State-of-the-art covert routing in heterogeneous networks (HetNets) focuses on balancing covertness and throughput, but often overlooks explicit energy optimization. While covert communication inherently limits transmit power, meeting throughput demands without coordinated design can still lead to high energy consumption. To this end, we propose DECOR, Decentralized Energy-efficient COvert Routing framework that jointly optimizes covertness, throughput, and energy efficiency. Unlike traditional methods that use a single wireless technology, DECOR leverages the diversity of available wireless communication technologies in HetNet to enable simultaneous multi-modal routing. The core idea behind DECOR is that optimal simultaneous utilization of multiple modalities improves throughput and overall energy efficiency. It minimizes the end-to-end energy consumption while satisfying stringent constraints on throughput and covertness through two core steps: (1)link-level optimizationusing sequential least squares programming (SLSQP), and (2)network-level optimizationthrough a custom cluster-based routing strategy. DECOR introduces a novel clustering-based strategy that aggregates intra-cluster link information and delegates routing decisions to cluster heads, significantly reducing control overhead and enabling scalable, energy-efficient covert communication. Extensive numerical analysis demonstrates that DECOR significantly outperforms existing approaches in terms of energy-efficiency and data overhead.

Multi-hop Heterogeneous wireless networks (HWNs) with multiple communication technologies have been extensively studied driven by the rising demand for enhanced resilience, coverage, and throughput. However, utilizing relays for wireless communication has the potential to heighten the risk of detection by an adversary. Furthermore, information about the adversary is usually unavailable in practice. Therefore, in this paper, we propose a covert routing using Q-learning for HWNs to maximize the detection error probability (DEP) with only limited knowledge about the adversary's general location, referred to as the threat region. To achieve this goal, we exploit fictitious adversaries that are randomly located inside the threat region to obtain estimated DEP. Then, we propose three different approaches to establish a route between the source and destination. Through simulations, we compare our proposed approaches to the conventional covert routing using Q-learning where the location of the adversary is assumed to be known. Our results show that our methods only experience a 10% reduction in DEP with fictitious adversaries. Furthermore, we investigate how the radius of the threat region affects the performance.

Reinforcement learning (RL) holds great promise for network control problems, yet its deployment in real-world systems remains limited due to the instability and unpredictability of RL policies during training. To address this challenge, we propose a two-phase conservative RL framework that combines domain expertise from classical network optimization with modern deep RL techniques. Our key idea is to initialize the learning process with a stable base policy, derived from expert knowledge, and then apply conservative fine-tuning under a Kullback–Leibler (KL) divergence constraint to safely explore improved behaviors. We apply this framework to the problem of covert multi-hop routing, where the objective is to optimize data throughput while minimizing detectability by adversaries. In Phase I, we construct a reliable base policy by imitating the back-pressure algorithm, which guarantees throughput-optimal behavior and stable queue dynamics. Phase II fine-tunes this policy to improve covert performance, as measured by the Detection Error Probability (DEP), while preserving training-time stability. Empirical evaluations on a grid network show that our method enables more reliable learning than pure RL. While pure RL (e.g., PPO) can sometimes achieve higher covert performance, it frequently suffers from large queues and collapsed throughput during training. In our experiments, our conservative RL framework reduces the worst-case training-time queue length by over 99% while maintaining comparable covert communication performance.

A fundamental challenge in covert routing is that meeting both covertness and throughput requirements often leads to increased transmit power, which can significantly elevate the overall energy consumption of the network. Therefore, it is important to achieve higher throughput and better energy efficiency while maintaining the required covertness. To this end, we propose a novel simultaneous multi-modal Decentralized Energy- Efficient covert Routing approach - DEER for a multi-hop heterogeneous network (HetNet). Unlike the prevailing single-modal approaches, DEER leverages the diversity of the available wireless communication technologies for simultaneous multi-modal routing. DEER aims to minimize the end-to-end total transmit power of the whole route in a decentralized fashion while maintaining the constraints on required throughput and covertness. DEER stems into two main steps: node-level optimization followed by network-level optimization using the proposed custom-tailored Dijkstra's based link state routing protocol to meet the constraints while minimizing the end-to-end total transmit power. We demonstrate by numerical analysis that DEER improves the energy efficiency by$23.5 x$and$2.9 x$times in comparison to the baseline single-modal and naive simultaneous multimodal approaches respectively.

Autonomous Vehicles (AVs) integrate numerous control units , network components, and protocols to operate effectively and interact with their surroundings, such as pedestrians and other vehicles. While these technologies enhance vehicle capabilities and enrich the driving experience, they also introduce new attack surfaces, making AVs vulnerable to cyber-attacks. Such cyber-attacks can lead to severe consequences, including traffic disruption and even threats to human life. Security modelling is crucial to safeguarding AVs as it enables the simulation and analysis of an AV’s security before any potential attacks. However, the existing research on AV security modelling methods for analysing security risks and evaluating the effectiveness of security measures remains limited. In this work, we introduce a novel graphical security model and metrics to assess the security of AV systems. The proposed model utilizes initial network information to build attack graphs and attack trees at different layers of network depth. From this, various metrics are automatically calculated to analyse the security and safety of the AV network. The proposed model is designed to identify potential attack paths, analyse security and safety with precise metrics, and evaluate various defence strategies. We demonstrate the effectiveness of our framework by applying it to two AV networks and distinct AV attack scenarios, showcasing its capability to enhance the security of AVs.

In this paper, we develop an approach to exploit multiple disparate wireless communication technologies simultaneously to enhance covertness of a communication link. Specifically, given two available communication modalities between a pair of friendly nodes (Alice and Bob), the goal is to evade detection by an adversary (Willie) who is equipped with a radiometer covering the frequency bands of both modalities. We propose a joint detection threshold optimization technique from Willie's point of view. We also develop a joint transmit power optimization strategy for Alice to maximize covertness while meeting the throughput requirement at Bob. Through numerical simulations we show that the proposed scheme matches the performance of exhaustive search method while reducing the computational time by 98% and also improves the covertness by 56% compared to a naïve benchmark scheme.

In this paper, we explore covert routing communication in a heterogeneous network where a source sends a confidential message to a destination node with the help of relaying nodes where each node adaptively selects one modality among multiple communication modalities based on the wireless environment. We study three optimization problems: 1) the maximization of the end-to-end detection error probability at an adversary with a requirement on the throughput; 2) the end-to-end throughput maximization under a covertness constraint; and 3) the end-to-end latency minimization with a covertness condition. For the three optimization problems, we develop novel algorithms that identify the routes from a source to a destination and allocate resources, which are communication modality, transmit power, and bandwidth, at all nodes along the route. First, for single-hop communications, we derive a closed-form joint optimal power and bandwidth solution for a given modality, and then provide a modality selection method. For multi-hop communications, we propose the optimal routing strategies for the three problems by modeling the network as graphs and defining edge weights based on the objectives of the problems. From numerical simulations, it is validated that the performance of the network can be enhanced with the proposed optimal joint route and resource allocation techniques by judiciously selecting one of the multiple modalities for each hop in the route based on the wireless environment.

Ultraviolet (UV) communications has been proposed as a promising modality for short-range military communications, as it is often presumed to have low-probability-of-detection characteristics, has desirable non-line-of-sight properties, and resides within an underutilized frequency band. Recent research efforts have sought to formalize the first presumption of the detection of UV communications. This effort seeks to begin the study of the localization of UV communication sources after they are detected. We focus here exclusively on the range estimation problem. Using a phenomenon relating UV received power and range over short-to-medium distances (≪ 1 km), we develop a range estimator using only the received signal strength. The approach does not require information about other system or environmental parameters. We also theoretically study the performance of the estimator using the Cramér-Rao bound, via simulations, and using previously collected data.

Deep learning-based cybersecurity applications should be able to continually accumulate threat knowledge for new types of threats over time while maintaining the knowledge of threats already exposed to the application. This paper proposes episodic memory management for continual learning with network intrusion datasets. For new attacks, the number of samples may not be sufficiently large for training, and thus the memory management algorithm should retain as many samples as possible instead of random sampling in the episodic memory for continual learning. The experiment results indicated that the proposed algorithm outperforms offline learning in terms of average per-class accuracy in a continual scenario with a network intrusion dataset.

As cyberattacks continuously threaten conventional defense techniques, Moving Target Defense (MTD) has emerged as a promising countermeasure to defend a system against them by dynamically changing attack surfaces of the system. MTD provides the system a state-of-art security mechanism that increases the attack cost or complexity of the system aiming for reducing vulnerabilities exposed to potential attackers. However, the notion of the proactive and dynamic systems adopting MTD services causes a substantial trade-off between system performance and security effectiveness, compared to conventional defense strategies. The MTD tactics accordingly result in performance degradation (e.g., interruptions of service availability) as one of the drawbacks caused by continuous mutations of the system configuration. Therefore, it is crucial to validate not only the security benefits against system threats but also quality-of-service (QoS) for clients when an MTD-enabled system proactively continues to mutate attack surfaces. This paper contributes to (i) developing new security metrics; (ii) measuring both the performance degradation and security effectiveness against potential real attacks (i.e., scanning, HTTP flood, dictionary, and SQL injection attack); and (iii) comparing the proposed job management strategies (i.e., drop and switch-over) from a performance and security perspective in a physical SDN testbed.

As cyberattacks are rising, Moving Target Defense (MTD) can be a countermeasure to proactively protect a networked system against cyber-attacks. Despite the fact that MTD systems demonstrate security effectiveness against the reconnaissance of Cyber Kill Chain (CKC), a time-based MTD has a limitation when it comes to protecting a system against the next phases of CKC. In this work, we propose a novel hybrid MTD technique, its implementation and evaluation. Our hybrid MTD system is designed on a real SDN testbed and it uses an intrusion detection system (IDS) to provide an additional MTD triggering condition. This in itself presents an extra layer of system protection. Our hybrid MTD technique can enhance security in the response to multi-phased cyber-attacks. The use of the reactive MTD triggering from intrusion detection alert shows that it is effective to thwart the further phase of detected cyber-attacks. We also investigate the performance degradation due to more frequent MTD triggers.This work contributes to (1) proposing an ML-based rule classification model for predicting identified attacks which helps a decision-making process for security enhancement; (2) developing a hybrid-based MTD integrated with a Network Intrusion Detection System (NIDS) with the consideration of performance and security; and (3) assessment of the performance degradation and security effectiveness against potential real attacks (i.e., scanning, dictionary, and SQL injection attack) in a physical testbed.

Reinforcement learning (RL) is a promising approach for intelligent agents to protect a given system under highly hostile environments. RL allows the agent to adaptively make sequential defense decisions based on the perceived current state of system security aiming to achieve the maximum defense performance in terms of fast, efficient, and automated detection, threat analysis, and response to the threat. In this paper, we propose a deep reinforcement learning (DRL)-based adaptive traffic inspection and moving target defense countermeasure framework, called ‘DIVERGENCE,’ for building a secure networked system. The DIVERGENCE provides two main security services: (1) a DRL-based network traffic inspection mechanism to achieve scalable and intensive network traffic visibility for rapid threat detection; and (2) an address shuffling-based moving target defense (MTD) technique to defend against threats as a proactive intrusion prevention mechanism. Through extensive simulations and experiments, we demonstrate that the DIVERGENCE successfully caught malicious traffic flows while significantly reducing the vulnerability of the network through MTD.

Diversity-based security approaches have been studied for several decades since the 1970s. The concept ofdiversity-by-designemerged in the 1980s. Since then, diversity-based system design research has been explored to provide more secure and dependable services in cyber-physical systems (CPSs). In this work, we are particularly interested in providing an in-depth, comprehensive survey of existing diversity-based approaches, their insights, and associated future work directions for building secure and dependable CPSs. This will allow us to provide promising ways of providing quality network and services based on key diversity-by-design principles for those who want to conduct research on developing secure and dependable CPSs using diversity as a system design feature. This survey paper mainly provides: (i) The common concept of diversity based on its multidisciplinary nature along with the historical evolution of the concept of diversity-by-design for providing secure and dependable services; (ii) the key diversity-by-design principles; (iii) the key benefits and caveats of using the diversity-by-design; (iv) the main concerns of CPS environments utilizing the diversity-by-design; (v) an extensive survey and discussions of existing diversity-based approaches based on five different classifications; (vi) the types of attacks considered by diversity-based approaches; (vii) the overall trends of evaluation methodologies used for diversity-based approaches, in terms of metrics, datasets, and testbeds; and (viii) the insights, lessons, and gaps identified from this extensive survey and future work directions.

In this work, we proposed a Deep reinforcement learning (DRL)-based NETwork Adaptations for network Resilience algorithm, namely DeepNETAR, which aims to generate robust network topologies against epidemic attacks. In DeepNETAR, a DRL agent aims to generate a robust network topology against epidemic attacks by removing vulnerable edges or adding the least vulnerable edges, given multiple objectives of system security and performance. Most existing network topology adaptation algorithms have used the size of the giant component (SGC) to ensure service availability based on network connectivity. However, in real communication networks, where packets may be dropped either from the presence of inside attackers or congestion on long routes, a larger SGC does not necessarily ensure higher service availability. In addition, for the DRL agent to learn fast and handle multiple, conflicting system objectives, we considered vulnerability-based selection of adaptable edge candidates, fractal-based solution search, and diverse reward functions aiming to achieve multi-objective optimization. Via extensive simulation experiments, we analyzed what DeepNETAR-based schemes using different objectives can achieve those two conflicting system objectives and comparing existing and baseline counterparts.

By leveraging the principle of software polyculture to ensure security in a network, we propose a vulnerability-based software diversity metric to determine how a network topology can be adapted to minimize security vulnerability while maintaining maximum network connectivity. Our proposed metric estimates the software diversity of the node using the vulnerabilities of software packages installed on nearby nodes on attack paths reachable to the node. Our software diversity-based adaptation (SDA) scheme employs the diversity of each node for edge adaptations. These adaptations include the removal of edges that expose high security vulnerability as well as the potential addition of edges between certain nodes with low vulnerabilities associated with them. To validate the proposed SDA scheme, we conduct extensive experiments comparing our approach with counterpart baseline schemes in real networks. Our simulation results demonstrate that SDA outperforms these existing counterparts. We discuss insights into these findings in terms of the effectiveness and efficiency of the proposed SDA scheme under three real network topologies with vastly different network densities.

Moving target defense (MTD) has emerged as a proactive defense mechanism aiming to thwart a potential attacker. The key underlying idea of MTD is to increase uncertainty and confusion for attackers by changing the attack surface (i.e., system or network configurations) that can invalidate the intelligence collected by the attackers and interrupt attack execution; ultimately leading to attack failure. Recently, the significant advance of software-defined networking (SDN) technology has enabled several complex system operations to be highly flexible and robust; particularly in terms of programmability and controllability with the help of SDN controllers. Accordingly, many security operations have utilized this capability to be optimally deployed in a complex network using the SDN functionalities. In this paper, by leveraging the advanced SDN technology, we developed an attack graph-based MTD technique that shuffles a host’s network configurations (e.g., MAC/IP/port addresses) based on its criticality, which is highly exploitable by attackers when the host is on the attack path(s). To this end, we developed a hierarchical attack graph model that provides a network’s vulnerability and network topology, which can be utilized for the MTD shuffling decisions in selecting highly exploitable hosts in a given network, and determining the frequency of shuffling the hosts’ network configurations. The MTD shuffling with a high priority on more exploitable, critical hosts contributes to providing adaptive, proactive, and affordable defense services aiming to minimize attack success probability with minimum MTD cost. We validated the out performance of the proposed MTD in attack success probability and MTD cost via both simulation and real SDN testbed experiments.

Moving target defense (MTD) is a proactive defense mechanism of changing the attack surface to increase an attacker's confusion and/or uncertainty, which invalidates its intelligence gained through reconnaissance and/or network scanning attacks. In this work, we propose software-defined networking (SDN)-based MTD technique using the shuffling of IP addresses and port numbers aiming to obfuscate both network and transport layers' real identities of the host and the service for defending against the network reconnaissance and scanning attacks. We call our proposed MTD technique Random Host and Service Multiplexing, namely RHSM. RHSM allows each host to use random, multiple virtual IP addresses to be dynamically and periodically shuffled. In addition, it uses short-lived, multiple virtual port numbers for an active service running on the host. Our proposed RHSM is novel in that we employ multiplexing (or de-multiplexing) to dynamically change and remap from all the virtual IPs of the host to the real IP or the virtual ports of the services to the real port, respectively. Via extensive simulation experiments, we prove how effectively and efficiently RHSM outperforms a baseline counterpart (i.e., a static network without RHSM) in terms of the attack success probability and defense cost.

As connected and autonomous vehicle technology evolves, the design of in-vehicle network architecture, which connects multiple electronic control units (ECUs) and internal sensors and supports connectivity to the outside of the vehicle, has increased significantly to meet security needs. However, the heterogeneous structure of the in-vehicle network and lack of security consideration has introduced a lack of scalability and security concerns. In this work, we propose a shuffling-based moving target defense (MTD) technique aiming to disturb network reconnaissance attacks and deployed it in the proposed software-defined networking (SDN)-based in-vehicle network architecture. To validate the proposed MTD, we compare the service availability of our proposed MTD and non-MTD counterpart in the presence of the reconnaissance-based false message injection attacks.

In the network science domain, a larger size of the giant component (i.e., the largest cluster of nodes) represents higher network resilience in terms of maximizing network availability in the presence of attacks. However, this does not necessarily represent how well the network provides promised services under attacks and/or failures. We aim to improve network resilience by introducing network adaptability (i.e., reconfiguration of a network topology), in addition to fault-tolerance. We develop a suite of strategies adopting processes from percolation theory, describing the process to percolate into a medium, for a tactical, mission-oriented network. This network is service-oriented, characterized by a number of task teams where each resource-restricted node aims to maximize resource utilization while completing multiple tasks without failure. We investigate how node failures can trigger overloads, leading to cascading failures. We consider various attack behaviors (infectious, non-infectious, random, or targeted) and analyze their effects. Through extensive simulations, we show the outperformance of the proposed adaptation strategy compared with the performance of the existing counterparts in terms of the size of the giant component, the utilization of resources, the number of alive task teams (or mission success ratio), and the adaptation cost for a large-scale, mission-oriented network under attack.

Percolation theory has been studied to investigate network resilience by identifying a critical value of node occupation probability where a giant component (i.e., a largest component in a network) represents high network resilience. However, the concept of network resilience studied in percolation theory has been limited to measuring network fault-tolerance in the presence of failures/attacks. In this work, we take a step to extend the concept of network resilience beyond fault-tolerance by introducing network adaptability. We consider a tactical network where a node is executing multiple tasks by belonging to multiple task groups. In this type of tactical networks, a node is limited with its resource while aiming to maximize its resource utilization and task execution without being overloaded. We investigate network resilience and resource utilization of the tactical network where the network is attacked by either infectious or non-infectious attacks. To mitigate the impact of the failed/attacked nodes in the network, we propose a suite of the proposed adaptation strategies to deal with correlated, cascading failures caused by overloaded nodes due to increased workload introduced by other failed nodes. We conduct a comparative performance analysis of the set of proposed adaptation strategies and a baseline scheme with no adaptation based on metrics including a size of a giant component, node resource utilization, a number of active tasks in execution, and adaptation cost. Our simulation results show that a large size of a giant component does not necessarily ensure high resource utilization of nodes and task performance in the given tactical network.

Team science is a collaborative approach to research, typically with researchers drawn from different disciplines. Team science networks have certain unique characteristics in their conception and intent that set them apart from other commonly studied social and collaboration networks. We study the structural properties, and present metrics for collaborative performance assessment in two real-world team science networks initiated by the Army Research Lab. We model a team using a higher-order generalization of an edge called a simplex. A simplex captures group relationships distinct from the union of pairwise relationships. Our evaluation using a rigorous methodology reveals that the distributions of vertex and facet degrees (the number of maximal groups that a vertex belongs to) follow a power law, but with exponential cut-off at the tail in most cases. We propose metrics for quantitatively assessing the extent of intra-team and extra-team collaborations, and compare their effectiveness vis-a-vis our intuitive notions. Our work can be used as the basis for generative models, and for evaluating the collaborative performance of team science networks.

There has recently been increased interest in applications of topology to areas ranging from control and sensing, to social network analysis, to high-dimensional point cloud data analysis. Here we use simplicial complexes to represent the group relationship structure in a network. We detail a novel algorithm for simplifying homology and “hole location” computations on a complex by reducing it to its core using a strong collapse. We show that the homology and hole locations are preserved and provide motivation for interest in this reduction technique with applications in sensor and social networks. Since the complexity of finding “holes” is quintic in the number of simplices, the proposed reduction leads to significant savings in complexity.

Stoica and Ng (1998) presented a simple expression for the constrained Cramer-Rao bound (CCRB) when the constraints are given by a differentiable function of the parameter to be estimated. This letter considers the parallel case in developing the CCRB when the parameters are locally fitted to a lower-dimensional parametric model, i.e., the parameters are locally assumed to be functions of a distinct reduced parameter vector. We employ classical elements of CRB theory on the locally fitted model to present a very simple derivation of the CCRB, conditions for attaining the bound, and a regularity condition. Examples illustrate the key ideas.

Cramér-Rao bounds (CRBs) are developed for narrow band source separation, when the sources are constrained to have constant modulus (CM). The bounds are appropriate for multi path CM sources, in blind, semi-blind, or fully known cases. Source separation bounds are contrasted for calibrated and uncalibrated arrays. It is shown that, from the CRB perspective, calibration adds no additional information. Closed-form CRBs are given for a single source, and two-source examples are also presented. Optimality of the analytical constant modulus algorithm (ACMA) for blind CM-source separation is demonstrated, achieving the appropriate constrained CRBs over a wide SNR range in challenging multipath scenarios.

We present constrained Cramer-Rao bounds for multi-input multi-output (MIMO) channel and source estimation. We find the MIMO Fisher information matrix (FIM) and consider its properties, including the maximum rank of the unconstrained FIM, and develop necessary conditions for the FIM to achieve full rank. Equality constraints provide a means to study the potential value of side information, such as training (semi-blind case), constant modulus (CM) sources, or source non-Gaussianity. Non-redundant constraints may be combined in an arbitrary fashion, so that side information may be different for different sources. The bounds are useful for evaluating various MIMO source and channel estimation algorithms. We present an example using the constant modulus blind equalization algorithm.

In this paper we develop Cramer-Rao bounds (CRBs) for bearing, symbol, and phase estimation of communications signals in flat fading channels. We do this using the constrained CRB formulation of Gorman and Hero (1999), and Stoica and Ng (1998). This provides a general framework for a large variety of cases, including semi-blind, constant modulus (CM), known cumulants, and others. These may be combined arbitrarily, e.g., we may develop CRBs for bearing estimation of constant modulus signals when a subset of the symbols are known (semi-blind, CM case). The results establish the value of side information in a large variety of communications scenarios, and may be used to compare performance of various blind and semi-blind algorithms.

We consider narrowband angle of arrival estimation in non-Gaussian (NG) noise channels, such as arises in some indoor and outdoor mobile communications channels. We develop a general expression for the Cramer-Rao bound (CRB) for direction finding using arrays for deterministic signals plus i.i.d. non-Gaussian noise, generalizing the Gaussian CRB. The CRBs for the noise and direction parameters decouple. The CRB for direction finding is expressed as a product of two terms that depend on the noise distribution, and the signal, respectively. We illustrate the results for a Gaussian mixture PDF, and present simulation results comparing five direction finding algorithms. An approach based on the expectation-maximization (EM) algorithm, that simultaneously estimates the noise parameters, the signal directions, and the signal waveforms, is shown to achieve the CRB over a wide SNR range.