In decentralized cognitive radio (CR) networks, enabling the radios to establish a control channel (i.e., "rendezvous" to establish a link) is a challenging problem. The use of a dedicated common control channel simplifies the rendezvous process but may not be feasible in many opportunistic spectrum sharing scenarios due to the dynamically changing availability of all the channels, including the control channel. To address this problem, researchers have proposed the use of channel hopping protocols for enabling rendezvous in CR networks. Most, if not all, of the existing channel hopping schemes only provide ad hoc approaches for generating channel hopping sequences and evaluating their properties. In this paper, we present a systematic approach, based on quorum systems, for designing and analyzing channel hopping protocols for the purpose of control channel establishment. The proposed approach, called Quorum-based Channel Hopping (QCH) system, can be used for implementing rendezvous protocols in CR networks that are robust against link breakage caused by the appearance of incumbent user signals. We describe two synchronous QCH systems under the assumption of global clock synchronization, and two asynchronous channel hopping systems that do not require global clock synchronization. Our analytical and simulation results show that the proposed channel hopping schemes outperform existing schemes under various network conditions.

Establishing a control channel for medium access control is a challenging problem in multi-channel and dynamic spectrum access (DSA) networks. In the design of multi-channel MAC protocols, the use of channel (or frequency) hopping techniques (a.k.a. parallel rendezvous) have been proposed to avoid the bottleneck of a single control channel. In DSA networks, the dynamic and opportunistic use of the available spectrum requires that the radios are able to "rendezvous" -- i.e., find each other to establish a link. The use of a dedicated global control channel simplifies the rendezvous process but may not be feasible in many opportunistic spectrum sharing scenarios due to the dynamically changing availability of all the channels, including the control channel. To address this problem, researchers have proposed the use of channel hopping protocols for enabling rendezvous in DSA networks.

Distributed spectrum sensing (DSS) enables a Cognitive Radio (CR) network to reliably detect licensed users and avoid causing interference to licensed communications. The data fusion technique is a key component of DSS. We discuss the Byzantine failure problem in the context of data fusion, which may be caused by either malfunctioning sensing terminals or Spectrum Sensing Data Falsification (SSDF) attacks. In either case, incorrect spectrum sensing data will be reported to a data collector which can lead to the distortion of data fusion outputs. We investigate various data fusion techniques, focusing on their robustness against Byzantine failures. In contrast to existing data fusion techniques that use a fixed number of samples, we propose a new technique that uses a variable number of samples. The proposed technique, which we call Weighted Sequential Probability Ratio Test (WSPRT), introduces a reputation-based mechanism to the Sequential Probability Ratio Test (SPRT). We evaluate WSPRT by comparing it with a variety of data fusion techniques under various network operating conditions. Our simulation results indicate that WSPRT is the most robust against the Byzantine failure problem among the data fusion techniques that were considered.

Cognitive Radio (CR) is a promising technology that can alleviate the spectrum shortage problem by enabling unlicensed users equipped with CRs to coexist with incumbent users in licensed spectrum bands while causing no interference to incumbent communications. Spectrum sensing is one of the essential mechanisms of CRs and its operational aspects are being investigated actively. However, the security aspects of spectrum sensing have garnered little attention. In this paper, we identify a threat to spectrum sensing, which we call theprimary user emulation (PUE) attack. In this attack, an adversary's CR transmits signals whose characteristics emulate those of incumbent signals. The highly flexible, software-based air interface of CRs makes such an attack possible. Our investigation shows that a PUE attack can severely interfere with the spectrum sensing process and significantly reduce the channel resources available to legitimate unlicensed users. To counter this threat, we propose a transmitter verification scheme, calledLocDef (localization-based defense), which verifies whether a given signal is that of an incumbent transmitter by estimating its location and observing its signal characteristics. To estimate the location of the signal transmitter, LocDef employs anon-interactive localizationscheme. Our security analysis and simulation results suggest that LocDef is effective in identifying PUE attacks under certain conditions.

Attack mitigation schemes actively throttle attack traffic generated in Distributed Denial-of-Service (DDoS) attacks. This paper presents Attack Diagnosis (AD), a novel attack mitigation scheme that adopts a divide-and-conquer strategy. AD combines the concepts of Pushback and packet marking, and its architecture is in line with the ideal DDoS attack countermeasure paradigm—attack detection is performed near the victim host and packet filtering is executed close to the attack sources. AD is a reactive defense mechanism that is activated by a victim host after an attack is detected. By instructing its upstream routers to mark packets deterministically, the victim can trace back one attack source and command an AD-enabled router close to the source to filter the attack packets. This process isolates one attacker and throttles it, which is repeated until the attack is mitigated. We also propose an extension to AD called Parallel Attack Diagnosis (PAD) that is capable of throttling traffic coming from a large number of attackers simultaneously. AD and PAD are analyzed and evaluated using the Skitter Internet map, Lumeta's Internet map, and the 6-degree complete tree topology model. Both schemes are shown to be robust against IP spoofing and to incur low false positive ratios.

Denial-of-Service (DoS) attacks pose a major threat to the availability of wireless ad hoc networks. Fault tolerant operation of wireless ad hoc networks will depend on the placement of DoS countermeasures in sufficiently robust form. In this paper, we describe a novel type of DoS attack called the Stasis Trap attack, and propose a technique for detecting such an attack. Stasis Trap attack has two distinguishing characteristics-it has a cross-layer design, and is stealthy. The Stasis Trap attack has a cross-layer design in that it is launched from the MAC layer but its aim is to degrade the end-to-end throughput of flows at the transport layer by exploiting TCP's congestion-control mechanism. Specifically, an adversary launches a Stasis Trap attack against neighboring nodes by periodically preempting the wireless channel in order to cause large variations in the round trip time (RTT) of TCP flows. Channel preemptions are carried out by manipulating the back-off mechanism of the Distributed Coordinating Function of the 802.11 MAC protocol. The periodic preemptions induce large RTT variations in the TCP flows that are within the transmission range of the adversary. This in turn causes a significant drop in the throughput of those flows, thereby creating a "stasis trap" around the adversary that entangles TCP flows. The aforementioned attack severely degrades end-to-end throughput but has very little effect on MAC-layer throughput, and hence it is very hard to detect at the MAC layer, which is its point of attack. In this sense, this attack is stealthy. To detect the Stasis Trap attack, we propose a minimax robust decentralized detection framework with robust hypothesis testing.

Distributed Denial-of-Service (DDoS) attacks have become a major threat to the Internet. As a countermeasure against DDoS attacks, IP traceback schemes identify the network paths the attack traffic traverses. This paper presents a novel IP traceback scheme called Router Interface Marking (RIM). In RIM, a router probabilistically marks packets with a router interface's identifier. After collecting the packets marked by each router in an attack path, a victim machine can use the information in the marked packets to trace back to the attack source. Different from most existing IP traceback schemes, RIM marks packets with the information of router interfaces rather than that of router IP addresses. This difference endows RIM with several advantageous features, including fast traceback speed, last-hop traceback capability, small computation overhead, low occurrence of false positives, and enhanced security.

We propose a secure routing architecture for mobile ad hoc networks (MANETs) called throughput-feedback (TUF) routing, which is resilient against a wide range of routing disruption denial-of-service (DoS) attacks. Unlike many existing solutions, TUF does not focus on a particular type of attack, but instead takes an approach that is fundamentally more general. TUF is a cross-layer technique that detects attacks at the transport layer but responds to attacks at the network layer. Because most routing disruption attacks cause a significant drop in end-to-end goodput, monitoring the goodput of a route at the transport layer can detect abnormalities in the network (e.g., node or link failures, DoS attacks, etc.). Once an abnormal event is detected, a route rebuilding process is initiated at the network layer to find a new route. Using analysis and simulation results, we show that the TUF architecture is effective in thwarting a wide range of attacks, including protocol-compliant (also known as "JellyFish") attacks.

This paper proposes an attack-resilient routing architecture, called cross-layer active re-routing (CARE), for mobile ad hoc networks (MANETs). Different from existing solutions, CARE does not focus on a particular type of attack, but instead takes a fundamentally general approach-it achieves resilience against a wide range of routing disruption Denial- of-Service (DoS) attacks by treating them and "dysfunctional" network events in the same way. Here, dysfunctional network events denote link and routing failures caused by link contention or node mobility. CARE is a cross-layer scheme that detects attacks at the transport layer but responds to them at the network layer. Because dysfunctional network events and routing disruption attacks have a pronounced effect on the size of the TCP congestion window, monitoring the window size is an effective method of detecting such events. Using this method, CARE is able to detect attacks. Once an attack is detected, CARE initiates a re-routing process to find a new route. For this purpose, a re-routing algorithm is proposed that circumvents the nodes that are likely to be misbehaving. Analysis and simulation results show that the CARE architecture is effective in thwarting a number of insider and protocol-compliant attacks. Our results indicate that CARE is also effective in improving network throughput in non-hostile environments because its proactive re-routing mechanism aids in maintaining a reasonable level of throughput when dysfunctional network events occur.

Attack mitigation schemes actively throttle attack traffic generated in distributed denial-of-service (DDoS) attacks. This paper presents attack diagnosis (AD), a novel attack mitigation scheme that combines the concepts of Pushback and packet marking. AD's architecture is inline with the ideal DDoS attack countermeasure paradigm, in which attack detection is performed near the victim host and attack mitigation is executed close to the attack sources. AD is a reactive defense that is activated by a victim host after an attack has been detected. A victim activates AD by sending AD-related commands to its upstream routers. On receipt of such commands, the AD-enabled upstream routers deterministically mark each packet destined for the victim with the information of the input interface that processed that packet. By collecting the router interface information recorded in the packet markings, the victim can trace back the attack traffic to the attack sources. Once the traceback is complete, the victim issues messages that command AD-enabled routers to filter attack packets close to the source. The AD commands can be authenticated by the TTL field of the IP header without relying on any global key distribution infrastructure in Internet. Although AD can effectively filter traffic generated by a moderate number of attack sources, it is not effective against large-scale attacks. To address this problem, we propose an extension to AD called parallel attack diagnosis (PAD) that is capable of throttling traffic coming from a large number of attack sources simultaneously. AD and PAD are analyzed and evaluated using a realistic network topology based on the Skitter Internet map. Both schemes are shown to be robust against IP spoofing and incur low false positive ratios.

This paper proposes an elliptical shadow algorithm for motion prediction and resource reservation in the cellular mobile network which can be used to improve the call admission procedures in wireless networks. This algorithm is based on the history information of the mobile entity and predicts an elliptical shadow around it, which covers all spots to which the mobile is going to move with a high possibility in a given time. The cells, and only the cells that overlap the ellipse should reserve the resource for the mobile connection to achieve a low hand-off dropping rate and reduce remarkably the unnecessarily reserved resource. The algorithm is also adaptive when the motion is very unpredictable, by observing the mobile's actual movement and automatically adjusting the elliptical shadow. Our simulation proved it to be effective in achieving both satisfactory connection quality and economical bandwidth utilization. We also suggest a distributed system framework to apply the algorithm effectively.