By decoupling the control plane and data plane in the software-defined network (SDN), the controller gains a comprehensive global view of the network. The SDN controller samples traffic from all switches to effectively manage data plane traffic. The sampling rate of flow traffic significantly impacts the accuracy of the controller’s decisions. While increasing the sampling rate is desirable for improved detection accuracy, it also escalates resource consumption on both switches and the controller. Hence, it is crucial to carefully manage sampling on switches to fine-tune anomaly detection accuracy. Existing flow sampling solutions often struggle to strike a balance between detection accuracy, sampling rate, and overhead. To address this challenge, we propose a robust cybersecurity framework for anomaly detection on SDNs through traffic flow inspection. Our proposed framework, Cyber-AnDe, integrates adaptive distributed sampling (ADS) with a Reinforcement Learning (RL) agent to enhance anomaly detection accuracy while minimizing the increase in controller overhead. In our framework, the controller leverages information gathered from each sampled traffic flow to determine whether the flow’s state is malicious, suspicious, or benign based on underlying anomaly detection algorithms. Once the flow state is determined, the controller takes the appropriate action with the help of the RL agent. Through extensive simulations and SDN test-bed experiments, we confirm a significant improvement of up to 93% in network traffic-based anomaly detection compared to existing solutions.

With the constant expansion of the cyber-space due to digital convergence, so does its attack surface. Modern day cyber criminals, astute and technology savvy, have embraced steganography including it as an important weapon in their cyber arsenal. In this paper, we present a new steganographic method that leverages the file slack space, generated by the Operating System, for hiding data. Our proposed method hides an entire file system volume exploiting the file slack space as the cover-media (a.k.$\mathbf{a}$. cover medium) deviating from previous works which focus on hiding individual files. The method is persistent across system reboots and restarts, has robust detection resistance, is portable and has minimum impact on the target system's performance adding to its stealth. We validate the proposed method through prototype implementation on a Ubuntu 20.04 with a ext4 file system, with FAT16 file system as the hidden file system.

Covert operations involving clandestine dealings and communication through cryptic and hidden messages have existed since time immemorial. While these do have a negative connotation, they have had their fair share of use in situations and applications beneficial to society in general. A "Dead Drop" is one such method of espionage trade craft used to physically exchange items or information between two individuals using a secret rendezvous point. With a "Dead Drop", to maintain operational security, the exchange itself is asynchronous. Information hiding in the slack space is one modern technique that has been used extensively. Slack space is the unused space within the last block allocated to a stored file. However, hiding in slack space operates under significant constraints with little resilience and fault tolerance.

Offline password cracking has seen significant advances in recent years. This is mainly due to a dramatic increase in accessible computational speeds and the increased exploitation of GPUs for parallel processing. Cheaper and faster hardware, combined with new techniques, have allowed inexpensive GPUs to crack passwords at rates which only supercomputers could achieve previously. One inexpensive mitigation technique that we have uncovered is built on the core idea of pre-hash password manipulations. Our technique is named STUMP. Through rigorous empirical analysis, we demonstrate that STUMP can prevent offline parallel attacks — including pre-computed attacks utilizing rainbow tables — from cracking 99.718% of passwords that are <8-characters in length; STUMP has also shown to completely prevent the attacker from cracking passwords that are ≥ 8 characters in length i.e., (100% secure). Finally, for all cases, STUMP can be employed to stall the attacks — regardless of whether the attack is a laborious brute-force technique or a more intelligent dictionary attack — as neither will return the user's original password.

Abstract Originally, the development of wireless sensor networks (WSNs) was motivated by military applications such as battlefield surveillance and land‐mine detection. Over time, however, WSNs have found a wide range of applications in diverse domains such as industrial automation and monitoring, environmental and habitat monitoring, health‐care applications, home automation, traffic regulation, smart hospitals, etc. In all these domains, the data sensed by the sensor nodes are reported to a central server called a base station, which then initiates appropriate actions based on the reported data. To this end, the location of sensors is very critical since the monitored event can be detrimental causing irreversible damage – such as forest fire, if the location of sensors is compromised and/or inaccurate. In this paper, we propose SecLoc – a novel localization method for WSNs, which can be easily extended to other wireless and mobile and ad‐hoc networks. The proposed method exploits the connected dominating set (CDS) property of a network graph. SecLoc, to the best of our knowledge, is the first localization model to exploit the CDS property for accurate and secure node localization in WSNs. In out proposed method, a set of specialty nodes, called the beacon nodes, with large resource base, assume the role of Dominant nodes. The beacon nodes are responsible for both accurate and secure localization of nodes. We confirm the efficiency and robustness of our model through simulation results. Copyright © 2011 John Wiley & Sons, Ltd.

The highly dynamic nature of infrastructureless ad- hoc networks poses new challenges during resource discovery. In this paper, we propose a novel algorithm for resource discovery in mobile ad hoc networks called Efficient Resource-Discovery (ERD). When proposing this novel algorithm, our primary goal is to spread the most relevant resources and queries to the nodes in the network. The proposed algorithm ERD is very efficient in dynamically ranking resources and queries based on their priority, selecting the transmission time, and determining how many resources and queries are to be transmitted. ERD utilizes the network bandwidth in an optimal manner avoiding the spread of redundant data in the network, which otherwise can significantly overload the network with duplicate copies. We compare ERD with periodic flooding and rank based broadcast (RBB) algorithms for mobile ad hoc networks. Results show that ERD outperforms both these algorithms significantly.

Abstract Wireless sensor networks (WSNs) have been the focal point of research over the last several years. Broadcast communication is a key requirement for WSNs since many tasks in the network depend on broadcasting, including critical tasks like querying. Consequently, securing broadcast communication over sensor networks has become an important research challenge. Typically, broadcast communication involves two steps: broadcasting and acknowledging. In the broadcasting phase, the message is broadcast in the network. In the acknowledging phase, nodes that successfully received the broadcast message send an acknowledgment to the broadcast origination node, which in this paper is always the sink. The terms ‘sink’ and ‘base station (BS)’ are used interchangeably throughout this paper. Intuitively, broadcast communication has two important metrics: reliability and security. Though the reliability metric has drawn sufficient attention in the research community, the security metric has not. In this paper, we address both metrics with an emphasis on the former and address the Denial‐of‐Broadcast Message attacks (DoBM) in sensor networks. We propose a novel multi‐parent tree‐based model called the k‐Parent Flooding Tree Model (k‐FTM). We also present distributed algorithms for the construction of k‐FTM and prove via simulation and analysis that the proposed k‐FTM is robust against DoBM. Our Multi‐Parent tree model enables the BS to detect DoBM very efficiently, even in the presence of a prudent adversary who focuses on remaining undetected by causing damage below the detection threshold. k‐FTM is, to our best knowledge, the first fault‐tolerant tree model that is both reliable and secure. Through simulations we confirm that our model achieves detection rates close to that of a static tree and a broadcast reliability close to that of blind flooding. Copyright © 2008 John Wiley & Sons, Ltd.

The core functionality of a wireless sensor network (WSN) is to detect deviations in expected normal behavior and report it to the sink. In this paper, we propose TRACK - a novel sink mobility model exploiting the connected dominating set (CDS) property of a network graph. TRACK, to the best of our knowledge, is the first contemporary sink mobility model to exploit the CDS property for WSN lifetime longevity and secure data aggregation. In TRACK, the CDS of the given network is computed and then the minimum spanning tree (MST) of the CDS is constructed. Using the CDS-MST as the underlying framework, a Hamiltonian circuit (HC) is constructed, along which the sink is mobilized to traverse the network. Since TRACK, by the very definition of CDS, passes through the transmission range of every node in the network, data can be relayed directly from the source node to the sink, eliminating the need for multi-hop routing. By virtue of this property, nodes in the WSN are discharged from their routing obligations and data aggregation becomes more secure. Additionally, we propose an extended version of TRACK called M-TRACK in this paper. The extended model trades higher fractions of sensor energy with the objective of minimizing the length of sink trajectory. This consequently minimizes the delay between consecutive sink visits, mitigating buffer-overflow of sensors. M-TRACK does necessitate multi-hop routing, but keeps it within a bounded number of hops. We confirm the efficiency and robustness of our models via simulation and analysis, and show that our model can extend the WSN lifetime up to seven times that which can be achieved using a static sink.

Link and node reliability are important metrics in wireless ad hoc networks. Therefore, evaluating and quantifying reliability has become the cornerstone of research in this field. Many existing wireless ad hoc network routing algorithms assume the availability of precise reliability information. This, however, is an unrealistic assumption given the dynamics of wireless ad hoc networks. Also, due to frequent changes in topology, reliability information is hard to collect, and oftentimes, inaccuracies can creep in. Therefore, a realistic method is needed to evaluate reliability by mitigating uncertainty in the estimation process. In this paper, we propose a novel reliability estimation model, account for uncertainty in the estimation, and design an uncertainty mitigation scheme. We then illustrate the effectiveness of our scheme in estimating reliability under various levels of uncertainty using a utility-oriented routing algorithm as a sample application. An extensive simulation study shows that the mitigation scheme significantly increases path stability and the long-term total benefit of the system.

Securing broadcast communication over sensor networks has become an important research challenge. Intuitively, broadcast communication has two important metrics: reliability and security. Though the reliability metric has drawn sufficient attention in the research community, the security metric has not. In this paper, we address both metrics with an emphasis on the former and address the denial-of-broadcast message attacks (DoBM) in sensor networks. We propose a novel tree-based model called the k-parent flooding tree model (k-FTM) and present algorithms for the construction of k-FTM. The proposed k-FTM is robust against DoBM. It enables the base station to detect DoBM very efficiently, even in the presence of a prudent adversary who focuses on remaining undetected by causing damage below the detection threshold. k-FTM is, to our best knowledge, the first fault-tolerant tree model that is both reliable and secure. Through simulations we confirm that our model achieves detection rates close to that of a static tree and a broadcast reliability close to that of blind flooding.

Wireless sensor networks (WSNs) have critical applications in diverse domains like environmental monitoring and military operations where accurate location of sensors is vital. One common method of location discovery uses a set of specialty nodes known as beacon nodes (BNs) that assist other sensor nodes (SNs) to determine their location. This paper proposes a novel reputation-based scheme called distributed reputation-based beacon trust system (DRBTS) for excluding malicious BNs that provide false location information. To the best of our knowledge, DRBTS is the first model to use the concept of reputation for excluding BNs. In DRBTS, every BN monitors its 1-hop neighborhood for misbehaving BNs and accordingly updates the reputation of the corresponding BN in the neighbor-reputation-table (NRT). The BNs then publish their NRT in their 1-hop neighborhood. BNs use this second-hand information published in NRT for updating the reputation of their neighbors after it qualifies a deviation test. On the other hand, the SNs use the NRT information to determine whether or not to use a given beacon's location information, based on a simple majority voting scheme