System specific cyber security risk depends on the likelihoods of potential multi-step attacks combining multiple vulnerabilities and the corresponding losses. These likelihoods are typically obtained under assumptions that exploits of individual vulnerabilities are jointly statistically independent random events and probabilities of these events can be estimated from the data on vulnerability exploits in the wild. However, exploit probabilities critically depend on the attacker determination to damage specific system: “high value” systems may expect higher exploit probabilities and vice versa. Also, for a rational attacker, who concentrates resources on the most impactful attack vectors, probabilities of individual exploits may significantly deviate from exploit probabilities in the wild. This paper reports on work in progress on developing a suite of system and attacker specific cyber security risk metrics, which account for both attacker willingness to expend resources on actual exploits of system vulnerabilities as well attacker ability to identify the most impactful attack vectors during reconnaissance phase to increase the attack efficiency. In our future work we intend to use the proposed metrics for guiding allocation of limited defense resources between system hardening and deception to reduce the attacker reconnaissance capabilities.

System specific cyber security risk depends on the likelihoods of potential multi-step attacks that combine multiple vulnerabilities and the corresponding losses. These likelihoods are typically obtained under assumptions that exploits of individual vulnerabilities are statistically joint independent random events and the probabilities of these events can be estimated from the data on vulnerability exploits in the wild, e.g., using the Common Vulnerability Scoring System (CVSS). However, these assumptions, which do not account for the inherently adversarial nature of the attacker-defender interactions, may lead to significant inaccuracies in cyber risk estimation and thus result in highly inefficient risk mitigation decisions. We propose a framework for system-specific cyber security risk evaluation, which addresses some of these shortcomings of the conventional risk evaluation techniques by combining public information, e.g., obtained from CVSS, with private information which the system defender may be reluctant to disclose. In the proposed framework, public information on the vulnerability exploits in the wild determines system-specific cybersecurity risk envelope, and defender estimates system cyber security risk inside this envelope using the available private information on the former attacks.

This paper reports on work in progress on incorporating a possibility of zero-day attacks into security risk metrics. System security is modelled by Attack Graph (AG), where attack paths may include a combination of known and zero-day exploits. While set of feasible zero-day exploits and composition of each attack path are known, only estimates of likelihoods of known exploits are available. We propose addressing uncertain likelihoods of zero-day exploits within framework of robust risk metrics. Assuming some base likelihoods of zero-day exploits, robust risk metrics assume worst-case Probabilistic or Bayesian AG scenario allowing for a controlled deviation of actual likelihoods of zero-day exploits from their base values. The corresponding worst-case scenario is defined with respect to the system losses due to a zero-day attack. These robust risk metrics interpolate between the corresponding probabilistic or Bayesian AG model on the one hand and purely antagonistic game-theoretic model on the other hand. Popular k-zero day security metric is a particular case of the proposed metric.

This paper reports on work in progress on security metrics combining risks of known and zero-day attacks. We assume that system security is modelled by Attack Graph (AG), where attack paths may include a combination of known and zeroday exploits and impact of successful attacks is quantified by system loss function. While set of feasible zero-day exploits and composition of each attack path are known, only estimates of likelihoods of known exploits are available. After averaging the system loss function over likelihoods of known exploits, we propose addressing uncertain likelihoods of zero-day exploits within framework of robust risk metrics. Assuming some prior likelihoods of zero-day exploits, robust risk metrics are identified with the worst-case Bayesian AG scenario subject to a controlled deviation of actual likelihoods of zero-day exploits from their priors. The corresponding worst-case scenario is defined with respect to the system losses due to a zero-day attack. We argue that the proposed risk metric quantifies potential benefits of system configuration diversification, such as Moving Target Defense, for mitigation of the system/attacker information asymmetry.

In this paper we suggest that diverse user risk tolerance levels can be incorporated into conventional network optimization frameworks by replacing user rate/throughput with the Entropic Rate at Risk (ERaR). We consider risk due to scenario-based uncertainty, where different scenarios include a "normal" scenario without jamming as well as feasible jamming scenarios. We demonstrate that ERaR user maximization results in user multi-connectivity to several Base Stations (BSs) when benefits of connectivity diversification out weight the "inefficiencies" due to connectivity to "distant" BSs.

A commonly used methodology to estimate the proximity of two individuals in an automatic exposure notification system uses the signal strength of the Bluetooth signal from their mobile phones. However, there is an underlying error in Bluetooth-based proximity detection that can result in wrong exposure decisions. A wrong decision in the exposure determination leads to two types of errors: false negatives and false positives. A false negative occurs when an exposed individual is incorrectly identified as not exposed. Similarly, a false positive occurs when a non-exposed individual is mistakenly identified as exposed. Both errors have costly implications and can ultimately determine the effectiveness of Bluetooth-based automatic exposure notification in containment of pandemics such as COVID-19. In this paper, we present a platform that allows for the analysis of the system performance under various parameters. This platform enables us to gain a better understanding on how the underlying technology error propagates through the contact tracing system. Preliminary results show the considerable impact of the Bluetooth-based proximity estimation error on false exposure determination. Alternatively, using this platform, analysis can be performed to determine the acceptable accuracy level of a proximity detection mechanism in order to have a more effective contact tracing solution.

Current automatic exposure notification apps primarily operate based on hard distance/time threshold guidelines (e.g., 2 m/15 min in the United States) to determine exposures due to close contacts. However, the possibility of virus transmission through inhalation for distances over the specified distance threshold might necessitate consideration of soft distance/time thresholds to accommodate all transmission scenarios. In this paper, using a simplifying approximation on the instantaneous rate of the viral exposure versus distance, we extend the definition of "contact" by proposing a soft distance/time threshold which includes the possibility of getting exposed at any distance (within certain limits) around an infected person. We then analyze the performance of automatic exposure notification with Bluetooth-based proximity detection by comparing the exposure results when soft or hard thresholds are used. This study is done through an agent-based simulation platform that allows for a comprehensive analysis using several system parameters. By tuning the parameters of the proposed soft thresholds, a more accurate determination of possible exposures at any distance would be possible. This would enhance the effectiveness of an automatic contact tracing system. Our results indicate the noticeable impact of using the soft distance/time threshold on the exposure detection accuracy.

The proximity detection mechanism in current automatic exposure notification systems is typically based on the Bluetooth signal strength from the individual’s mobile phone. However, there is an underlying error in this proximity detection methodology that could result in wrong exposure decisions i.e., false negatives and false positives. A false negative error happens if a truly exposed individual is mistakenly identified as not exposed. This misidentification could result in further spread of the virus by the exposed (yet undetected) individual. Likewise, when a non-exposed individual is incorrectly identified as exposed, a false positive error occurs. This could lead to unnecessary quarantine of the individual; and therefore, incurring further economic cost. In this paper, using a simulation platform and a notion of proximity detection error, we investigate the performance of the system in terms of false exposure determinations. Knowledge of how the Bluetooth-based proximity detection error impacts such false determinations and identification of methodologies that can reduce this impact will be helpful to enhance the effectiveness of an automatic contact tracing system. Our preliminary results indicate the substantial impact of the proximity estimation error on the exposure detection accuracy. The results also suggest how proper filtering of distance measurements may reduce this impact.

Sensor Networks (SNs) are comprised of low-cost nodes deployed in an ad-hoc fashion over a large area and thus are susceptible to various security attacks. Overall SN's security metrics are often modeled by stochastic or Bayesian Attack Graphs which assume certain likelihoods of feasible attacks paths. This paper discusses a next step, security risk attribution to individual SN's components/vulnerabilities, which is an integral part of efficient risk miti-gation. The challenges are due to highly non-linear contribution of individual vulnerabilities to the overall system security risk and as-tronomically large number of mitigation scenarios in real systems. Motivated by (a) uniqueness of Shapley-value based attribution having some desirable properties, and (b) successful application of this attribution in various settings including financial risk attribution, we propose a Shapley value-based security risk attribution to individual SN's components/vulnerabilities.

Fog computing is an emerging architecture, which extends the Cloud computing paradigm to the edge of the network, enabling new applications and services, including Internet of Things (IoT). End users have certain computation tasks, which can be completed either locally on the end device or remotely on an accessible Fog node via computation offloading. The access is wireless with severe physical limitations on the access network capacity to sustain stringent latency requirements for streaming and real-time applications. Robust access can be provided by maintaining connectivity to several Fog nodes. We propose a scalable access network management scheme, which intends to approximately maximizes the aggregate utility for large-scale networks comprised of a large number of Fog nodes and mobile users with vastly different bandwidth requirements and transmission power restrictions. Scalability is due to a two-level architecture, where each user only communicates with the "closest" Fog nodes, while different Fog nodes exchange aggregated information on the intercell interference. Future research should address accuracy and possible improvements to the approximations. We also plan to incorporate robustness constraints requiring connectivity to multiple Fog nodes.

Economic and convenience benefits of interconnectivity drive current explosive emergence and growth of networked systems. However, as recent catastrophic contagious failures in numerous large scale networked infrastructures demonstrated, these benefits of interconnectivity are inherently associated with various risks, including risk of undesirable contagion. Current research on network formation by contagion risk averse agents, which analyzes Nash or some other game-theoretic equilibrium notion of the corresponding game, suffers from interrelated problems of intractability and oversimplification. We argue that these problems can be alleviated with dynamic view, which assumes logit responses by strategic agents with utilities quantifying multiple competing incentives. While this approach naturally incorporates practically critical assumption of bounded rationality, it also allows for leveraging a vast body of results on network formation, e.g., preferential attachment in growing networks.

This paper reports on quantification and management of inherent systemic risk/performance tradeoff in the cloud computing model. We view Cloud as a Complex System and associate the systemic risks with a possibility of system phase transition to the undesirable persistent state. Our analysis under mean-field and fluid approximations suggests a shift in cloud architecture design and operation paradigm from maximizing the economic benefits to management and optimization of the inherent systemic risk/benefit tradeoffs. We argue that economics makes this tradeoff more pronounced by driving Cloud service providers towards the boundary of the operational regime, and thus increasing risk of overload when the system does not have sufficient capacity for sustaining the exogenous demand.

IEEE802.15.6 is a radio interface standard for wireless connectivity of wearable and implantable sensors and actuators located inside or in close proximity to the human body i.e., Body Area Network (BAN). Medical applications impose stringent requirements on BAN Quality of Service (QoS), including reliability and on-time availability of data. However, interference from other co-located BANs or other nearby devices sharing the same spectrum, e.g., due to BAN mobility, may cause unacceptable QoS degradation. This paper suggests that the impact of such QoS degradations can be minimized with a queue-size and channel quality based adaptation of the Energy Detection Threshold (EDT) at the transmitting nodes. Guided by known results for Q-CSMA/CA, we propose an adaptive EDT algorithm for use in the IEEE 802.15.6 BAN standard. Our preliminary simulation results demonstrate the performance gain of our algorithm compared to using a fixed EDT, and thus warrant future efforts in the adaptive EDT optimization as a mechanism to maintain QoS in various interference scenarios.

This paper proposes a framework for systemic risk aware engineering of large-scale networks. Economics drives two major evolutionary trends in networked system design/operation: (a) towards the boundary of the system capacity/operational region, where all system resources are fully utilized, and (b) an increase in the system interconnectivity allowing enlargement of this region due to dynamic resource sharing. However, numerous recent systemic failures in various performance oriented networked systems demonstrated systemic risks associated with these trends. Using the "Complex System" perspective, we associate the systemic risks with a possibility of system phase transition to an undesirable persistent state. Specifically, we argue that while growing interconnectivity allows a system to accommodate "small" demand/capacity imbalances, sufficiently large imbalances may result in abrupt/discontinuous instabilities, which is a form of "robust yet fragile" phenomenon. Motivated by higher performance losses and lower predictability of abrupt/discontinuous vs. gradual/continuous systemic overload, the proposed "systemic risk aware performance engineering," intends to enlarge the system capacity/operational region subject to ensuring gradual/continuous system performance deterioration once the boundary of the system operational region is breached.

In this paper, efficient sensor deployment strategies are developed to increase coverage in wireless mobile sensor networks. The sensors find coverage holes within their Voronoi polygons and then move in an appropriate direction to minimize them. Novel edge-based and vertex-based strategies are introduced, and their performances are compared with existing techniques. The proposed movement strategies are based on the distances of each sensor and the points inside its Voronoi polygon from the edges or vertices of the polygon. Simulations confirm the effectiveness of the proposed deployment algorithms and their superiority to the techniques reported in the literature.

A wireless Body Area Network (BAN) consists of multiple radio-enabled wearable and implantable sensor nodes for use inside or in proximity to the human body. BANs are expected to balance requirement for reliable communication of their nodes with a need for battery energy conservation to ensure their longevity. The main challenge in managing this tradeoff is the inability of interfering BANs to explicitly coordinate their transmissions. This may result in unacceptably high battery energy draining rates to overcome cross-interference by other BANs in the vicinity. Here, we propose a utility-based, link-layer adaptation framework for balancing these tradeoffs for each BAN as well as across different BANs. The framework accounts for the utility of the BANs data rates and penalties associated with high transmission powers. Our analysis indicates that link-layer adaptation is beneficial for mitigating the interference from multiple adjacent BANs. Simulation results support our mathematical framework, indicating a much better spectral efficiency obtainable by using link layer adaptation techniques.

This paper reports on work in progress on modeling of the effect of packet-level TCP congestion avoidance dynamics on flow-level Internet performance and management including buffer sizing under arriving/departing flows. The proposed model accounts for the packet-level TCP burstiness due to congestion avoidance dynamics by incorporating the entire effective bandwidth of TCP-controlled traffic as opposed to the conventional model which accounts for the average TCP rate only. In particular, we demonstrate that conventional Markov model of Internet performance is applicable only in a case of sufficiently heavy average load corresponding to long flow-level queues and file transfer times. In a case of lighter average load the conventional Markov performance model significantly underestimates flow-level queues and file transfer times, and surprisingly a simpler mean-field performance model may be more accurate. While increasing buffer sizes causes proportional increase in the worst-case packet-level delays, the positive effect on the average capacity utilization and flow-level performance may be muted due to increase in the TCP burstiness. These conclusions may explain and quantify observed self-similarity of TCP traffic, and have important implications for the Internet design, operations, and management.

Allowing selfish agents to acquire and exploit system information has both positive and negative effects on the overall performance of resource allocation systems. The positive effect results from reduction in the uncertainty inherently present in large-scale systems. The negative effect, which can be mitigated through congestion pricing, is due to agent selfishness. However, current research, concentrated around the notion of “Price of Anarchy”, is mostly concerned with the negative effect. This paper evaluates systemic risks/benefits of selfish agent ability to acquire and exploit dynamic system information in a specific case of selfish routing in a large-scale, random, loss network. Our analysis indicates that the beneficial effect of this ability dominates in a case of high system uncertainty - low load, while the negative effect dominates in a case of low system uncertainty - high load. In the intermediate cases while the beneficial effect still dominates in the “normal” operating mode, the negative effect manifests itself in a risk of cascading overload driving the system to an emergent metastable, i.e., persistent, congested mode. Future research should consider resource allocation models with elastic selfish users and evaluate effect of the congestion pricing.

This paper reports on work in progress on developing a unified co-evolutionary/pricing framework for Mobile Sensor Networks (MSN) self-organization. MSN self-organization involves cooperative sensor positioning and formation of a multi-hop Mobile Ad-hoc NETwork (MANET) enabling sensor information acquisition and communication while prolonging MSN life-span. A number of inherent MSN traits such as lack of centralized control and variety of performance criteria suggest framing MSN self-organization as a sensor co-evolutionary optimization. The first issue to be addressed is aligning individual sensor utility/fitness landscapes with the overall MSN goals as “selfish” sensor behavior may result in suboptimal overall MSN performance. The paper proposes using “socially optimal pricing” to internalize the effect of each sensor relocation on the overall MSN performance. It is assumed that intermediate nodes in the MSN relay sensor information to a single fusion point without processing. The proposed framework is illustrated for the special case of a MSN tracking a single target.

In this paper, efficient sensor deployment algorithms are proposed to improve the coverage area in the target field. The proposed algorithms calculate the position of the sensors iteratively, based on the existing coverage holes in the target field. The multiplicatively weighted Voronoi (MW-Voronoi) diagram is used to discover the coverage holes corresponding to different sensors with different sensing ranges. Under the proposed procedures, the sensors move in such a way that the coverage holes in the target field are reduced. Simulation results are provided to demonstrate the effectiveness of the deployment schemes proposed in this paper.

We investigate the metastable behavior in a model of a cellular network with multiple service classes. While the Markov model provides an accurate "microscopic" model of the network behavior, the dimension of this model grows exponentially with the number of cells precluding solution of the corresponding Kolmogorov equations. Dimension of the mean-field approximation model grows only linearly with the number of cells making this approximation computationally tractable. Through numerical analysis we show that the equilibrium manifold of the mean-field model develops "folds" under increasing network load which give rise to multiple stable equilibria. These multiple equilibria can be interpreted as describing network's metastable states. By comparing simulation data with numerical computations we show that mean-field approximation can be used to predict equilibrium states of a realistic network. We construct a sample phase diagram showing distribution of metastable regions in the user load plane, derive a formula for the likelihood of successful service completion for metastable states and discuss performance characteristics of the network.

F.P. Kelly et. al. have proposed the aggregate utility maximization framework for fair bandwidth sharing among competing elastic demands. This paper advocates extending of the aggregate utility maximization framework for balancing a wide range of the conflicting requirements of the elastic users/contracts. An elastic user/contract is capable of adjusting not only its transmission rate, but also a wide range of burstiness and quality of service parameters as well as willingness to expend resources, such as battery power in a wireless network. The extended framework attempts to maximize the aggregate utility assuming that each elastic user/contract quantifies its preferences with respect to the contract parameters in terms of the individual utility function, and the aggregate utility is a sum of individual utilities of all users. Decentralized maximization of the aggregate utility leads to the minimum cost routing solution, typically with more than one feasible route having minimum cost among all feasible routes. The paper suggests that instability problems of such equal cost multipath routing can be alleviated with Optimized Multipath Shortest Path First (OMP-SPF) routing algorithm. The paper also discusses specific cases of network management solutions, including survivability of the network services and self-organization in a wireless network by resolving trade-offs between user willingness to transmit and depleting the battery power affecting the network life expectancy. Future efforts should be directed towards developing decentralized pricing schemes for complex contracts capable of maximizing the aggregate utility.

Traditional approaches to network provisioning assume availability of the reliable estimates for the expected demands. This assumption, however, oversimplifies many practical situations when some incomplete information on the expected demands is available, and proper utilization of this information may improve the network performance. In a case of traffic engineering the uncertainty in the expected demands may be a result of sudden changes in the demand pattern, when significant statistical uncertainty in determining the varying demand pattern and possible undesirable transient effects make continuous adjustment of the routing algorithm to varying demands difficult. A long-term network provisioning, e.g., capacity planning, is a subject to uncertainties in the overall economic conditions. Despite the network may be capable of controlling demands through pricing, the overall economic condition affect the priced-demand curve. As the recent sharp downturn in the demand for communication bandwidth demonstrated, making long-term network planning decisions without assessing reliability of the underlying assumptions on the expected demands may lead to disastrous results. Assuming that the expected demand is an unknown mixture of some known scenarios, i.e., demand matrices, this paper proposes a framework for robust network provisioning by guarding against the worst case scenario with respect to the future demands. This framework can be interpreted as a game between the network, e.g., service provider, and nature. The service provider makes the network provisioning decisions in an attempt to minimize losses due to the uncertain future demands, while the nature selects a feasible demand matrix. Solution to this game balances risks of over and under provisioning of the network.

This paper proposes a framework for optimized multipath routing in a wireless network with frequently changing topology. The topology changes may be due to node mobility in mobile ad hoc networks, or limited node reliability and power supply in sensor networks. The framework attempts to minimize losses (regrets) resulted from uncertainty in the network state at the point of making the routing decision. This uncertainty results from delays in propagating rapidly changing network state information and high cost of network state updates in terms of the network resources. The framework yields the optimal route mixture in the neighborhood of the "best" route. This is consistent with observation [1] that while a desirable goal is to deliver data along the best available (primary) route, maintaining multiple routes through multipath may have beneficial effect on the network performance due to keeping track of the "best" route. The proposed framework explicitly accounts for this effect by assuming that the routing affects the level of uncertainty. Resiliency of the routing under uncertainty may be achieved by assuming that the uncertainty is adversarial, given the available information on the network state. This framework naturally allows for the game theoretic interpretation with routing algorithm making a feasible routing decision and adversarial environment selecting a feasible, i.e., consistent with available information, network state. The optimal route mixture is identified with (generally mixed) Nash routing strategy in the corresponding game. Future efforts should be directed towards solving the corresponding games.

A cost based admission control and routing scheme admits an arriving request on the minimum cost route if this cost does not exceed the cost of the request, and rejects the request otherwise. Cost based strategies naturally arise as a result of optimization of network performance or incorporating quality of service (QoS) requirements into the admission and routing processes. In the former case, the implied cost of the resources represents expected revenue losses due to insufficient resources to service future requests. In the latter case, the cost of a route represents the expected level of QoS provided to the request. In both cases, due to aggregation, the statistical nature of the resource costs, propagation and queueing delays in disseminating signaling information, and a nonsteady or adversarial operational environment, the exact resource cost may be unknown. Usually, this uncertainty is modeled by assuming that resource costs are random variables with fixed probability distributions, which may or may not be known to the network. This paper explores a different approach intended to guard against adversarial uncertainty, i.e., worst case scenario, with respect to the resource costs lying within known "confidence" intervals. We assume that the network minimizes, and the adversarial environment maximizes, the loss or risk resulting from non-optimal admission and routing decisions due to the uncertainty. In a symmetric case, we explicitly identify the optimal network strategy by solving the corresponding game of the network against environment.

A new routing and, performed by the leaky bucket regulators, congestion control strategy in ATM networks is proposed. The "potential" source provides the network with its characteristics and required quality of service. Based on this information, the network makes the admission and routing decisions and selects parameters of the leaky bucket "regulators" reinforcing the contract. The strategy minimizes the weighted average delay in the network, subject to the constraints on the average delays for the individual sessions and on the nodes buffers' overflow probabilities.>