Speaker verification (SV) systems, crucial for securing online banking and Internet of Things devices, employ human voice biometrics to identify users. However, as these state-of-the-art systems rely on machine learning models, they are susceptible to adversarial attacks. Presently, there exists no defense system entirely immune to every form of adversarial attack. This work aims to develop a defense mechanism capable of effectively countering a broad spectrum of known adversarial threats. Our approach introduces an ensemble defense system that integrates the minimum energy in high frequencies for short time (MEH-FEST) and noise-adding (NA) strategies. To evaluate the performance of a defense system, a revised measure, namely the Refined F1 score, which incorporates the maximum false negative rate (MFNR) instead of the false negative rate in the traditional F1 score, is proposed. Experimental results reveal that our defense system achieves an MFNR 13.5% across 110 adversarial attacks. Consequently, while an SV system with a singular defense strategy may reach a maximum refined F1 score of 0.16, our ensemble defense system significantly improves performance, achieving a score of 0.91. This underscores its enhanced effectiveness in protecting against adversarial attacks. Furthermore, an ensemble attack method is designed to counter the proposed defense, incorporating two adaptive attacks against the NA defense and a novel strategy against the MEH-FEST detection. Experiments demonstrate that this ensemble attack significantly diminishes the effectiveness of the ensemble defenses.

In smart home, voice control becomes a main interface between users and smart devices. To make voice control more secure, speaker verification systems have been researched to apply human voice as biometrics to accurately identify a legitimate user and avoid illegal access. In recent studies, however, it has been shown that speaker verification systems are particularly vulnerable to adversarial attacks. In this work, we attempt to design and implement a defense system that is simple, light-weight, and effective against adversarial attacks for speaker verification. Specifically, we study two opposite operations to preprocess input audios in speaker verification systems against adversarial attacks: denoising that attempts to remove or reduce perturbations and noise-adding that adds small Gaussian noises to an input audio. We show through experiments that both methods can significantly degrade the performance of a state-of-the-art adversarial attack. Specifically, it is shown that denoising and noise-adding can reduce the targeted attack success rate of the attack from 100% to only 56% and 5.2%, respectively. Moreover, noise-adding can slow down the attack 25 times in speed and only has a minor effect on the normal operations of a speaker verification system.

Epidemic routing is considered useful for wireless mobile sensor networks where infrastructure support is limited and sensed information has to be disseminated in a timely manner. The relaying overhead of epidemic routing, however, needs to be reduced to conserve energy. In this paper, we study a new problem: what is a good strategy in epidemic routing to self-stop forwarding a message when a certain percentage of nodes have received a copy of the message? The goal of such a strategy is to disseminate the information to a certain percentage of nodes in the network in a timely and predictable manner, and at the same time to cooperatively avoid further spreading when the goal has been reached. As a first attempt, we focus on wireless mobile sensor networks where nodes move rapidly and randomly around and a synchronous time model is applied. We first select an accurate mathematical model to characterize the information dissemination in wireless mobile sensor networks. We then apply and extend the model to analyze and design different self-stopping strategies. Moreover, we propose a new self-stopping strategy, called the time-based probabilistic self-stopping strategy, by taking advantages of both the time-based and the probability-based strategies. We find that such a self-stopping strategy is fast, accurate, and energy efficient.

Worm attacks continue to be a significant threat to the Internet and have been a main tool used by botnets to recruit bots. Worm propagation models are important for understanding worm dynamics and designing effective and efficient detection and defense systems. The existing models, however, ignore the heterogeneity in vulnerable hosts and assume that the worm-scanning rate is the same for all infected hosts. In this work, we analytically and empirically study the impact of heterogeneity of vulnerable hosts on worm propagation. Specifically, we first apply the Jensen's inequality to show that the heterogeneity in vulnerable hosts indeed hinders the speed of worm propagation. We then conjecture, through the approximation analysis, that if the degree of the heterogeneity in vulnerable hosts is higher, the worm spreads slower. Next, we propose a novel model to predict and characterize worm dynamics among heterogeneous vulnerable hosts. Finally, applying the scale-down simulations and simulating the propagation of a Witty-like worm in the Internet, we verify our analytical results and demonstrate that our proposed model can accurately predict the spread of worms among heterogeneous vulnerable hosts.

Internet worm infection continues to be one of top security threats and has been widely used by botnets to recruit new bots. In this work, we attempt to quantify the infection ability of individual hosts and reveal the key characteristics of the underlying topology formed by worm infection, i.e., the number of children and the generation of the worm infection family tree. Specifically, we first apply probabilistic modeling methods and a sequential growth model to analyze the infection tree of a wide class of worms. Through both mathematical analysis and simulation, we find that the number of children has asymptotically a geometric distribution with parameter 0.5. As a result, on average half of infected hosts never compromise any vulnerable host, over 98% of infected hosts have no more than five children, and a small portion of infected hosts have a large number of children. We also discover that the generation follows closely a Poisson distribution and the average path length of the worm infection family tree increases approximately logarithmically with the total number of infected hosts. Next, we study the infection structure of localized-scanning and permutation-scanning worms through simulation and surprisingly find that the above observations also apply to these worms. Finally, we apply our findings to evaluate bot assessment strategies for forensic analysis after a worm tree has been formed.

In cognitive radio networks, secondary users must constantly probe the spectrum to promptly detect the arrival and the departure of primary users (PUs). However, spectrum probing is an energy-consuming process. This indicates the tradeoff between the frequency of spectrum probing and the delay of detecting the PU state change, and highlights the need for energy-conscious spectrum-probing strategies. In this paper, we provide a theoretical framework to find the optimal spectrum-probing methods that minimize the probing delay under a constraint on energy consumption in real stochastic environments. Specifically, we find that the most widely used spectrum-probing scheme, i.e., periodic probing, is not optimal when the arrival rate of the PU state change is not constant or when the distribution of PU channel occupancy/vacancy is not uniform. On the other hand, the derived optimal strategies can adapt to the dynamics of PUs and choose the probing intervals based on the time-varying arrival rate of the PU state change or the non-uniform distribution of PU channel occupancy/vacancy. Our simulation results show that the optimal spectrum-probing strategies perform much better and consume much less energy than periodic probing in realistic environments.

Internet worm attacks pose a significant threat to network security and management. In this work, we coin the term Internet worm tomography as inferring the characteristics of Internet worms from the observations of Darknet or network telescopes that monitor a routable but unused IP address space. Under the framework of Internet worm tomography, we attempt to infer Internet worm temporal behaviors, i.e., the host infection time and the worm infection sequence, and thus pinpoint patient zero or initially infected hosts. Specifically, we apply statistical estimation techniques and propose method of moments, maximum likelihood, and linear regression estimators. We show analytically and empirically that our proposed estimators can better infer worm temporal characteristics than a naive estimator that has been used in the previous work. We also demonstrate that our estimators can be applied to worms using different scanning strategies such as random scanning and localized scanning.

Peer-to-peer botnets formed by worm infection have become a real threat to the Internet and are expected to become rampant in the near future. In our previous work, we have analyzed the underlying botnet topology formed by worm infection, without considering potential user defenses. In this paper, we extend the study to characterize the evolution of the botnet structure when users patch or clean part of infected hosts after all vulnerable machines are compromised. Specifically, we examine the number of peers of an infected host and the size of disconnected botnets under random node removal through simulation. We find that when part of infected hosts are patched or cleaned, the distribution of the number of peers follows closely an exponential distribution, whereas the distribution of the size of isolated botnets is power-law. Moreover, we also evaluate a simple countermeasure by botnets that enhances topology robustness through worm re-infection, and show that re-infection can significantly mitigate the effectiveness of patching and cleaning on the botnet structure. We believe that such a study can not only provide better understandings on both the strength and the weakness of botnets, but also better prepare us for future attacks.

In cognitive radio networks, dynamic spectrum access is achieved by allowing secondary users (SUs) to probe the spectrum and utilize available channels opportunistically. Spectrum probing mechanisms should be efficient and fast to avoid harmful interference with primary users (PUs). Periodic probing has been commonly adopted as a default spectrum probing mechanism. In this paper, we attempt to study different spectrum probing mechanisms and evaluate a performance metric called the probing delay, i.e., how quickly a probing mechanism can detect a channel change. We find that randomization in the probing strategy does affect the probing delay. Specifically, in the independent sensing scenario, periodic probing indeed achieves the smallest probing delay. In the cooperative sensing scenario, however, randomization can drastically reduce the probing delay.

Advances in wireless sensor networks and embedded devices make it possible to develop new solutions for smart home health care at a low cost. This paper describes a wireless body sensor system that monitors physiological vital signs of a person while staying at home. Specifically, a waist-mounted triaxial accelerometer unit is used to record human movements. Sampled data are transmitted using an IEEE 802.15.4 wireless transceiver to a data logger unit. The acceleration measurement tests show that it is possible to classify different human motion through the acceleration reading. When IEEE 802.15.4 devices are used at home, there is interference from nearby IEEE 802.11 signals and microwave ovens. The data delivery performance, however, is found to be satisfactory and can be improved by selecting an appropriate channel. On the other hand, the wireless signal can be attenuated by housing materials, home appliances, and even plants. Therefore, the deployment of wireless body sensor systems at home needs to take these factors into consideration.

This paper describes simulation work in modeling a city-wide trunked radio system and evaluating its performance under stress. Specifically, traffic models are developed to simulate both routine background traffic and the traffic load associated with an emergency scenario of a high-rise apartment fire. An analysis of a one-month radio data log provided insights on the traffic distribution among different talk-groups, as well as building individual traffic loading profiles for the talk-groups directly involved in the emergency response. The performance of the radio system is evaluated under different traffic loading intensity levels. Initial simulation results show that this emergency response communication system provides adequate capacity even under intense traffic loading. However, one area of concern is the build-up of waiting calls within some heavily loaded talk-group, which results in long waiting time to access the channel.

Botnets have become one of top threats to the Internet. Many detection methods have been developed to distinguish botnet behaviors from normal human behaviors. Future botnets, however, may incorporate the characteristics of human beings and weaken the existing detection techniques. In this work, we study an intelligent botnet, called the delay-tolerant botnet, that intentionally adds random delays to the command propagation and endeavors to avoid the detection. We then apply mathematical analysis to derive the average delay required to distribute a command to all bots in three types of command and control architectures: centralized, distributed, and hybrid delay-tolerant botnets. We find that in all cases, the delay increases approximately logarithmically with the number of bots, indicating that the delay-tolerant botnets are scalable. Finally, we verify the analytical results by simulations.

Primary user emulation attacks are a potential security threat to cognitive radio networks. In this work, we attempt to characterize an advanced primary user emulation attack and an advanced countermeasure against such an attack. Specifically, we show that both the attacker and the defender can apply estimation techniques and learning methods to obtain the key information of the environment and thus design better strategies. We further demonstrate that the advanced attack strategy can defeat the naive defense technique that focuses only on the received signal power, whereas the advanced defense strategy that exploits the invariant of communication channels can counteract the advanced attack effectively.

The movement of real users often follows patterns that can be characterized by certain statistical metrics of the contacts. Such metrics are useful for routing decisions, especially in sparse mobile ad hoc networks where node connectivity is opportunistic and messages are delivered using store-carry-forward routing. Past analysis on real-world data traces indicates that human behaviors affect the node contact pattern and spatial dependency exists among mobile nodes. A new metric called the expected dependent delay that characterizes the expected delay of a contact dependent on the previous hop is proposed. It characterizes the spatial dependency between neighboring contact pairs and reflects the regularity in node movement. In sparse opportunistic mobile ad hoc networks, a good approximation of the expected delay of a multihop path can be derived as the sum of the expected delay of the first hop and the expected dependent delays of later hops. We apply the proposed path-delay estimation to end-to-end routing. Simulation results show that compared with routing schemes that consider only the delivery probability or the expected delay, the proposed scheme can reduce the message delay significantly, when the network is sufficiently sparse and the spatial dependency is quantitatively constant over time. Moreover, the proposed method is tractable and can be easily implemented in combination with other routing techniques such as multipath routing and per-contact routing.

Internet worm attacks pose a significant threat to network security. In this work, we coin the term Internet worm tomography as inferring the characteristics of Internet worms from the observations of Darknet or network telescopes that are routable but unused IP addresses. Under the framework of Internet worm tomography, we attempt to infer worm temporal behaviors such as the host infection time and the worm infection sequence, and thus pinpoint patient zero. Specifically, we introduce statistical estimation techniques and propose method of moments, maximum likelihood, and linear regression estimators. We show analytically and empirically that our proposed estimators can better infer worm temporal characteristics than a naive estimator that has been used in the previous work.

This work presents a closed-form expression for characterizing the spread of static worm-scanning strategies through a mean-field approximation. Our model can both accurately capture the worm propagation speed before the number of infections becomes large and explicitly demonstrate the effects of important parameters such as the vulnerable-host distribution and the worm-scanning strategy. Our approach is based on the mean-field theory that investigates the average number of infected hosts over time. Experiments are carried out based on the parameters chosen from the Witty worm. Experimental results verify that the closed-form expression can accurately reflect the mean value of infections over time before the infected hosts become saturated for a wide range of scanning methods. Therefore, our model can help defenders design better detection and defense systems and provide a stepping stone towards obtaining closed-form expressions for the propagation of dynamic worm-scanning strategies.

Internet worms have been a significant security threat. Divide-conquer scanning is a simple yet effective technique that can potentially be exploited by future Internet epidemics. Therefore, it is imperative that defenders understand the characteristics of divide-conquer-scanning worms and study the countermeasures. In this work, we first provide the intuitions that a divide-conquer-scanning worm can potentially spread faster and stealthier than a traditional random-scanning worm. We then characterize the relationships between the propagation speeds of divide-conquer-scanning worms and the distributions of vulnerable hosts through mathematical analysis and simulations. Specifically, we find that if vulnerable hosts follow a non-uniform distribution such as the Witty-worm victim distribution, divide-conquer scanning can spread a worm much faster than random scanning. We also study empirically the effect of important parameters on the spread of divide-conquer-scanning worms. Furthermore, to counteract such attacks, we discuss the weakness of divide-conquer scanning and study a defense mechanism.

Localized scanning is a simple technique used by attackers to search for vulnerable hosts. Localized scanning trades off between the local and the global search of vulnerable hosts and has been used by Code Red II and Ninida worms. As such a strategy is so simple yet effective in attacking the Internet, it is important that defenders understand the spreading ability and behaviors of localized-scanning worms. In this work, we first characterize the relationships between vulnerable-host distributions and the spread of localized-scanning worms through mathematical modeling and analysis, and compare random scanning with localized scanning. We then design an optimal localized-scanning strategy, which provides an upper bound on the spreading speed of localized-scanning self-propagating codes. Furthermore, we construct three variants of localized scanning. Specifically, the feedback localized scanning and the ping-pong localized scanning adapt the scanning methods based on the feedback from the probed host, and thus spread faster than the original localized scanning and meanwhile have a smaller variance.