Integrated Sensing and Communication (ISAC) systems promise unprecedented capabilities by merging connectivity and situational awareness, but also expose new attack surfaces at the physical layer. In this work, we demonstrate a blind full-frame OFDM replay attack that manipulates sensing outputs by injecting false targets and concealing real ones, without disrupting communication. The blind nature of our attack lies in the fact that it requires neither synchronization nor any knowledge of the signal structure, reference signals, or sensing parameters, making it not only practically viable, but even (somewhat) straightforward to execute. By replaying entire OFDM frames with a controlled delay and a frequency shift, the attacker can distort range estimations and induce Doppler shifts, mimicking the presence of moving targets. We present a general analytical framework to characterize the attack’s impact on range-Doppler processing and validate it through both system-level simulations with 5G NR parameters and real-world experiments. Experimental results build directly on a working 5G testbed with software-defined radios and commercial off-the-shelf hardware, which we extend with sensing capabilities, thereby demonstrating the attack’s feasibility and impact in a realistic ISAC scenario.

Accurate localization is an essential functionality of 5G and beyond systems to enable location-based applications, such as autonomous vehicles and emergency response. Nevertheless, the integrity of location data faces challenges not only from unintentional sources of error, such as wireless propagation impairments and synchronization failures but also from malicious and intentional threats, such as spoofing attacks. This paper specifically addresses the risk to localization integrity posed by malicious attacks. It provides a framework for modeling security threats at the physical layer of cellular positioning, with a focus on 5G and beyond systems. Two detection methods are proposed to mitigate the impact of spoofing attacks, by leveraging cross-correlation analysis and Gaussian Mixture Models (GMMs). These methods leverage standard metrics already defined in the localization procedure, thus eliminating the need for additional signal processing steps. Simulation results in 3GPP standard-compliant scenarios demonstrate the effectiveness of these methods in significantly reducing the integrity risk under attack conditions, thus providing a foundation for developing resilient mobile network location-based services.

As network programmability promotes increasingly intelligent hosts, NICs, and switches, we argue that the next frontier lies in making the cables themselves smarter. By embedding lightweight, wire-speed processing directly within transceivers, we enable precise, low-latency, and energy-efficient network functions, providing a modular and cost-effective path to extend the life of legacy infrastructure and to fundamentally rethink where intelligence belongs in the data plane. To concretize such vision, this paper introduces FlexSFP, a programmable variant of the standard SFP+ transceiver, embedding lightweight FPGA-based logic for in-line packet processing. Driven by both technical and economic considerations, FlexSFP offers a compelling "cheap path" alongside host CPUs and SmartNICs, enabling targeted acceleration where cost, power, and deployment flexibility are critical. We explore practical use cases, such as per-port firewalling, in-line telemetry, and retrofitting legacy switches, and outline a feasible architecture and programming model.

One of the most reliable and effective solutions against Return-Oriented Programming (ROP) attacks is the incorporation of Backward Edge Control-Flow Integrity. The most prominent implementation of this concept involves the integration of a dedicated shadow stack, which is a distinct memory structure used for saving and checking functions’ return addresses, and consequently, enforcing the control flow within a program. In this article we propose an alternative perspective to this established notion via the introduction of KSS, a Kernel Shadow Stack for user programs. Our solution not only upholds program flow but also enables determining which code block has been the origin of stack tampering. Furthermore, by placing itself at a higher privilege level, its information can no way be altered by the (attacked) user-level code. Overall, it does not only offer the support for more secure program operations, rather it also allows the analysis of program flows-an aspect that can be very relevant in software deploy phases. Beyond a kernellevel subsystem, which we developed for Linux, KSS includes an instrumentation engine and a custom loader designed to enable its usage with preexisting programs, with no need for any access to the program’s source code. Via experimental results we show how the impact of costs (in terms of CPU-cycles) inherent to the implementation of KSS can be definitely reduced in scenarios involving networking-based applications where threads classically exhibit an I/O-bound execution profile.

This demo paper experimentally explores the feasibility of full-frame meaconing attacks in 5th generation (5G) systems, wherein adversaries stealthily manipulate time-of-arrival (ToA) measurements without disrupting ongoing communications. By intercepting, delaying, and amplifying the entire 5G frames, including critical positioning signals from the gNodeB (gNB), the attack injects a bias into the ToA estimation process, leading to significant positioning errors while leaving the communication service uninterrupted. Our evaluation, conducted on a comprehensive end-to-end 5G testbed built with commercial-off-the-shelf (COTS) and Software-Defined Radio (SDR) devices, includes real-time monitoring of key performance metrics such as reference signal received power (RSRP) and signal to interference and noise ratio (SINR). The experimental results highlight a critical physical-layer vulnerability in 5G positioning, underscoring the urgent need for robust countermeasures to safeguard network integrity.

IMSI catchers are surveillance tools that intercept cellular signals to capture user identifiers, such as the IMSI. By imitating a legitimate BS and compelling phones to connect via jamming or stronger signal, they cause temporary disconnection, risking service disruption and raising suspicion, which limits their covert effectiveness. This paper presents FlashCatch, an IMSI-catching approach that significantly accelerates the two primary factors leading to service disruption. First, by exploiting 3GPP standard vulnerabilities, FlashCatch reduces IMSI capture time by over 200 times. Second, it improves the detachment phase through intentional authentication failures, inducing a rapid switch back to a legitimate cell and barring the FBS cell from further reconnection, thus reducing overall noticeable service disruption by at least 50-fold. Laboratory experiments on 7 devices featuring basebands from three different manufacturers demonstrate sub-second IMSI retrieval with seamless service continuity, while dedicated VoLTE and VoIP experiments confirm that ongoing calls resume without termination after a transient small disruption. In-the-wild field tests with 50 volunteers further validate its stealth and operational effectiveness. Moreover, FlashCatch preserves the UE's security context, retaining temporary identifiers that enable linkability attacks for subsequent tracking.

While extensively studied in Global Positioning Systems, meaconing—i.e., the delay, amplification, and replay of a signal—is often regarded as impractical in cellular positioning systems due to the potential risk of communication disruption. We challenge this belief by experimentally validating full-frame meaconing attacks on 5G systems. Using off-the-shelf hardware, we demonstrate how an attacker can replay entire 5G frames, introducing o(μs) controlled TOA biases while maintaining uninterrupted communication. Our findings reveal the real world viability of these attacks, highlighting the urgent need for robust countermeasures to protect 5G localization systems.

This paper introduces ScasDK, an innovative proxy-based framework designed to enable advanced security assurance testing within virtualized 5G Core Networks. Unlike conventional 5G-specific security assurance approaches meant to be employed in offline, certification-oriented testing, ScasDK utilizes programmable proxies between network functions, enabling testing directly within online environments—in principle even in production scenarios. Additionally, ScasDK allows third-party test labs and infrastructure providers to efficiently define, deploy, and manage not only the standardized Security Assurance Specifications (SCAS) tests established by 3GPP but also custom, scenario-specific testing methodologies. Seamlessly integrated into a DevSecOps pipeline, ScasDK was validated through comprehensive security assessments on three open-source 5G Core Networks, uncovering several vulnerabilities and identifying areas for improvement. The performance evaluation further demonstrates the feasibility of online testing, setting the stage for future security testing practices in 5G core networks.

In cellular networks, security vulnerabilities often arise from misconfigurations and improper implementations of protection mechanisms. Typically, ensuring proper security configurations is the responsibility of network operators. The tool described in this paper, called 5GMap, empowers legitimate subscribers, equipped with software-defined radios (Ettus B210 or X310), with innovative means and methodologies for auditing security configurations of the access networks they are connecting to. Specifically, 5GMap allows to evaluate negotiable ciphers, predictability of temporary identifiers (TMSI), resilience against disclosure of privacy-sensitive identifiers (IMSI, IMEI), and susceptibility to downgrade attacks. 5GMap achieves this by iterating access and attach primitives using either carefully crafted signaling messages requiring specific cryptographic configuration, as well as custom methodologies such as using predictable TMSIs and querying the network with non-standard signaling message sequences to detect potential departures from the expected protocol specification. Extensive testing over four mobile network operators and three virtual network operators reveals significant security and privacy issues: many networks allow unencrypted or even unauthenticated communication, TMSI randomness and IMSI concealment are not consistently ensured across all operators tested, and many other fine-grained concerns emerge among different operators. We believe that our findings highlight the usefulness of tools like 5GMap to assess (and ultimately improve, through responsible disclosure) the security posture of 4G and 5G cellular networks in the wild.

This paper empirically explores the resilience of the current Android ecosystem against stegomalware, which involves both Java/Kotlin and native code. To this aim, we rely on a methodology that goes beyond traditional approaches by hiding malicious Java code and extending it to encoding and dynamically loading native libraries at runtime. By merging app resources, steganography, and repackaging, the methodology seamlessly embeds malware samples into the assets of a host app, making detection significantly more challenging. We implemented the methodology in a tool, StegoPack, which allows the extraction and execution of the payload at runtime through reverse steganography. We used StegoPack to embed well-known DEX and native malware samples over 14 years into real Android host apps. We then challenged top-notch antivirus engines, which previously had high detection rates on the original malware, to detect the embedded samples. Our results reveal a significant reduction in the number of detections (up to zero in most cases), indicating that current detection techniques, while thorough in analyzing app code, largely disregard app assets, leading us to believe that steganographic adversaries are not even included in the adversary models of most deployed defensive analysis systems. Thus, we propose potential countermeasures for StegoPack to detect steganographic data in the app assets and the dynamic loader used to execute malware.

Distributed Denial of Service (DDoS) attacks pose a significant threat to the stability and availability of online services. An effective strategy for mitigating these attacks involves the decentralization of filtering mechanisms, which enhances resilience by distributing the load and reducing single points of failure. However, the deployment of decentralized filters presents challenges in terms of ease of deployment, performance, and scalability. To address these challenges, this study proposes the utilization of extended Berkeley Packet Filter (eBPF) for coding the filters and eHDL for hardware offloading. Our solution leverages the flexibility of eBPF for rapid development and deployment of complex filtering logic, while eHDL facilitates the efficient translation of these filters into hardware configurations capable of operating at the network speed. We demonstrate the effectiveness of our approach by offloading four distinct eBPFbased DDoS prevention applications, including two previously proposed in scholarly literature, and validate the scalability of our system up to 100 Gbps. This proof-of-concept underscores the potential of combining eBPF and eHDL to create robust, scalable, and high-performance DDoS protection architectures.

Configuration security in 5G infrastructure man-dates the use of advanced tools that can automate the understanding of network deployments. Addressing this need, we introduce 5GRecon, a novel tool designed to enhance 5G configuration security. The primary objectives of 5GRecon are twofold: first, to automatically recognize network functions and accurately detect their associations with network-related configurations such as IP addresses; and second, to proactively raise alerts about potential misconfigurations, thereby aiding in the troubleshooting of 5G core networks and significantly reducing time and effort required for network security management. To evaluate the effectiveness, capabilities, and usability of 5GRecon, we conducted preliminary assessments on three open-source Core Networks. The results demonstrate the tool's potential in enhancing 5G network configuration security and its practical applicability in real-world scenarios. Finally, we further investigate the possibility of integrating the operation of 5GRecon within an automated security testing framework, thus enabling comprehensive security assessments of identified network functions.

Despite extensive research and standardization efforts aimed at developing and enhancing 5G localization services, a significant gap persists between theoretical findings and experimental deployments, impeding the validation of key results in real-world operational settings. This paper contributes to fill this gap by proposing an End-to-End (E2E) implementation of a 5G localization system to explore the existing support of commercial off-the-shelf (COTS) user devices and existing RAN solutions for the localization functionality. To this end, we first develop a standard-compliant implementation of the location management function (LMF), i.e., the standard network function responsible for managing location information in the 5G core network. Then, we integrate the LMF with open-source core networks to conduct comprehensive testing on a suite of COTS user equipments and existing 5G RAN solutions, comparing commercial with open-source alternatives. By documenting encountered limitations and releasing our LMF software implementation as open-source, our work significantly contributes to the advancement of 5G localization research and testing in real environments and advocates for increased experiment-readiness in 5G positioning systems.

Positioning is a key focus in 5G standardization, starting with 3GPP Release 16. However, most of the effort from the research community and work presented in the technical standardization has been limited mainly to simulation studies. This paper explores the use of software-defined radios (SDRs) platforms for 5G positioning, presenting an overview of the current state-of-the-art and available open-source platforms. Utilizing an advanced SDR-based multi-gNodeBs (gNBs) synchronized testbed, the paper conducts a series of time-based, over-the-air measurements. Results offer insights into the impact of various real-world system parameters, such as the number of gNBs, transmission bandwidth, signal processing techniques, and localization algorithms on positioning accuracy and Time to First Fix (TTFF). These findings provide a pathway for the cost-effective and efficient implementation of high-precision 5G localization systems. The paper contributes to advancing both theoretical understanding and practical applications, serving as a guide for the development of 5G positioning technology.

With the rise of the Network Softwarization era, eBPF has become a hot technology for efficient packet processing on commodity hardware. However the development of custom eBPF solutions is a challenging process that requires highly qualified human resources. Indeed, in eBPF, it is difficult to devise truly modular applications since the development model does not favour the use of pre-compiled functions and libraries. In addition, for safety purposes, each eBFF program must pass a binary code verifier of the Linux kernel, which may increase the difficulty of the development process. To overcome such difficulties and enable a new development model, in this paper we propose the eCLAT framework with the goal to lower the learning curve of engineers by re-using eBPF code in a programmable way. eCLAT offers a high level programming abstraction to eBPF based network programmability, allowing a developer to create custom application logic with no need of understanding the complex details of regular eBPF programming. A developer can write eCLAT scripts in a python-like language to compose eBPF programs. To support such abstraction at the eBPF level, we created an eBPF framework called HIKe which brings code reuse and modularity in eBPF. The eCLAT/HIKe solution does not require any kernel modification. The new development model is tested through two concrete examples and compared with other proposed frameworks in the eBPF world.

Modern malware has become increasingly sophisticated, posing a significant threat to cybersecurity. As a result, researchers and security professionals are constantly seeking more advanced methods to detect and analyze malware. Most of these methods are under the umbrella of dynamic analysis, which offers advantages over static analysis—it allows for the observation of the runtime behavior and the detection of obfuscated or encrypted code that may be used to evade detection. However, running executables in a controlled environment can be costly, often leading to a pragmatic compromise of running them with sandboxing only for a limited initial time. In this paper, we propose a different approach to dynamic executable analysis: we analyze the presence of malicious signatures in executable virtual pages of an application the moment they are materialized in RAM—possibly with a new content after an update. We specifically design and evaluate JITScanner, a Linux-oriented package based on a Loadable Kernel Module (LKM), which supports checking any executable page each time its fresh content located in RAM is accessed for instruction fetch enabling the detection of malicious updates to executable pages. The user-level component of the architecture communicates with the LKM via a scalable solution that exploits multi-processor/core technology. We also present experimental data that show the effectiveness of our solution and its promising potential.

To ensure 5G infrastructure security, standardized Security Assurance Specification (SCAS) tests are being developed by 3GPP. However, executing these tests on complex 5G infrastructures with multiple closed-source network functions (NFs) poses a challenge. This paper presents ScasDK, a development framework that enables third-party test labs to design, deploy, and control SCAS tests on virtualized 5G core infrastructures. ScasDK addresses the multi-NF hurdle by inserting proxies (including custom ones) between NFs and using a central controller to program their responses. Preliminary assessments using seven SCAS tests on three open-source 5G core networks revealed significant test failures, emphasizing the need for enhanced security focus in open-source 5G development.

Enterprise Wi-Fi networks are essential for businesses and public administrations as they provide a perfectly scalable and secure system. In the university environment, they are often deployed to offer services to students. One of the most famous university Wi-Fi Enterprise networks is Eduroam, which stands for education roaming; it is a worldwide Wi-Fi access and roaming service widely adopted by the international research and education community. It is based on 802.1x mechanisms that use TLS tunnels for achieving mutual authentication goals, and, as such, it requires careful configuration of mobile devices and responsible users’ behaviors to avoid trivial attacks carried out with rogue Access Points (APs). Differently than employees in a corporate network whose devices are properly configured by ICT teams, the user base of Eduroam consists of (likely) millions of students and professors around the world, with a myriad of different and uncontrolled devices. To assess the security of 802.1x in general, and more specifically that of Eduroam, we ran attacks against two communities of students of increasing size in order to test how users (and their devices) react when rogue 802.1x APs appear in the list of available networks. We then focused our attention on devices, and investigated their detailed dependence on different WPA-Enterprise configurations and certificate settings. The aftermath is that, even with a completely passive attack (users are keeping devices in their pockets), it is possible to steal credentials from more than one-third of the students. While most of the 802.1x vulnerabilities employed in this work should be considered somewhat known (being disclosed in former technical papers), our work appears to raise a threefold concern: (i) most pragmatic 802.1x configurations appear to be grossly insecure; (ii) no Apple’s iPhone felt in our attack unless explicitly forced by the user, owing to its reduced possibility for a user to misconfigure the terminal; and (iii) the awareness of Wi-Fi authentication threats even in relatively skilled end users is close to zero.

The Google's Loon$^{TM}$initiative aims at covering rural or underdeveloped areas via fleets of high-altitude balloons supporting LTE connectivity. But how effective and stable can be the coverage provided by a network deployed via propulsion-free balloons, floating in the sky, and only loosely controllable through altitude variations? To provide some insights on the relevant performance and trade-offs, in this paper we gather real-world data from publicly available flight tracking services, and we analyze coverage and service stability in three past deployment scenarios. Besides employing a variety of metrics related to spatial and temporal coverage, we also assess service continuity, by also leveraging recently proposed “meaningful availability” metrics. While our analyses show that balloons are certainly a cost-effective way to provide a better-than-nothing and delay-tolerant service, there is yet no empirical evidence that an increase in the number of overlapping balloons may be rewarded with a substantial performance increase — in other words, we suspect that guaranteeing coverage and service stability levels comparable to that of a terrestrial cellular network is a challenging goal.

The increasing performance requirements of modern applications place a significant burden on software-based packet processing. Most of today’s software input/output accelerations achieve high performance at the expense of reserving CPU resources dedicated to continuously poll the Network Interface Card. This is specifically the case with DPDK (Data Plane Development Kit), probably the most widely used framework for software-based packet processing today. The approach presented in this paper, descriptively called Metronome, has the dual goals of providing CPU utilization proportional to the load, and allowing flexible sharing of CPU resources between I/O tasks and applications. Metronome replaces DPDK’s continuous polling with an intermittent sleep&wake mode, and revolves around a new multi-threaded operation, which improves service continuity. Since the proposed operation trades CPU usage with buffering delay, we propose an analytical model devised to dynamically adapt the sleep&wake parameters to the actual traffic load, meanwhile providing a target average latency. Our experimental results show a significant reduction of the CPU cycles, improvements in power usage, and robustness to CPU sharing even when challenged with CPU-intensive applications.

Modern wireless communication networks are threatened by new generations of radio hackers. These are skilled attackers equipped with low-cost software radios, suitably instrumented so as to monitor, degrade, or even alter the radio signals. The aim of this paper is to devise innovative detection architectures against the most common classes of threats: broadband noise jammers, whose goal is to reduce the signal-to-noise ratio, and spoofing/meaconing attacks, which aim to inject false or incorrect information into the receiver. To this end, we resort to the hypothesis testing theory and solve the associated problems by means of the GLRT possibly accounting for penalty terms. The resulting decision schemes represent the main technical novelty of this work. The analysis of their performance focuses on a location security case study for 4G/5G cellular networks. To this end, we leverage measurement models from the cellular localization literature and generate data according to these models. The numerical results show the effectiveness of the proposed approaches in comparison with suitable counterparts.

With the rise of the Network Softwarization era, eBPF has become a hot technology for efficient packet processing on commodity hardware. However the development of custom eBPF solutions is a challenging process that requires highly qualified human resources. In this paper we propose the eCLAT framework with the goal to lower the learning curve of engineers by re-using eBPF code in a programmable way. eCLAT offers a high level programming abstraction to eBPF based network programmability, allowing a developer to create custom application logic in eBPF with no need of understanding the complex details of regular eBPF programming. To support such modularity at the eBPF level, we created an eBPF library that implements a virtual machine, called HIKe VM. The HIKe VM library extends the conventional eBPF programs so that they can be integrated in eCLAT. The eCLAT/HIKe solution does not require any kernel modification.

Probabilistic approaches allow designing very efficient data structures and algorithms aimed at computing the number of flows within a given observation window. The practical applications are many, ranging from security to network monitoring and control. We focus our investigation on approaches tailored for sliding windows, that enable continous-time measurements independently from the observation window. In particular, we show how to extend standard approaches, such as Probabilistic Counting with Stochastic Averaging (PCSA), to count over an observation window. The main idea is to modify the data structure to store a compact representation of the timestamp in the registers and to modify coherently the related algorithms. We propose a timestamp-augmented version of PCSA, denoted as TS-PCSA, and compare it with state-of-the-art solutions based on Hyper-LogLog (HLL) counters that evaluate the cardinality over a sliding window, but without storing the timestamps. We will show that TS-PCSA with a limited memory footprint is achieving a different tradeoff between memory and accuracy with respect to HLL-based solutions.

While GPS has traditionally been the primary positioning technology, 3GPP has more recently begun to include positioning services as native, built-in features of future-generation cellular networks. With Release 16 of the 3GPP, finalized in 2021, a significant standardization effort has taken place for positioning in 5G networks, especially in terms of physical layer signals, measurements, schemes, and architecture to meet the requirements of a wide range of regulatory, commercial and industrial use cases. However, experimentally-driven research aiming to assess the real-world performance of 5G positioning is still lagging behind, root causes being i) the slow integration of positioning technologies in open-source 5G frameworks, ii) the complexity in setting up and properly configuring a 5G positioning testbed and iii) the cost of a multi-BS deployment. This paper sheds some light on all such aspects. After a brief overview of state of the art in 5G positioning and its support in open-source platforms based on software-defined radios, we provide advice on how to set-up positioning testbeds, and we demonstrate, via a set of real-world measurements, how to assess aspects such as reference signal configurations, localization algorithms, and network deployments, even with a cost-constrained limited-size testbed.

The continuous quest for performance pushed processors to incorporate elements such as multiple cores, caches, acceleration units, or speculative execution that make systems very complex. On the other hand, these features often expose unexpected vulnerabilities that pose new challenges. For example, the timing differences introduced by caches or speculative execution can be exploited to leak information or detect activity patterns. Protecting embedded systems from existing attacks is extremely challenging, and it is made even harder by the continuous rise of new microarchitectural attacks (e.g., the Spectre and Orchestration attacks). In this article, we present a new approach based on count-min sketches for detecting microarchitectural attacks in the microprocessors featured by embedded systems. The idea is to add to the system a security checking module (without modifying the microprocessor under protection) in charge of observing the fetched instructions and identifying and signaling possible suspicious activities without interfering with the nominal activity of the system. The proposed approach can be programmed at design time (and reprogrammed after deployment) in order to always keep updated the list of the attacks that the checker is able to identify. We integrated the proposed approach in a large RISC-V core, and we proved its effectiveness in detecting several versions of the Spectre, Orchestration, Rowhammer, and Flush + Reload attacks. In its best configuration, the proposed approach has been able to detect 100% of the attacks, with no false alarms and introducing about 10% area overhead, about 4% power increase, and without working frequency reduction.

A very popular theory circulating among non-scientific communities claims that the massive deployment of Base Stations (BSs) over the territory, a.k.a. cellular network densification, always triggers an uncontrolled and exponential increase of human exposure to Radio Frequency “Pollution” (RFP). To face such concern in a way that can be understood by the layman, in this work we develop a very simple model to compute the RFP, based on a set of worst-case and conservative assumptions. We then provide closed-form expressions to evaluate the RFP variation in a pair of candidate 5G deployments, subject to different densification levels. Results, obtained over a wide set of representative 5G scenarios, dispel the myth: cellular network densification triggers an RFP decrease (up to three orders of magnitude) when the radiated power from the BS is adjusted to ensure a minimum sensitivity at the cell edge. Eventually, we analyze the conditions under which the RFP may increase when the network is densified (e.g., when the radiated power does not scale with the cell size), proving that the amount of RFP is always controlled. Finally, the results obtained by simulation confirm the outcomes of the RFP model.

Most localization systems rely on measurements gathered from signals emitted by stations whose position is assumed known as ground truth, namely anchors. As demonstrated by a significant bulk of experimental research, location security is threatened when an attacker becomes able to tamper either the signals emitted by the stations, or convince the user that the anchor station is in a different position than the true one. With this paper, we first propose a formal threat model which captures the above-mentioned wide class of attacks, and permits to quantitatively evaluate how tampering of one or more anchor locations undermines the user’s localization accuracy. We specifically derive a Cramér Rao Bound for the localization error, and we assess a number of example scenarios. We believe that our study may provide a useful formal benchmark for the design and analysis of detection and mitigation solutions.

In any cybersecurity training program, a non-marginal fraction of the activities are usually devoted to ”hands-on” practice, typically in the form of vulnerable scenarios that the trainee must evaluate/penetrate. The manual setup and implementation of such training scenarios is a significant burden on trainers, and takes away valuable time. In order to automate this step and enable reuse of components or even entire scenarios, this paper proposes Nautilus, a Cyber Range with extended capabilities that at the same time provides a training environment and a ”marketplace” platform to share scenarios, pre-implemented vulnerabilities/CVEs, scripts, etc. Nautilus leverages advanced cloud technologies to semi-automate deployment of vulnerable configurations of virtualized networks and systems, provides a graphical interface and a scenario description language, and integrates easy-to-use data/knowledge sharing facilities. In this respect, we believe that Nautilus can foster collaboration among different training teams and programs, and stimulate less skilled trainers, which alone would have perhaps prepared only basic scenarios, to access and reuse more advanced exercises prepared by others. Finally, we preliminary show the effectiveness and ease of use of the Nautilus Cyber Range via the results of a (so far) small-scale usability test conducted among different prospective trainers.

Besides providing data sharing, commercial cloud-based storage services (e.g., Dropbox) also enforce access control, i.e. permit users to decide who can access which data. In this paper we advocate the separation between the sharing of data and the access control function. We specifically promote an overlay approach which provides end-to-end encryption and empowers the end users with the possibility to enforce access control policies without involving the cloud provider itself. To this end, our proposal, named ABEBox, relies on the careful combination of i) attribute-based encryption for custom policy definition and management, with ii) proxy re-encryption to provide scalable re-keying and protection to key-scraping attacks, with a novel revocation procedure. Moreover, iii) we concretely embed our protection mechanisms inside a public domain virtual file system module to provide an overlay and trivial-to-use transparent service which can be deployed on top of any arbitrary cloud storage provider.

Many Internet-connected appliances are often moved to different environments, such as when they are re-located. And even when they are buried in a given physical environment, their ownership "moves", such as when a home or smart space changes hands. This calls for roaming-friendly IoT authentication devised to circumvent the need to deploy long-term authentication credentials across different visited domains. Noting that this issue has been very extensively addressed since at least three decades in cellular network, in this paper we integrate, within the RIOT IoT Operating system, an authentication and key agreement protocol designed to be as close as possible to the standard one used by 4G/5G cellular systems. Our design accounts for a few technical improvements made possible since, unlike the case of cellular networks, we are here free from back-ward compatibility issues. Our proof-of-concept implementation is built on COAP for the radio interface, and on HTTPS for the core network signaling parts, and can be further configured to use two different types of secret keys: pre-shared or on-demand, (re)generated via a SRAM-PUF API available in RIOT.

The debate over whether electromagnetic fields (EMFs) exposure poses a danger to human health is recurring and goes back centuries to when our society first began to rely on electricity [1].

The papers in this special issue focus on sustainable cyber forensics and threat intelligence. Increasing societal reliance on interconnected digital systems, including smart grids and Internet of Things (IoT), made sustainable detection and investigation of threat actors among the highest priorities of any society. Scale and attack surface of modern networks mandate optimized deployment of limited cyber forensics and threat intelligence resources to detect and remove malicious actors in a timely manner. However, timely dealing with such a huge number of attacks is not possible without employment of artificial intelligence and machine learning techniques. When a significant amount of data is collected from or generated by different security monitoring solutions, intelligent big-data analytical techniques are necessary to mine, interpret and extract knowledge out of those data. The emerging field of cyber threat intelligence is investigating applications of artificial intelligence and machine learning techniques to perceive, reason, learn and act intelligently against advanced cyber attacks. A crucial success factor in implementation, installation and deployment of threat intelligence and cyber forensics capacities in modern networks is sustainability.

LoRaWAN (Long 1 Range Wide Area Network) is an attractive network infrastructure and protocol suite for ultra low power Internet of Things devices. Even if the technology itself is quite mature and specified, the currently deployed wireless resource allocation strategies are still coarse and based on rough heuristics. This paper proposes an innovative “sequential waterfilling” strategy for assigning spreading factors to End Devices. Our design relies on three complementary approaches: i) equalize the Time-on-Air of packets transmitted by the system's End Devices in each spreading factor's group; ii) balance the spreading factors across multiple gateways and iii) keep into account the channel capture, which our experimental results show to be very substantial in LoRa. While retaining an extremely simple and scalable implementation, this strategy yields a significant improvement (up to 38%) in the network capacity over the Adaptive Data Rate used by many network operators on the basis of the design suggested by Semtech, and appears to be extremely robust to different operating/load conditions and network topology configurations.

We propose DISCO - a lightweight approach to flow monitoring in the data plane. The idea is to disaggregate the computation of a single (logically) centralized sketch into multiple small "sketch fragments" that are distributed across the flows' paths. This allows use less resources at switches without trading on telemetry capabilities.

DPDK (Data Plane Development Kit) is arguably today's most employed framework for software packet processing. Its impressive performance however comes at the cost of precious CPU resources, dedicated to continuously poll the NICs. To face this issue, this paper presents Metronome, an approach devised to replace the continuous DPDK polling with a sleep&wake intermittent mode. Metronome revolves around two main innovations. First, we design a microseconds time-scale sleep function, named hr_sleep(), which outperforms Linux' nanosleep() of more than one order of magnitude in terms of precision when running threads with common time-sharing priorities. Then, we design, model, and assess an efficient multi-thread operation which guarantees service continuity and improved robustness against preemptive thread executions, like in common CPU-sharing scenarios, meanwhile providing controlled latency and high polling efficiency by dynamically adapting to the measured traffic load.

Cryptography key management system plays a very central role in the cloud data security. Nonetheless, a great part of the current commercial solutions rely on cloud providers that hold both the encrypted data and the related private master key of their served customers in their secure key vaults, having a de-facto total control on their customer digital assets. Conversely, entrusting customer companies for key holding can be dangerous as witnessed by many cases of key loss or theft. In this work we present CoProtect, a novel architecture to protect the cryptography keys in cloud systems that leverage on the cooperation between the cloud provider and the customer company. With such trust model, we present the proposed data management strategy, the key generation and the crypto procedures, and a proof of concept.

A common concern among the population is that installing new 5G Base Stations (BSs) over a given geographic region may result in an uncontrollable increase of Radio-Frequency “Pollution” (RFP). To face this dispute in a way that can be understood by the layman, we develop a very simple model, which evaluates the RFP at selected distances between the user and the 5G BS locations. We then obtain closed-form expressions to quantify the RFP increase/decrease when comparing a pair of alternative 5G deployments. Results show that a dense 5G deployment is beneficial to the users living in proximity to the 5G BSs, with an abrupt decrease of RFP (up to three orders of magnitude) compared to a sparse deployment. We also analyze scenarios where the user equipment minimum detectable signal threshold is increased, showing that in such cases a (slight) increase of RFP may be experienced.

We focus on the ElectroMagnetic Field (EMF) exposure safety for people living in the vicinity of cellular towers. To this aim, we analyze a large dataset of long-term EMF measurements collected over almost 20 years in more than 2000 measurement points spread over an Italian region. We evaluate the relationship between EMF exposure and the following factors: (i) distance from the closest installation(s), (ii) type of EMF sources in the vicinity, (iii) Base Station (BS) technology, and (iv) EMF regulation updates. Overall, the exposure levels from BSs in the vicinity are below the Italian EMF limits, thus ensuring safety for the population. Moreover, BSs represent the lowest exposure compared to Radio/TV repeaters and other EMF sources. However, the BS EMF exposure in proximity to users exhibits an increasing trend over the last years, which is likely due to the pervasive deployment of multiple technologies and to the EMF regulation updates. As a side consideration, if the EMF levels continue to increase with the current trends, the EMF exposure in proximity to BSs will saturate to the maximum EMF limit by the next 20 years at a distance of 30 meters from the closest BS.

Current authentication methods on the Web have serious weaknesses. First, services heavily rely on the traditional password paradigm, which diminishes the end-users' security and usability. Second, the lack of attribute-based authentication does not allow anonymity-preserving access to services. Third, users have multiple online accounts that often reflect distinct identity aspects. This makes proving combinations of identity attributes hard on the users. In this paper, we address these weaknesses by proposing a privacy-preserving architecture for device-centric and attribute-based authentication based on: 1) the seamless integration between usable/strong device-centric authentication methods and federated login solutions; 2) the separation of the concerns for Authorization, Authentication, Behavioral Authentication and Identification to facilitate incremental deployability, wide adoption and compliance with NIST assurance levels; and 3) a novel centralized component that allows end-users to perform identity profile and consent management, to prove combinations of fragmented identity aspects, and to perform account recovery in case of device loss. To the best of our knowledge, this is the first effort towards fusing the aforementioned techniques under an integrated architecture. This architecture effectively deems the password paradigm obsolete with minimal modification on the service provider's software stack.

On August 14, 2018, a new set of vulnerabilities collectively named “L1 terminal fault” were announced. Systems with microprocessors utilizing out-of-order execution could allow unauthorized disclosure of information residing in the L1data cache, by tweaking the virtual memory abstraction. The vulnerability was therein mentioned for three different scenarios. In this demo-paper, we provide practical evidence about the feasibility of the most complex “VMM” case of an attacker residing in a Virtual Machine (VM), and targeting information leakage from the host OS and other independent VMs.

Narrowband Internet of Things (NB-IoT) is a cellular standard supporting IoT applications in wide area. NB-IoT utilizes “repetition” to extend the coverage of the base station. The repetition value in NB-IoT physical random access channel (NPRACH) is set to ensure 99% detection probability without considering the inherent “retransmission” nature of NPRACH. In this paper, we try to optimally trade extra time-diversity gain in preamble transmission obtained from retransmission to reduce the repetition requirement in NB-IoT. The preferred regions for pure repetition and retransmission schemes sharing the same amount of NPRACH resource under various offered loads and channel conditions are first investigated. The optimal amount of NPRACH resource, repetition value, and retransmission value are then obtained subject to a target successful probability. The results show that the embedded retransmission nature of NPRACH can effectively reduce the number of repetitions. High number of repetitions is required only under worse channel condition.

Many Internet of Things applications require a regular periodic sampling of physical quantities, such as light, CO2, or position. However, for energy harvesting devices, this can be in sharp contrast with the unreliable and time-varying amount of energy gathered opportunistically from the environment, and the severe energy storage limitations in constrained devices further exacerbate such issue. This article proposes an approach devised to jointly optimize frequency and stability of the sampling rate in energy harvesting sensors. Unlike heuristic approaches, StableSENS builds upon a solid theoretical foundation, namely, Lyapunov optimization, which-to the best of our knowledge-is applied here for the first time to the sensing scenario. One of StableSENS' main assets is its very broad applicability: we remark that neither assumptions nor predictions on future energy availability patterns are required. Numerical results obtained in realistic scenarios show that StableSENS yields superior performance with respect to previous heuristic approaches as well as reinforcement-learning-based approaches.

The ongoing network softwarization trend holds the promise to revolutionize network infrastructures by making them more flexible, reconfigurable, portable, and more adaptive than ever. Still, the migration from hard-coded/hard-wired network functions toward their software-programmable counterparts comes along with the need for tailored optimizations and acceleration techniques so as to avoid or at least mitigate the throughput/latency performance degradation with respect to fixed function network elements. The contribution of this paper is twofold. First, we provide a comprehensive overview of the host-based network function virtualization (NFV) ecosystem, covering a broad range of techniques, from low-level hardware acceleration and bump-in-the-wire offloading approaches to high-level software acceleration solutions, including the virtualization technique itself. Second, we derive guidelines regarding the design, development, and operation of NFV-based deployments that meet the flexibility and scalability requirements of modern communication networks.

XTRA (XFSM for Transport) aims at providing a first attempt towards a “code-once-port-everywhere” platform-agnostic programming abstraction tailored to the deployment of transport layer functions. XTRA's programming abstraction not only fits SW platforms, but is specifically designed to harness, with no re-coding effort, the offloading opportunities offered by CPU-less HW boards or smart NICs. We demonstrate the viability of XTRA with three completely different implementations of the underlying execution engine (HW proof-of-concept on a NetFPGA board, User-space SW over Linux' Open Data Plane, and NS3 emulator). Flexibility is shown via a number of example applications, ranging from a variety of congestion control algorithms, to a middlebox-type TCP proxy functionality, up to a customized “Timer-Based” (TB) TCP which leverages the native reliance of XTRA on timers, so as to produce a loss recovery operation which, despite being formalized only via a handful of code lines, performs almost comparable with the highly optimized Linux and FreeBSD implementations.

Simultaneous random access attempts from massive machine-type communications (mMTC) devices may severely congest a shared physical random access channel (PRACH) in mobile networks. This paper presents a novel two-phase random access (TPRA) procedure to deal with the congestion caused by mMTC devices accessing the PRACH. During the first phase, the TPRA splits the mMTC devices into smaller groups according to a preamble selected randomly by the devices. Then, in the second phase, each group of devices is assigned with a dedicated channel to complete the random access procedure. The proposed concept allows a base station to adjust the number of dedicated channels in real-time according to the actual network load. We then present an analytical model to estimate the access success probability and the average access delay of the TPRA. Finally, we propose a simple formula to determine the optimal number of random access resources for the second phase of the proposed TPRA. Simulations are carried out to validate the analytical models and to demonstrate the benefits of the TPRA compared to competitive techniques.

The challenge addressed in this paper consists in offloading packet-based pacing to a hardware Network Interface Card, while retaining the flexibility of software timers. In this direction, we propose, design, implement, and evaluate a hardware calendar, which can be programmed via a simple yet very flexible programming interface leveraging stateful (adaptive) per-packet timers. We show, for both specific examples (exponential, linearly increasing, etc) as well as for the general case, how to derive such a per-packet timer setting from a high-level desired rate envelope. Further, we describe and evaluate an FPGA implementation which relies on a novel insertion strategy for solving collisions in the calendar's hash table.

As applications and user requirements are constantly evolving, there is a need to provide flexible networks that are able to process packets at high speed. One of the basic functions used for packet processing is matching a key formed by some fields of the incoming packet header against a set of stored rules. This is done for example to determine the next hop of a packet or to apply security checks on a firewall. In many cases, the stored rules have do not care bits as that enables a more flexible and compact representation of the rules. Therefore, the matching can be done in hardware using Ternary Content Addressable Memories (TCAMs). However, TCAMs pose several problems in many implementations. For example, for ASICs they require much more circuit area and power than standard SRAMs. On the other hand, designs based on programmable logic such as Field Programmable Gate Arrays (FPGAs) can only use the blocks provided by the FPGA that do not typically include TCAMs. In this last case, a TCAM can be emulated using the FPGA logic resources but with a large cost. To reduce the cost of implementing TCAMs, a number of algorithmic solutions have been proposed and are known as Algorithmic TCAMs or A-TCAMs. Most of those schemes target either software or ASIC implementations. In this paper we present Multiple Hash Matching Units (MHMU) an A-TCAM solution targeted towards FPGA implementations. The proposed scheme exploits the massive parallelism of FPGAs to implement many hash based matching units that use the embedded block RAM memories of the FPGA. The proposed MHMU scheme has been mapped to a Xilinx series 7 FPGA to check its efficiency in terms of resource usage and its scalability. To validate the effectiveness of MHMU, a simple configuration has been tested with Classbench generated sets of rules. The results show that the MHMU is able to consistently accommodate sets with several tens of thousands of rules with large keys.

While enabling brand new services and opportunities, the federation of vertical Internet of Things platforms presents new challenges in terms of secure and controlled access to heterogeneous resources, especially when authorization permissions must be regulated by multiple decentralized authorities. The work presented herein designs, develops, and experimentally validates a flexible and effective attribute-based access control framework, properly devised to operate in a federated and cloud-assisted cyber-physical system (CPS). Our main novelty stems in the original way we turn a policy-based encryption scheme, customarily used for accessing data, into a cyber-physical resource access control protocol. The proposed design approach is able to address several security issues characterizing the emerging use cases in this context, including the decoupling between authentication and authorization, fine-grained, offline, and time-limited authorization, protection against collusion attacks, access rights revocation, and user privacy. A security analysis and a performance evaluation executed through experimental tests clearly demonstrate the viability of the proposed approach in realistic cloud-assisted CPSs, as well as its ability to overcome the lacks affecting competitive approaches without introducing huge communication and computational requirements.

Cloning is a very serious threat in the Internet of Things (IoT), owing to the simplicity for an attacker to gather configuration and authentication credentials from a non-tamper-proof node, and replicate it in the network. In this paper, we propose MDSClone, a novel clone detection method based on multidimensional scaling (MDS). MDSClone appears to be very well suited to IoT scenarios, as it: 1) detects clones without the need to know the geographical positions of nodes; 2) unlike prior methods, it can be applied to hybrid networks that comprise both static and mobile nodes, for which no mobility pattern may be assumed a priori. Moreover, a further advantage of MDSClone is that 3) the core part of the detection algorithm can be parallelized, resulting in an acceleration of the whole detection mechanism. Our thorough analytical and experimental evaluations demonstrate that MDSClone can achieve a 100% clone detection probability. Moreover, we propose several modifications to the original MDS calculation, which lead to over a 75% speed up in large scale scenarios. The demonstrated efficiency of MDSClone proves that it is a promising method towards a practical clone detection design in IoT.

In the last few years, there has been a growing interest in developing sensing systems using RF signals of opportunity, especially exploiting radar-based techniques. Long Term Evolution (LTE) signals are excellent candidates as signals of opportunity thanks to their wide availability and penetration in indoor environments. This is the first work investigating the possibility to use LTE signals for crowd density estimation. The proposed approach is not radar-like but it exploits the correlation between the variations of the received LTE signals (in particular, of the Reference Signal Received Power) and the number of people. An experimental evaluation of the performance is carried out in a indoor environment testing three different positions of the LTE receiver. Achieved results in terms of classification accuracy are very promising.

In the last few years, there has been a growing interest on the usage of passive WiFi signals for detecting and classifying human behavior activities. In most generality, the idea underlying most state of the art approaches is to monitor changes in the Channel State Information (CSI) or equivalent spectral metrics, caused by the different multi- path conditions (and their temporal variations) induced by human activity. The (implicit) underlying intuitive assumption is that, in a static environment, i.e. with no moving humans, the multi-path conditions do not vary, and hence the CSI gathered at the passive receiver side should remain substantially stable in time. Goal of this paper is to document, with an extensive set of experimental measurements, a perhaps surprising result: with modern multi-antenna 802.11n/ac access points, such an intuitive assumption does not seem to hold anymore. Rather, the measured CSI time pattern, which differs for different access point brands, appears to be affected by access points' implementation artifacts. Indeed, our measurements unveil frequent fluctuations of the CSI pattern among multiple ``modes". Albeit still preliminary and, at least in part, still requiring a more thorough understanding (that only the reverse engineering of the access points' implementation may ultimately provide), our measurements unveil a phenomenon which may play havoc with several CSI-based human behavior detection approaches proposed in past works, and especially with those based on CSI measured on data frames, opposed to those based on relatively more stable (but still to be reconsidered in sight of our results) Beacon frames.

While the Internet of Things is breaking into the market, the controlled access to constrained resources still remains a blocking concern. Unfortunately, conventional solutions already accepted for both web and cloud applications cannot be directly used in this context. In fact, they generally require high computational and bandwidth capabilities (that are impossible to reach with constrained devices) and offer poor interoperability against standardized communication protocols for the Internet of Things. To solve this issue, this contribution presents a flexible authentication and authorization framework for the Internet of Things, namely OAuth-IoT. It leverages and properly harmonizes existing open-standards (including the OAuth 2.0 authorization framework, different token formats, and the protocol suite for the Internet of Things tailored by the Internet Engineering Task Force), while carefully taking into account the limited capabilities of constrained devices. Functionalities and benefits offered by OAuth-IoT are pragmatically shown by means of an experimental testbed, and further demonstrated with a very preliminary performance assessment.

The paper tackles the problem of finding the correct solution to a set of binary choice questions or labeling tasks, by adaptively assigning them to workers in a crowdsourcing system. Such problem becomes quite challenging when we do not initially know neither workers' abilities, nor questions' difficulties (besides common a priori statistics), nor (of course) which is the correct answer. Indeed, such problem requires to jointly learn workers' abilities and questions' difficulties, while adaptively assigning questions to the most appropriate workers so as to maximize our chances to find which are the correct answers. To address such problem, we first cast it into a suitably constructed Bayesian framework which permits us to obtain an analytically tractable (closed form) single-question inference step, and then we address the more general framework via the Expectation Propagation algorithm, an approximated message-passing iterative technique. We then exploit the information gathered by the inference framework as adaptive weights for a maximum weight matching task assignment policy, proposing a computationally efficient algorithm which maximizes the entropy reduction for the questions assigned at each step.

It is our great pleasure to welcome you all to the beautiful and exciting city Osaka for the 23rd IEEE International Symposium of Local and Metropolitan Networks (LANMAN 2017 - for the first time held in Japan).

Programmable dataplanes are emerging as a disruptive technology to implement network function virtualization in an SDN environment. This technology can be further enhanced by using data plane abstraction with stateful processing. In this paper we focus on real world use cases with stateful forwarding requirements to validate Open Packet Processor data plane abstraction. We first demonstrate the suitability of OPP for implementing complex stateful network functions by providing the detailed implementation of three use cases. Second, we assess the scalability of the use case implementations in the context of a datacenter deployment.

Stateful programmable dataplanes are emerging as a disruptive technology and an enabler factor for network function virtualization in SDN environments. In this demo paper we show three real world use cases with stateful forwarding requirements to validate both the hardware and software implementations of the Open Packet Processor data plane.

Many reasons make NFV an attractive paradigm for IT security: lowers costs, agile operations and better isolation as well as fast security updates, improved incident responses and better level of automation. On the other side, the network threats tend to be increasingly complex and distributed, implying huge traffic scale to be monitored and increasingly strict mitigation delay requirements. Considering the current trend of the networking and the requirements to counteract to the evolution of cyber-threats, it is expected that also network monitoring will move towards NFV based solutions. In this paper, we present D-StreaMon an NFV-capable distributed framework for network monitoring realized to face the above described challenges. It relies on the StreaMon platform, a solution for network monitoring originally designed for traditional middleboxes. An evolution path which migrates StreaMon from middleboxes to Virtual Network Functions (VNFs) has been realized.

Recently, with new hardware architectures such as Reconfigurable Match Tables and languages such as P4, the Software Defined Networking community has started to bring linerate data plane programmatic flexibility inside switching chipsets. Starting from the original OpenFlow's match/action abstraction, most of the work has so far focused on key improvements in matching flexibility. Conversely, the "action" part, i.e. the set of operations (such as encapsulation or header manipulation) performed on packets after the forwarding decision, has received way less attention: the OpenFlow community has limited to standardize the set of supported actions, whereas their implementation has been delegated to each specific vendor/device. Goal of this paper is to move beyond the idea of "atomic", pre-implemented, actions, and rather make them programmable while retaining high speed multi-gbps operation. In this work we propose a domain-specific HW architecture, called Packet Manipulation Processor (PMP), able to efficiently support microprograms implementing such actions. We describe three non trivial use cases (tunneling, NAT, and ARP reply generation), and assess the relevant throughput performance.

This paper presents a method to implement complex tasks into stateful SDN programmable dataplanes. In particular, the presented method proposes to use the internal microcontroller typically used to configure the programmable dataplane also to perform some complex operations that do not require to be executed on each packet. These operations can be executed on a set of data gathered by the dataplane and processed in a time scale that is much higher than the time window of a packet, but is much less than time scale needed for an external SDN controller. Moreover, the use of the configuration microcontroller instead of an external SDN controller to avoid the exchange of data on the control links permits a fine grain tuning of the operations to perform from the timing point of view (precise timestamping, low latency etc.). A set of measurements showing the feasibility of the method are presented, and a simple use case is described to show the effectiveness of this method to enhance the capability of stateful programmable dataplanes.

Energy-harvesting techniques for low-power embedded devices are opening up new opportunities for the design and optimization of security protocols for Green Wireless Sensor Networks. In this paper, we focus on scenarios where the energy resources of nodes in the network are heterogeneous, and propose a network-level solution that leverages the heterogeneity of harvesting capabilities to reduce the energy consumption of performing costly security operations. Our proposed distributed protocol, called HELIOS (Harvesting- EnabLed computatIon Outsourcing Scheme), allows nodes with scarce energy availability to outsource resource-demanding cryptographic operations to nodes that are harvesting power in excess, resulting in a significant reduction of their energy consumption.

LoRaWAN is emerging as an attractive network infrastructure for ultra low power Internet of Thing devices. Albeit the technology itself is quite mature and specified, how to effectively allocate wireless resources so as to support a large amount of devices in a same terrestrial area is an open challenge. This paper contributes by proposing two algorithms (of incremental complexity) which are shown to outperform the basic Adaptive Rate Strategy (ADR) so far considered. A first approach, named EXPLoRa-SF, shows the benefits of a simple strategy which does not limit to use (as per ADR) distance/RSSI measurements, but also selects Spreading Factors (SF) based on the total number of connected devices. The advantages attained with EXPLoRa-SF further lead us to propose a more sophisticated algorithm, named EXPLoRa-AT, which employs an innovative “ordered waterfilling” approach which attempts to allocate the spreading factors so as to equalize the Time on Air of the packets transmitted by the system's end devices in each spreading factor's group. Simulation results show that the proposed algorithms significantly outperform the basic ADR strategy, and particularly the EXPLoRa-AT algorithm appears very robust to different operating conditions and consistently guarantees high bit rates in the case of high traffic loads.

User authentication at Wi-Fi Access Points (APs) is becoming an important issue. Wi-Fi APs are indeed ubiquitous, but existing authentication methods such as WPA/WPA2 static pre-shared secret key (PSK), or 802.1X-based online authentication services (e.g., RADIUS servers/proxies) have their theoretical or practical limitations. In a previous work, we proposed WIFAB, a new authentication mechanism which neither requires online backend access control infrastructure, nor relies on a static pre-shared secret key. In this paper, we extend WI-FAB by removing the need for having a central authority for user authentication and credential issuing. Our main contribution is twofold: (i) adopting decentralized multi-authority CP-ABE, we support the users who have authentication/authorization credentials from multiple authorities. We decouple the user credentials issuing from the management of the WPA2-PSK, so that neither the credential issuing authority can track the users, nor the AP can access the real identity of the users. Considering an extensive attack model, we show that the proposed approach is secure and preserves the privacy of the users. (ii) We provide a real-world implementation of the proposed approach on off-the-shelf embedded hardware to demonstrate its feasibility and efficiency.

The fast evolving nature of modern cyber threats and network monitoring needs calls for new, “software-defined”, approaches to simplify and quicken programming and deployment of online (stream-based) traffic analysis functions. StreaMon is a carefully designed data-plane abstraction devised to scalably decouple the “programming logic” of a traffic analysis application (tracked states, features, anomaly conditions, etc.) from elementary primitives (counting and metering, matching, events generation, etc), efficiently pre-implemented in the probes, and used as common instruction set for supporting the desired logic. Multi-stage multi-step real-time tracking and detection algorithms are supported via the ability to deploy custom states, relevant state transitions, and associated monitoring actions and triggering conditions. Such a separation entails platform-independent, portable, online traffic analysis tasks written in a high level language, without requiring developers to access the monitoring device internals and program their custom monitoring logic via low level compiled languages (e.g., C, assembly, VHDL). We validate our design by developing a prototype and a set of simple (but functionally demanding) use-case applications and by testing them over real traffic traces.

This work is motivated by a general question: can micro-scale energy-harvesting techniques be exploited to support low-cost standard security solutions on resource-constrained devices? We focus on guaranteeing integrity and authentication in Internet of Things (IoT) and Wireless Sensor Network (WSN) applications. In this article, we propose techniques to make ECDSA signatures low cost and implementable on resource-constrained devices. By combining precomputation techniques and energy-harvesting capabilities of modern sensor nodes, we achieve significant improvement over prior works. In addition, we show that the cost of ECDSA signatures can be reduced by up to a factor 10 by using harvesting-aware optimizations.

We propose a privacy-enhanced matrix factorization recommender that exploits the fact that users can often be grouped together by interest. This allows a form of “hiding in the crowd” privacy. We introduce a novel matrix factorization approach suited to making recommendations in a shared group (or “nym”) setting and the BLC algorithm for carrying out this matrix factorization in a privacy-enhanced manner. We demonstrate that the increased privacy does not come at the cost of reduced recommendation accuracy.

While the usage of behavioural features for authentication purposes is gaining more and more consensus in the community, there is less consensus on which specific behavioural traits may be useful in eventually different settings. This calls for flexible tools which the application developer can leverage to automate the extraction and management of behavioural features for identification and authentication. This paper specifically describes a framework called FEBA (Feature Extraction Based on Action), which to the best of our knowledge is the first open-source framework that provides the developer with simple and flexible means to: i) define application-specific actions, ii) recognize actions based on the received raw data, and iii) finally extract the action-specific features. We have built a complete implementation of FEBA, and made it available online to facilitate future research in such context. To prove the performance of FEBA, we provide an experimental evaluation of a use case scenario, i.e., mouse movements feature extraction and pattern recognition. We believe that FEBA will help researchers and developers to design and implement novel behavioural authentication mechanisms.

In this paper we describe how a novel backoff mechanism called Moderated Backoff (MB), recently proposed as a standard extension for 802.11 networks, has been prototyped and experimentally validated on a commercial 802.11 card before being ratified. Indeed, for performance reasons, the time critical operations of MAC protocols, such as the backoff mechanism, are implemented into the card hardware/firmware and cannot be arbitrarily changed by third parties or by manufacturers only for experimental reasons. Our validation has been possible thanks to the availability of the so called Wireless MAC Processor (WMP), a prototype of a novel wireless card architecture in which MAC protocols can be programmed by using proper abstractions and a state-machine formal language, which enable easy modifications of legacy operations. Experimental results are in agreement with simulations and prove the effectiveness of Moderated Backoff, as well as the potentialities of the WMP platform.

Neighbor discovery is a primary enabling ability for many emerging mobile applications. Due to its significant impact on the energy budget of battery equipped devices, energy preserving solutions have been investigated for a longtime, often introducing duty cycling. Ultimately, these solutions settle for trade-offs between energy and performance, leaving the final decision on how much energy to allocate to neighbor discovery in the hands of application developers or system engineers. In other words, someone must decide if an improvement in the quality of the discovery (e.g. better discovery latency) is worth an increase in energy consumption. In this paper, we devise a different approach in order to answer the following basic question: how many contacts can a smartphone discover using its battery energy budget? The answer clearly depends on the adopted discovery algorithm, on the mobility conditions, and on the stochastic characteristics of the encounters. However, we demonstrate that there is a natural optimum duty cycle that maximizes the number of discovered contacts in almost every real application scenario. This optimum is natural in the sense that it does not depend on any system level parameter or performance requirements. It depends uniquely on the stochastic characteristics of the meeting process between the nodes. We present an analytic analysis and devise a practical algorithm that dynamically adapts the duty cycle length to the time-varying context, without the need to make assumptions on (or predict) the distribution of the contact duration. The findings presented in the paper are validated against data coming from real human mobility traces and implemented on a mobile application.

This paper presents a hardware implementation of Openstate, an extension of OpenFlow that allows performing stateful control functionalities directly inside the switch, without requiring the intervention of an external controller. The paper shows how, with a minimal reworking of the OpenFlow's basic architecture, and reusing the same building blocks, it is possible to greatly extend the intelligence of an OpenFlow switch allowing the offload of many control task directly in the switch. An FPGA based implementation of an Openstate prototype is here presented, the different architectural design choices are discussed, and the performance and limitations of the developed prototype are examinated. Finally, the paper proposes a discussion on the performance achievable by using an ASIC implementation of the OpenState switch1.

This paper provides an in-depth understanding of the per-frame energy consumption behavior in 802.11 wireless LAN devices. Extensive measurements are performed for seven devices of different types (wireless routers, smartphones, tablets, and embedded devices) and for both UDP and TCP traffic. Experimental results unveil that a substantial fraction of energy consumption, hereafter descriptively named cross-factor, may be ascribed to each individual frame while it crosses the protocol stack (OS, driver, NIC) and is independent of the frame size. Our findings, summarized in a convenient energy consumption model, contrast traditional models that (implicitly) amortize such energy cost component in a fixed baseline cost or in a toll proportional to the frame size and raise the alert that, in some cases, conclusions drawn using traditional energy models may be fallacious.

Random access channels (RACHs) in cellular networks are normally designed for Poisson-distributed arrivals with a constant rate. Unexpected bursty arrivals may result in severe collisions in RACHs and thus degrade users' service qualities. This paper presents an analytical model for investigating the transient behavior of the RACHs with bursty arrivals generated in a specific time interval for orthogonal frequency-division multiple access (OFDMA) wireless networks. The proposed model has considered the implementation details of the OFDMA random access procedure (such as periodic access characteristic, uniform random backoff policy, and power-ramping effect) and the effect of new arrivals. The performance metrics of collision probability, success probability, and average access delay and the cumulative distribution function of the number of preamble transmissions and access delay for the successfully accessed mobile station are then derived based on the analytical model. The accuracy of the proposed analytical model was verified through computer simulations, and the results show the effectiveness of the proposed model.

Our scientific community faces a sort of paradox. A large bulk of work has been done on data-oriented techniques devised to improve peer reputation and knowledge extraction from data, so as to improve trustworthiness of digital services involving coordination and cooperation among heterogeneous peers. But, perhaps surprisingly, to the best of our knowledge, such techniques have rarely been applied to the (for our own community, crucial) process of reducing noise in the process of peer reviewing our own papers. Goal of this work is to provide initial insights on the applicability of methodologies and tools from inferential statistical to the field of peer review quality control. Our contribution is threefold. First, we propose a statistical model where each technical program committee member (reviewer) is characterized as random noise added to the “actual” value of the paper. Second, we provide an iterative data-oriented approach based on Expectation-Maximization devised to estimate mean value and variance of the noise added by each reviewer; our approach uses only the ratings provided by the reviewers themselves and does not rely on any additional source of a-priori knowledge. Third, we make use of the estimated mean values and variances to improve the accuracy of paper's evaluation and ranking.

Algorithms and protocols for opportunistic, delay tolerant and wireless ad-hoc networks are designed and validated by simulating the people interactions induced by the nodes mobility. There are cases in which we are interested in simulating just the first interaction between a pair of nodes, for instance to assess the performance of a discovery or epidemic routing protocol. In this cases nodes rapidly extinguish their utility hence it is not convenient to simulate these scenarios using a fixed amount of nodes. Thus we present a novel simulation methodology that introduces the "open environment" where nodes enter, can interact through meeting with other nodes and then exit, keeping the focus on the environment rather than on what happen before and after the nodes stay in the interesting area. The proposed approach uses the statistical distribution extracted from the real traces to reproduce directly the human interaction pattern without going through the traditional random way point approach. Meetings are simulated by a time-varying graph that holds the state of the interactions in the environment, while adapting to the statistics of single node to its history. We show that even in a simple scenario, the epidemic infection, Markov memory-less models have been fairly far from the interaction scenarios that the method reproduces.

Information Centric Networking (ICN) is paradigm in which the network layer provides users with content addressed “by name”. In-network caching is one of the key functionality to be provided by ICN nodes. To avoid network nodes caching fake contents, it is necessary to verify the validity of data items. A content is deemed to be valid if it verifies three properties: i) integrity: it has not be modified; ii) provenance: it comes from the intended source; iii) relevance: it is indeed the content requested from the user (by using the name of that content). In this paper, we discuss the interplay among three pivotal ICN aspects: caching, validity and naming. Specifically, we will investigate different naming and digital signature schemes, evaluating their speed, overhead and their impact on caching performance. Perhaps counter-intuitively, we find that the relatively slow verification time of today's signatures, which bottlenecks the rate of storing new data items in the network caches, does not come as a critical shortcoming, but may actually even improve the cache hit probability when the LRU caching policy is employed.

Security of today's networks heavily rely on network intrusion detection systems (NIDSs). The ability to promptly update the supported rule sets and detect new emerging attacks makes field-programmable gate arrays (FPGAs) a very appealing technology. An important issue is how to scale FPGA-based NIDS implementations to ever faster network links. Whereas a trivial approach is to balance traffic over multiple, but functionally equivalent, hardware blocks, each implementing the whole rule set (several thousands rules), the obvious cons is the linear increase in the resource occupation. In this work, we promote a different, traffic-aware, modular approach in the design of FPGA-based NIDS. Instead of purely splitting traffic across equivalent modules, we classify and group homogeneous traffic, and dispatch it to differently capable hardware blocks, each supporting a (smaller) rule set tailored to the specific traffic category. We implement and validate our approach using the rule set of the well-known Snort NIDS, and we experimentally investigate the emerging trade-offs and advantages, showing resource savings up to 80 percent based on real-world traffic statistics gathered from an operator's backbone.

We introduce MAClets, software programs uploaded and executed on-demand over wireless cards, and devised to change the card's real-time medium access control operation. MAClets permit seamless reconfiguration of the MAC stack, so as to adapt it to mutated context and spectrum conditions and perform tailored performance optimizations hardly accountable by an once-for-all protocol stack design. Following traditional active networking principles, MAClets can be directly conveyed within data packets and executed on hard-coded devices acting as virtual MAC machines. Indeed, rather than executing a pre-defined protocol, we envision a new architecture for wireless cards based on a protocol interpreter (enabling code portability) and a powerful API. Experiments involving the distribution of MAClets within data packets, and their execution over commodity WLAN cards, show the flexibility and viability of the proposed concept.

A thorough understanding of the power consumption behavior of real world wireless devices is of paramount importance to ground energy-efficient protocols and optimizations on realistic and accurate energy models. This paper provides an in-depth experimental investigation of the per-frame energy consumption components in 802.11 Wireless LAN devices. To the best of our knowledge, our measurements are the first to unveil that a substantial fraction of energy consumption, hereafter descriptively named cross-factor, may be ascribed to each individual frame while it crosses the protocol/implementation stack (OS, driver, NIC). Our findings, summarized in a convenient new energy consumption model, contrast traditional models which either neglect or amortize such energy cost component in a fixed baseline cost, and raise the alert that, in some cases, conclusions drawn using traditional energy models may be fallacious.

With the rate of mobile traffic growth eventually outpacing 4G technology upgrades, it appears crucial to explore new means to offload cellular networks. Exploitation of device-to-device opportunistic short range connectivity for offloading purposes is an intriguing and widely investigated direction, but might ultimately play a negligible practical role: in front of the huge overall content universe a user may select to access, it is indeed unlikely that a specific user request is found in a possibly small number of neighboring mobile devices. Focusing on a concrete use-case scenario, namely Apps download from Google's Android market, we discuss a preliminary design and implementation of CarpeDroid, a local coordination approach devised to proactively augment the network response to a user lookup (in our use-case, coming from the App Market server) with download opportunities for content locally stored in neighboring devices and likely to fall within the users' interest. Our approach aims at acting as a simple recommending system, locally operated on the end user device, and not requiring any interaction with centralized servers. Efficiency and “better than nothing” privacy protection is achieved through the exchange of Bloom filters devised to summarize content opportunistically available in neighboring devices.

Programmable wireless platforms aim at responding to the quest for wireless access flexibility and adaptability. This paper introduces the notion of wireless MAC processors. Instead of implementing a specific MAC protocol stack, Wireless MAC processors do support a set of Medium Access Control “commands” which can be run-time composed (programmed) through software-defined state machines, thus providing the desired MAC protocol operation. We clearly distinguish from related work in this area as, unlike other works which rely on dedicated DSPs or programmable hardware platforms, we experimentally prove the feasibility of the wireless MAC processor concept over ultra-cheap commodity WLAN hardware cards. Specifically, we reflash the firmware of the commercial Broadcom AirForce54G off-the-shelf chipset, replacing its 802.11 WLAN MAC protocol implementation with our proposed extended state machine execution engine. We prove the flexibility of the proposed approach through three use-case implementation examples.

Wireless community networks are mesh networks built by volunteers which own, configure, and manage their wireless node. Such networks are prone to either unintentional (e.g. misconfiguration) or intentional node misbehavior. This paper proposes a fully distributed trust-based routing framework, tightly integrated with OLSR, which is the most exploited routing protocol in real world wireless community networks. The framework, designed to be modular for easy upgrade, relies on active probes, hidden in the normal data traffic through adaptation of steganography techniques. The combination of path-wide measurements into a distributed trust-framework, preliminary based upon the well known EigenTrust mechanism, permit to infer whether, and which, packet-droppers (i.e. nodes misbehaving at the data plane) affect the network forwarding operation. The resulting per-node trust values are then transformed into suitable "weights" provides as input to the OLSR protocol for mitigation through re-routing. A simulation-based performance evaluation shows that the proposed framework appears already effective in detecting and circumventing packet-droppers, despite the relative simplicity of the preliminarily considered algorithms.

A Network Intrusion Detection System (NIDS) inspects the traffic flowing in a network to detect malicious content such as spam, viruses, and so on. Hardware based solutions appear necessary to face the performance requirements emerging when the goal is to deploy such systems in high speed network scenarios. However, the appropriate choice of the hardware platform is believed to be subject to at least two requirements, usually considered independent each other: i) it needs to be reprogrammable, in order to update the intrusion detection rules each time a new threat arises, and ii) it must be capable of containing the typically very large set of rules of existing NIDSs. The goal of this paper is to show that reprogrammability can be further exploited to reduce the resource requirements for the chosen platform. Specifically, we propose an FPGA-based solution that classifies and dispatches traffic to elastic buffers, connecting one buffer at a time to a dynamically reconfigurable rule matching core. This core supports only the appropriate subset of detection rules. A worst-case analysis shows that the saving in hardware resources is achieved with a relatively small buffer space, currently available in cheap, low end, FPGA boards, with no impairment on the resulting throughput.

We present an efficient network measurement primitive that measures the rate of variations, or unique values for a given characteristic of a traffic flow. The primitive is widely applicable to a variety of data reduction and pre-analysis tasks at the measurement interface, and we show it to be particularly useful for building data-reducing preanalysis stages for scan detection within a multistage network analysis architecture. The presented approach is based upon data structures derived from Bloom filters, and as such yields high performance with probabilistic accuracy and controllable worst-case time and memory complexity. This predictability makes it suitable for hardware implementation in dedicated network measurement devices. One key innovation of the present work is that it is self-tuning, adapting to the characteristics of the measured traffic.

Thanks to its in-network drop-based adaptation capabilities, H.264 Scalable Video Coding is perceived as an effective approach for delivering video over networks characterized by sudden large bandwidth fluctuations, such as Wireless LANs. Performance may be boosted by the adoption of application-aware/cross-layer schedulers devised to intelligently drop video data units (NALUs), so that i) decoding dependencies are preserved, and ii) the quality perceived by the end users is maximized. In this paper, we provide a theoretical formulation of a QoE utility-optimal cross-layer scheduling problem for H.264 SVC downlink delivery over WLANs. We show that, because of the unique characteristics of the WLAN MAC operation, this problem significantly differs from related approaches proposed for scheduled wireless technologies, especially when the WLAN carries background traffic in the uplink direction. From these theoretical insights, we derive, design, implement and experimentally assess a simple practical scheduling algorithm, whose performance is very close to the optimal solution.

In this paper, we propose and evaluate an overlay distribution algorithm for P2P, chunk-based, streaming systems over forest-based topologies. In such systems, the stream is divided in chunks; chunks are delivered by each node in a store-and-forward way. A relaying node starts distributing a chunk only when it has completed its reception from another node. Peers are logically organized in a forest of trees, where each tree includes all peers. The source periodically distributes different chunks to each tree for their delivery. Our key idea consists in employing serial transmission: for each tree, and thus, for each chunk, the source node sends the chunk to its children in series; the same holds for each peer node of the tree, excluding the leaves. Besides this basic idea, the contributions of this paper are: 1) we demonstrate the feasibility of serial transmission over a forest of trees, which is not a trivial problem, unlike the case of parallel transmission; 2) we derive an analytical model to evaluate the system performance; 3) we derive a theoretical bound for the number of nodes reachable in a given time interval or equivalently for the time required to reach a given number of nodes; 4) we prove the optimality of our approach in terms of its capability to reach such bound; and 5) we develop a general simulation package for P2P streaming systems and use it to compare our solution to literature results. Finally, we stress that this paper is focused on the theoretical properties and performance understanding of the proposed distribution algorithm, rather than on its practical implementation in a real system. However, we also briefly describe a practical workable implementation of our algorithm.

This paper describes the H.264 scalable video coding streaming evaluation framework (SVEF). This is the first open-source framework for experimental assessment of H.264 scalable video coding (SVC) delivery over real networks. Effectively adapting of the transport of an H.264 SVC stream to time-varying, bandwidth constrained, and loss prone networks is an important research area. However, very little experimental work has been performed due to the unavailability of real-time H.264 SVC players, the limitations of existing decoding software libraries when challenged with network-imparied received SVC streams (e.g., affected by random loss of Network Abstraction Layer Units - NALUs), and the lack of solutions for SVC streaming support. SVEF overcomes these issues by developing missing components and by integrating them in a hybrid online/offline experimental framework. We believe SVEF will be of significant help to the research community interested in experimentally benchmarking their own proposed SVC adaptation approaches and delivery mechanisms. As a proof-of-concept of SVEF, we provide the experimental performance evaluation of an SVC cross-layer in-network scheduler in a wireless LAN hot spot scenario.

Many distribution algorithms have been proposed up to now for P2P real time streaming. However, due to the lack of basic theoretical results and bounds, common sense and intuitions and heuristics have driven their design so far. The consequence is that we can find in the literature a large variety of different choices about the main aspects of a P2P system, such as overlay topology, scheduling process and upload strategy. In this situation, it is difficult to establish unambiguously the absolute goodness of a particular algorithm or even the rationale behind a particular choice or solution. In this paper we propose and evaluate a theory-driven distribution algorithm for P2P real time streaming. We take advantage from a previous theoretical study, where: i) we derived a theoretical performance bound for forest-based overlay topologies regarding the number of nodes reachable in a given time interval or equivalently the time required to reach a given number of nodes; ii) we proved the optimality of streamline, a distribution algorithm based on the serial transmission over forest-based topologies, in terms of its capability to reach such a bound. The streamline algorithm is based on some ideal assumptions that prevent its practical implementation. In this paper we remove these assumptions and present a practical and working algorithm, named operational streamline or simply O-Streamline. We also evaluate the performance of O-Streamline, comparing them with the optimal bounds of streamline.

This paper provides experimental evidence that "weird'/poor outdoor link-level performance measurements may be caused by driver/card-specific antenna diversity algorithms unexpectedly supported/activated at the WLAN transmitter side. We focus our analysis on the Atheros/MADWiFi card/driver case, and we observe that the transmit antenna diversity mechanisms remain by default enabled when the available antennas are not homogeneous in terms of gain or, even worse, when only a single antenna is connected. This may cause considerable performance impairments (large frame loss ratio), in conditions frequently encountered in outdoor link deployments. The negative impact of transmit antenna diversity is not limited to the transmission of broadcast frames (where a cyclic shift between the "two" assumed antennas is performed), but under certain circumstances it can severely affect the delivery of unicast frames as well, and despite the fact that in this case the ACK receptions may provide a feedback about the best receiving antenna. While, as obvious, driver developers are expectedly fully aware of the existence of such mechanisms, we believe that the scientific research community has very limited awareness of the implications these mechanisms have on the measured link-level performance. Indeed, to the best of our knowledge, ours is the first research paper which explicitly raises this issue.

Abstract The 3GPP architecture includes the Multimedia Broadcast Multicast Service (MBMS) to provide efficient broadcast and multicast services. In the 3GPP long‐term evolution, the evolved MBMS (e‐MBMS) architecture is currently being standardized. Unlike MBMS, the new e‐MBMS architecture explicitly raises, as additional security requirement, the protection of the IP multicast user plane. Currently proposed e‐MBMS security architectures “limit” themselves to suggest the deployment of Group Security Associations (GSA). In this paper, we start by discussing that, on one side, GSA might not be a sufficiently secure solution in the long run, and on the other side GSA integration within the e‐MBMS architecture might not be as straightforward as it might appear. The point made in this paper is that there are sound alternatives to GSA if the goal is to deploy a short‐term solution with basically no impact on the current e‐MBMS architecture. In particular, we propose to adopt a Secure Multicast Overlay (SMO) approach. To prove the straightforward implementation of SMO we describe how a proof‐of‐concept test‐bed over public domain linux routers. Moreover, a functional comparison between GSA and SMO leads us to the following conclusions: (i) not only SMO provides the same level of security of GSA, but also it achieves a reduced risk of denial of service attacks; (ii) SMO has significant advantages over GSA in terms of impact on the architecture and on device requirements; (iii) security association management and key management in GSA has a greater impact on the performance achievable than in the case of SMO. We believe that these advantages outweigh the performance penalties due to overlay networking overhead. Copyright © 2008 John Wiley & Sons, Ltd.

It has been observed that different IEEE 802.11 commercial cards produced by different vendors experience different performance, either when accessing alone the channel, as well as when competing against each other. These differences persist also when thorough measurement methodologies (such as RF shielding, laptop rotation, etc) are applied, and alignment of the environmental factors (same laptop models, traffic generators, etc) is carried out. This paper provides an extensive experimental characterization of the backoff operation of six commercial NIC cards. It suggests a relevant methodological approach, namely a repeatable, well defined, set of experiments, for such a characterization. Low level backoff distribution measurements are taken through a custom equipment developed in our laboratory. Our work allows to detect both a non-standard backoff behavior of some commercial cards (in terms of minimum contention window size and neglection of EIFS times), as well as potential implementation limits (in either the card hardware/firmware and/or the software driver) which appear to severely alter the card performance in challenging conditions.

The paper focus is on the minimum mean square error (MSE) estimation methods in RSS-based localization techniques. We in particular discuss three different error criteria: i) minimizing the mean square distance error (distance-based MSE), ii) minimizing the mean square power error (power-based MSE), iii) minimizing the mean square relative distance error (relative distance-based MSE). The goal is to assess the impact of the chosen error criterion on the estimate accuracy. Simulation results show that i) flip ambiguities in the position estimate may occur when the node to be positioned is very close to the signal source, ii) in presence of flip ambiguities, provided that RSS measurements are combined with information about the signal arrival direction, relative distance-based MSE minimization offers better accuracy in a bi-dimensional localization scenario1.

Passive network monitoring is required for the operation and maintenance of communication networks as well as to detect frauds and attacks. Typically, raw packet-level traffic traces are collected using suitable traffic probe devices and fed to monitoring applications (IDSs, antivirus, etc.) for analysis, with potential risks for the legitimate privacy rights of the customers. This paper aims to discuss the technical feasibility and the underlying research challenges of a two-tiered privacy-preserving network monitoring system, where carefully designed data protection mechanisms can coexist with suitably adapted monitoring applications.

Broadcast probes are typically used in Wireless LAN networks to assess the quality of the radio link and/or to runtime derive metrics to be used by higher layer protocols (e.g., routing in WLAN-based ad hoc or mesh networks). This work raises the concern that proprietary vendor operation may severely affect broadcast-based measurements. More precisely, we present and analyze experimental outdoor link quality measurement results obtained with a device/driver pair (Atheros card + MADWiFi driver) widely exploited in the research community. We show that an unexpected periodic transmission power reduction mechanism at the NIC level, undocumented by the device vendor and apparently hard to be disabled, may dramatically impair the measured link quality performance. Our experimental evidence shows that links which would otherwise experience good quality are subject to a significant frame loss ratio, when tested through a broadcast frame transmission methodology. This frame loss ratio is artificially induced by the NIC card operation on broadcast frames: unicast frames are in fact shown to be exempt from such a problem.

In recent years, the physical layer data rate provided by 802.11 Wireless LANs has dramatically increased thanks to significant advances in the modulation and coding techniques employed. However, previous studies show that the 802.11 MAC operation, namely the distributed coordination function (DCF), represents a limiting factor: the throughput efficiency drops as the channel bit rate increases, and a throughput upper limit does indeed exist when the channel bit rate goes to infinite high. These findings indicate that the performance of the DCF protocol will not be efficiently improved by merely increasing the channel bit rate. This paper shows that the DCF performance may significantly benefit from the adoption of two separate physical carriers: one devised to manage the channel access contention, and another devised to deliver information data. We propose a scheme, referred to as out-of-band signaling (OBS), designed to reuse (and remain backward compatible with) the existing 802.11 medium access control (MAC) specification. Performance evaluation of OBS is carried out through analytical techniques validated via extensive simulation, for both saturation and statistical traffic conditions. Numerical results show that OBS improves the throughput/delay performance, and provides better bandwidth usage compared with the in-band signaling technique employed by DCF.

This paper describes an unexpected finding concerning link quality measurements carried out through broadcast frames. We found out that, with experimental equipments/drivers widely used by the scientific community (Atheros WLAN cards with MADWiFi driver), broadcast-based link quality measurements seem to be affected by a NIC-proprietary power saving mode. The striking conclusion is that some packet losses, typically attributed to bad channel characteristics, rather may depend on the broadcast measurement methodology. Unicast measurements are shown to be exempt from such a problem. A very simple test is furthermore proposed to verify whether measurement results are affected by the described phenomenon.

This work presents a general layer-2 approach for routing and load balancing in Wireless Infrastructure Mesh Network The key idea is dynamic select routes among a set of slowly changing alternative network paths. Our approach decouples the routing and load balancing problem into two distinct sub-problems: path creation and path selection. Paths are created through the reuse of classical 802.1Q multiple spanning tree mechanisms. This guarantees that, for each formed tree, a path is deployed from each mesh node to the Mesh Gateway. Moreover, each tree (path) is assigned a Virtual LAN identifier. Path selection is driven by a local algorithm running at each mesh node, fed by measurements (taken along each path connecting the mesh node to the gateway) which allow to dynamically determine which are the best paths. In order to route a packet it is sufficient to mark the packet with the VLAN tag corresponding to the chosen path. The described approach provides a very general and flexible framework: performance/stability trade-offs can be tuned through the choice of i) the mechanism used to measure the path quality; ii) the algorithm employed to select the path, and iii) the system parameter used (link costs and link weights) for the multiple spanning tree formation.

Fluid-flow simulation models of peer-to-peer (P2P) networks are an effective way to properly account for low-level network bottleneck details, meanwhile circumventing the scalability limits imposed by packet-based simulators. A fundamental component in a fluid-flow simulator is the algorithm for the computation of the achievable per-flow rate for several competing flows offered to a given network topology. This paper presents a novel efficient approach to compute, in an exact manner (i.e. with no approximations), the max-min fair rate allocation. Numerical results demonstrate that our proposed algorithm outperforms traditional max-min computation approaches by as much as a factor 100 for a million nodes network.

Many models have been proposed to analyze the performance of the IEEE 802.11 distributed coordination function (DCF) and the IEEE 802.11e enhanced distributed coordination function (EDCA) under saturation condition. To analyze DCF under statistical traffic, Foh and Zukerman introduce a model that uses Markovian Framework to compute the throughput and delay performance. In this paper, we analyze the protocol service time of EDCA mechanism and introduce a model to analyze EDCA under statistical traffic using Markovian Framework. Using this model, we analyze the throughput and delay performance of EDCA mechanism under statistical traffic.

Outdoor WLAN communication is envisioning an increasing interest, due to the massive emergence and deployment of outdoor wireless mesh networks. This paper provides a report on an extensive measurement campaign carried out in an outdoor wireless LAN campus scenario. A public domain driver, namely MADWiFi, has been modified in order to achieve a high (per-node and per-frame) measurement granularity, and in order to distinguish the different causes that contribute to link-layer errors. The main result of our experimental investigation is that, unlike 802.11b, which appears a robust technology in most of the operational conditions, 802.11g may lead to severe inefficiencies when employed in an outdoor scenario

Despite its recent release, the mobile agent JADE platform is attracting the scientific community attention for its effective and seamless portability. Unlike most of the JADE research efforts, which have so far focused mainly on the agent framework architecture and on the technical design issues, this paper aims at showing JADE performance measurements. First, we assess the effect of two different factors, the operating system and the execution environment, on the container start up operations. A statistical approach based on the ANOVA analysis has been followed. Second, we investigate JADE scalability with specific reference to the agent migration and the interaction with FIPA agents

It has been observed that IEEE 802.11 commercial cards produced by different vendors show a different behavior in terms of perceived throughput or access delay. Performance differences are evident both when the cards contend alone to the channel, and when heterogeneous cards contend together. Since the performance misalignment does not disappear by averaging the environmental factors (such as propagation conditions, laptop models, traffic generators, etc), it is evident that the well known throughput-fairness property of the DCF protocol is not guaranteed in actual networks. In this paper we propose a methodological approach devised to experimentally characterize the IEEE 802.11 commercial cards thus understanding and predicting their performances in different network scenarios. We set up some specific experiments using a custom test equipment, able to classify the card behavior not only in terms of figures which are evident to the user perspective (such as the throughput), but also in terms of low-level channel access operations and delays. Our approach is able to detect potential hardware limits or not-standard MAC implementations, which severely affect the contending card performance.

Directional antennas may dramatically increase the capacity of a wireless LAN by allowing several stations to simultaneously communicate. Since deployment of directive/smart antennas on the customer's terminals is awkward (for technological, cost, robustness, and convenience reasons) it is of interest to deploy advanced antenna solutions only at the access point. When omnidirectional transmissions are used at the mobile stations, the asynchronous nature of the 802.11 MAC handshake structurally limits the possibility to exploit spatial reuse. Significant throughput enhancements can be achieved only at the expense of redesigning (part of) the 802.11 MAC protocol: mainly a form of synchronization is required. This paper addresses this problem and proposes a novel solution, devised to operate in the above scenario. The system operation is based on the joint usage of space division and time division multiple access techniques. A synchronous time-division structure avoids unwanted interference among different antenna coverage regions. Backward compatibility with legacy IEEE 802.11 terminals is also accounted for.

In this paper, we study the performance of our earlier proposed out-of-band signaling (OBS) scheme for high speed wireless local area networks (WLANs). We employ the system approximation technique for modeling of the OBS scheme. An equivalent state dependent single server queue, that describes the OBS scheme, is constructed for the analysis of the throughput and delay performances. Moreover, we study the throughput optimization of the OBS scheme, which provides a means for optimizing the performance of the OBS scheme, given a particular network environment. Finally, we conduct several simulation experiments to validate our analytical results.

The IEEE 802.11e draft specification aims to extend the original 802.11 MAC protocol by introducing priority mechanisms able to manage bandwidth and resource allocation according to the QoS needs of real-time applications. Different strategies based on MAC parameter diversifications, such as contention window limits, contention window updating factor and silence monitoring time, can be pursued in order to provide service differentiation, also in the case of distributed access. In this paper, we investigate on the behaviour of each differentiation possibility under different load conditions and traffic requirements. Our results show that the most powerful mechanisms which provide service differentiation are based on inter frame space (IFS) and minimum contention window (CW/sub min/) diversification. We conclude that the best differentiation policy should be based on a joined use of IFS and CW/sub min/ differentiation, using the first parameter to adjust access probabilities, and the second parameter to optimize the resource utilization in the network.

This paper presents a resource management mechanism aimed at improving the effectiveness of streaming services in vehicular networks. The scenario considered in this paper is that of a group of customers located into a same public vehicle, e.g. a moving train connected to the network via a satellite link, and requesting either video-on-demand-like services, as well as real-time diffusive (broadcast) streaming services. We show that a proxy server, devised to introduce an elastic buffer aimed at decoupling the information retrieval download speed on the outer network from the natural play-out speed used in the vehicular network, results to be an extremely effective approach in reducing the outage probability given by link failure in the outer network (e.g. tunnel crossing). A resource management mechanism, called A2M, is applied to both video-on-demand and diffusive services, and its performance effectiveness is evaluated through simulation.

Abstract This paper refers to a wireless cellular packet network scenario where fast retransmission of corrupted packets is used to improve the packet error ratio. Since the ‘gross’ packet transmission rate (including retransmission) depends on the channel quality perceived, admitted calls weight unevenly in terms of effective resource consumption. In this paper, we suggest using channel quality information to drive load balancing mechanisms. We propose two novel metrics to determine the best cell to attach to, during handover or new call origination. Extensive simulation results prove the superiority of our proposed schemes with respect to traditional load balancing, which base their operation on the number of admitted calls per cell. Copyright © 2004 John Wiley & Sons, Ltd.

In differentiated services (DiffServ) networks, packets may receive a different treatment according to their differentiated services code point (DSCP) label. As a consequence, packet marking schemes can be devised to differentiate packets belonging to the same TCP flow, with the goal of improving the experienced performance. The paper presents an extensive performance evaluation of a new adaptive packet marking scheme, applied to a traffic scenario composed of TCP flows with different lengths. The proposed marking scheme is most efficient when applied to a scenario composed of all long-lived flows. In a realistic mixed traffic scenario, composed of both long-lived and short-lived TCP flows, our marking scheme provides excellent performance in high utilization conditions, and still provides improved performance in medium utilization conditions, comparable with that achieved by a recently proposed marking algorithm specifically devised for short-lived flows. We also propose a "three colors" marking scheme, which merges this approach with ours to achieve improved performance in all utilization conditions.

Throughput performance of the IEEE 802.11 distributed coordination function (DCF) is very sensitive to the number n of competing stations. The contribute of this paper is threefold. First, we show that n can be expressed as function of the collision probability encountered on the channel; hence, it can be estimated based on run-time measurements. Second, we show that the estimation of n, based on exponential smoothing of the measured collision probability (specifically, an ARMA filter), results to be a biased estimation, with poor performance in terms of accuracy/tracking trade-offs. Third, we propose a methodology to estimate n, based on an extended Kalman filter coupled with a change detection mechanism. This approach shows both high accuracy as well as prompt reactivity to changes in the network occupancy status. Numerical results show that, although devised in the assumption of saturated terminals, our proposed approach results effective also in non-saturated conditions, and specifically in tracking the average number of competing terminals.

We focus on an admission controlled traffic scenario. Flows, characterized by heavy-tailed on/off periods, are admitted to a network link according to a measurement based admission control algorithm. Our simulation results show that the long range dependence of the accepted traffic aggregate is marginal, particularly when compared with that resulting from a traffic aggregate accepted by a parameter-based admission control scheme. Our results appear to suggest that measurement based admission control is a value added tool to dramatically improve performance in the presence of self-similar traffic, rather than being a mere approximation for traditional (parameter-based) admission control schemes.

This paper provides a comparative performance evaluation of various load balancing schemes in cellular packet networks. With respect to circuit switched networks, wireless packet technology adds the further issue of quality of service of accepted connections. In fact, with packet technology, transmission error performance does not uniquely depend on the perceived channel quality, but it can be improved by adopting a scheduling mechanism enforcing fast retransmission of corrupted packets. The result is that throughput can be traded off with QoS experienced by an admitted flow. This paper proposes new packet-level load balancing mechanisms. In addition to the number of calls admitted in a cell, our schemes use supplementary packet level information, expressed in terms of effective resource consumption of each individual call when retransmission mechanisms are employed. Simulation results prove the superiority of our proposed schemes with respect to traditional load balancing schemes.

The assured forwarding per hop behavior (AF PHB) has been devised by the IETF differentiated services (DiffServ) working group to provide drop level differentiation. This paper shows, quite surprisingly, that a standard AF PHB class is semantically capable of supporting per flow admission control. This is obtained by adopting the AF PHB as the core router forwarding mechanism in conjunction with an end point admission control mechanism running at the network edges. Our work appears to prove that the extent of the AF PHB can be larger than was originally expected, since it can support an admission control mechanism, which is deemed necessary in recent RFCs to offer QoS aware services. An interesting related issue is whether the expedited forwarding PHB, devised to support flows with strict delay requirements, and based on a single DSCP tag, should be redesigned as a PHB class to comply with end point admission control. Preliminary performance results show that, under suitable assumptions, our scheme can provide as much as hard QOS guarantees (see Bianchi, G. et al., IEEE Globecom, 2001; http://drake.diei.unipg.it/netweb/GRIP/sub -/tech/sub -/rep.pdf).

Distributed admission control solutions share the idea that no coordination among network routers (ie, explicit signaling) is necessary, when the decision whether to admit or reject a new offered flow is pushed to the edge of the IP network. Proposed solutions differ in the degree of complexity required in internal network routers, and result in a different robustness and effectiveness in controlling the accepted traffic. This paper builds on a recently proposed distributed admission control solution, called GRIP (Gauge and Gate Reservation with Independent Probing), designed to integrate the flexibility and scalability advantages of a fully distributed operation with the performance effectiveness of admission control mechanisms based on traffic measurements. We show that, in the assumption that traffic sources are dual-leaky-bucket shaped, GRIP allows providing deterministic performance guarantees. Tight QoS performances are made possible even in impulsive load conditions (i.e., sudden activation of several flows), thanks to the introduction of a "stack" mechanism in each network node. A thorough performance evaluation of the conservative effects of the stack shows that the throughput reduction brought about by this mechanism is tolerable, and limited to about 15%.

This paper provides a comparative performance evaluation of various load balancing schemes in cellular packet networks. With respect to traditional schemes, that measure each cell load in terms of number of admitted calls, our schemes use supplementary packet level information, expressed in terms of effective resource consumption of each individual call when retransmission mechanisms are employed. The simulation model adopted is based on a toroidal cellular network topology, to avoid border effects affecting the numerical results.

This paper introduces approximate analytical models to evaluate the performance of end-to-end measurement based connection admission control (EMBAC) mechanisms, devised for the setup of real time flows over the Internet. These mechanisms rely on users probing the current congestion status of their required network path using a succession of probing packets. If the probing rate measured at the end receivers is greater than a certain threshold, users are allowed to switch to a phase of data exchange; otherwise they abort the call setup attempts. In conformance with the differentiated services framework, routers are oblivious to individual flows, and only need to give higher priority to data packets than to probing traffic. Despite the approximations introduced to make the analysis tractable, our model appears to be extremely accurate for a scenario of constant rate connections. Much less accurate, but useful as a possible starting point for future work, is the extension of the model to a scenario of variable rate connections. Simulation results are also presented in the paper to gain additional quantitative insights on the effectiveness of EMBAC to provide support for tight QoS requirements.

The algorithm which selects the best candidate base station to connect to is a key component in handover and admission control schemes for wireless cellular networks. This paper shows that, in wireless packet networks based on dynamic channel slot assignment, this algorithm can exploit additional packet-level information. The idea is that connections consume a different amount of resources even if they have the same nominal rate. In fact, corrupted packets can be retransmitted, and the retransmission overhead reflects the time varying channel quality perceived by each connection. We propose two novel load balancing metrics that effectively account for the uneven "weight" of each connection in terms of its up-to-date resource consumption. The performance of the proposed metrics are then evaluated for a particular (i.e. static) scenario. Although supplementary investigation is required in dynamic scenarios, our preliminary results provide new insights in the field of handover and admission control, and appear to open a new promising research area.

The IEEE has standardized the 802.11 protocol for wireless local area networks. The primary medium access control (MAC) technique of 802.11 is called the distributed coordination function (DCF). The DCF is a carrier sense multiple access with collision avoidance (CSMA/CA) scheme with binary slotted exponential backoff. This paper provides a simple, but nevertheless extremely accurate, analytical model to compute the 802.11 DCF throughput, in the assumption of finite number of terminals and ideal channel conditions. The proposed analysis applies to both the packet transmission schemes employed by DCF, namely, the basic access and the RTS/CTS access mechanisms. In addition, it also applies to a combination of the two schemes, in which packets longer than a given threshold are transmitted according to the RTS/CTS mechanism. By means of the proposed model, we provide an extensive throughput performance evaluation of both access mechanisms of the 802.11 protocol.

We describe the design and evaluation of a programmable medium access control framework which is based on a hybrid centralized/distributed data link controller. The programmable framework and its associated algorithms are capable of supporting adaptive real-time applications over time-varying and bandwidth limited networks (e.g., wireless networks) in a fair and efficient manner taking into account application-specific adaptation needs. The framework is flexible, extensible and supports the dynamic introduction of new adaptive services on-demand. As part of the service creation process, applications interact with a set of distributed adaptation handlers to program services without the need to upgrade the centralized adaptation controller. This approach is in contrast to existing techniques that offer a fixed set of "hard-wired" services at the data link from which applications select. We present a framework where a centralized adaptation controller responsible for the fair allocation of available bandwidth among adaptive applications is driven by application specific bandwidth utility curves. A set of distributed adaptation handlers execute at edge devices interacting with a central controller allowing applications to program their adaptation needs in terms of utility curves, adaptation time scales and adaptation policy. The central controller offers a set of simple meta-services called "profiles" that distributed handlers use to build sophisticated adaptive real-time services.

Several works have recently appeared in the literature on the design, performance and dimensioning of networks supporting video on demand and multimedia services. It has been shown that performance is strongly dependent on the model adopted to describe the user's behaviour in terms of requests for programs. In this paper we provide a detailed investigation of a non stationary model for the user's request distribution. Numerical results are provided for a network scenario proposed in the literature to investigate the error achieved when the non stationary distribution is approximated with a stationary exponential one.

This paper studies a reference network architecture for video information retrieval, based on hierarchical storage of the video segments and asynchronous transfer mode (ATM) transport capability on the long distance network. The storage associated to local switching nodes can be exploited in two complementary ways, either for caching the most requested video programs, and for decoupling the transmission speed on the long distance network from the natural playout speed of the video segments. We show that both approaches lead to a substantial increase of the load carried on the long distance network with a given service requirement. Moreover, we show that a greater efficiency is obtained when a suitable integration of the two approaches is considered.

The IEEE 802.11 protocol for wireless local area networks adopts a CSMA/CA protocol with exponential backoff as medium access control technique. As the throughput performance of such a scheme becomes critical when the number of mobile stations increases, in this paper we propose an adaptive contention window mechanism, which dynamically selects the optimal backoff window according to the estimate of the number of contending stations. We show that this technique leads to stable behavior, and it outperforms the standard protocol when the network load and the number of mobile stations are high. We also investigate the CSMA/CA with the optional RTS/CTS technique, and we show that our adaptive technique reaches better performance only when the packet size is short. Finally, the performance of a system environment with hidden terminals show that the RTS/CTS mechanism, which can also be used in conjunction with the adaptive contention window mechanism, provides significant improvements.

This paper presents a new architecture for the third-generation mobile systems, capture-division packetized access (CDPA), that overcomes most of the limitations of present cellular systems. It addresses the three main issues of radio access, namely the channel reuse, the multiple access, and the handover problems, in complete adherence to packet-switching principles. The CDPA channel reuse mechanism is a completely new alternative with respect to time-division, frequency-division, or code-division multiple-access (TDMA, FDMA, and CDMA, respectively), which achieve communication parallelism by subdividing the bandwidth a priori among cells. In CDPA, a single frequency channel is used and parallel transmissions are achieved through the "capture" capability of receivers. The hybrid reservation-polling multiple access mechanism used in CDPA is able to integrate any kind of traffic and guarantees almost immediate retransmission of packets that are not captured, thus assuring their correct reception. Finally, the packet-switching approach allows connectionless communications with any base station (BS), and eliminates the need for extra radio traffic in managing handovers. This turns out to be very effective in local area systems where the required high bandwidth is obtained by using a pico-cell structure. We present the CDPA architecture, discuss some implementation issues, and evaluate its performance under a variety of system parameters and operating conditions, using analytical and simulation methods.

There is a rapidly growing demand for low-cost packet data services in GSM networks. Therefore, the ETSI is considering the possible introduction of a general packet radio service (GPRS) in GSM. We propose an enhancement of a GPRS proposal which improves the utilization of the radio resource. In particular, we consider a random access technique, that is very close to the PRMA, and allows mobile stations to share all data traffic channels available in the cell. In this context, the performance of typical data applications, which require short messages, are evaluated by simulations. The results obtained confirm the validity of this proposal even if more accurate investigations are needed for its complete definition.

Several methods for analyzing the queuing behavior of switching networks with flow control and shared buffer switches are described. The methods are compared on the basis of accuracy and computation speed, with the performance metric of most concern being the maximum throughput. The best of the methods accurately predicts throughput for multistage networks constructed from large switches (>or=8 ports).>

The authors describe several methods for analyzing the queueing behavior of switching networks with flow control and shared buffer switches. They compare the various methods on the basis of accuracy and computation speed, where the performance metric of most concern is the maximum throughput. The best of the methods accurately predicts throughput for multistage networks constructed from large switches (>or=8 ports).>