Large language models (LLMs) are increasingly evaluated not only on the correctness of their outputs but also on the explanations they provide for their answers. To study LLM output behaviour in a controlled setting, including both final answers and post-hoc explanations, we use shortest-path routing as a testbed: it provides unambiguous ground truth while allowing systematic variation in topology and edge-weight distributions. We construct a large suite of graphs spanning five canonical topologies, grid, fat-tree, jellyfish, Erdős-Rényi, and Barabási-Albert, with fixed, uniform, discrete, and lognormal weights and evaluate both answer accuracy and the linguistic form of post-hoc explanations across multiple models. Two post-hoc explanation styles emerge consistently. An analytical style approximates algorithmic exploration, produces concise explanations, and remains accurate across graph families. A verbose explanation style narrates step-by-step simulations of procedures such as Dijkstra. In our results, this style is often associated with suboptimal paths or invalid edges, especially under irregular structure and non-uniform weights. We further identify recurring failure modes, including hallucinated edges that break path continuity, loops with repeated nodes, and paths that fail to connect the correct source and destination, that characterise this breakdown. All answers and explanations are produced without code execution; the observed behaviours therefore reflect text-only problem solving and retrospective verbalisation. Our findings show that post-hoc explanation style, not only final-answer accuracy, is associated with robustness within the evaluated model set, and they support shortest-path routing as a controlled diagnostic probe for evaluating LLM outputs and post-hoc explanations on structured graph tasks.

Large language models (LLMs) have recently demonstrated significant success across a wide range of domains. Their extensive pre-training on vast quantities of information available on the internet endows them with a broad and general understanding of many areas. This presents an opportunity to apply LLMs to the networking domain, such as assisting human operators in maintaining data centers or helping security analysts respond to network attacks in time-sensitive environments. However, it remains unclear if LLMs possess the necessary understanding of the networking domain. To evaluate this, we assess LLMs’ ability to reason about networking by testing their performance on the Cisco Certified Network Associate ( CCNA ), Cisco Certified Support Technician (CCST) and the Microsoft Networking Foundations (N.F) certifications, industry-leading exam. Our findings reveal that various open and closed weights models can pass the CCNA certification but encounter difficulties when answering questions that require advanced reasoning.

This paper presents the implementation of various quantised neural network-based Network Intrusion Detection Systems on a SmartNIC using the P4 programming language. SmartNICs impose significant memory and computational constraints, making deep learning integration particularly challenging. Prior work has been restricted to shallow networks and 1-bit quantisation due to these limitations. In contrast, we deploy a binary neural network with a 64–16–8–1 architecture, along with several other quantised models not previously implemented on SmartNICs. To overcome the limited support for quantisation-aware training, which is restricted to 8-bit, we introduce a variable quantiser scheme for neural networks that allows adaptable quantisation levels during training. We further deploy and evaluate 2-bit and 4-bit models on the SmartNIC, made feasible by optimising resource utilisation. The model achieves a 91.65% accuracy and a 91.46% F1 score while achieving throughputs above 6Mpps.

This paper presents a proof-of-concept framework integrating time-windowed NetFlow traffic visualisations with zero-shot inference from multimodal LLMs for network intrusion detection. Real-world network traffic, augmented with manually injected attacks such as IP sweep, DoS, and DDoS, is transformed into scatter plots representing host communication structure and traffic volume for each 1-minute window. These visualisations are assessed by GPT-4o and LLaVA in a zero-shot setting, without task-specific fine-tuning or prior examples. Results show that multimodal LLMs, particularly GPT-4o, effectively detect structural anomalies in network traffic using visual patterns alone, especially when prompts are enhanced with detailed explanations of attack appearances in the visualisations. These findings underscore the potential of LLM-based visual intrusion detection for NetFlow data and encourage further research into domain-specific visual encodings, optimised prompt design, and multimodal LLM adaptations for network intrusion detection applications.

Despite extensive efforts in developing machine learning-based Network Intrusion Detection Systems, inconsistencies in the choice of pre-processing of training data exists across the literature. This study surveys both seminal and recent works, identifying that while the same benchmark datasets and model classes are frequently used, the data pre-processing methods vary significantly, often without in-depth discussion and justification, limiting performance and hindering fair comparison. This work aims to address this problem, by exploring the possibility of a standardised pre-processing for Network Intrusion Detection Systems benchmark datasets We perform a detailed experimental evaluation on the most common machine learning models and four prevalent Network Intrusion Detection Systems benchmark datasets, considering a total of 72 combinations of pre-processing methods for both numerical and categorical fields in the network flow data. Based on our experimental evaluation, we propose a uniform (or ’standardised’) data pre-processing approach, which consistently performs well across the considered datasets and machine learning models. We demonstrate that our proposed method can achieve up to a 11% increase in detection accuracy over commonly applied pre-processing techniques for a shallow neural network (for the purposes of this work, we deem networks with fewer than 3 hidden layers as shallow), versus less-optimal pre-processing approaches. To facilitate future research, we make our code publicly available 1 .

This paper tackles the challenge of accurately estimating shower duration from non-intrusive multi-modal sensor data to facilitate efficient water management. Efficient water usage is a critical environmental challenge, and showering contributes significantly to domestic water consumption. Developing accurate, accessible monitoring solutions is essential for promoting sustainability . Utilizing data from humidity, temperature, sound average, and sound peak sensors, we explore suitable data processing steps and the application of machine learning models to estimate shower duration. Our approach includes the design of a bidirectional Long Short-Term Memory model and the application of an existing Gated Transformer Network model to address the multivariate time series classification task . Our analysis reveals that both models are highly effective in this context, also compared to baseline models, and humidity emerges as a particularly powerful predictor either on its own or when combined with the temperature sensor . This work not only showcases the potential of using machine learning methods for multivariate time series classification in the domain of water consumption but also underscores the implications for adopting such technologies in promoting sustainable water use.

Graph clustering discovers groups or communities within networks. Increasingly, models use autoencoders to achieve effective clustering combined with Graph Neural Networks (GNN) for structure incorporation. However, GNNs based on convolution or attention variants lack dynamic fusion, suffer from over-smoothing, noise, node heterophily, are computationally expensive and typically require the complete graph being present. Instead, we propose SCGC, capable of dynamic soft structure fusion via augmentation-less edge-contrastive loss. Further, we propose SCGC*, with a more expressive novel distance metric, Influence, and our Influence Augmented Contrastive (IAC) loss, requiring only half the model parameters. Our models, SCGC and SCGC*, dynamically fuse discriminative node representations, jointly refine soft cluster assignments, completely eliminate convolutions and attention of traditional GNNs, use only simple linear units, and yet efficiently incorporate structure. They are impervious to layer depth; robust to over-smoothing, incorrect edges and heterophily; scalable by batching; augmentation-less; relaxes the homophily assumption and trivially parallelizable. We improve significantly over the state-of-the-art on a wide range of benchmarks, including images, sensor data, text, and citation networks, with superb efficiency. Specifically, 20% on ARI and 18% on NMI for DBLP; overall 55% reduction in training time and overall, 81% reduction on inference time. code: https://github.com/gayanku/SCGC .

Efficient detection of Distributed Denial of Service (DDoS) attacks in datacentres and corporate networks is an active research domain. This paper introduces, P4-Secure, an efficient approach for in-band detection of DDoS attacks, without using the controller resources and channel. The pure in-band implementation of DDoS detection, makes it a practical and viable solution for real-world network security applications, including large-scale backbone networks. The proposed DDoS detection uses an axis-aligned classifier based on the packet asymmetry metric, trained through the negative selection approach. The trained axis-aligned classifier was then implemented in the data plane using P4 programming and managed to classify network flows with a configurable false-positive ratio. Through experiments on two independent real-world network datasets (UQ and ISP) and the CAIDA DDoS attack dataset, the robustness of the proposed approach was evaluated across varying network characteristics. The approach demonstrated a notably superior performance in minimising false positives compared to alternative methods, with a rate of only 0.5%. This achievement was coupled with a 90% F1 score, highlighting its effectiveness in addressing DDoS attacks while avoiding unnecessary false alarms. The evaluation on real-world hardware demonstrates that P4-Secure incurs minimal overhead even at high packet rates, such as 8 Mpps, making it highly suitable for datacentres and backbone network security applications.

Large Language Models (LLMs) have revolutionised natural language processing tasks, particularly as chat agents. However, their applicability to threat detection problems remains unclear. This paper examines the feasibility of employing LLMs as a Network Intrusion Detection System (NIDS), despite their high computational requirements, primarily for the sake of explain-ability. Furthermore, considerable resources have been invested in developing LLMs, and they may offer utility for NIDS. Current state-of-the-art NIDS rely on artificial benchmarking datasets, resulting in skewed performance when applied to real-world networking environments. Therefore, we compare the GPT-4 and LLama3 models against traditional architectures and transformer-based models to assess their ability to detect malicious NetFlows without depending on artificially skewed datasets, but solely on their vast pre-trained acquired knowledge. Our results reveal that, although LLMs struggle with precise attack detection, they hold significant potential for a path towards explainable NIDS. Our preliminary exploration shows that LLMs are unfit for the detection of Malicious NetFlows. Most promisingly, however, these exhibit significant potential as complementary agents in NIDS, particularly in providing explanations and aiding in threat response when integrated with Retrieval Augmented Generation (RAG) and function calling capabilities.

This paper presents the FlowTransformer framework, a novel approach for implementing transformer-based Network Intrusion Detection Systems (NIDSs). FlowTransformer leverages the strengths of transformer models in identifying the long-term behaviour and characteristics of networks, which are often overlooked by most existing NIDSs. By capturing these complex patterns in network traffic, FlowTransformer offers a flexible and efficient tool for researchers and practitioners in the cybersecurity community who are seeking to implement NIDSs using transformer-based models. FlowTransformer allows the direct substitution of various transformer components, including the input encoding, transformer, classification head, and the evaluation of these across any flow-based network dataset. To demonstrate the effectiveness and efficiency of the FlowTransformer framework, we utilise it to provide an extensive evaluation of various common transformer architectures, such as GPT 2.0 and BERT, on three commonly used public NIDS benchmark datasets. We provide results for accuracy, model size and speed. A key finding of our evaluation is that the choice of classification head has the most significant impact on the model performance. Surprisingly, Global Average Pooling, which is commonly used in text classification, performs very poorly in the context of NIDS. In addition, we show that model size can be reduced by over 50%, and inference and training times improved, with no loss of accuracy, by making specific choices of input encoding and classification head instead of other commonly used alternatives.

Network Intrusion Detection Systems (NIDSs) are an increasingly important tool for the prevention and mitigation of cyber attacks. Over the past years, a lot of research efforts have aimed at leveraging the increasingly powerful models of Machine Learning (ML) for this purpose. A number of labelled synthetic datasets have been generated and made publicly available by researchers, and they have become the benchmarks via which new ML-based NIDS classifiers are being evaluated. Recently published results show excellent classification performance with these datasets, increasingly approaching 100 percent performance across key evaluation metrics such as Accuracy, F1 score, AUC, etc. Unfortunately, we have not yet seen these excellent academic research results translated into practical NIDS systems with such near-perfect performance. This motivated our research presented in this paper, where we analyse the statistical properties of the benign traffic in three of the more recent and relevant NIDS datasets, (CIC_IDS, UNSW_NB15, TON_IOT), by converting them into a common flow format. As a comparison, we consider two datasets obtained from real-world production networks, one from a university network and one from a medium size Internet Service Provider (ISP). Our results show that the two real-world datasets are quite similar among themselves in regards to most of the considered statistical features. Equally, the three synthetic datasets are also relatively similar within their group. However, and most importantly, our results show a distinct difference of most of the considered statistical features between the three synthetic datasets and the two real-world datasets. Since ML relies on the basic assumption of training and test datasets being sampled from the same distribution, this raises the question of how well the performance results of ML-classifiers trained on the considered synthetic datasets can translate and generalise to real-world networks. We believe this is an interesting and relevant question which provides motivation for further research in this space.

The field-deployed Internet-of-Things (IoT) sensor nodes are powered by rechargeable batteries. The nodes are equipped with energy harvesters to harvest energy from the environment to replenish the batteries and continue the sensing operations. However, due to the high energy consumption of the power-hungry sensors, the nodes still suffer from energy depletion issues. Towards a green IoT system, an energy aware adaptive sensing algorithm is proposed in this paper. For a multi-sensing node, a learning-aided smart sensing strategy is developed to find a set of optimal sensors to be activated in the next measurement cycle depending on the cross-correlation factors and the sensing energy consumption. The parameters of inactive sensors are predicted from cross-correlated parameters of active sensors using Gaussian process regressor model. Further, the algorithm is implemented in a solar powered air pollution monitoring system to analyze the performance of this method. The proposed method saves 68% energy of the node compared to the nearest competitive method, while the sensing error is within the limit.

Contrastive learning has recently achieved remarkable success in many domains including graphs. However contrastive loss, especially for graphs, requires a large number of negative samples which is unscalable and computationally prohibitive with a quadratic time complexity. Sub-sampling is not optimal. Incorrect negative sampling leads to sampling bias. In this work, we propose a meta-node based approximation technique that is (a) simple, (b) canproxy all negative combinations (c) in quadratic cluster size time complexity, (d) at graph level, not node level, and (e) exploit graph sparsity. By replacing node-pairs with additive cluster-pairs, we compute the negatives in cluster-time at graph level. The resulting Proxy approximated meta-node Contrastive (PamC) loss, based on simple optimized GPU operations, captures the full set of negatives, yet is efficient with a linear time complexity. By avoiding sampling, we effectively eliminate sample bias. We meet the criterion for larger number of samples, thus achieving block-contrastiveness, which is proven to outperform pair-wise losses. We use learnt soft cluster assignments for the meta-node construction, and avoid possible heterophily and noise added during edge creation. Theoretically, we show that real world graphs easily satisfy conditions necessary for our approximation. Empirically, we show promising accuracy gains over state-of-the-art graph clustering on 6 benchmarks. Importantly, we gain substantially in efficiency; over 2x reduction in training time and over 5x in GPU memory reduction. Additionally, our embeddings, combined with a single learnt linear transformation, is sufficient for node classification; we achieve state-of-the-art on Citeseer classification benchmark. code:https://github.com/gayanku/PAMC

The performance of machine learning based network intrusion detection systems (NIDSs) severely degrades when deployed on a network with significantly different feature distributions from the ones of the training dataset. In various applications, such as computer vision, domain adaptation techniques have been successful in mitigating the gap between the distributions of the training and test data. In the case of network intrusion detection however, the state-of-the-art domain adaptation approaches have had limited success. According to recent studies, as well as our own results, the performance of an NIDS considerably deteriorates when the ‘unseen’ test dataset does not follow the training dataset distribution. In order to enhance the generalisability of machine learning based network intrusion detection systems, we propose to extract domain invariant features using adversarial domain adaptation from multiple network domains, and then apply an unsupervised technique for recognising abnormalities, i.e., intrusions. More specifically, we train a domain adversarial neural network on labelled source domains, extract the domain invariant features, and train a One-Class SVM (OSVM) model to detect anomalies. At test time, we feedforward the unlabelled test data to the feature extractor network to project it into a domain invariant space, and then apply OSVM on the extracted features to achieve our final goal of detecting intrusions. Our extensive experiments on the NIDS benchmark datasets of NFv2-CIC-2018 and NFv2-UNSW-NB15 show that our proposed setup demonstrates superior cross-domain performance in comparison to the previous approaches.

This paper presents a new Network Intrusion Detection System (NIDS) based on Graph Neural Networks (GNNs). GNNs are a relatively new sub-field of deep neural networks, which can leverage the inherent structure of graph-based data. Training and evaluation data for NIDSs are typically represented as flow records, which can naturally be represented in a graph format. In this paper, we propose E-GraphSAGE, a GNN approach that allows capturing both the edge features of a graph as well as the topological information for network intrusion detection in IoT networks. To the best of our knowledge, our proposal is the first successful, practical, and extensively evaluated approach of applying GNNs on the problem of network intrusion detection for IoT using flow-based data. Our extensive experimental evaluation on four recent NIDS benchmark datasets shows that our approach outperforms the state-of-the-art in terms of key classification metrics, which demonstrates the potential of GNNs in network intrusion detection, and provides motivation for further research.

Wireless sensors networks (WSNs) are gaining enormous attention for monitoring physical conditions in various application. WSNs equipped with power-hungry senors often suffer from energy sustainability. Hence, an efficient smart sensing approach is required to enhance the energy sustainability of such WSNs. A wireless node equipped with a sensor monitoring the variation of a particular parameter in time often exhibits high temporal correlation that can be studied to smartly sense the parameter. To optimize the energy consumption of these sensors and increase the network lifetime, this paper presents a learning- based adaptive sampling framework that explores the sparsity in the time series data and finds optimal sampling instants for the next measurement cycle. Principal component analysis (PCA) is used to sparsify the time domain signal and the sparse signal is reconstructed from its low-dimensional signal using the sparse Bayesian learning (SBL) method. An optimization function is formed that solves the trade-off between accuracy and energy consumption and finds the optimal sampling instants for the next measurement cycle. The performance of the proposed adaptive sampling framework is tested on air pollution monitoring dataset. The simulation results validate the energy efficiency of the proposed method. Compared to the existing adaptive sampling algorithms the proposed learning-based algorithm saves up to 58% energy with a marginally higher computational complexity while maintaining an acceptable range of sensing error.

The high power consumption of inertial activity sensors limits the battery lifetime of today's wearable devices. Recent studies promise to extend the lifetime of wearable devices by translating kinetic energy from human movements into electrical energy while using the harvesting signal to replace conventional activity sensors. However, in human-centric applications, the amount of harvested kinetic energy is not enough to power a real-time activity recognition algorithm and run the wearable device perpetually. In this paper, we propose Solar based human Activity Recognition (SolAR), which uses solar cells simultaneously as an activity sensor as well as an energy source. Our key observation is that the power available from a wrist-worn solar cell changes dynamically while a person moves, encoding information about the underlying activity. We collect empirical solar energy data to explore its activity sensing potential and implement the activity recognition pipeline on an ultra low-power micro-controller unit to evaluate the end-to-end power consumption of the system. Our analysis reveals that SolAR improves activity recognition accuracy by up to 8.3% and harvests more than one order of magnitude higher power compared to its kinetic counterpart. This enables SolAR to generate more energy than required for the entire activity recognition pipeline, which we term as energy positive activity recognition, achieving uninterrupted, autonomous, self-powered and real-time operation.

The Internet of Things (IoT) has important applications in our daily lives, including health and fitness tracking, environmental monitoring, and transportation. However, sensor nodes in IoT suffer from the limited lifetime of batteries resulting from their finite energy availability. A promising solution is to harvest energy from environmental sources, such as solar, kinetic, thermal, and radio-frequency (RF) waves, for perpetual and continuous operation of IoT sensor nodes. In addition to energy generation, recently energy harvesters have been used for context detection, eliminating the need for conventional activity sensors (e.g., accelerometers), saving space, cost, and energy consumption. Using energy harvesters for simultaneous sensing and energy harvesting enables energy positive sensing-an important and emerging class of sensors, which harvest more energy than required for context detection and the additional energy can be used to power other components of the system. Although simultaneous sensing and energy harvesting is an important step forward toward autonomous self-powered sensor nodes, the energy and information availability can be still intermittent, unpredictable, and temporally misaligned with various computational tasks on the sensor node. This article provides a comprehensive survey on task scheduling algorithms for the emerging class of energy harvesting-based sensors (i.e., energy positive sensors) to achieve the sustainable operation of IoT. We discuss inherent differences between conventional sensing and energy positive sensing and provide an extensive critical analysis for devising revised task scheduling algorithms incorporating this new class of sensors. Finally, we outline future research directions toward the implementation of autonomous and self-powered IoT.

In this manuscript we present an original implementation of network management functions in the context of Software Defined Networking. We demonstrate a full integration of an artificial intelligence driven management, an SDN control plane, and a programmable data plane. Constraint Programming is used to implement a management operating system that accepts high level specifications, via a northbound interface, in terms of operational objective and directives. These are translated in technology-specific constraints and directives for the SDN control plane, leveraging the programmable data plane, which is enriched with functionalities suited to feed data that enable the most effective operation of the “intelligent” control plane, by exploiting the P4 language.

Conventional systems for motion context detection rely on batteries to provide the energy required for sampling a motion sensor. Batteries, however, have limited capacity and, once depleted, have to be replaced or recharged. Kinetic Energy Harvesting (KEH) allows to convert ambient motion and vibration into usable electricity and can enable batteryless, maintenance free operation of motion sensors. The signal from a KEH transducer correlates with the underlying motion and may thus directly be used for context detection, saving space, cost and energy by omitting the accelerometer. Previous work uses the open circuit or the capacitor voltage for sensing without using the harvested energy to power a load. In this paper, we propose to use other sensing points in the KEH circuit that offer information-rich sensing signals while the energy from the harvester is used to power a load. We systematically analyze multiple sensing signals available in different KEH architectures and compare their performance in a transport mode detection case study. To this end, we develop four hardware prototypes, conduct an extensive measurement campaign and use the data to train and evaluate different classifiers. We show that sensing the harvesting current signal from a transducer can be energy positive, delivering up to ten times as much power as it consumes for signal acquisition, while offering comparable detection accuracy to the accelerometer signal for most of the considered transport modes.

Software‐defined networking (SDN) is an emerging technology of efficiently controlling and managing computer networks, such as in data centres, wide‐area networks, as well as in ubiquitous communication. In this study, the authors explore the idea of embedding the SDN components, represented by SDN controller and virtual switch, in end‐hosts to improve network performance. In particular, the authors consider load balancing across multiple network interfaces on end‐hosts with different link capacity scenarios. The authors have explored and implemented different SDN‐based load‐balancing approaches based on OpenFlow software switches, and have demonstrated the feasibility and the potential of this approach. The proposed system has been evaluated with MultiPath transmission control protocol (MPTCP). The proposed results demonstrated the potential of applying the SDN concepts on multi‐homed devices resulting in an increase in achieved throughput of 55% compared to the legacy single network approach and 10% compared to the MPTCP.

Long range wide area networks (LoRaWAN) technology provides a simple solution to enable low-cost services for low power internet-of-things (IoT) networks in various applications. The current evaluation of LoRaWAN networks relies on simulations or early testing, which are typically time consuming and prevent effective exploration of the design space. This paper proposes an analytical model to calculate the delay and energy consumed for reliable Uplink (UL) data delivery in Class A LoRaWAN. The analytical model is evaluated using a real network test-bed as well as simulation experiments based on the ns-3 LoRaWAN module. The resulting comparison confirms that the model accurately estimates the delay and energy consumed in the considered environment. The value of the model is demonstrated via its application to evaluate the impact of the number of end-devices and the maximum number of data frame retransmissions on delay and energy consumed for the confirmed UL data delivery in LoRaWAN networks. The model can be used to optimize different transmission parameters in future LoRaWAN networks.

The mapping of Layer 3 (IP) to Layer 2 (MAC) addresses is a key service in IP networks, and is achieved via the ARP protocol in IPv4, and the NDP protocol in IPv6. Due to their stateless nature and lack of authentication, both ARP and NDP are vulnerable to spoofing attacks, which can enable Denial of Service (DoS) or man-in-the-middle (MITM) attacks. In this paper, we discuss the problem of ARP spoofing in the context of Software Defined Networks (SDNs), and present a new mitigation approach which leverages the centralised network control of SDN.

Topology Discovery is an essential service in Software Defined Networks (SDN). Most SDN controllers use a de-facto standard topology discovery mechanism based on Open-Flow to identify active links in the network. This paper discusses the security, or rather lack thereof, of the current SDN topology discovery mechanism, and its vulnerability to link spoofing attacks. The feasibility and impact of the attacks are verified and demonstrated via experiments. The paper presents and evaluates a countermeasure based on HMAC authentication.

In typical wireless networks, end-to-end routing is a usual way to deliver data packets from source nodes to destination nodes. In the case of link failures when no alternative route is found, the routing protocols will drop these packets. As a way to improve the packet delivery ratio, an integration of the store-carry-forward features with the traditional end-to-end communication has been already proposed. The existing solutions propose one-time only switching from one communication mode to another should the link failures occur. In this paper, we propose a hybrid protocol to support the dynamic switch between the two modes of communication should the link conditions changed. That is, the protocol utilises the ability to buffer packets when end-to-end routes are not possible, and leverages the end-to-end routes whenever they become available to ensure performance. We evaluate the proposed protocol using a set of comprehensive simulation scenarios to systematically demonstrate its significant improvement in packet delivery over one of the best representative routing protocol for end-to-end routing.

In the area of mobile ad-hoc networks and wireless mesh networks, sequence numbers are often used in routing protocols to avoid routing loops. It is commonly stated in protocol specifications that sequence numbers are sufficient to guarantee loop freedom if they are monotonically increased over time. A classical example for the use of sequence numbers is the popular Ad hoc On-Demand Distance Vector (AODV) routing protocol. The loop freedom of AODV is not only a common belief, it has been claimed in the abstract of its RFC and at least two proofs have been proposed. AODV-based protocols such as AODVv2 (DYMO) and HWMP also claim loop freedom due to the same use of sequence numbers.

Many wireless network protocols and algorithms rely on estimations of the link capacity in order to make informed decisions on routing data packets, selection of the optimal transmission rate, flow and admission control. In this paper we present an investigation into our Effective Link Capacity (ELC) metric which combines the use of MAC layer monitoring with knowledge of the network timing specifications to provide an accurate model of link conditions. We subject the resulting metric to an experimental investigation across a range of conditions using a conducted testbed. We demonstrate that commodity wireless devices do not conform to the IEEE 802.11 specification, thus making modeling difficult. Given that ELC and the IEEE 802.11s Airtime link metric are directly related, we compare their accuracy in estimating the link capacity. We demonstrate that ELC significantly outperforms two widely-used implementations of Airtime.

This paper presents a practical and low-cost approach to estimate the maximum achievable wireless link bandwidth based on the prevailing link conditions in an IEEE 802.11 network. This approach works by observing the number of bits successfully delivered over a link, divided by the corresponding channel occupancy time. The method is passive and does not introduce any extra overhead on the channel, and is based on the timing model of the IEEE 802.11 MAC layer. All required parameters are obtained locally at the sending node from the MAC layer. We evaluate the accuracy of the proposed method via a full implementation and experiments on our conducted testbed, which provides a more controlled environment and increased repeatability of experiments, compared to over-the-air wireless testbeds. The experiment results show that our method can accurately estimate the link bandwidth with both saturated and low traffic load across links with different transmission rates and link qualities. In addition, results also show that our method is able to track the link bandwidth as its link quality changes.

Node mobility, signal fading and interference introduce dynamics in wireless channels. In 802.11 wireless networks, there are several transmission rates that can be adaptively selected by the MAC-layer rate control mechanisms to cater for various channel conditions. Accurately estimating the current channel conditions and successfully selecting the appropriate rates at the right time is critical to ensure the network's optimal performance. In this paper we focus on the problem of rate selection and present a robust, yet practical, rate control mechanism-RCELC, which measures the throughput achieved by each rate, and it selects a rate that achieve the highest throughput for the current channel conditions. To ensure its robustness RCELC optimises rate sampling and also guarantees achieving the highest throughput even in the cases of collisions. RCELC is a practical rate control mechanism that we have developed and evaluated on new mac80211 framework in Linux. We use a set of comprehensive evaluation scenarios and show that RCELC achieves superior performance and substantially outperforms the best rate control mechanism currently available in Linux.

In this paper we present a rigorous analysis of the Ad hoc On-Demand Distance Vector (AODV) routing protocol using a formal specification in AWN (Algebra for Wireless Networks), a process algebra which has been specifically tailored for the modelling of Mobile Ad Hoc Networks and Wireless Mesh Network protocols. Our formalisation models the exact details of the core functionality of AODV, such as route discovery, route maintenance and error handling. We demonstrate how AWN can be used to reason about critical protocol correctness properties by providing a detailed proof of loop freedom. In contrast to evaluations using simulation or other formal methods such as model checking, our proof is generic and holds for any possible network scenario in terms of network topology, node mobility, traffic pattern, etc. A key contribution of this paper is the demonstration of how the reasoning and proofs can relatively easily be adapted to protocol variants.

The ability to accurately estimate wireless link quality is critical to the performance of routing protocols and rate adaptation algorithms in wireless mesh networks. Current link quality estimation methods utilize the packet delivery ratio (PDR) measurement of periodic broadcast probes sent at the lowest transmission rate. However, the estimated link quality does not readily translate to the performance of unicast data traffic at higher transmission rates. In this paper, we propose the use of a measurement-based signal-to-noise ratio (SNR) model to estimate wireless link quality in terms of its PDR performance. Using broadcast traffic measurements at the lowest transmission rate, we construct an "SNR profile'' that characterizes the relationship between the PDR metric and the SNR values computed at a node. We show how we can use the SNR profile to predict the PDR performance at different transmission rates. More importantly, we argue that the frame delivery ratio (FDR) at the MAC layer is a better link quality metric compared to PDR, and show that our proposed approach can use an SNR profile generated with broadcast traffic, to accurately estimate the FDR performance of unicast data traffic at different transmission rates. This then allows us to also accurately estimate the maximum achievable throughput of the wireless link at those rates.

In 802.11-based wireless networks, the ability to accurately predict the impact of interference via the use of an interference model is essential to better and more efficient channel assignment algorithms and data routing protocols. Recently, there have been several works that proposed new interference models utilizing the well-known concept of signal-to-interference-plus-noise ratio (SINR). Using active measurements, these models construct a profile that maps either the measured received signal strength (RSS) or the computed SNR or SINR values at a receiver, to its packet delivery ratio (PDR) performance. The profile is then used by the models to predict the PDR performance in more complex scenarios involving multiple interferers. While comparison with other basic models (e.g. hop-based and distance-based) have been made in these works, there has as yet been no comprehensive comparison on the accuracy of these measurement-based SINR interference models. In this paper, we systematically evaluate the performance of three measurement-based SINR interference models in predicting the interference impact on the successful reception of packets. Our evaluations cover various interference scenarios with both 802.11 and non-802.11 interferers, in experiments carried out in both our conducted testbed and an over-the-air testbed. Our results show that an interference model that utilizes an SINR profile can accurately predict the PDR performance with a maximum root-mean-square error (RMSE) of 10.8% across all our evaluations. In contrast, interference models that rely on the SNR profile and the RSS profile perform poorly, with a maximum RMSE of 61.7% and 66.1% respectively.

Interference is a crucial factor that impacts the overall throughput performance of IEEE 802.11-based wireless networks. As such, understanding interference characteristics is essential towards the optimal management and operation of these networks. In this paper, we use a conducted testbed (that allows us to completely control the signal propagation and received signal strength) to systematically evaluate the impact of interference in terms of the carrier-sensing interference and the receiver interference. Our results show that carrier-sensing interference does not conform to the often-used binary model of "either carrier-sense or no carrier-sense", and that the sum of the normalized sending rates of nodes that can fully carrier-sense each other is greater than 1.0. In terms of receiver interference, our results show that while the interference impact on a data link's throughput is approximately linear with respect to the offered load of the interferer node, its relationship with respect to the offered load of the data sender is non-linear. Our results also show that the combined interference impact of multiple interferer nodes cannot be predicted by just using independent measurements of the interference impact of individual interferer nodes. The results in this paper indicate that commonly made underlying assumptions of interference models are not valid, and consequently show the limitations of the corresponding models.

HELLO messages are widely used for neighbor discovery in routing protocols for wireless multihop networks. In this paper, we provide mathematical and experimental proofs that the current strategy of declaring a link down based on observations that a specific number of HELLO messages are lost, is not a correct strategy. In our mathematical analysis, we characterized the error bursts over wireless links by extending the Gilbert bit error model, and validate our model using HELLO loss data from our wireless mesh testbed. Our analysis shows that error burst lengths follow a geometric distribution, i.e. the probability of additional losses in the burst does not depend on the observed losses. We propose an alternative link break detection strategy where a link break is declared when the observed mean error burst length for the link is longer than the mean route recovery time. Our testbed results show that running the AODV routing protocol with our proposed strategy yields better throughput and lower control message overhead, compared to the case where AODV relies on its default settings of declaring link breaks when two consecutive HELLO messages are lost.

This paper presents the results of an independent evaluation of four different commercial wireless mesh network systems using IEEE 802.11 radios in the context of small-scale, rapid deployment scenarios in public safety and emergency applications. To ensure repeatability and fairness in our evaluation, we designed and built a conducted wireless evaluation platform which provides a controlled test environment. Using our conducted test-bed, we investigated the performance of the different wireless mesh products in terms of their singlehop and multi-hop capacity under varying link conditions, and their ability to handle link failures. We have also conducted an outdoor multi-hop capacity test with the wireless mesh products, and compared the outdoor performance with the lab-based results. The test scenarios and the corresponding results demonstrate the flexibility and advantages of our conducted test-bed in fleshing out the performance differences of the evaluated mesh products. From our test results, we observed the differences in the MAC auto-rate behaviour of the different mesh network systems, as well as the throughput performance stability in one of the vendor's mesh routers. Our results also show that the multi-hop throughput performance of an unplanned (or rapid) network deployment can be substantially lower (ranging from 44% to 67%) compared to that of a planned network deployment.

The performance of 802.11-based multi-channel wireless mesh networks is affected by the interference due to neighboring nodes operating on same or adjacent channels. In this paper, we have performed extensive measurements on our conducted testbed to evaluate the effects of adjacent channel interference (ACI) in 802.11 networks, under the exposed terminal and hidden terminal scenarios. By varying the path loss and the channel separation distance between two nodes, we investigate the effective attenuation needed in order to completely eliminate the ACI between the two nodes. Using node throughput as a metric, our results confirm that for low path loss between two 802.11 nodes, there still exists interference between the two nodes even though they are operating on non-overlapping channels. Our results also show that we require 37 dB - 45 dB less attenuation to completely eliminate the ACI between two nodes operating on non-overlapping channels, compared to when both nodes are operating on the same channel. Our results are useful to network planners in terms of the placement of mesh nodes and the assignment of channels on the nodes in an 802.11-based multi-channel wireless mesh network.

Wireless networks are being used increasingly in industrial, health care, military and public-safety environments. In these environments security is extremely important because a successful attack against the network may pose a threat to human life. To secure such wireless networks against hostile attack requires both preventative and detective measures.In this paper we propose a novel intrusion detection mechanism that identifies man-in-the-middle and wormhole attacks against wireless mesh networks by external adversaries. A simple modification to the wireless MAC protocol is proposed to expose the presence of an adversary conducting a frame-relaying attack. We evaluate the modified MAC protocol experimentally and show the detection mechanism to have a high detection rate, no false positives and a small computational and communication overhead.

APCO Project 25 (P25) is the digital communications standard that has widespread deployment amongst emergency first-responders in several different countries. This paper describes the implementation of a low-cost software-defined radio receiver for APCO Project 25 signals. The OP25 Receiver has been developed as part of an investigation into the security of the P25 protocol suite and provides low-level access to the actual message traffic using the WireShark packet sniffer. The proposed OP25 Receiver is a useful diagnostic and security analysis tool. Our initial experience suggests that the flexibility of the software-defined radio approach is well-suited to meeting the varying needs of public-safety radio communications.

Nodes in multi-hop wireless networks, and specifically in ad-hoc and mesh networks, are being increasingly equipped with multiple wireless network interfaces (radios) operating on orthogonal channels to achieve better utilisation of the frequency spectrum. In addition to reducing interference via increased channel diversity, these additional interfaces can be used to create multiple concurrent links between adjacent nodes, i.e. nodes within single-hop range of each other. Information about the availability of multiple links between nodes provides the opportunity to increase the overall performance of the network by optimally balancing traffic between the set of available inter- node links. In this paper, we present extensions to the well known Ad-hoc On-demand Distance Vector (AODV) routing protocol with the aim to discover and exploit multiple links in Wireless Mesh Networks. As demonstrated via extensive simulations, Multi-Link AODV (AODV-ML) achieves a more than 100% improvement over standard multi-radio AODV in terms of key performance metrics such as packet delivery ratio, latency and routing overhead.

Hybrid wireless mesh networks are multi-hop networks consisting of two types of nodes, mesh routers and mesh clients. Mesh routers are more static and less resource constrained than mobile mesh clients, and form the wireless backhaul of the network. Routing in hybrid wireless mesh networks is a challenging task as both type of nodes participate in the routing and forwarding of packets. In this paper, we present extensions to the ad-hoc on-demand distance vector (AODV) routing protocol with the aim to exploit the heterogeneity of hybrid wireless mesh networks. As demonstrated via extensive simulations, our extensions achieve a more than 100% improvement over the standard multi-radio AODV in terms of key performance metrics such as packet delivery ratio, routing overhead and latency.

We present the idea of a programmable structured P2P architecture. Our proposed system allows the key-based routing infrastructure, which is common to all structured P2P overlays, to be shared by multiple applications. Furthermore, our architecture allows the dynamic and on-demand deployment of new applications and services on top of the shared routing layer.

Recently, there has been a growing interest in peer-to-peer networks such as Gnutella. A typical characteristic of Gnutella is that it is a 'pure' peer-to-peer system, with all nodes being equal participants in the network. Due to its decentralized nature, Gnutella implements services such as searching and peer discovery via flooding-based application-level broadcast. In this paper, we study the cost of Gnutella's version of broadcast, based on the total number of messages generated and forwarded as the metric of cost. We further propose the use of Rumor Mongering (or Gossip) as an alternative routing method in decentralized peer-to-peer networks. Using simulation, we show that this probabilistic protocol significantly reduces the cost of broadcast.