The rowhammer bug belongs to software-induced hardware faults, and has been exploited to form a wide range of powerful rowhammer attacks. Yet, how to effectively detect such attacks remains a challenging problem. In this paper, we propose a novel approach named RADAR (Rowhammer Attack Detection via A Radio) that leverages certain electromagnetic (EM) signals to detect rowhammer attacks. In particular, we have found that there are recognizable hammering-correlated sideband patterns in the spectrum of the DRAM clock signal. As such patterns are inevitable physical side effects of hammering the DRAM, they can "expose" any potential rowhammer attacks including the extremely elusive ones hidden inside encrypted and isolated environments like Intel SGX enclaves. However, the patterns of interest may become unapparent due to the common use of spread-spectrum clocking (SSC) in computer systems. We propose a de-spreading method that can reassemble the hammering-correlated sideband patterns scattered by SSC. Using a common classification technique, we can achieve both effective and robust detection-based defense against rowhammer attacks, as evaluated on a RADAR prototype under various scenarios. In addition, our RADAR does not impose any performance overhead on the protected system. There has been little prior work that uses physical side-channel information to perform rowhammer defenses, and to the best of our knowledge, this is the first investigation on leveraging EM side-channel information for this purpose.

The vision of the `Smart Grid' assumes a distributed real-time embedded system that implements various monitoring and control functions. As the reliability of the power grid is critical to modern society, the software supporting the grid must support fault tolerance and resilience in the resulting cyber-physical system. This paper describes the fault-tolerance features of a software framework called Resilient Information Architecture Platform for Smart Grid (RIAPS). The framework supports various mechanisms for fault detection and mitigation and works in concert with the applications that implement the grid-specific functions. The paper discusses the design philosophy for and the implementation of the fault tolerance features and presents an application example to show how it can be used to build highly resilient systems.

Wildlife poaching is a critical driver of biodiversity loss and population decline. Poaching is a particular threat to high value, large-bodied species, such as elephants, that are slow to reproduce. Increasingly, GPS tracking collars serve as a key tool for studying the behavior and monitoring wildlife globally, including application to anti-poaching efforts. However, collars provide indirect information on poaching, such as immobility, that is often not available in real time. In parallel to collar development, acoustic gunshot detection systems have proliferated in the military and law enforcement. Static systems in wildlife areas have been deployed for detecting poaching, but such systems do not scale geographically. This paper explores the idea of fusing GPS tracking collars with acoustic shockwave detectors to create an animal-borne anti-poaching sensor. A real-time alert of gunshots near elephant groups would enable rangers to respond immediately to such events. The two main technical challenges to such a system are battery life and detection accuracy. The paper presents a prototype designed for elephants that has great promise in addressing these significant technical challenges.

Poaching is one of the primary drivers of wildlife decline [1]. Animalborne sensors, particularly GPS-equipped collars, are used to enhance real-time wildlife protection. Innovations that can be integrated into these systems can immediately scale, offering broad application. GPS tracking data streams have been valuable to resolve a number of conservation challenges, but these systems have not been particularly effective in identifying poaching in real-time. Detecting poaching events is a critical need to provide actionable information for law enforcement.

The paper presents RoboScape, a collaborative, networked robotics environment that makes key ideas in computer science accessible to groups of learners in informal learning spaces and K-12 classrooms. RoboScape is built on top of NetsBlox, an open-source, networked, visual programming environment based on Snap! that is specifically designed to introduce students to distributed computation and computer networking. RoboScape provides a twist on the state of the art of robotics learning platforms. First, a user's program controlling the robot runs in the browser and not on the robot. There is no need to download the program to the robot and hence, development and debugging become much easier. Second, the wireless communication between a student's program and the robot can be overheard by the programs of the other students. This makes cybersecurity an immediate need that students realize and can work to address. We have designed and delivered a cybersecurity summer camp to 24 students in grades between 7 and 12. The paper summarizes the technology behind RoboScape, the hands-on curriculum of the camp and the lessons learned.

The exponential growth of information and communication technologies have caused a profound shift in the way humans engineer systems leading to the emergence of closed-loop systems involving strong integration and coordination of physical and cyber components, often referred to as cyber-physical systems (CPSs). Because of these disruptive changes, physical systems can now be attacked through cyberspace and cyberspace can be attacked through physical means. The paper considers security and resilience as system properties emerging from the intersection of system dynamics and the computing architecture. A modeling and simulation integration platform for experimentation and evaluation of resilient CPSs is presented using smart transportation systems as the application domain. Evaluation of resilience is based on attacker-defender games using simulations of sufficient fidelity. The platform integrates 1) realistic models of cyber and physical components and their interactions; 2) cyber attack models that focus on the impact of attacks to CPS behavior and operation; and 3) operational scenarios that can be used for evaluation of cybersecurity risks. Three case studies are presented to demonstrate the advantages of the platform: 1) vulnerability analysis of transportation networks to traffic signal tampering; 2) resilient sensor selection for forecasting traffic flow; and 3) resilient traffic signal control in the presence of denial-of-service attacks.

This paper presents the time synchronization infrastructure for a low-cost run-time platform and application framework specifically targeting Smart Grid applications. Such distributed applications require the execution of reliable and accurate time-coordinated actions and observations both within islands of deployments and across geographically distant nodes. The time synchronization infrastructure is built on well-established technologies: GPS, NTP, PTP, PPS and Linux with real-time extensions, running on low-cost BeagleBone Black hardware nodes. We describe the architecture, implementation, instrumentation approach, performance results and present an example from the application domain. Also, we discuss an important finding on the effect of the Linux RT_PREEMPT real-time patch on the accuracy of the PPS subsystem and its use for GPS-based time references.

This paper introduces NetsBlox, a visual programming environment for learning distributed programming principles. Extending both the visual formalism and open source code base of Snap!, NetsBlox provides two accessible distributed programming abstractions to simplify the process of creating networked applications: message passing and Remote Procedure Calls (RPC). Messaging passing allows NetsBlox applications to send data to other connected NetsBlox clients. Remote Procedure Calls enable seamless integration of third party services, such as Google Maps, weather, traffic and other public domain data sources, into NetsBlox applications. Other RPCs help coordinating distributed clients which may be difficult for novice programmers allowing the user to more quickly create captivating and sophisticated applications. These abstractions empower users to develop networked programs, including multi-player games and client-server applications. By providing networking support, NetsBlox not only allows users to learn distribute programming concepts but also makes programming more engaging by incorporating diverse services available on the web.

Minimally invasive robotic surgery techniques are becoming popular thanks to their enhanced patient benefits, including shorter recovery time, better cosmetic results and reduced discomforts. Less invasive procedures would be achieved with the use of Medical Capsule Robots (MCRs). These devices are characterized by low power requirements and small dimensions as well as uncompromising safety. MCRs operate wirelessly in abdominal Minimally Invasive Surgery (MIS) and Natural Orifice Transluminal Endoscopic Surgery (NOTES) or in the Gastrointestinal (GI) tract. The design process of MCRs, however, is expensive and time consuming. A platform for rapid prototyping MCRs is needed so that MCR researchers can reduce development costs and spend more time in studying innovative MCR applications. In this work, we introduce an open source modular platform geared toward rapid prototyping MCRs. To speed up the prototyping process, the MCR is programmed using TinyOS instead of bare-bone C. We present the hardware architecture of the platform, and the motivation for using TinyOS. To show the viability of TinyOS, we present results from an experiment involving sensing, actuation and wireless communication. This work lays the foundation for our future goal of building an integrated design environment for the design, analysis and simulation of MCRs.

For outdoor navigation, GPS provides the most widely-used means of node localization; however, the level of accuracy provided by low-cost receivers is typically insufficient for use in high-precision applications. Additionally, many of these applications do not require precise absolute Earth coordinates, but rather rely on relative positioning to infer information about the geometric configuration of the constituent nodes in a system. This paper presents a novel approach that uses GPS to derive relative location information for a scalable network of single-frequency receivers. Networked nodes share their raw satellite observations, enabling each node to localize its neighbors in a pairwise fashion as opposed to computing its own standalone position. Random and systematic errors are mitigated in novel ways, challenging long-standing beliefs that precision GPS systems require extensive stationary calibration times or complex equipment configurations. In addition to presenting the mathematical basis for our technique, a working prototype is developed, enabling experimental evaluation of several real-world test scenarios. The results of these experiments indicate sub-meter relative positioning accuracy under various conditions and in varying environments. This represents up to order of magnitude increase in precision over existing absolute positioning techniques or other unimodal GPS-based solutions.

One of the primary limitations to widescale adoption of many of today's high-precision location-aware applications is the cost associated with achieving the levels of accuracy necessary for safe and reliable operation. We have developed a relative localization solution enabling centimeter-scale positioning of a network of mobile nodes. The success of this research in the relative sense can be coupled with the known locations of a set of stationary nodes as well as the computational power of the cloud to open the door for an absolute localization service, whereby base stations at well-known locations can be used to transform relative coordinates into absolute locations. We will demonstrate the current progress of our work via live walking and driving experiments in which observers in an exhibition hall can issue commands to walkers and drivers in the field and see the results of these commands as determined by our positioning system in real-time.

Minimally invasive surgical techniques are becoming popular due to their enhanced patient benefits. Less invasive procedures can be achieved with the use of wireless Medical Capsule Robots (MCRs). MCRs are low powered and small in size and can be used for physiological parameter monitoring, therapy delivery, and biopsy sampling. Designing MCRs from the ground up is a costly and time consuming process. In this work, we present a flexible modular architecture to facilitate the design of MCRs and propose using TinyOS as the operating system. To assess the architecture and validate the feasibility of TinyOS, we implement a closed-loop control of a sensor-actuator system and compare the results with a traditional MCR built based on an 8051 microcontroller (MCU) programmed in plain C. Similar performances from the two approaches lead us to conclude that TinyOS is a valid option to implement a modular architecture for designing MCRs.

The paper presents a smartphone-based shooter localization system. As muzzle blasts are difficult to detect at longer distances and consequently present higher false detection rates, the system relies on shockwaves only. Each sensor uses four microphones to detect the Angle of Arrival and the length of the shockwave. This information, along with the sensor's own GPS coordinates, are shared among nearby smartphones. Assuming a known weapon type, it then proceeds to estimate the two possible projectile trajectory candidates for each sensor that are consistent with the observations in the horizontal plane of the sensors. A simple clustering algorithm identifies the correct projectile trajectory relying on as few as two sensors. The trajectory is then used to estimate the bearing to the shooter relative to each sensor. The paper presents the overall system architecture, the design of the sensor node that interfaces with the smartphone, the trajectory and bearing estimation algorithms, and the evaluation of the system based on a field experiment.

In many mobile wireless applications such as the automated driving of cars, formation flying of unmanned air vehicles, and source localization or target tracking with wireless sensor networks, it is more important to know the precise relative locations of nodes than their absolute coordinates. GPS, the most ubiquitous localization system available, generally provides only absolute coordinates. Furthermore, low-cost receivers can exhibit tens of meters of error or worse in challenging RF environments. This paper presents an approach that uses GPS to derive relative location information for multiple receivers. Nodes in a network share their raw satellite measurements and use this data to track the relative motions of neighboring nodes as opposed to computing their own absolute coordinates. The system has been implemented using a network of Android phones equipped with a custom Bluetooth headset and integrated GPS chip to provide raw measurement data. Our evaluation shows that centimeter-scale tracking accuracy at an update rate of 1 Hz is possible under various conditions with the presented technique. This is more than an order of magnitude more accurate than simply taking the difference of reported absolute node coordinates or other simplistic approaches due to the presence of uncorrelated measurement errors.

In many mobile wireless applications such as the automated driving of cars, formation flying of unmanned air vehicles, and source localization or target tracking with wireless sensor networks, it is more important to know the precise relative locations of nodes than their absolute coordinates. GPS, the most ubiquitous localization system available, generally provides only absolute coordinates. Furthermore, low-cost receivers can exhibit tens of meters of error or worse in challenging RF environments. This video demonstration presents an approach that uses GPS to derive relative location information for multiple receivers. Cooperating nodes in a network share their raw satellite measurements and use this data to track the relative motions of neighboring nodes as opposed to computing their own absolute coordinates. This is achieved via creation of a new error model that incorporates GPS localization errors specific to the multiple-receiver case, development of a new, highly accurate observation model that allows for the change in range between a single satellite and two receivers to be mapped through time, and the synthesis of these two models into a novel 3D pairwise tracking algorithm that uses the local GPS node as its own reference and requires only an approximate estimate of its own absolute position to achieve centimeter-scale relative tracking precision.

Molecular dynamics simulators are indispensable tools in the arsenal of chemical engineers and material scientists. However, they are often difficult to use and require programming skills as well as deep knowledge of both the given scientific domain and the simulation software itself. In this paper, we describe a metaprogramming approach where simulator experts can create a library of simulation components and templates of frequently used simulations. Domain experts, in turn, can build and customize their own simulations and the required input for the various supported simulators is automatically synthesized. The web-based environment also supports setting up a suite of simulation jobs, for example, to carry out automated parameter optimization, via a visual programming environment. The entire simulation setup – including the various parameters, the version of tools utilized and the results – is stored in a database to support searching and browsing of existing simulation outputs and facilitating the reproducibility of scientific results.

Acoustic shooter localization systems are being rapidly deployed in the field. However, these are standalone systems---either wearable or vehicle-mounted---that do not have networking capability even though the advantages of widely distributed sensing for locating shooters have been demonstrated before. The reason for this is that certain disadvantages of wireless network-based prototypes made them impractical for the military. The system that utilized stationary single-channel sensors required many sensor nodes, while the multi-channel wearable version needed to track the absolute self-orientation of the nodes continuously, a notoriously hard task. This paper presents an approach that overcomes the shortcomings of past approaches. Specifically, the technique requires as few as five single-channel wireless sensors to provide accurate shooter localization and projectile trajectory estimation. Caliber estimation and weapon classification are also supported. In addition, a single node alone can provide reliable miss distance and range estimates based on a single shot as long as a reasonable assumption holds. The main contribution of the work and the focus of this paper is the novel sensor fusion technique that works well with a limited number of observations. The technique is thoroughly evaluated using an extensive shot library.

Modern software-defined radios are large, expensive, and power-hungry devices and this, we argue, hampers their more widespread deployment and use, particularly in low-power, size-constrained application settings like mobile phones and sensor networks. To rectify this problem, we propose to put the software-defined radio on a diet by redesigning it around just two core chips -- an integrated RF transceiver and a Flash-based, mixed-signal FPGA. Modern transceivers integrate almost all RF front-end functions while emerging FPGAs integrate nearly all of required signal conditioning and processing functions. And, unlike conventional FPGAs, Flash-based FPGAs offer sleep mode power draws measured in the microamps and startup times measured in the microseconds, both of which are critical for low-power operation. If our platform architecture vision is realized, it will be possible to hold a software-defined radio in the palm of one's hand, build it for $100, and power it for days using the energy in a typical mobile phone battery. This will make software radios deployable in high densities and broadly accessible for research and education.

Mobile wireless sensors require position updates for tracking and navigation. We present a localization technique that uses the Doppler shift in radio transmission frequency observed by stationary sensors. We consider two scenarios. In the first, the mobile node is carried by a person. In the second, the mobile node controls a robot. In both approaches the mobile node transmits an RF signal, and infrastructure nodes measure the Doppler-shifted frequency. Such measurements enable us to calculate the position and velocity of the mobile transmitter. Our experimental results demonstrate that this technique is viable and accurate for resource-constrained mobile sensor tracking and navigation.

The paper describes a target tracking system running on a heterogeneous sensor network (HSN) and presents results gathered from a realistic deployment. The system fuses audio direction of arrival data from mote class devices and object detection measurements from embedded PCs equipped with cameras. The acoustic sensor nodes perform beamforming and measure the energy as a function of the angle. The camera nodes detect moving objects and estimate their angle. The sensor detections are sent to a centralized sensor fusion node via a combination of two wireless networks. The novelty of our system is the unique combination of target tracking methods customized for the application at hand and their implementation on an actual HSN platform.

The Mobile Air Quality Monitoring Network (MAQUMON) is presented. The system consists of a number of car-mounted sensor nodes measuring different pollutants in the air. The data points are tagged with location and time utilizing an on-board GPS. Periodically, the measurements are uploaded to a server, processed and then published on the SensorMap portal. Given a sufficient number of nodes and diverse mobility patterns, a detailed picture of the air quality in a large area will be obtained at a low cost.

The paper presents a wireless sensor network-based mobilecountersniper system. A sensor node consists of a helmetmountedmicrophone array, a COTS MICAz mote for internodecommunication and a custom sensorboard that implementsthe acoustic detection and Time of Arrival (ToA) estimationalgorithms on an FPGA. A 3-axis compass providesself orientation and Bluetooth is used for communicationwith the soldier's PDA running the data fusion and the userinterface. The heterogeneous sensor fusion algorithm canwork with data from a single sensor or it can fuse ToA orAngle of Arrival (AoA) observations of muzzle blasts andballistic shockwaves from multiple sensors. The system estimatesthe trajectory, the range, the caliber and the weapontype. The paper presents the system design and the resultsfrom an independent evaluation at the US Army AberdeenTest Center. The system performance is characterized by 1-degree trajectory precision and over 95% caliber estimationaccuracy for all shots, and close to 100% weapon estimationaccuracy for 4 out of 6 guns tested.

Experiences developing a sensor network-based acoustic shooter localization system are presented. The system is able to localize the position of a shooter and the trajectory of the projectile using observed acoustic events, such as the muzzle blast and the ballistic shockwave. The network consists of a large number of cheap sensors communicating through an ad-hoc wireless network, which enables the system to resolve multiple simultaneous acoustic sources, eliminate multipath effects, tolerate multiple sensor failures while providing good coverage and high accuracy, even in such challenging environment as urban terrain. The paper describes the hardware and software platform developed for this application and summarizes the lessons learned during the development of the system.

We present a mobile acoustic beacon based sensor node localization method. Our technique is passive in that the sensor nodes themselves do not need to generate an acoustic signal for ranging. This saves cost, power and provides stealthy operation. Furthermore, the beacon can generate much more acoustic energy than a severely resource constrained sensor node, thereby significantly increasing the range. The acoustic ranging method uses a linear frequency modulated signal that can be accurately detected by matched filtering. This provides longer range and higher accuracy than the current state-of-the-art. The localization algorithm was especially designed to work in such acoustically reverberant environment, as urban terrain. The algorithm presented handles non-Gaussian ranging errors caused by echoes. Node locations are computed centrally by solving a global non-linear optimization problem in an iterative and incremental fashion

We present a novel radio interference based sensor localization method for wireless sensor networks. The technique relies on a pair of nodes emitting radio waves simultaneously at slightly different frequencies. The carrier frequency of the composite signal is between the two frequencies, but has a very low frequency envelope. Neighboring nodes can measure the energy of the envelope signal as the signal strength. The relative phase offset of this signal measured at two receivers is a function of the distances between the four nodes involved and the carrier frequency. By making multiple measurements in an at least 8-node network, it is possible to reconstruct the relative location of the nodes in 3D. Our prototype implementation on the MICA2 platform yields an average localization error as small as 3 cm and a range of up to 160 meters. In addition to this high precision and long range, the other main advantage of the Radio Interferometric Positioning System (RIPS) is the fact that it does not require any sensors other than the radio used for wireless communication.

An ad-hoc wireless sensor network-based system is presented that detects and accurately locates shooters even in urban environments. The localization accuracy of the system in open terrain is competitive with that of existing centralized countersniper systems. However, the presented sensor network-based solution surpasses the traditional approach because it can mitigate acoustic multipath effects prevalent in urban areas and it can also resolve multiple simultaneous shots. These unique characteristics of the system are made possible by employing novel sensor fusion techniques that utilize the spatial and temporal diversity of multiple detections. In this article, in addition to the overall system architecture, the middleware services and the unique sensor fusion algorithms are described. An analysis of the experimental data gathered during field trials at US military facilities is also presented.