Smart mobile phones are, nowadays, in wide use and day by day they are transformed into an essential part of everyday life, for business and for entertainment alike. Mobile Networks have been implemented in order to serve these needs. Unfortunately there are many users who want to use the benefits that technology gives to them for malicious and/or illegal actions. In this paper we present and analyze a hypothetical (but realistic) cyber crime investigation scenario. According to this, a user who has wireless internet access using a mobile phone through a University's network facilities, visits sites with pornographic content. A fact that complicates the analysis of the scenario is that the user employs anti-forensics techniques (e.g. data encryption). In this paper we show how to apply to the investigation of this scenario (as well as similar ones) a number of widely available open source forensics analysis tools overcoming the anti-forensics efforts of malicious users. Our goal is to demonstrate their applicability to cyber-crime forensics and their capability to operate in a complementary, to each other, way so that their deployment sheds light to different aspects of the case at hand.

As the Internet of Things (IOT) arises, the use of low-end devices on a daily basis increases. The wireless nature of communication that these devices provide raises security and privacy issues. For protecting a user's privacy, cryptography offers the tool of zero knowledge proofs (ZKP). In this paper, we study well-established ZKP protocols based on the discrete logarithm problem and we adapt them to the Elliptic Curve Cryptography (ECC) setting, which consists an ideal candidate for embedded implementations. Then, we implement the proposed protocols on Wiselib, a generic and open source algorithmic library. For the first time, we present a thorough evaluation of the protocols on two popular hardware platforms equipped with low end microcontrollers (Jennic JN5139, TI MSP430) and 802.15.4 RF transceivers, in terms of code size, execution time, message size and energy requirements. This work's results can be used from developers who wish to achieve certain levels of privacy in their applications.

Recently, an interest has arisen for network worms that propagate using domain name servers (DNS) in order to discover victim hosts.These worms generate random strings, as possible network domain names, and then query domain name servers in order to discover the corresponding IP addresses. In this paper we present models for the dynamics of the co-evolution of worm agents in the presence of anti-worm agents that move in the network in order to stop worm propagation. The proposed models consider anti-worm agents who know the network and anti-worm agents thaServerst do not know it and need to issue queries in order to discover valid IP addresses. We,further, introduce "honeypot'' domain name servers that attempt to lure worms, introducing only a delay and providing no answer.We show that by simply delaying the response to DNS queries issued by the worm has little positive effect on the worms propagation.

The technological as well as software advances in microelectronics and embedded component design have led to the development of low cost, small-sized devices capable of forming wireless, ad-hoc networks and sensing a number of qualities of their environment, while performing computations that depend on the sensed qualities as well as information received by their peers. These sensor networks rely on the collective power of the separate devices as well as their computational and sensing capabilities to understand ldquoglobalrdquo environmental states through locally sampled information and local sensor interactions. Due to the locality of the sensor networks, that naturally arises due to the locality of their communications capabilities, a number of interesting connections exist between these networks and geometrical concepts and problems. In this paper we study two simple problems that pertain to the formation of low power and low interference communication patterns in fixed topology sensor networks. We study the problem of using multihop communication links instead of direct ones as well as the problem of forming a communication ring of sensor networks so as to reduce power consumption as well as interference from other nodes. Our focus is on the connection between sensor networks and geometrical concepts, rather than on practicality, so as to highlight their interrelationship.

Elliptic curve cryptography (ECC) is one of the most promising alternatives to conventional public key cryptography, such as RSA and ElGamal, since it employs keys of smaller sizes for the same level of cryptographic strength. Smaller key sizes imply smaller hardware units for performing the arithmetic operations required by cryptographic protocols and, thus, ECC is an ideal candidate for implementation in embedded systems where the major computational resources (speed and storage) are limited. In this paper we present a port, written in ANSI C for maximum portability, of an open source ECC-based cryptographic library (ECC-LIB) to ATMEL's AT76C520 802.11 WLAN Access Point. One of the major features of this port, not found in similar ports, is that it supports Complex Multiplication (CM) for the construction of Elliptic Curves with good security properties. We present some experimental results that demonstrate that the port is efficient and can lead to generic embedded systems with robust ECC-based cryptographic protocols using cryptographically strong ECCs generated with CM. As an application of the ported library, an EC Diffie-Hellman key exchange protocol is developed as an alternative of the 4-way key handshake protocol of the 802.11 protocol.

In this paper we present a virus propagation and elimination model that takes into account the traffic and server characteristics of the network computers. This model partitions the network nodes into perimeter and non-perimeter nodes. Incoming/outgoing traffic of the network passes through the perimeter of the network, where the perimeter is defined as the set of the servers which are connected directly to the internet. The non-perimeter network nodes, i.e. the computers with no direct internet connection, form a kind of isolated internet connected to the outside world through the perimeter nodes. All network nodes are assumed to process tasks based on the M/M/1 queuing model. Thus, the model behaves as an open network of M/M/1 queues. We study burst intrusions (e.g.denial of service attacks) at the network perimeter and how the intrusion evolves given that, in parallel with the intrusion, anti-virus tasks also propagate in the network and kill intruder tasks. We propose a realistic kind of interactions between these agents that results in a product form steady state distribution of the agent numbers for each network node, much like the product form solution for the distribution of network tasks for Jackson open networks of queues.

Today we are experiencing a major reconsideration of the computing paradigm, as witnessed by the abundance and increasing frequency of use of terms such as ambient intelligence, ubiquitous computing, disappearing computer, grid computer, global computing and mobile ad-hoc networks. Systems that can be described with such terms are of a dynamic, with no clear physical boundary, nature and it seems that it is impossible (or, at least, difficult) to define sharply a number of important properties holding with certainty as well as holding throughout the whole lifetime of the system. One such system property, which is important for the viability of a system, is trust. Our departure point is the assumption that it seems very difficult to define static system properties related to trust and expect that they hold eternally in the rapidly changing systems falling under the new computing paradigm. One should, rather, attempt to define trust in terms of properties that hold with some limiting probability as the system grows and try to establish conditions that ensure that "good" properties hold almost certainly. Based on this viewpoint, in this paper we provide a new framework for defining trust through formally definable properties that hold, almost certainly, in the limit in randomly growing combinatorial structures that model "shapeless" computing systems (e.g., ad-hoc networks), drawing on results that establish the threshold behavior of predicates written in the first and second order logic

One of the major issues involved in mobile ad-hoc network security is that of key management. Key management refers to the creation, distribution and revocation of keys amongst the network. A solution to these issues is given by key pre-distribution schemes according to which each node is initially given a set of keys from which keys can be chosen to be used for their communication needs. In this paper we first give a formal definition of what constitutes a desirable set system design for key pre-distribution and propose a deterministic key pre-distribution scheme based on set systems whose members have intersection sizes that fall within a limited, predetermined range. The resulting key sets are theoretically shown to possess many of the properties of desirable set system design

Abstract We consider the problem of searching for a piece of information in a fully interconnected computer network (also called a complete network orclique) by exploiting advice about its location from the network nodes. Each node contains a database that “knows” what kind of documents or information are stored in other nodes (e.g., a node could be a Web server that answers queries about documents stored on the Web). The databases in each node, when queried, provide a pointer that leads to the node that contains the information. However, this information is up‐to‐date (or correct) with some bounded probability. While, in principle, one may always locate the information by simply visiting the network nodes in some prescribed ordering, this requires a time complexity in the order of the number of nodes of the network. In this paper, we provide algorithms for locating an information node in the complete communication network, which take advantage ofadvicegiven from network nodes. The nodes may either give correct advice, by pointing directly to the information node, or give wrong advice, by pointing elsewhere. On the lower‐bounds' side, we show that no fixed‐memory (i.e., with memory independent of the network size) deterministic algorithm may locate the information node in a constant (independent of the network size) expected number of steps. Moreover, ifp= ω(1/n) is the probability that a node of ann‐node clique gives correct advice, we show that no algorithm may locate the information node in an expected number of steps less than 1/p−o(1). To study how the expected number of steps is affected by the amount of memory allowed to the algorithms, we give a memoryless randomized algorithm with expected number of steps 4/p+o(1/p) +o(1) and a 1‐bit randomized algorithm requiring on the average at most 2/p+o(1) steps. In addition, in the memoryless case, we also prove a 4/plower bound for the expected number of steps in the case where the nodes giving faulty advice may decide on the content of this advice in any possible way and not merely at random (adversarialfault model). Finally, for the case where faulty nodes behave randomly, we give an optimal, unlimited memory deterministic algorithm with expected number of steps bounded from above by 1/p+o(1/p) + 1. © 2003 Wiley Periodicals, Inc.

In this paper we examine the problem of searching for some information item in the nodes of a fully interconnected computer network, where each node contains information relevant to some topic as well as links to other network nodes that also contain information, not necessarily related to locally kept information. These links are used to facilitate the Internet users and mobile software agents that try to locate specific pieces of information. However, the links do not necessarily point to nodes containing information of interest to the user or relevant to the aims of the mobile agent. Thus an element of uncertainty is introduced. For example, when an Internet user or some search agent lands on a particular network node, they see a set of links that point to information that is, supposedly, relevant to the current search. Therefore, we can assume that a link points to relevant information with some unknown probability $p$ that, in general, is related to the number of nodes in the network (intuitively, as the network grows, this probability tends to zero since adding more nodes to the network renders some extant links less accurate or obsolete). Consequently, since there is uncertainty as to whether the links contained in a node's Web page are correct or not, a search algorithm cannot rely on following the links systematically since it may end up spending too much time visiting nodes that contain irrelevant information. In this work, we will describe and analyze a search algorithm that is only allowed to transfer a fixed amount of memory along communication links as it visits the network nodes. The algorithm is, however, allowed to use one bit of memory at each node as an ‘already visited’ flag. In this way the algorithm has its memory distributed to the network nodes, avoiding overloading the network links as it moves from node to node searching for the information. We work on fully interconnected networks for simplicity reasons and, moreover, because according to some recent experimental evidence, such networks can be considered to be a good approximation of the current structure of the World Wide Web.