-based interactions intelligently and still allow online companies to innovate and flourish. The primary contributions of our work include exploration of visualization techniques that support self-monitoring based on a user requirements survey, a human-centric evaluation, and a Firefox extension based on one of the visual monitoring solutions developed.

In this paper we propose a passive approach to using network traffic to discover the availability of resources in local distributed networks (e.g., cluster grids, campus desktop grids, etc.). To our knowledge, this is the first approach of its kind. The ability to quickly identify resource availability is critical because the presence of available resources directly affects the job execution time of a distributed environment. The proposed method creates a delay sensitive profile generated by the analysis of monitored network traffic, which emulates high performance UDP based grid services such as file transfer applications (FOBS, Tsunami, UDT, SABUL, etc.), message passing platforms (MPICHG2/Score, etc.), and others. An energy value is derived from the delay sensitive profile, which represents the state (over-utilized CPU or under-utilized CPU) of the resource of interest. Then a simple threshold (derived from initial calibrations on the over-utilized resources.) is applied to the energy value to identify the state of the resource. This method could be used to enhance existing resource discovery algorithms used in local distributed networks because this approach is capable of passively determining a major dynamic resource attribute - CPU utilization. The main benefits are the reduction in the necessary complexity associated with the use of non-passive algorithms (e.g., flooding algorithm, name-dropper algorithm, distinctive awareness algorithm, etc.) and the reduction in the extra network traffic that results from the continual need to determine the availability of dynamic resources. Since this method is passive in nature, there is no need to query potential resources directly to determine their availability to complete distributed computing related jobs. Results suggest that once the CPU utilization approaches 70% (unavailable) the network traffic produced by that node exhibits different behavior than when the CPU utilization is less than 70% (available).

Unauthorized or rogue access points (APs) produce security vulnerabilities in enterprise/campus networks by circumventing inherent security mechanisms. We propose to use the round trip time (RTT) of network traffic to distinguish between wired and wireless nodes. This information coupled with a standard wireless AP authorization policy allows the differentiation (at a central location) between wired nodes, authorized APs, and rogue APs. We show that the lower capacity and the higher variability in a wireless network can be used to effectively distinguish between wired and wireless nodes. Further, this detection is not dependant upon the wireless technology (802.11a, 802.11b, or 802.11g), is scalable, does not contain the inefficiencies of current solutions, remains valid as the capacity of wired and wireless links increase, and is independent of the signal range of the rogue APs.

Sensor networks can be used for event alarming applications. To date, in most of the proposed schemes, the raw or aggregated sensed data is periodically sent to a data consuming center. However, with this scheme, the occurrence of an emergency event such as a fire is hardly reported in a timely manner which is a strict requirement for event alarming applications. In sensor networks, it is also highly desired to conserve energy so that the network lifetime can be maximized. Furthermore, to ensure the quality of surveillance, some applications require that if an event occurs, it needs to be detected by at least k sensors where k is a user-defined parameter. In this work, we examine the timely energy-efficient k-watching event detection problem (TEKWEO). A topology-and-routing-supported algorithm is proposed which constructs a set of detection sets that satisfy the short notification time, energy conservation, and tunable quality of surveillance requirements for event alarming applications. Simulation results are shown to validate the proposed algorithm.

In this paper we characterize the proprietary active scanning algorithms of several wireless network interface cards (WNICs) and driver combinations. We believe our experiments are the first of their kind to observe the complete scanning process as the WNICs probe all the channels in the 2.4GHz spectrum. We discuss the 1) channel probe order; 2) correlation of channel popularity during active scanning and access point (AP) channel deployment popularity; 3) number of probe request frames (PRFs) sent on each channel across WNICs; 4) amount of time spent on each channel across WNICs (dwell time); and 5) variation in scanning algorithms. The knowledge gained from profiling WNICs is of significant importance to numerous disciplines. It enables us to understand different implementations (hardware and software) of active scanning. The same knowledge can help lay a foundation for implementing active scanning in network simulators. It is generically considered in only one of the popular simulators. Finally, the results from our work can also radically influence research in link-layer handovers, effective deployment of access points (APs), securing wireless networks, etc.

IEEE 802.11 wireless networks are plagued with problems of unauthorized access. Left undetected, unauthorized access is the precursor to additional mischief. Current approaches to detecting intruders are invasive or can be evaded by stealthy attackers. We propose the use of spectral analysis to identify a type of wireless network interface card. This mechanism can be applied to support the detection of unauthorized systems that use wireless network interface cards that are different from that of a legitimate system. The approach is passive and works in the presence of encrypted traffic.

Networked systems still suffer from poor firewall configuration and monitoring. VisualFirewall seeks to aid in the configuration of firewalls and monitoring of networks by providing four simultaneous views that display varying levels of detail and time-scales as well as correctly visualizing firewall reactions to individual packets. The four implemented views, real-time traffic, visual signature, statistics, and IDS alarm, provide the levels of detail and temporality that system administrators need to properly monitor their systems in a passive or an active manner. We have visualized several attacks, and we feel that even individuals unfamiliar with networking concepts can quickly distinguish between benign and malignant traffic patterns with a minimal amount of introduction.

As the cost of IEEE 802.11 hardware continues to fall, the appeal of inserting unauthorized wireless access into enterprise networks grows. These rogue access points (AP) expose the enterprise network to a barrage of security vulnerabilities in that they are typically connected to a network port behind the firewall. Most of the current approaches to detecting rogue AP are rudimentary and are easily evaded by hackers. We propose the use of temporal traffic characteristics to detect rogue AP at a central location. This detection is independent of the wireless technology (IEEE 802.11a, 802.11b, or 802.11g), is scalable, does not possess the inefficiencies of the current solutions, and is independent of the signal range of the rogue AP.

We propose a deployable approach to improving QoS by using the familiar overlay architecture approach. The goals of this work are: (1) to create an overlay architecture which allows us to sample specific path quality metrics among different paths; (2) to utilize the proposed overlay architecture in order to implement our proposed QoS-based routing scheme, application layer switching (ALSW). We show that we are able to achieve better than best-effort QoS without modifying intermediate nodes (i.e., routers), thus encouraging immediate deployment. Additionally, this research is performed on an actual wide area network testbed, comprised of universities across the nation. Also, we assemble this architecture as a peer-to-peer framework, encouraging collaborating individuals with average workstations to improve the QoS of their traffic.

On HFC cable networks, in order to develop a real-time game application, we face a design problem to efficiently transmit packets with reliability. This paper introduces the SCRA (server-based collision resolution and avoidance) scheme. SCRA is a reliable transport method using UDP for real-time applications on HFC networks. In this design, we first analyze the collision probability, and estimate the required throughput on an upstream contention channel. SCRA controls the packet delivery, de-correlates the traffic bursts, and maintains a stable throughput for the application. The simulation shows that SCRA achieves ideal transmission time and bandwidth utilization. We also give the formulae to derive the parameters for a specific real-time application using SCRA.