Distributed Denial-of-Service (DDoS) attacks are widespread for Internet of Things (IoT) systems that aim to disrupt the availability of a system completely (high-rate DDoS) or partially (low-rate DDoS). Design and placement of intrusion detection systems (IDSs) for DDoS attacks on IoT systems are challenging due to the low power and lossy nature of networks. Existing IDSs are designed to handle either high-rate or low-rate DDoS but cannot handle both with good accuracy. Existing IDS placement techniques are mostly nontransparent, making malicious nodes aware of the presence of IDS nodes. Most of the IDS placement strategies are nonoptimal, making them energy inefficient. Accordingly, this work proposes a transparent, optimally placed, distributed IDS solution, namely, OPTIMIST, which can handle both high-rate and low-rate DDoS attacks with good accuracy. The placement problem is formulated as the weighted minimum vertex cover problem of a${K}$-uniform hypergraph and solved with an approximation algorithm. The IDS module is based on a long short-term memory (LSTM) model where a novel offline training method for LSTM is proposed using Wasserstein GAN-generated artificial flows. Extensive experimentation on simulation and testbed shows that the OPTIMIST can best achieve the balance between DDoS detection and energy overhead.

Scan chain-based Design for Testability is the industry standard in use for testing manufacturing defects in the semiconductor industry to ensure the structural and functional correctness of chips. Fault coverage is significantly enhanced due to the higher observability and controllability of the internal latches. These ensuing benefits to testing, if misused, expose vulnerabilities that can be detrimental to the security aspects, especially in the context of crypto-chips that contain a secret key. Hence, it remains of paramount importance for a chip designer to secure crypto-chips against various scan attacks. A countermeasure is proposed in this article that preserves the secrecy of an embedded key in a cryptographic integrated circuit running an Advanced Encryption Standard (AES) implementation. A novel design involving a hardware unit is illustrated that circumvents differential scan attacks by essentially performing bit flips deterministically, using a pre-computed mask value. This helps secure the chip while retaining full testability. The controller logic directly depends on a mask determination algorithm that can defend against any scan attack with 𝒪 theoretical complexity. Security analysis of our proposed defense procedure is performed in the framework of Discrete Event Systems (DES). The sequential scan circuit of an AES cryptosystem is modeled as a DES using Finite State Automata. A security notion, Opacity , is used to quantify and formally verify the security aspects of our controlled system, which shows that the entropy of the secret key is preserved. A case study is performed that shows to mitigate state-of-the-art differential scan attacks successfully at a nominal extra overhead of 1.78%.

This article introduces a fault localization method to extract the exact location of single and multiple missing gate faults in reversible \( k \) -CNOT -based circuits. The primary target of the proposed method is to obtain the complete test set for localizing faults in \( k \) -CNOT circuits. We propose a fault localization algorithm to construct a fault localization tree that can be used to find equivalent and non-equivalent faults. For the non-equivalent faults, the test sequences can be obtained from the fault localization tree that uniquely localizes the non-equivalent faults. Finally, this article presents the experimental results and comparative analysis with existing works.

Low-power design is a major concern in the circuit design domain. The reversible circuit is an alternative for moving beyond the conventional ways of computing. For performing the high reliability and the correctness of the circuit, testing is necessary for evaluating the faults. This paper presents the fault detection method for classical fault models like stuck-at faults and bridging faults in reversible circuits using the negative-controlled augmented k-CNOT based circuit. We initially construct the n number of test vectors with n input lines for a given circuit. The constructed test vector sequences successfully attempt as the complete test set on the testable design augmented k-CNOT circuit for detecting faults. The proposed method applies to several benchmark circuits for detecting the stuck-at and bridging faults and also comparative analysis is prepared with some existing works.

Scan based DfT is the de facto standard for testing the functional and structural correctness of chips. It provides high observability and controllability of internal latches leading to enhanced fault coverage, but can also induce vulnerability in crypto-chips containing an embedded secret key. Protecting crypto-chips against scan attack is of paramount concern to a designer. In this paper, we propose a countermeasure using a controller to circumvent differential scan attacks on crypto-chips running an AES implementation. The controller we design is minimally restrictive and ensures security by performing deterministic bit flips yet maintaining full testability. The controller logic directly depends on input-based pre-computed mask values and the controlled system behaviour is formally verified to be secure using the notion of Opacity. We evaluate our defense by launching recent attacks on the AES cryptosystem. Our security analysis shows that the proposed technique is secure against the state of the art scan based differential scan attacks with a nominal hardware overhead of 0.94%.

Internet of Things (IoT) is a way to communicate with the real world without much human involvement. It is booming in today's computing world, with billions of devices having sensors and actuators connected to the internet using various low power technologies. Despite several profits, it experiences multiple security threats that impel catastrophic crashes in the IEEE 802.15.4e (6TiSCH) network. Various threats like jamming attacks, DDoS, abnormal behavior, etc., are detected using multiple Machine Learning (ML) and Deep Learning (DL) approaches. In this paper, an edge-based ML enables Intrusion Detection Systems (IDS) is proposed to detect distributed denial-of-service (DDoS) attack patterns from a particular source. Experimental outcomes confirm that the proposed approach is scalable and efficient in terms of computation and storage. Hence, the intended approach gives a faster response as (24.2- 68.9) Sec. The average memory utilization (ROM/RAM), energy usage, and accuracy achieved by our intended solution are 35834B/5378B, 85916mJ, 98.7%, respectively, which outperform closely related work.

Nowadays, the reliability in network-on-chip (NoC) has become a crucial issue that leads to network performance degradation. Built-in-self-test (BIST) is one of the primary test schemes often used to achieve high reliability. The scheme allows a frequent test of and recovery from faults experienced on an NoC’s fundamental component, e.g., communication channels. This paper presents a BIST approach that detects open and short faults in communication media to demonstrate the fault-masking phenomenon. The phenomenon as the self-repairing mode of the communication media improves the yield and performance of the NoCs. Rigorous simulations are made on an 8×8 mesh NoC with faulty and repaired channels. Results reveal that allowing faults in communication tracks degrades the network performance up to 30% while the self-repairing mode improves nearly 75%.

This paper introduces a fault diagnosis technique to obtain the exact location of Single Missing Gate Faults (SMGFs) in$k$-CNOT based reversible logic circuits. The proposed fault diagnosis technique establishes that the generated single test vector can identify the exact location of SMGFs. For this purpose, we construct the augmented circuit that behaves as Circuit Under Test (CUT) and the testable augmented circuit is used for detecting the SMGF faults. The parity checking operations are included in the constructed augmented$k$-CNOT circuit to obtain the exact location of SMGF. Finally, this paper presents the experimental results and analysis in order to show the effectiveness of determining the exact location of faults in a$k$-CNOT circuit.

Constrained Application Protocol (CoAP), an IETF-standardized web transfer protocol, is specially designed to facilitate resource-constrained devices and low power, lossy networks. The steep rise in extensive deployment of Internet of Things (IoT) technology, of late, makes it necessary for web services to be used over the internet by constrained wireless nodes for a majority of Machine-to-Machine (M2M) applications. However, considering that the system is constrained, ensuring security is a challenge when employing CoAP since it uses User Datagram Protocol (UDP), which is unrealiable and lacks handshaking mechanism. A malicious endpoint with read and write access can severly jeopardize service availability by launching an IP address spoofed attack. Moreover, it can help mount other complex Distributed Denial-of-Service (DDoS) attacks like amplification attacks. Though response spoofing vulnerability has been addressed in the research community for quite some time now, request spoofing countermeasures are relatively few. In this paper, we propose an attacker identification scheme using a Discrete Event System (DES) based Intrusion Detection System (IDS). Through our scheme, we not only detect request and response spoofing attack in CoAP, but also identify the adversarial node by analysing the LoWPAN event dynamics generated due to probe responses. Correctness of our approach is guaranteed by construction of a DES diagnoser. We have tested our approach on Contiki OS. The experimental results show our proposed scheme to be energy efficient with response time of approx 6 sec at 99.2% accuracy.

Routing is critical in the Internet of Things (IoT) environment, which encompasses deployment of restrained devices like sensors and RFIDs in a large-scale. In the IoT environment, these restrained devices together form Low Power and Lossy Networks. The routing protocol assimilated for LLNs is Routing Protocol for Low power and Lossy Networks. The Root node solely manages the arrangement and maintenance of nodes present in the DODAG, via control messages, to disseminate the information of the network. Multiple nodes of the LLN in the DODAG are connected to the root node. Therefore, any node wants to join the DODAG must have connectivity with the root node. Adversary node isolates a group of IoT network nodes from the root node due to the vulnerability of the flow sequence of the control messages. In the Network Isolation Attack (NIA) specifically, an adversary node forms its own network without the knowledge of root node and victim nodes are unaware that they are not connected to the root node. This threat creates separate topology, packet loss etc in the network. In this paper, we propose a mitigation technique against the NIA in DODAG of 6LoWPAN network. The effect of the threat and mitigation technique is analyzed through simulation using Cooja simulator. The performance is analyzed in terms of metrics i.e, no. of devices isolated from the sink device and average Packet Delivery Ratio. The proposed mitigation technique performs better than RPL against NIA in DODAG.

Nowadays System on Chip (SOC) is used widely. Clients require gadgets that can handle several applications progressively. Due to an increase in the number of applications, the number of cores embedded in SOC increased too. Each core has a large number of components which increases the probability of occurring of bridging faults in SOC. Efficient testing of these faults is necessary. Testing larger SOC needs large test data volume (TDV), large test access time (TAT). It is hard to store this large amount of test data. It requires a large amount of time to process this test data which makes the testing sluggish. Testing is more complicated for large SOCs. Various traditional methods for testing bridging faults are already proposed to test SOC thoroughly. These strategies are accurate but more expensive in terms of testing resources and the cost of testing. A large number of cores in SOC leads to long TAT which is infeasible sometimes. In this paper, a method is proposed to test the bridging faults and to reduce the TDV and TAT. We propose an efficient method for incomplete testing of SOC considering bridging faults which affectively reduces the TDV but with a little compromise with the fault coverage. In this method, essential bridging faults are considered and a heuristic optimization technique is utilized to improve the TDV while compromising with the quality of testing.

The ability to maintain functional and temporal correctness in the presence of faults is a key requirement in many safety-critical embedded systems. This work proposes an efficient fault recovery mechanism for real-time multiprocessor systems scheduled using a low overhead, semi-partitioned optimal proportional fair scheduling technique. We assume a system that can handle a single permanent processor fault at any time, using cold back-ups (with pre-specified activation / recovery time subsequent to the detection of a fault). As a result of the fault, the system may suffer transient overloads during such recovery periods, potentially leading to unacceptable fairness deviations and consequent rejections / early terminations of critical jobs. The proposed fault-tolerant scheduler, called Fault Tolerant Fair Scheduler (FT-FS), attempts to minimize such job terminations / rejections during recovery, by judiciously redistributing slacks accumulated by a subset of jobs, delivering more sustainable performance in the process. Experimental results reveal that the proposed FT-FS algorithm performs appreciably even under high system loads. Practical applicability of our proposed scheme has been illustrated using a case study on aircraft flight control system.

With the continuous growth in wire density, the reliability has become a dominant burden while channels of a modern NoC are exposed to various faults. A key requirement for the NoC is therefore to propose a mechanism that can account for a channel fault since it significantly impacts NoC performance. This paper presents a distributed test strategy that detects and diagnoses logic-level faults coexist in NoC channels and deeply analyze the severe impact of these faults on network performance. Fault coexistence in channels makes a fraction undetectable and is addressed here. Simulation results demonstrate the effectiveness of the proposed strategy.

The reversible logic circuit is a prominent research area for its low-power design, and also quantum computing. The development of synthesis and optimization is a well-known problem in the reversible circuits. For ensuring the high reliability and integrity performance of these circuits, the proper testing technique will be required to detect and locate the faults. In this paper, we consider the problem of reversible circuit testing, specifically targeting the fault detection for the missing-gate fault model in the k-CNOT based reversible circuit. It has been shown that n number of test vectors is sufficient for the detection of all single missing-gate faults (SMGFs), repeated-gate faults (RGFs), and partial missing-gate faults (PMGFs) of the proposed fault detection scheme in a reversible circuit with n inputs. Finally, we provide our experimental results based on several benchmark circuits and also show the comparative analysis with existing methods.

The maximizing yield concept ensures a semi-conductor manufacturing structure towards recognizing, diminishing, and avoiding yield-related defects and contamination. According to the current scenario of technology scaling, manufacturing yield is measured in terms of the number of perfect chips produced. However, in this paper, an imperfect chip producing a good-enough result like Approximate Circuit (AxIC) can also be considered and helps enhance the yield. Hence, this paper's primary objective is to identify those acceptable circuits (AcICs) through retesting, which indirectly increases the effective yield. The basic idea is to divide the testing process into two phases. In the first phase, we follow a conventional test flow architecture and collect the rejected circuits. In the second phase, all the rejected circuits that are tested imperfect in the first phase are retested by applying the test patterns. During this phase, the circuit may produce wrong results for some test patterns, but we should ignore and continue the test until all the test patterns are applied. The test patterns for which the circuit produces a wrong result (error) are quantified and checked against the golden output for deviation. If the amount of deviation is nominal and does not affect the circuit's overall performance, then the circuit is accepted as an AxIC. Though the circuit does not precisely follow the definitions of AxICs, it can significantly contribute to the yield enhancement and termed as AcICs.

In modern-day deep sub-micron technology various cores and components are integrated on a single chip called System on Chip (SOC). To assure performance of SOC, intra-core communication must be efficient and accurate. Network on Chip (NOC) plays a vital role in communication among cores, memory, input-output, and other components. Increased density of components on-chip enhances the probability of failure. Failure can be due to faulty components, link failure, deadlock, livelock, starvation, congestion, etc. To avoid failure in communication, we need an efficient algorithm that must have properties like deadlock-free, livelock free, highly adaptive, fault-tolerant, minimal etc. In this paper, we propose a novel fault-tolerant, deadlock-free, livelock free, fully adaptive, and minimal breadth-first search (BFS) based routing algorithm which routes a packet from source to destination efficiently. The simulation results depict that our algorithm can route packets in the presence of faulty links or faulty components. It also gives the alternate routes while facing faults.

A formal modeling of a Network-on-Chip (NoC) using a communicating finite state machine (CFSM) is presented in this article. We have automated the CFSM model generation for NoCs with Mesh and Torus topologies. To verify deadlock in an NoC, we need to consider the formal model of all the routers in a given topology. It is not supported by the available verification tools due to the state space explosion problem. An NoC simulator gives only a warning message about a possible deadlock, which does not guarantee a real deadlock situation. Therefore, we have developed a simulation framework based on our CFSM models of NoCs in which any routing algorithm can be simulated over a given traffic pattern. Our simulation framework confirms real deadlock when simulation reaches a state from which no progress is possible. We have shown that this situation actually depicts cyclic dependencies among the different NoC components. As a proof of concept, we have implemented our simulation framework for one static routing and two adaptive routing algorithms. The experimental results show that our method is scalable. This is possible because we only check the existence of a deadlock for a given traffic pattern at a time, rather than for all possible traffic patterns. Our approach opens up a way to verify other NoC properties such as starvation, livelock, and so on for a given routing algorithm for any realistic traffic patterns.

Safety-critical systems implemented on multicore platforms need to satisfy stringent power dissipation constraints such as thermal design power (TDP) thresholds used by chip manufacturers. Power dissipation beyond TDP may trigger dynamic thermal management (DTM) in order to ensure thermal stability of the system. However, the application of DTM makes the system susceptible to higher unpredictability and performance degradations for real-time tasks. This paper proposes a formal scheduler synthesis framework that guarantees adherence to a system level peak power constraint while allowing optimal resource utilization in multicores. Our proposed framework makes use of supervisory control of timed discrete event systems as the underlying formalism. All steps starting from individual models to construction of the scheduler have been implemented through binary decision diagram based symbolic computation, so that the state-space complexity associated with the framework may be controlled. Furthermore, the synthesis framework has been extended to handle tasks with phased execution behavior. Conducted experiments have shown promising results and indicate to the practical efficacy of our approach.

High--performance multiprocessor SoCs used in practice require a complex network-on-chip (NoC) as communication architecture, and the channels therein often suffer from various manufacturing defects. Such physical defects cause a multitude of system-level failures and subsequent degradation of reliability, yield, and performance of the computing platform. Most of the existing test approaches consider mesh-based NoC channels only and do not perform well for other regular topologies such as octagons or spidergons, with regard to test time and overhead issues. This article proposes a topology-agnostic test mechanism that is capable of diagnosing on-line, coexistent channel-short, and stuck-at faults in these special NoCs as well as in traditional mesh architectures. We introduce a new test model called Damaru to decompose the network and present an efficient scheduling scheme to reduce test time without compromising resource utilization during testing. Additionally, the proposed scheduling scheme scales well with network size, channel width, and topological diversity. Simulation results show that the method achieves nearly 92% fault coverage and improves area overhead by almost 60% and test time by 98% compared to earlier approaches. As a sequel, packet latency and energy consumption are also improved by 67.05% and 54.69%, respectively, and they are further improved with increasing network size.

This paper presents a fast and low cost on-line scheme named Charka that analyzes short faults in channels of octagon NoCs. Experimental results demonstrate that the proposed scheme achieves 100% coverage metrics and its online evaluation reveals compelling effect of these faults on system performance. We observe that the proposed scheme is upto 9X faster while packet latency is improved by 13.79-21.17% and energy consumption is reduced by 17.57-24.97%. Further, the test area overhead is reduced by 13-26% that shows 52-57.77% improvement.

Safety-critical real-time systems must meet stringent timing and fault-tolerance requirements. This article proposes a methodology for synthesizing an optimal preemptive multiprocessor aperiodic task scheduler using a formal supervisory control framework. The scheduler can tolerate single/multiple permanent processor faults. Further, the synthesis framework has been empowered with a novel BDD-based symbolic computation mechanism to control the exponential state-space complexity of the optimal exhaustive enumeration-oriented synthesis methodology.

Packet corruption, misrouting, and dropping have become an extra burden on network performances due to stuck-at and open faults on network-on-chip (NoC) interconnects. Existing works for testing interconnect faults have addressed either shorts and/or stuck-ats with the assumption that the opens do not exist on interconnects. A new distributed test scheme that addresses coexistent stuck-at and open faults on NoC interconnects is proposed. The scheme is governed by a set of odd/even router and cores and takes account of testing of a subset of interconnects in turn. Results achieve 100% fault coverage in terms of packets received and dropped, and test coverage in terms of link-wires tested. Results also show evaluation of different performance metrics affected by the faulty links in a NoC.

This paper presents a scalable time optimized online test solution that addresses short faults in interconnects of an on-chip network (NoC) and observes the deep impact of these faults on NoC performance at large traffics.

Traditional bus-based systems-on-chip (SoCs) are turned to on-chip networks (NoCs) to overcome communication bottleneck. But, fabricating such NoC-based systems without any defect in interconnects or logics is a major challenge. This paper proposes a cost effective and scalable on-line test solution that detects and diagnoses intra-and inter-shorts in NoC interconnects. The proposed solution offers constant test time with general NoC topologies, and channel widths considering little hardware area and performance overheads. Simulation results establish the effectiveness of the proposed solution. We see that the test time is reduced by 0.5-11.25x achieving 100% coverage metrics. Simulation results also reveal the significant effect of interconnect shorts on network performance at large traffics. We see that our test solution improves packet latency by 14.98-40.57% and reduces energy consumption of a packet flit by 6.83-31.19%.

In an on-chip network (NoC), the channels often experience several open faults because of certain manufacturing or in-field defects. Such faults may cause enormous loss of packets degrading the reliability and performance of the system. A reliability-aware NoC should include a module that has the capability of detecting and locating an open fault in the channels so as to enable alternative routing paths and to prevent excessive packet loss. This paper proposes an on-line test scheme that detects open faults and locates the faulty channel-wires in an NoC. The proposed scheme makes use of diagonal-driven test strategy and scales well when the size of the NoC increases. We evaluate the performance of an NoC under large-traffic scenario and our simulation results establish the effectiveness of the proposed scheme in terms of several network-metrics.

The presence of open-faults in NoC channels drastically drops packets while routing them causing severe degradation of network performance. Nevertheless, it can still be compensated by utilizing a fault-repairing scheme. This paper shows how the performance of a NoC architecture can be improved through self-repairing of open channels using short-defects. Simulation results reveal that the performance degrades to nearly 30% when the channels suffer from manufacturing open-faults, and to 10% when they are self-repaired with the help of co-existent short-defects. Thus, the overall performance can be improved beyond 65%.

With the ever-shrinking global geometries on a die and the concomitant rise in the complexity of interconnections in an on-chip network (NoC), the links used therein often suffer from various manufacturing defects such as shorts. These defects not only cause logical or functional errors but also give rise to various other system level failures such as duplication, misrouting, or dropping of a packet, thereby impacting the performance of the network significantly. This paper proposes an on-line test method that detects the presence of pairwise-shorts, if any, and identifies the faulty links. Several performance metrics are evaluated to demonstrate the impact of these faults, and simulation results demonstrate 100% coverage. The proposed method scales well to large-size NoCs irrespective of the topology and link-width.

This paper presents a distributed on-line test mechanism that detects stuck-at faults (SAFs) in the channels as well as identifies the faulty channel-wires in an on-chip network (NoC). The proposed test mechanism improves yield and reliability of NoCs at the cost of few test clocks and small performance degradation. Additionally, the mechanism is scalable to large-scale NoCs. We study the impact of channel stuck-at faults on various performance metrics and simulation results establish 100% coverage metrics and the effectiveness of the proposed test mechanism.

Abstract Signature‐based intrusion detection systems (IDSs) are employed to monitor computer networks for signs of network intrusions. However, they produce a large number of false positive alarms when operated with default settings without considering the underlying network environment. Inundation of false alarms is the Achilles heel of IDS technology, which could render the IDS ineffective in detecting network attacks. Several false alarm minimization approaches have been proposed in the literature. However, there are many drawbacks associated with these works, namely, modification of well‐established attack signatures; heavy dependence on the attack signatures' reference numbers, which might not always be available; and non‐consideration of the underlying network context information. In this paper, we propose an efficient game theory‐based false alarm minimization scheme for signature‐based IDS. The proposed scheme uses a game theory‐based correlation engine to correlate IDS alarms with network vulnerabilities to minimize the overall false positive alarm rate of the IDS. Experimental results and comparison analysis of the proposed false alarm minimization framework with other frameworks on the benchmark DARPA intrusion detection evaluation dataset and an in‐house IIT Guwahati Lab dataset show that the proposed scheme achieves the highest accuracy among all the frameworks under consideration without degrading the overall detection rate of the IDS. Copyright © 2016 John Wiley & Sons, Ltd.

Media Access Layer (MAC) vulnerabilities are the primary reason for the existence of the significant number of Denial of Service (DoS) attacks in 802.11 Wi-Fi networks. In this paper we focus on the de-authentication DoS (Deauth-DoS) attack in Wi-Fi networks. In Deauth-DoS attack an attacker sends a large number of spoofed de-authentication frames to the client (s) resulting in their disconnection. Existing solutions to mitigate Deauth-DoS attack rely on encryption, protocol modifications, 802.11 standard up gradation, software and hardware upgrades which are costly. In this paper we propose a Machine Learning (ML) based Intrusion Detection System (IDS) to detect the Deauth-DoS attack in Wi-Fi network which does not suffer from these drawbacks. To the best of our knowledge ML based techniques have never been used for detection of Deauth-DoS attack. We have used a variety of ML based classifiers for detection of Deauth-DoS attack enabling an administrator to choose among a host of classification algorithms. Experiments performed on in-house test bed shows that the proposed ML based IDS detects Deauth-DoS attack with precision (accuracy) and recall (detection rate) exceeding 96% mark.

Previous works on detecting and locating manufacturing faults-shorts, stuck-at, and open on an interswitch link of a channel in a network-on-chip (NoC) have been based on the assumption that these faults do not coexist. The works failed to diagnose all these faults when this assumption is relaxed. A deficiency for non-diagnosability of these faults is then represented. A packet address driven test strategy that detects and locates a faulty inters witch link in a NoC channel is proposed. The strategy addresses the intra-channel shorts, stuck at, and open faults coexist on inters witch links and is governed by parallel activation of diagonal routers. The strategy is scalable with mesh NoCs. Simulation results achieve 100% and more than 97% fault coverages when faults are diagnosed explicitly and implicitly respectively.

In this paper we propose a high level test pattern generation scheme for integrated circuits designed at the behavioral level. The scheme is based on the directed symbolic execution that results a symbolic expression for a test path. A test pattern for a circuit under test is derived from actual values of input variables on evaluation of the resulting symbolic expression of a test path and ensures the design correctness. The derived test patterns are further used to measure the percentage of design correctness that directs us to code coverage analysis. We achieve 100% code coverage. Experiments are performed on a number of custom-built and benchmark circuits to validate the proposed test generation. The results from the experiments show as well the performance of the proposed scheme.

The failure diagnosis problem for a wide variety of systems has been studied using Discrete Event System (DES) models. The DES framework declares a fault as non-diagnosable if there is a cycle through failure states which cannot be distinguished from a similar cycle through normal states. Thorsley et al. showed that mere presence of such a cycle through faulty states to declare the failure non-diagnosable, does not hold for many system e.g., once having continuous dynamics. Thorsley et al. proposed a new DES paradigm where the classical DES model was augmented with probabilities of transitions. In the stochastic framework, failure is considered diagnosed when it is found that probability of the system traversing though failure states is higher than a threshold. Latter, Biswas et al. have proposed another DES paradigm to handle similar systems, where fairness was augmented to the classical DES model. The claim was, the abstraction employed in obtaining DES models from many systems e.g., those having continuous dynamics often obliterates the fairness property. The diagnosability condition in this case checks if there exists equivalent Strongly Connected Components (SCCs) involving failure states and normal states. The present paper establishes formal equivalence of stochastic DES and Fair DES frameworks and the diagnosability conditions.

ABSTRACT Anomaly based intrusion detection systems (IDSs) create a benign behavior profile of the network, and any deviation from this profile is considered as an attack. Many of the algorithms proposed in the literature for anomaly IDS fall into cluster analysis category. As networks become faster in operation, the amount of data that needs to be analyzed becomes huge. Many clustering techniques require more than one pass on the dataset; thus, when used as anomaly IDSs, these algorithms becomes computationally expensive and cannot work for such high‐speed networks. To handle voluminous data, anomaly IDS schemes have been proposed that use data summarization techniques. Data summarization techniques found in the literature suffer from false alarms due to improper clustering when used as anomaly IDS. In this paper, an anomaly IDS is proposed that is capable of handling large dataset yet minimizing false alarms. Copyright © 2012 John Wiley & Sons, Ltd.

Neighbor Discovery Protocol (NDP) is one of the core protocol in IPv6 network. It provides facilities like Stateless Address Autoconfiguration (SLAAC), Neighbor unreachability Detection (NUD), address resolution (similar to ARP in IPv4) etc. Due to lack of authorization in NDP messages, many attacks like Neighbor Solicitation (NS) spoofing, Neighbor Advertisement (NA) spoofing, Man-in-the-Middle (MiTM), Denial-of- Service (DoS) etc. are possible. The attack detection mechanism proposed in this paper is based on two different schemes, passive monitoring scheme and active detection mechanism using probing. In the proposed scheme, we build state of the network using Multicast Listener Discovery (MLD) queries and validate captured packets with this state. This allows us to detect attacks almost instantaneously and reduce the network traffic induced by IDS as compared to Active Probing scheme and at the same time retain its high detection rate.

In recent years, the number of attacks in computer networks are constantly increasing due to the lack of proper authentication of communicating entities in the network. TCP/IP layering architecture is prone to various threats due to the vulnerabilities in each of its layers. This mandates the requirement for a suitable detection system in the network to monitor the possible attacks. ICMP is a mandatory protocol which provides the error reporting, control and network management functionalities to the Internet Protocol (IP). Many of the attacks in the network like MiTM and DoS can be initiated with the exploitation of this essential protocols. In this paper, an active detection mechanism to identify many ICMP Error messages based attacks is proposed. The ICMP messages are verified by sending suitable probe packets to the hosts and validating their responses. The detection scheme is successfully validated in a testbed with various attack scenarios and the results show the effectiveness of the proposed technique in terms of greater accuracy in the detection rates.

Address Resolution Protocol (ARP) based attacks are caused by compromised hosts in the LAN and mainly involve spoofing with falsified IP-MAC pairs. Since ARP is a stateless protocol such attacks are possible. Neither there are signatures available for these attacks nor any significant statistical behavior change can be observed. So existing signature or anomaly intrusion detection systems are unable to detect these type of attacks. Several schemes have been proposed in the literature to circumvent these attacks, however, these techniques either make IP-MAC pairing static, modify the existing ARP, violate network layering architecture etc. In this paper a host based Discrete Event System (DES) approach is proposed for detecting ARP spoofing attacks. This approach does not require any extra constraint like static IP-MAC, changing the ARP or violation of network layering architecture.

With the increase in number of hosts in the Internet, there is also a rise in the demand for IP address space. To cater to this issue, IP version 6 (IPv6) succeeded IPv4. Compared to 32 bit IP address space in IPv4, IP address in IPv6 is composed of 128 bits. In IPv4, when a host wants to communicate with another host in an LAN, it needs to know the MAC address of the target host, which was possible through Address Resolution Protocol (ARP). As ARP is stateless and due to lack of authorization in ARP messages, many attacks like request spoofing, response spoofing, Man-in-the-Middle (MiTM), Denial-of- Service (DoS) etc. are possible. IPv6 uses Network Discovery Protocol (NDP) to find the MAC address. NDP is also stateless and lacks authentication of its messages by default. So NDP also suffers from many attacks similar to ARP. Although there are various attack detection and prevention mechanisms available for ARP attacks, they are not yet implemented for NDP (IPv6). In this paper we propose an attack detection mechanism for neighbor solicitation spoofing and neighbor advertisement spoofing.

A network Intrusion Detection System (IDS) is a device or software that monitors network activities and raises alerts on detection of malicious behavior. State-transition based framework like Finite State Machines (FSM), extended FSM, timed FSM, Discrete Event Systems (DES) etc. are widely used in network IDSs because the framework enables formal modeling, analysis, verification etc. The attack detection capability in these IDSs is based on passive monitoring of sequence of events with the assumption that intrusions lead to change in the sequence (which needs to be detected). However, there are certain attacks like ARP spoofing, Internet Control Message Protocol (ICMP) error message based attacks etc. for which passive monitoring schemes have several limitations because in such attacks there is no change in sequence of events. IDSs with active probing are now being proposed for such attacks which involve sending of probe packets that cause difference in sequence of events under attack condition and can be then detected using passive monitoring. In this paper we propose an IDS to detect ARP spoofing attacks using active state-transition framework called “active DES”.

ABSTRACT Intrusion Detection Systems (IDSs) are used to find the security violations in computer networks. Usually IDSs produce a vast number of alarms that include a large percentage of false alarms. One of the main reason for such false alarm generation is that, in most cases IDSs are run with default set of signatures. In this paper, a scheme for network specific false alarm reduction in IDS is proposed. A threat profile of the network is created and IDS generated alarms are correlated using neural network. Experiments conducted in a test bed have successfully filtered out most of the false alarms for a range of attacks yet maintaining theDetection Rate. Copyright © 2010 John Wiley & Sons, Ltd.

Application based intrusion detection involves analysis of network packet payload data. Recently statistical methods for analyzing the payload are being used. Since behavior of every application is not same a different model is necessary for each application. Studies have revealed that higher order n-grams are good for capturing the network profile. In this paper we introduce a concept of layered version of n-gram for payload based anomaly network intrusion detection. Each layer works as an independent anomaly detection system. A packet is declared as normal after passing through all the layers. A packet is declared as anomalous if at any layer it is declared as anomalous and we stop further processing the packet. We create a set of bins and equally distribute the distinct n-grams to each bin. Each such n-gram is a 2 tulle where the first element is byte values of the n-gram and second is the frequency of gram in the entire training data. We assign an anomaly score to each bin based on the frequency of the individual gram in the bin and is termed as coverage of the bin.We evaluate the proposed scheme on normal traffic of DARLA 99 dataset mixed with a set of attacks. Experimental results shows the efficacy of the method with a false alarm rate as low as 0.001\%.

Prototyping on FPGA has become a main stream verification methodology for hardware design, test development, software co-design etc. in the area of digital VLSI. In the case of test development, FPGA serves as a virtual DUT (Design under Test) and test patters are applied from automatic test equipment (ATE). This verifies not only the chip with design for test (DFT) circuitry and test program but also the entire test setup involving virtual DUT, load board, interconnections with ATE etc. Although, FPGA based platform is used widely for test program verification of digital ICs, this technique is not used for analog/mixed signal (AMS) circuits because of the difficulty in implementing AMS circuits in FPFAs. This work is concerned with the development of a test emulation platform, termed as hand-in-hand test flow, of AMS circuits based on FPGA. The proposed methodology exploits fixed-point modeling and DSP implementation technique facilitated by latest FPGAs to model the AMS circuits. The proposed hand-in-hand test flow for AMS circuits will help the test engineers to start their test plan concurrently with the design engineers and validate them much prior to the first silicon. We have illustrated the proposed scheme using the case study of an analog phase locked loop (PLL) on Xilinx® Virtex"-4 FPGA. The FPGA emulation results show that performance of the emulated analog PLL (e.g., acquisition characteristics, step response) matches well with that of behavioral simulation.

This work is concerned with the development of generic, non-intrusive and flexible algorithms for the design of digital circuits with on line testing (OLT) capability. Most of the works presented in the literature on OLT have used single stuck at fault models. However, in deep submicron era single s-a fault models may not capture more than a fraction of the real defects. To cater to the problem it is now advocated that additional fault models such as Bridging faults, Transition faults, Delay faults etc. are also used. The proposed technique is one of the first works that enables on-line detection of bridging faults and provides a high value of n for the n-Detect tests. The technique can handle generic digital circuits with cell count as high as 15,000 and having the order of 2500 states. Results for design of on-line detectors for various ISCAS89 benchmark circuits are provided. The results illustrate that with marginal increase in area overhead, if compared to ones with single s-a fault coverage, the proposed scheme also provides coverage for bridging faults and high value of n for n-Detect coverage.

This work is concerned with the development of algorithms and CAD tools for the design of digital circuits with on line monitoring capability. An existing theory of fault detection and diagnosis available in the literature on discrete event systems has been adopted for on-line detection of stuck-at faults in digital circuits. Efficient computational techniques to deal with very large state spaces based on ordered binary decision diagrams and abstraction have been proposed. Based on these a CAD tool has been developed that can provide a fully automated flow for design of circuits with on-line test capability without the requirement of any modification to the core and can handle generic digital circuits with cell count as high as 15,000 and having the order of 2/sup 500/ states. Chips, designed using this methodology have been fabricated in 0.18-micron technology and are tested to be working.