In an era characterised by evolving cyber threats and sophisticated adversar-ial behaviour, the field of cyber-security faces a continuous and formidablechallenge. The development of dynamic and adaptive security control mea-sures is imperative in order to safeguard critical assets and information.This article delves into the realm of Moving Target Defence (MTD), astrategic approach that seeks to outmanoeuvre adversaries by constantlyshifting the security landscape. Our research specifically focuses on the ap-plication of Reinforcement Learning (RL) in MTD, with a focus on threatexposure and the efficacy of control strategies with respect to risk reduction.A defensive RL agent is proposed that incorporates attack graphs as ablueprint to assess possible paths that an adversary may take. By consideringreceived events about an adversary’s actions, the defensive agent continuouslyupdates its knowledge about the adversary’s position on the attack graph.The proposed research establishes and evaluates a risk-based, RL-drivenagent capable of MTD operations in order to address adversarial behaviours.The proposed approach provides valuable insights into optimally deployingsecurity controls under dynamic threat scenarios and restricted budget resources.

In this paper, we introduce a new trusted opportunistic routing protocol called Trusted Context-aware Opportunistic Routing (TCOR) which produces a secured routing for VANET and it is incorporated with a recommendation mechanism (TCOR-Rec). OMNET++ is used to implement and simulate TCOR, which has proved its efficiency in comparison with other routing protocols (COR opportunistic protocol, AODV and trusted AODV). To simulate an adequate VANET environment and evaluate the protocols under realistic conditions, different metrics and network parameters such as the network traffic pattern, mobility pattern, and the fading propagation model have been used. The results have shown that TCOR and TCOR-Rec outperform traditional routing protocols by approximately 9% and 15%, respectively, in terms of packet delivery when the attacker nodes are involved in the network.

The growth of connected vehicles and their associated services has endowed them with the remarkable ability to rapidly generate vast volumes of data. This proliferation has led to an increasing demand for effective data governance solutions. This paper delves into the exploration of currently available in-vehicle data, meticulously assessing the aspects of data velocity and heterogeneity. By scrutinising these factors, the paper aims to pinpoint and address critical gaps in how to deal with in-vehicle data, ultimately striving to create a seamless platform for managing and harnessing in-vehicle data. This project explores approaches for various connected vehicle communications, including V2V, V2I, and V2X, to de?ne data feeds in the connected vehicle data landscape. The results of the study could in uence the design of in-vehicle data governance by providing information on a stronger integrated framework, helping data owners and users make informed decisions about managing their data assets.

With cyberspace becoming ever more fiercely contested, blue team operations face a growing demand for more efficient and sophisticated capabilities. One way to meet this demand is by integrating Human-Machine Teaming (HMT) and autonomous cyber defence (ACD), enhancing blue team collaboration with AI-driven machines. A rigorous analysis of their interaction dynamics is essential to ensure these technologies are safely deployed in high-stakes environments.This study employs Systems Theoretic Process Analysis (STPA) to examine the control actions and feedback loops between machines and controlled processors in the context of ACD, identifying potential hazards and losses arising from unsafe control actions. Additionally, it establishes system constraints to mitigate risks and enhance the safety and reliability of AI-driven HMT operations.

Artificial Intelligence (AI) is seen as a disruptive solution to the ever increasing security threats on network infrastructures. To automate the process of defending networked environments from such threats, approaches such as Reinforcement Learning (RL) have been used to train agents in cyber adversarial games. One primary challenge is how contextual information could be integrated into RL models to create agents which adapt their behaviour to adversarial posture. Two desirable characteristics identified for such models are that they should be interpretable and causal. To address this challenge, we propose an approach through the integration of a causal rewards model with a modified Proximal Policy Optimisation (PPO) agent in Meta’s MBRL-Lib framework. Our RL agents are trained and evaluated against a range of cyber-relevant scenarios in the Dstl YAWNING-TITAN (YT) environment. We have constructed and experimented with two types of reward functions to facilitate the agent’s learning process. Evaluation metrics include, among others, games won by the defence agent (blue wins), episode length, healthy nodes and isolated nodes. Results show that, over all scenarios, our causally aware agent achieves better performance than causally-blind state-of-the-art benchmarks in these scenarios for the above evaluation metrics. In particular, with our proposed High Value Target (HVT) rewards function, which aims not to disrupt HVT nodes, the number of isolated nodes is improved by 17% and 18% against the model-free and Neural Network (NN) model-based agents across all scenarios. More importantly, the overall performance improvement for the blue wins metric exceeded that of model-free and NN model-based agents by 40% and 17%, respectively, across all scenarios. • Integrated a causal inference approach within a Deep Reinforcement Learning framework. • Compared the proposed algorithm against model-based and model-free DRL algorithms. • Demonstrated our approach on PPO agents, but is applicable for any RL algorithm. • Increased win-rate by up to 40%, and reduced number of environment interactions.

The easy exploitation of IoT devices with limited security, compute and processing power has enabled hackers to carry out sophisticated attacks. Many research studies have highlighted the benefits of utilising artificial-intelligence based models in DDoS detection, but emphasis has not been placed on quantitative measurements of compute requirements for Machine Learning and Deep Learning algorithms used for DDoS detection, especially in the inference or detection stage. This research aims to fill the gap by performing quantitative measurement and comparison of various lightweight ML and DL algorithms, as well as design a lightweight collaborative framework capable of DDoS detection close to the source of the attack.

Vehicular Ad-hoc NETworks (VANET) have revolutionised the intelligent transportation systems. Indeed, they enable vehicles to communicate with each other and with the infrastructure, and they facilitate several vital applications in real-time. Several trust models have been proposed to ensure a secured VANET and the authenticity, integrity and reliability of information exchanged in the network. The concept of trust models is to introduce and implement trust explicitly in the vehicular nodes. In this paper, we propose a lightweight evaluation methodology to evaluate trust models, specifically designed for VANET. Our study focused on the three categories of VANET trust models (TMs): Entity-oriented Trust Models (ETM), Data oriented Trust Models (DTM) and Combined Trust Models (CTM). Our simulations evaluate the efficiency of the trust models and compare them against several trust related parameters: false positive rate, precision and accuracy level in detecting malicious nodes. Since the scope of this research work is to evaluate the performance of TMs under adversary conditions, we have considered on-off attacks which can act as man-in-the-middle to drop and delay transmitted packets.

Network Function Virtualisation (NFV) enables rapid deployment of new services in networks on an on-demand basis using general purpose servers. Multiple virtual network functions (VNFs) can be dynamically chained in an ordered sequence for the delivery of end-to-end services. Nevertheless, network latency caused by the sequential order of packet processing on every VNF can hurt the performance of latency-sensitive applications. To reduce such network latency, existing solutions only consider the maximum capacity of individual virtual network functions (VNFs) and do not take into account the fact that performance of VNFs, as with any software applications, is bottlenecked by either CPU or I/O peripheral capacity of the server they run on and their underneath implementation such as singleor multi-threaded.By exploiting this knowledge, we can better determine the number of required VNF instances and distribute the network traffic among them for any given VNF chain. In this paper, we formulate the VNF Scaling and Traffic Distribution problem and prove that it is NP-hard. We then present the design and implementation of Natif, an efficient VNF-Aware VNF insTantIation and traFfic distribution scheme. Through our OpenStack-based testbed evaluations, we demonstrate that Natif can significantly improve the network latency by 188% on average as compared to other approaches. As a chain composition scheme, Natif can effectively work with any VNF chaining algorithms.

Provision of instantaneous, mobile and dependable communications in military and safety-critical scenarios must overcome certain wireless network issues: lack of reliable existing infrastructure, immutability of mission-critical protocols and detrimental wireless dynamics with contributing factors including hidden transmitters and fading channels. Benchmarked approaches do not fully meet these challenges, due to reliance on addressing Quality of Service (QoS) at a layer-specific level rather than taking a system of systems approach. This paper presents an adaptive middleware methodology to provide timely MANET communications through predictive selection and dynamic contention reduction, without invasive protocol modification. This is done using ROAM, the proposed, novel Real-time Optimised Ad hoc Middleware based architecture. Extensive simulation results demonstrate the adaptability and scalability of the architecture as well as capability to bound maximum delay, jitter and packet loss in complex and dynamic MANETs.

The growth of the Internet has made IPv4 addresses a scarce resource. Due to slow IPv6 deployment, IANA-level IPv4 address exhaustion was reached before the world could transition to an IPv6-only Internet. The continuing need for IPv4 reachability will only be supported by IPv4 address sharing. This paper reviews ISP-level address sharing mechanisms, which allow Internet service providers to connect multiple customers who share a single IPv4 address. Some mechanisms come with severe and unpredicted consequences, and all of them come with tradeoffs. We propose a novel classification, which we apply to existing mechanisms such as NAT444 and DS-Lite and proposals such as 4rd, MAP, etc. Our tradeoff analysis reveals insights into many problems including: abuse attribution, performance degradation, address and port usage efficiency, direct intercustomer communication, and availability.

Emulated networks and systems, where router and server software are run in virtual environments, allow network operators and researchers to perform experiments at large scale more economically than in testbeds. Running real code provides a greater level of realism than simulation.

In Wireless Sensor Networks (WSNs), controlling transmission power is a commonly used technique to extend battery life. This paper describes a novel mechanism using measured RSS (Received Signal Strength) to calculate optimal transmission power. This technique works in multipath environments and with nodes with differing transmission capability. Our technique achieves automatic configuration employing modifications to RPL (Routing Protocol for Low-power and lossy networks) router discovery without requiring extra steps or messages. Consequently, each node can send packets with ideal transmission power, which will usually be lower than maximum power and will help to prolong its lifetime. We evaluate the effectiveness of the proposed scheme, using performance metrics such as energy consumption and packet loss, on an WSN testbed. Several factors that impact the RSS, such as antenna, multipath environment, output power and the node's capabilities are also investigated. Moreover, two RSS estimation techniques are evaluated and compared to the average measured RSS. The experimental results show that energy consumption is reduced by using the proposed technique.

Internet Service Providers (ISPs) need to balance multiple opposing objectives. On one hand, they strive to offer innovative services to obtain competitive advantages; on the other, they have to interconnect with potentially competing ISPs to achieve reachability, and coordinate with them for certain services. The complexity of balancing these objectives is reflected in the diversity of policies of the Border Gateway Protocol (BGP), the standard inter-domain routing protocol. Unforeseen interactions among the BGP policies of different ISPs can cause routing anomalies. In this work, we propose a methodology to allow ISPs to check their BGP policy configurations for guaranteed convergence to a single stable state. This requires that a set of ISPs share their configurations with each other, or with a trusted third party. Compared to previous approaches to BGP safety, we (1) allow ISPs to use a richer set of policies, (2) do not modify the BGP protocol itself, and (3) detect not only instability, but also multiple stable states. Our methodology is based on the extension of current theoretical frameworks to relax their constraints and use incomplete data. We believe that this provides a rigorous foundation for the design and implementation of safety checking tools.

Internet Service Providers (ISPs) use routing policies to implement the requirements of business contracts, manage traffic, address security concerns and increase scalability of their network. These routing policies are often a high-level expression of strategies or intentions of the ISP. They have meaning when viewed from a network-wide perspective (e.g., mark on ingress, filter on egress). However, configuring these policies for the Border Gateway Protocol (BGP) is undertaken at a low-level, on a per router basis. Unintended routing outcomes have been observed. In this work, we define a language that allows analysis of network-wide configurations at the high-level. This language aims at bridging the gap between router configurations and abstract mathematical models capable of capturing complex policies. The language can be used to verify desired properties of routing protocols and hence detect potential unintended states of BGP. The language is accompanied by a tool suite that parses router configuration languages (which by their nature are vendor-dependent) and translates them into vendor-independent representations of policies.

Routing stability and correctness in the Internet have long been a concern. Despite this, few theoretical frameworks have been proposed to check BGP configurations for convergence and safety. The most popular approach is based on the Stable Paths Problem (SPP) model. Unfortunately, SPP requires enumeration of all possible control-plane paths, which is infeasible in large networks. In this work, we study how to apply algebraic frameworks to the BGP configuration checking problem. We propose an extension of the Stratified Shortest Path Problem (SSPP) model that has a similar expressive power to SPP, but enables more efficient checking of configuration correctness. Our approach remains valid when BGP policies are applied to iBGP sessions - a case which is often overlooked by previous work, although common in today's Internet. While this paper focuses mainly on iBGP problems, our methodology can be extended to eBGP if operators are willing to share their local-preference configurations.

We present a methodology that brings simplicity to large and complex test labs by using abstraction. The networking community has appreciated the value of large scale test labs to explore complex network interactions, as seen in projects such as PlanetLab, GENI, DETER, Emulab, and SecSI. Virtualization has enabled the creation of many more such labs. However, one problem remains: it is time consuming, tedious and error prone to setup and configure large scale test networks. Separate devices need to be configured in a coordinated way, even in a virtual lab.

Random Early Detection (RED) is recommended as the congestion avoidance mechanism in packet switched networks in RFC2309 and has become the focus of much research into congestion control. Furthermore, RED and WRED are the AQM schemes most widely deployed in commercial Internet routers, such as Cisco and Juniper routers. This paper describes an analytical approach that models RED and WRED schemes using a discrete-time queuing model with superposition of N MMBP-2 sources as arrival processes. Each MMBP-2 represents an aggregated Internet traffic flow from different traffic classes or with different precedence. Performance analysis for RED and WRED are then carried out using different dropping profiles through Matlab numerical analysis based on the proposed queuing model. Performance measures, such as throughput, mean queuing delay and loss probability, obtained from analytical analysis are studied; the trade-off between packet loss and queuing delay can then be evaluated easily for different traffic classes. In this way, the proposed analytical model facilitates fine tuning of RED and WRED parameters for the purpose of QoS provisioning and capacity planning on Internet routers.

In urban search and rescue (USAR) operations, there is a considerable amount of danger faced by rescuers. The use of mobile robots can alleviate this issue. Coordinating the search effort is made more difficult by the communication issues typically faced in these environments, such that communication is often restricted to line of sight. Since the rescue workers outside of the structure need to know the location of any victims, the task is two parted: 1) to locate the victims (Search Time), and 2) to get this data outside the structure (Delay Time). Communication with the outside is assumed to be performed by a static robot designated as the Command Station. Since it is unlikely that there will be sufficient robots to provide full communications coverage of the area, robots that discover victims are faced with the difficult decision of whether they should continue searching or return with the victim data. We investigate a variety of search techniques and see how the application of biological foraging models can help to streamline the search process, while we have also implemented an opportunistic network to ensure that data are shared whenever robots come within line of sight of each other or the Command Station. We examine this trade-off between performing a search and communicating the results.

This paper presents a comprehensive system modeling and analysis approach for both predicting and controlling queuing delay at an expected value under multi-class traffic in a single buffer. This approach could effectively enhance QoS delivery for delay sensitive applications. Six major contributions are given in the paper: (1) a discrete-time analytical model is developed for capturing multi-class traffic with binomial distribution; (2) a control strategy with dynamic queue thresholds is used in simulation experiments to control the delay at a specified value within the buffer; (3) the feasibility of the system is validated by comparing theoretical analysis with simulation scenarios; (4) the arrival rate can be adjusted for each forthcoming time window during the simulation with multi-packet sources; (5) statistical evaluation is performed to show both efficiency and accuracy of the analytical and simulation results; (6) a graphical user interface is developed that can provide flexible configuration for the simulation and validate input values.

This paper presents a comprehensive analytical approach to maintain queuing delay in a router at a required level through closed-loop feedback control under aggregated traffic flows from various traffic classes. The approach is able to bound average queuing delay but still achieve a high system utilization by regulating traffic arrival rate implicitly through a movable queuing threshold. The queuing threshold is adjusted dynamically through feedback of average queuing delay measurement. Consequently, packets are dropped dynamically with respect to the changes of queuing threshold and the packets loss event served as an implicit congestion indicator. Three major contributions are given in this paper: (1) a discrete time queuing model is developed to derive the mapping table of average queuing delay and queuing threshold; (2) a traffic model that models LRD aggregated Internet traffic through superposing of N MMBP-2 arrival processes; (3) a closed-loop feedback control to control queuing delay at its target level based on expected system utilization. Matlab is used to perform queuing analysis and simulation. Statistical evaluation is performed to show the efficiency and accuracy of the analytical and simulation results.

The production of a large-scale monitoring system for a high-speed network leads to a number of challenges. These challenges are not purely technical but also socio-political and legal. The number of stakeholders in such monitoring activity is large including the network operators, the users, the equipment manufacturers and, of course, the monitoring researchers. The MASTS project (measurement at all scales in time and space) was created to instrument the high-speed JANET Lightpath network and has been extended to incorporate other paths supported by JANET(UK). Challenges the project has faced included: simple access to the network; legal issues involved in the storage and dissemination of the captured information, which may be personal; the volume of data captured and the rate at which these data appear at store. To this end, the MASTS system will have established four monitoring points each capturing packets on a high-speed link. Traffic header data will be continuously collected, anonymised, indexed, stored and made available to the research community. A legal framework for the capture and storage of network measurement data has been developed which allows the anonymised IP traces to be used for research purposes.

Honeypots are a useful tool for discovering the distribution of malicious traffic on the Internet and how that traffic evolves over time. In addition, they allow an insight into new attacks appearing. One major problem is analysing the large amounts of data generated by such honeypots and correlating between multiple honeypots. Honey Plotter is a web-based query and visualisation tool to allow investigation into data gathered by a distributed honeypot network. It is built on top of a relational database, which allows great flexibility in the questions that can be asked and has automatic generation of visualisations based on the results of queries. The main focus is on aggregate statistics but individual attacks can also be analysed. Statistical comparison of distributions is also provided to assist with detecting anomalies in the data; helping separate out common malicious traffic from new threats and trends. Two short case studies are presented to give an example of the types of analysis that can be performed.

As communication networks increase in performance and complexity, and more dependence is placed upon them, it becomes ever more important that their behaviour is understood in an efficient and timely manner. Visualisation is an established technique for the presentation of the vast volume of data yielded in monitoring such networks. It is apparent, however, that much of the work in this area has been performed in isolation, and it is timely that a review of this research is conducted. The techniques for the visualisation of communication networks and related measurements are surveyed. The research is classified by the type of visualisation used and is separated into three classes: geographic visualisations, in which the data are presented with respect to the physical location of nodes in the network; abstract topological visualisations, in which the relationships between nodes are presented independently of physical location; and plot-based visualisation, in which the focus is a single point in the network, often presented with respect to time. The research in this area is reviewed and the techniques proposed are discussed in terms of these three classes.

Network performance monitoring is an ongoing process as networks and their users are constantly changing. Networks are subject to various changes, some of which are controlled by the network providers (such as upgrades or re-routes) and some are not (equipment failure, usage). Network monitoring may include the detecting of such changes. These changes can be referred to as network events.

This paper discusses various approaches to the development of an integrated and automated network performance measurement tool. Adopting an object-orientated approach to the entire system design can assist this requirement for intelligence in a distributed manner. The authors have found the JAVA language to greatly assist in this task and this language has been used for all aspects of the system from traffic generation/reception, to the database and display systems. Finally, examples of the systems have been developed and implemented at various levels, from experimental operations on ATM networks, to a prototype operational system on BT's commercial SMDS (Switched Multi-megabit Data Service) network.