Real-time multi-view 3D reconstruction is a missioncritical application for key edge-native use cases, such as fire rescue, where timely and accurate 3D scene modeling enables situational awareness and informed decision-making. However, the dynamic and unpredictable nature of edge resource availability introduces disruptions, such as degraded image quality, unstable network links, and fluctuating server loads, which challenge the reliability of the reconstruction pipeline. In this work, we present a reinforcement learning (RL)-based edge resource management framework for reliable 3D reconstruction to ensure high quality reconstruction within a reasonable amount of time, despite the system operating under a resource-constrained and disruptionprone environment. In particular, the framework adopts two cooperative Q-learning agents, one for camera selection and one for server selection, both of which operate entirely online, learning policies through interactions with the edge environment. To support learning under realistic constraints and evaluate system performance, we implement a distributed testbed comprising lab-hosted end devices and FABRIC infrastructure-hosted edge servers to emulate smart city edge infrastructure under realistic disruption scenarios. Results show that the proposed framework improves application reliability by effectively balancing end-toend latency and reconstruction quality in dynamic environments.

The ability to centrally control network infrastructure using a programmable middleware has made Software-Defined Networking (SDN) ideal for emerging applications, such as immersive environments. However, such flexibility introduces new vulnerabilities, such as switch misreporting led load imbalance, which in turn make such immersive environment vulnerable to severe quality degradation. In this paper, we present a hybrid machine learning (ML)-based network anomaly detection framework that identifies such stealthy misreporting by capturing temporal inconsistencies in switch-reported loads, and thereby counter potentially catastrophic quality degradation of hosted immersive application. The detection system combines unsupervised anomaly scoring with supervised classification to robustly distinguish malicious behavior. Data collected from a realistic testbed deployment under both benign and adversarial conditions is used to train and evaluate the model. Experimental results show that the framework achieves high recall in detecting misreporting behavior, making it effective for early and reliable detection in SDN environments.

Adversarial attacks threaten deep learning models deployed in edge environments that involve many Internet of Things(IoT) devices, yet most such studies assume access to powerful computing resources. This work demonstrates the feasibility of generating adversarial examples using light-weight surrogate models directly on resource-constrained IoT devices with limited computational capacity (e.g., Raspberry Pi) and evaluates the transferability of such examples impact across multiple target convolutional neural networks (CNN) architectures. Using a small surrogate CNN and Fast Gradient Sign Method (FGSM), we show that adversarial perturbations exhibit strong transferability, reducing classification accuracy by up to 65% on lightweight target models and 48% on larger target architectures. Perceptual analysis confirms that low-magnitude perturbations remain visually imperceptible while degrading model performance, whereas higher perturbations introduce noticeable distortions but further increase attack success rates. Despite computational constraints, adversarial generation is feasible in real time, raising security concerns for AI-driven IoT applications such as surveillance and authentication. These findings highlight the need for robust adversarial defenses in IoT-based AI systems, as attackers can compromise deep learning models without requiring specialized hardware or extensive machine learning expertise.

In recent years, Deep Neural Networks (DNNs) have become increasingly integral to IoT-based environments, enabling real-time visual computing. However, the limited computational capacity of these devices has motivated the adoption of collaborative DNN inference, where the IoT device offloads part of the inference-related computation to a remote server. Such offloading often requires dynamic DNN partitioning information to be exchanged among the participants over an unsecured network or via relays/hops, leading to novel privacy vulnerabilities. In this paper, we propose AdVAR-DNN, an adversarial variational autoencoder (VAE)-based misclassification attack, leveraging classifiers to detect model information and a VAE to generate untraceable manipulated samples, specifically designed to compromise the collaborative inference process. AdVAR-DNN attack uses the sensitive information exchange vulnerability of collaborative DNN inference and is black-box in nature in terms of having no prior knowledge about the DNN model and how it is partitioned. Our evaluation using the most popular object classification DNNs on the CIFAR-100 dataset demonstrates the effectiveness of AdVAR-DNN in terms of high attack success rate with little to no probability of detection.

Object identification and classification play an important role in a variety of real-world applications, such as surveillance, public safety, and emergency response. The traditional RGB image/video-based object classification suffers from privacy preservation issues. While the alternative of adopting X-rays and mmWave based video processing either suffers from harmful radiation or subpar performance for static object classification. In this paper, we propose a WiFi signal-based object classification approach where objects are classified by analyzing the channel state information (CSI) of transmitted signals from a WiFi access point (AP). We devise a data-driven instance-based machine learning (ML) approach to identify objects in a multiclass classification problem. Using publicly available and our own WiFi CSI dataset, we demonstrate why traditional deep convolutional neural network based approaches prove futile towards static object classification due to the relatively smaller amplitude in the CSI stream. Using CSI dataset from our own lab testbed, we demonstrate that the proposed k-nearest neighbor algorithm (kNN) achieves a high classification accuracy of upto 100% under line of sight (LoS) conditions. The results demonstrate that in the absence of Doppler shift caused by moving objects, our proposed methodology overcomes the challenge related to the static object classification.

Multi-view 3D reconstruction applications are revolutionizing critical use cases that require rapid situational-awareness, such as emergency response, tactical scenarios, and public safety. In many cases, their near-real-time latency requirements and ad-hoc needs for compute resources necessitate adoption of ‘Just-in-time’ edge environments where the system is set up on the fly to support the applications during the mission lifetime. However, reliability issues can arise from the inherent dynamism and operational adversities of such edge environments, resulting in spatiotemporally correlated disruptions that impact the camera operations, which can lead to sustained degradation of reconstruction quality. In this paper, we propose a novel portfolio theory inspired edge resource management strategy for reliable multi-view 3D reconstruction against possible system disruptions. Our proposed methodology can guarantee reconstruction quality satisfaction even when the cameras are prone to spatiotemporally correlated disruptions. The portfolio theoretic optimization problem is solved using a genetic algorithm that converges quickly for realistic system settings. Using publicly available and customized 3D datasets, we demonstrate the proposed camera selection strategy’s benefits in guaranteeing reliable 3D reconstruction against traditional baseline strategies, under spatiotemporal disruptions.

Visual—Inertial Odometry (VIO) supports immersive Virtual Reality (VR) by fusing camera and Inertial Measurement Unit (IMU) data for real-time pose. However, current trend of offloading VIO to edge servers can lead to server-side threat surface where subtle pose spoofing can accumulate into substantial drift, while evading heuristic checks. In this paper, we study this threat and present an unsupervised, label-free detection and recovery mechanism. The proposed model is trained on attack-free sessions to learn temporal regularities of motion to detect runtime deviations and initiate recovery to restore pose consistency. We evaluate the approach in a realistic offloaded-VIO environment using ILLIXR testbed across multiple spoofing intensities. Experimental results in terms of well-known performance metrics show substantial reductions in trajectory and pose error compared to a no-defense baseline.

In recent times, ‘Just-in-time’ edge environments have gained popularity due to on-demand edge resource requirements for deep neural network (DNN) based video processing applications in mission-critical use cases, such as public safety and tactical situations. However, striking a balance among mutually diverging performance metrics, such as end-to-end latency, accuracy, and device energy consumption in such inherently resource-constrained and loosely coupled environment is non-trivial. In this paper, we design and develop the Infer-EDGE framework that seeks to strike such trade-off. First, using comprehensive benchmarking experiments, we develop intuitions about the trade-off characteristics, which are then used by the framework to develop an Advantage Actor-Critic (A2C) Reinforcement Learning (RL) approach that can choose optimal run-time DNN inference parameters, aligning the performance metrics with the application requirements. Using real-world DNNs and a hardware testbed, we evaluate the benefits of Infer-EDGE framework in terms of energy savings, inference accuracy improvement. and end-to-end inference latency reduction.

Deep neural networks (DNNs) are influencing a wide range of applications from safety-critical to security-sensitive use cases. In many such use cases, the DNN inference process relies on distributed systems involving IoT devices and edge/cloud severs as participants where a pre-trained DNN model is partitioned/split onto multiple parts and the participants collaboratively execute them. However, often such collaboration requires dynamic DNN partitioning information to be exchanged among the participants over unsecured network or via relays/hops which can lead to novel privacy vulnerabilities. In this paper, we propose a DNN model extraction attack that exploits such vulnerabilities to not only extract the original input data, but also reconstruct the entire victim DNN model. Specifically, the proposed attack model utilizes extracted/leaked data and adversarial autoencoders to generate and train a shadow model that closely mimics the behavior of the original victim model. The proposed attack is query-free and does not require the attacker to have any prior information about the victim model and input data. Using an IoT-edge hardware testbed running collaborative DNN inference, we demonstrate the effectiveness of the proposed attack model in extracting the victim model with high levels of certainty across many realistic scenarios.

Edge computing plays a crucial role in large-scale and real-time video analytics for smart cities, particularly in environments with massive machine-type communications (mMTC) among IoT devices. Due to the dynamic nature of mMTC, one of the main challenges is to achieve energy-efficient resource allocation and service placement in resource-constrained edge computing environments. In this paper, we introduce DeepRB, a deep learning-based resource broker framework designed for real-time video analytics in edge-native environments. DeepRB develops a two-stage algorithm to address both resource allocation and service placement efficiently. First, it uses a Residual Multilayer Perceptron ( ResMLP) network to approximate traditional iterative resource allocation policies for IoT devices that frequently transition between active and idle states. Second, for service placement, DeepRB leverages a multi-agent federated deep reinforcement learning (DRL) approach that incorporates clustering and knowledge-aware model aggregation. Through extensive simulations, we demonstrate the effectiveness of DeepRB in improving schedulability and scalability compared to baseline edge resource management algorithms. Our results highlight the potential of DeepRB for optimizing resource allocation and service placement for real-time video analytics in dynamic and resource-constrained edge computing environments.

Balancing mutually diverging performance metrics, such as, processing latency, outcome accuracy, and end device energy consumption is a challenging undertaking for deep learning model inference in ad-hoc edge environments. In this paper, we propose EdgeRL framework that seeks to strike such balance by using an Advantage Actor-Critic (A2C) Reinforcement Learning (RL) approach that can choose optimal run-time DNN inference parameters and aligns the performance metrics based on the application requirements. Using real world deep learning model and a hardware testbed, we evaluate the benefits of EdgeRL framework in terms of end device energy savings, inference accuracy improvement, and end-to-end inference latency reduction.

Volunteer Edge-Cloud (VEC) computing has a significant potential to support scientific workflows in user communities contributing volunteer edge nodes. However, managing heterogeneous and intermittent resources to support machine/deep learning (ML/DL) based workflows poses challenges in resource governance for reliability, and confidentiality for model/data privacy protection. There is a need for approaches to handle the volatility of volunteer edge node availability, and also to scale the confidential data-intensive workflow execution across a large number of VEC nodes. In this paper, we present VECA, a reliable and confidential VEC resource clustering solution featuring three-fold methods tailored for executing ML/DL-based scientific workflows on VEC resources. Firstly, a capacity-based clustering approach enhances system reliability and minimizes VEC node search latency. Secondly, a novel two-phase, globally distributed scheduling scheme optimizes job allocation based on node attributes and using time-series-based Recurrent Neural Networks. Lastly, the integration of confidential computing ensures privacy preservation of the scientific workflows, where model and data information are not shared with VEC resources providers. We evaluate VECA in a Function-as-a-Service (FaaS) cloud testbed that features OpenFaaS and MicroK8S to support two ML/DL-based scientific workflows viz., G2P-Deep (bioinformatics) and PAS-ML (health informatics). Results from tested experiments demonstrate that our proposed VECA approach outperforms state-of-the-art methods; especially VECA exhibits a two-fold reduction in VEC node search latency and over $20 \%$ improvement in productivity rates following execution failures compared to the next best method.

In recent times, Volunteer Edge-Cloud (VEC) has gained traction as a cost-effective, community computing paradigm to support data-intensive scientific workflows. However, due to the highly distributed and heterogeneous nature of VEC resources, centralized workflow task scheduling remains a challenge. In this paper, we propose a Reinforcement Learning (RL)-driven data-intensive scientific workflow scheduling approach that takes into consideration: i) workflow requirements, ii) VEC resources' preference on workflows, and iii) diverse VEC resource policies, to ensure robust resource allocation. We formulate the long-term average performance optimization problem as a Markov Decision Process, which is solved using an event-based Asynchronous Advantage Actor-Critic based RL approach. Our extensive simulations and testbed implementations demonstrate our approach's benefits over popular baseline strategies in terms of workflow requirement satisfaction, VEC preference satisfaction, and available VEC resource utilization.

Ad-hoc edge deployments to support real-time complex video processing applications such as, multi-view 3D reconstruction often suffer from spatio-temporal system disruptions that greatly impact reconstruction quality. In this poster paper, we present a novel portfolio theory-inspired edge resource management strategy to ensure reliable multi-view 3D reconstruction by accounting for possible system disruptions.

Collaborative IoT-edge environments, although effective in hosting latency-sensitive applications, are fundamentally vulnerable to data falsification attacks that can potentially impact key system performance objectives. In this paper, we explore and propose an intent-driven energy data falsification attack model for collaborative IoT-edge environments and shed light on the attack's impact on system performance. Our primary contribution lies in developing key intuitions and systemization of threat landscape for attacks with selfish and malicious intents that target one or many key system performance objectives, viz., overall system energy-efficiency and end-to-end latency of hosted applications. The proposed attack model is evaluated, optimized, and validated through ‘testbed-in-the-loop’ simulations. The results demonstrate that depending on selfish and malicious intents, the proposed attack model can achieve upto 50% increase in energy savings for the compromised IoT devices, accelerate battery drainage of non-compromised devices, and ensure upto 61% success in violating application latency requirements.

Real-time video analytics applications are one of the driving forces towards adoption of edge computing due to the latter’s ability to provide ‘near cloud-scale’ resources closer to the application site. However, striking a balance between system energy-efficiency and video quality satisfaction still remains a challenge. In this paper, we propose an edge-driven unified resource broker (URB) framework, viz., EdgeURB that seeks to find a trade-off between edge devices’ energy-efficiency and video configuration adaptation, with an aim to satisfying the real-time latency requirements without compromising analytics accuracy. Particularly, we design a two-stage algorithm: 1) a centralized algorithm for resource allocation, frame resolution selection, and user device to sever assignment and 2) a strategic game to further improve the energy-efficiency. We evaluate the performance of EdgeURB framework using an edge hardware testbed prototype that demonstrates EdgeURB’s success in simultaneously satisfying application latency, analytics accuracy, and devices’ energy consumption requirements. Also, through extensive simulations, we demonstrate EdgeURB’s schedulability and scalability improvement over baseline algorithms for a large number of devices and for varying edge resource availability.

Multi-view 3D reconstruction driven augmented, virtual, and mixed reality applications are becoming increasingly edge-native, due to factors such as, rapid reconstruction needs, security/privacy concerns, and lack of connectivity to cloud platforms. Managing edge-native 3D reconstruction, due to edge resource constraints and inherent dynamism of 'in the wild' 3D environments, involves striking a balance between conflicting objectives of achieving rapid reconstruction and satisfying minimum quality requirements. In this paper, we take a deeper dive into multi-view 3D reconstruction latency-quality trade-off, with an emphasis on reconstruction of dynamic 3D scenes. We propose data-level and task-level parallelization of 3D reconstruction pipelines, holistic edge system optimizations to reduce reconstruction latency, and long-term minimum reconstruction quality satisfaction. The proposed solutions are validated through collection of real-world 3D scenes with varying degree of dynamism that are used to perform experiments on hardware edge testbed. The results show that our solutions can achieve between 50% to 75% latency reduction without violating long term minimum quality requirements.

Real-time visual computing applications running Deep Neural Networks (DNN) are becoming popular for mission-critical use cases such as, disaster response, tactical scenarios, and medical triage that require establishing ad-hoc edge environments. However, strict latency deadlines of such applications require real-time processing of pre-trained DNN layers (i.e., DNN inference) involving image/video data which is highly challenging to achieve under such resource- constrained edge environments. In this paper, we address the trade-off between end-to-end latency of DNN inference and IoT devices’ energy consumption by proposing ‘EFFECT-DNN’, an energy efficient edge computing framework. The EFFECT-DNN framework aims to strike such balance by employing a collaborative DNN partitioning and task offloading strategy. Such strategy also involves resource allocation from IoT devices and edge servers to satisfy DNN inference deadline requirement even when the network bandwidth is on the lower end, which is often the case for critical use cases. The underlying optimization is formulated as a dynamic Mixed-Integer Nonlinear Programming (MINLP) problem is decoupled and solved by convex optimization and a game-like heuristic algorithm. We evaluate the performance of EFFECT-DNN framework on a hardware testbed and using extensive simulations with real-world DNN s. The results demonstrate that the proposed framework can ensure DNN inference deadline satisfaction with significant (~ 20-30%) device energy savings.

Energy efficient task offloading within a fog computing environment comprising of end-devices and edge servers remains a challenging problem to solve, especially for real-time video processing applications due to such tasks' strict latency deadline demands. In this paper we propose an Energy-efficient Fog Computing framework (EFFECT) for real-time applications within mission-critical use cases. The proposed framework runs a Unified Resource Broker (URB) that implements: a) centralized sub-channel and transmission power allocation as well as end-device/edge server computation speed allocation algorithms, along with b) distributed multi-device, multi-server task offloading game based Directed Acyclic Graph (DAG) partition and edge server selection algorithms. The framework is designed, developed, implemented, and evaluated on an Amazon EC2 virtual testbed built using Apache Storm, which is a distributed computing platform. The results from the testbed experiments along with realistic simulations validate the utility of EFFECT task offloading strategy in minimizing energy consumption yet satisfying latency deadlines.

Federated multi-cloud resource allocation for data-intensive application workflows is generally performed based on performance or quality of service (i.e., QSpecs) considerations. At the same time, end-to-end security requirements of these workflows across multiple domains are considered as an afterthought due to lack of standardized formalization methods. Consequently, diverse/heterogenous domain resource and security policies cause inter-conflicts between application's security and performance requirements that lead to sub-optimal resource allocations. In this paper, we present a joint performance and security-driven federated resource allocation scheme for data-intensive scientific applications. In order to aid joint resource brokering among multi-cloud domains with diverse/heterogenous security postures, we first define and characterize a data-intensive application's security specifications (i.e., SSpecs). Then we describe an alignment technique inspired by Portunes Algebra to homogenize the various domain resource policies (i.e., RSpecs) along an application's workflow lifecycle stages. Using such formalization and alignment, we propose a near optimal cost-aware joint QSpecs-SSpecs-driven, RSpecs-compliant resource allocation algorithm for multi-cloud computing resource domain/location selection as well as network path selection. We implement our security formalization, alignment, and allocation scheme as a framework, viz., “OnTimeURB” and validate it in a multi-cloud environment with exemplar data-intensive application workflows involving distributed computing and remote instrumentation use cases with different performance and security requirements.

In mobile edge computing (MEC) systems, offloading real-time and compute-intensive application tasks to remote edge servers is performed to relieve energy-constrained mobile devices of energy consuming computations. However, such practice often becomes counter-productive as transmission power requirements to offload such real-time tasks through wireless can make the mobile devices spend significant energy. In this paper, we propose an energy-efficient task offloading scheme for real-time and compute-intensive applications that optimizes energy consumption at mobile devices without violating such applications' strict latency requirements. In particular, for local energy savings at the mobile devices, we propose a Computation and Power Optimization (CPO) algorithm for optimal job partitioning. Then we propose a multi-device and multi-server task Joint Task Offloading Game (JTOG) algorithm in order to minimize the energy consumption for all mobile devices generating multiple tasks. Finally, using a realistic and detailed simulation, we prove that a tractable Nash Equilibrium always exists for the game that optimizes the energy savings of all mobile devices. We also show that the proposed JTOG algorithm performs significantly better than other default full task offloading schemes in terms of overall energy savings.

With the increase of DDoS attacks, resource adaptation schemes need to be effective to protect critical cloud-hosted applications. Specifically, they need to be adaptable to attack behavior, and be dynamic in terms of resource utilization. In this paper, we propose an intelligent strategy for proactive and reactive application migration by leveraging the concept of `moving target defense' (MTD). The novelty of our approach lies in: (a) stochastic proactive migration frequency minimization across heterogeneous cloud resources to optimize migration management overheads, (b) market-driven migration location selection during proactive migration to optimize resource utilization, cloud service providers (CSPs) cost and user quality of experience, and (c) fast converging cost-minimizing reactive migration coupled with a `false reality' pretense to reduce the future attack success probability. We evaluate the effectiveness of our proposed MTD-based defense strategy using a Software-defined Networking (SDN) enabled GENI Cloud testbed for a “Just-in-time news articles and video feeds” application. Our frequency minimization results show more than 40% reduction in DDoS attack success rate in the best cases when compared to the traditional periodic migration schemes on homogeneous cloud resources. The results also show that our market-driven migration location selection strategy decreases CSP cost and increases resource utilization by 30%.

Data-intensive bioinformatics applications often use federated multi-cloud infrastructures to support compute-intensive processing needs. In this paper, we propose a Multi-Cloud Performance and Security (MCPS) Brokering framework within such federated multi-cloud infrastructures to allocate cloud resources to applications by satisfying their performance and security requirements.

Cloud based incidence response systems suffer from lack of network connectivity to offload compute intensive mission-critical applications to remote cloud. Thus, the next-generation incidence response solutions are becoming more edge-cloud based where computational resources are available closer to the disaster site. However, frequent and dynamic unpredictabilities or fluctuations generated in such edge-cloud deployments (e.g., using wireless spectrum in unlicensed manner) adversely impact the performance of mission-critical, real-time applications which often demand strict performance guarantees. Such fluctuations cause severe performance degradations to mission-critical applications that use such channels. In this paper, we propose an intelligent yet lightweight application task assignment (end-user device to edge-cloud) and application migration scheme (between edge-cloud resources) that can help mission-critical applications avoid impending fluctuations and improve system resilience. The proposed scheme implements Largest Bandwidth Largest Job-First Fit (LBLJ-FF) algorithm as a Unified Resource Broker (URB) service that optimizes transmission cost and migration overhead. The algorithm is light-weight and fast converging in reacting to sudden fluctuations. We demonstrate the performance of the proposed scheme through a realistic simulation that uses real fluctuation dataset. The results demonstrate the existence of an optimal trade-off point between transmission cost and migration overhead optimizations. The results also show the resilience of the proposed algorithm in improving job completion rate when the edge-cloud system is under intense fluctuation.

Securing multi-domain network performance monitoring (NPM) systems that are being widely deployed as `Measurement Infrastructure-as-a-Service' (MIaaS) in high-performance computing is becoming increasingly critical. It presents an emerging set of research challenges in cloud security given that security mechanisms such as policy-driven access to federated NPM services across multiple domains need to be designed carefully to protect MIaaS resources and data. In this paper, we advocate the design of a security middleground between default open/closed access settings and present policy-driven access controls of measurement functions for a multi-domain federation using a MIaaS. Our approach involves an analytical investigation based on a set of custom metrics to compare and contrast the legacy, role-based and more fine-grained, attribute-based access control schemes to design a security middleground. We implement the chosen middleground with a secured middleware, viz., “OnTimeSecure”. Our middleware enables `user-to-service' and `service-to-service' authentication, and enforces federated authorization entitlement policies for timely orchestration of MIaaS services. Lastly, we evaluate OnTimeSecure in a real multi-domain MIaaS testbed by performing threat modeling and security risk assessments to validate the analysis outcomes and demonstrate its effectiveness for easy integration and sustainable adoption.

With the surge in data-intensive science applications, the campus cloud infrastructures are increasingly dealing with sensitive data that has strict security requirements. However, in most cases due to lack of sophisticated security frameworks and trained personnel, such campus private clouds (CPC) are not fully equipped to handle sophisticated integrity, availability, and confidentiality attacks. In this paper, we demonstrate the utility of a cost-effective, and implementationally simpler Moving Target Defense (MTD) based cloud resource adaptation approach that significantly reduces the probability of attack success. In particular, we propose a Bayesian Attack Graph (BAG) based threat assessment model. Our proposed model follows Common Vulnerability Scoring System (CVSS) impact evaluation recommendations. As a case study, We use our graph based threat assessment model to demonstrate the utility of MTD against attacks on City University of New York (CUNY) research network. The study involves unique scenarios with multiple confidentiality, integrity, and availability related vulnerabilities being exploited by attacks from different network locations. Finally, we simulate a CUNY research network in GENI environment to validate our BAG model by emulating attack scenarios and observing system resilience with and without MTD.

With wider adoption of Software-Defined Networking (SDN), network obfuscation and resource adaptation within a cloud environment have emerged as cost-effective solutions against cyber attacks. In spite of their implementation simplicity, shortcomings of such one-dimensional strategies are considerable against sophisticated attacks where the attacker/s have enhanced visibility to the cloud network. In this paper, we propose Whack-a-Mole, a SDN-driven cloud resource management scheme through network obfuscation that can help Cloud Service Providers (CSPs) to: a) proactively protect critical services from impending DDoS attacks and b) contribute very little service interruption footprint while doing so. Whack-a-Mole works at two levels: it employs a novel virtual machine (VM) spawning model that not only creates multiple VM-replicas of critical services to new cloud resource instances, but also assigns VM-replicas' IP addresses through address space randomization. Using numerical results, we show how such VM spawning can be optimized based on realistic cloud Service Level Agreements (SLA) without compromising its effectiveness. Finally, Whack-a-Mole is implemented through SDN/OpenFlow controllers over Open vSwitches on a GENI testbed where the efficacy and effectiveness of the scheme is evaluated. The results show Whack-a-Mole to be as effective as random obfuscation in evading attack events and more than 2x better on average in attack avoidance over other static resource adaptation based defense strategies.

Campuses are increasingly adopting hybrid cloud architectures for supporting data-intensive science applications that require “on-demand” resources, which are not always available locally on-site. Policies at the campus edge for handling multiple such applications competing for remote resources can cause bottlenecks across applications. These bottlenecks can be proactively avoided with pertinent profiling, monitoring and control of application flows using software-defined networking and pertinent selection of local or remote compute resources. In this paper, we present an “application-driven overlay network-as-a-service” (ADON) that manages the hybrid cloud requirements of multiple applications in a scalable and extensible manner by allowing users to specify requirements of the application that are translated into the underlying network and compute provisioning requirements. Our solution involves scheduling transit selection, a cost optimized selection of site(s) for computation and traffic engineering at the campus-edge based upon real-time policy control that ensures prioritized application performance delivery for multi-tenant traffic profiles. We validate our ADON approach through an emulation study and through a wide-area overlay network testbed implementation across two campuses. Our workflow orchestration results show the ADON effectiveness in handling temporal behavior of multi-tenant traffic burst arrivals using profiles from a diverse set of actual data-intensive applications.

Multi-domain end-to-end network performance monitoring federations such as perfSONAR are increasingly being used in Big Data application management. They rely on trustworthy collaborative measurement intelligence to identify and diagnose network anomaly events that impact application performance. Large volumes of end-to-end measurement traces are generated on a daily basis, and new Big Data analysis techniques are needed to isolate network-wide anomaly event(s) and to diagnose the root-cause(s). In addition, not all network operators and application users have enough knowledge and experience to understand the anomaly events. The lack of a platform for sharing knowledge and working collaboratively makes it difficult to isolate and diagnose network-wide anomaly events quickly and accurately. In this paper, we define a “social plane” that relies on recommended measurements based on “content-based filtering” and “collaborative filtering” approaches to enable network performance expectation management. Based on similarity analysis, the content-based filtering facilitates users to subscribe to useful measurements, and the collaborative filtering promotes users to share knowledge on anomaly symptoms. Using real perfSONAR measurements and synthetic events, we show the effectiveness of our social plane approach within a SoyKB Big Data application case study using social network creation and mingling of experts. Our experimental results show that our measurements recommendation scheme has high precision, recall, and accuracy, as well as efficiency in terms of the time taken for large volume measurement trace analysis.

Traditionally, the allocation and dynamic adaptation of federated cyberinfrastructure resources residing across multiple domains for data-intensive application workflows have been performance or quality of service-centric (i.e., QSpecs), often compromising the end-to-end security requirements of scientific workflows. Lack of standardized formalization methods of the workflows' end-to-end security requirements, and diverse/heterogenous domain resource and security policies make inter-conflict characterization between application's security and performance requirements non-trivial, and leads to sub-optimal resource allocation. In this paper, we present a joint security and performance-driven federated resource allocation and adaptation scheme to define and characterize a data-intensive scientific application's security specifications (i.e., SSpecs). In order to aid security-driven resource brokering among domains with diverse security postures, we describe an alignment technique inspired by Portunes Algebra to combine domain-specific resource policies (i.e., RSpecs) along the application workflow life cycle. We use standardized guidelines that help in compute/storage resource domain/location selection as well as network path selection based on both application QSpecs and SSpecs. We implement our security formalization and alignment methods as a framework, viz., "OnTimeURB" and apply it on an exemplar Distributed Computing workflow to show the benefits of joint QSpecs-SSpecs-driven, RSpecs-compliant federated workflow management.

Multi-domain network performance monitoring (NPM) federations, such as perfSONAR rely on collaborative measurement intelligence to identify network anomaly events and diagnose performance bottlenecks affecting data-intensive science applications. In this paper, we present a novel measurement recommendation scheme to assist network operators and application users by recommending pertinent samples from a pool of measurement data involving multiple domains to detect and troubleshoot correlated network anomaly events. The recommendations are based on the principles of content-based filtering. Such recommendations are complimented with Bayesian Inference based domain reputation meta-information to strengthen the veracity information of the recommended traces. Using actual long-term and short-term perfSONAR traces, we analyze recommendation results and show: a) how the content-based filter recommends the most pertinent traces based on their attributes, and b) the time-variant characteristics of domain reputation. Finally, using synthetic traces, we show the effectiveness of our proposed measurements recommendation scheme in accurately identifying anomaly events for an exemplar use case, and also show how our content filter based recommendation scheme performs better in terms of false alarms in comparison to: a) recommendations that consider partial trace features for filtering, and b) greedy recommendation approaches based on random trace selection.

High-performance computing (HPC) environments supporting data-intensive applications need multidomain network performance measurements from open frameworks such as perfSONAR. Detected network-wide correlated anomaly events that impact data throughput performance need to be quickly and accurately notified along with a root-cause analysis for remediation. In this paper, we present a novel network anomaly events detection and diagnosis scheme for network-wide visibility that improves accuracy of root-cause analysis. We address analysis limitations in cases where there is absence of complete network topology information, and when measurement probes are mis-calibrated leading to erroneous diagnosis. Our proposed scheme fuses perfSONAR time-series path measurements data from multiple domains using principal component analysis (PCA) to transform data for accurate correlated and uncorrelated anomaly events detection. We quantify the certainty of such detection using a measurement data sanity checking that involves: 1) measurement data reputation analysis to qualify the measurement samples and 2) filter framework to prune potentially misleading samples. Lastly, using actual perfSONAR one-way delay measurement traces, we show our proposed scheme's effectiveness in diagnosing the root-cause of critical network performance anomaly events.

In this paper, we propose a spectrum map aided routing protocol for a distributed cognitive radio network. We assume the presence of dedicated sensors that capture the spatio-temporal spectrum usage statistics to create the radio environment map. We exploit the map to find not only the best hops along a route but also the best available channel in terms of the expected performance. Through the use of edge nodes, which lie in the intersection of more than one sensors' domain, inter-domain routing is facilitated. The selection of each hop, the channel to be used per hop, and the transmitting power to be used considers i) protection of primary receivers, and ii) maximization of desired performance metric. In this context, we propose a novel power control mechanism that computes just enough power to maintain the desired signal-to-noise ratio for secondary communication but at the same time protects the primary receivers in the vicinity. We analyze and compute the probability of network connectivity by finding the minimum spanning tree of the graph formed by the over-lapping domains. Through simulations, we show how the proposed routing scheme works in terms of route capacity, connectivity of the network, reachability among the nodes, and number of primary receivers protected.

Design of an efficient medium access control protocol is critical for proper functioning of a distributed cognitive radio network and better utilization of the channels not being used by primary users. In this paper, we design a contention based distributed medium access control (MAC) protocol for the secondary users' channel access. The proposed MAC protocol allows collision-free access to the available data channels and eventually their utilization by secondary users, with spectrum sensing part being handled by exclusive sensing nodes. We further introduce the provision of reservation of free channels by secondaries for extended periods to increase utilization without causing harmful interference to primaries. We demonstrate how such extended access to resources can be tuned to provide differential quality of service to the secondary users. The effectiveness of the protocol is evaluated by performing analysis and simulation. We use blocking probability, secondary usage of a secondary user and performance degradation caused to primary incumbents as performance metrics. We obtain the conditions for such extended access and try to gauge the resulting increase in utilization. Under optimal conditions, the proposed scheme enables the secondary network to utilize all available channels. The proposed scheme is shown to outperform the most sophisticated existing MAC schemes for distributed secondary networks.

Design of an efficient medium access control protocol is critical for proper functioning of a distributed cognitive radio network and better utilization of the available channels not being used by primary users. In this paper, we design a contention based distributed medium access control (MAC) protocol for the secondary users' channel access. The proposed MAC protocol allows collision-free access of the available channels and eventual utilization by secondary users, with spectrum sensing part being handled by exclusive sensing nodes. The effectiveness of the proposed MAC protocol is evaluated analytically and also through empirical simulations. We show how the protocol performs with respect to blocking probability, channel grabbing, and channel utilization1.

In cognitive radio networks, the radios continuously scan the radio spectrum and create a spectrum usage report. Due to channel uncertainty, there are inaccuracies in these reports. Oftentimes, the radios share and fuse the observed data in order to increase the accuracy of the spectrum usage. However, malicious nodes tend to send false information (i.e., attack) in order to mislead the construction of the spectrum usage report. In this paper, we use a trust model to evaluate the trustworthiness of every node and use the trust values to effectively fuse the information from all nodes. A node compares the information sent by a neighboring node with the predicted information. Based on the ratio of matches (or mismatches), the neighboring node is assigned a trust value. Then, we propose a log-weighted metric utilizing trust values to distinguish malicious nodes from others. Subsequently, we propose threshold based Selective Inversion (SI) fusion and Complete Inversion (CI) fusion to effectively combine not only the information sent by honest nodes but also utilize misleading information sent by malicious nodes. We also propose a combination of the two inversion schemes. We compare the performance of the inversion based fusion schemes with blind and trust-based fusions. Results reveal better performance for inversion based fusion schemes for various intensities of attack. We also conduct simulations to evaluate the optimal thresholds that are used for invoking the inversion based fusion schemes.

This work introduces the concept of critical sections for online first person shooter games (FPS). A critical section is a section of game-play which demands higher precision or tighter deadlines. Critical section traffic is more sensitive to network degradations than sections immediately preceding or following it. Critical sections provide game developers and network programmers a notion of relative priority of game traffic, and can identify segments whose preservation can lead to superior user perceived quality of playing FPS games on a network. By analyzing video-recordings of over 5 hours of FPS gameplay by 10 volunteers, we identify sections of FPS game-play whose degradation would cause inconsistent game-state updates resulting in user frustration. We observe that critical sections exhibit a pattern of occurrence and can account for upto 17% of game-play time. We next quantify the expected network induced degradations on critical sections for online FPS games on the Internet. Using traces from a deployment of FPS workloads on 50+ nodes in the Internet, we study network dynamics and their ensuing effect on critical sections. Using traces from this experiment, we derive the lower bound on potentially degraded game-play session on todays Internet. We argue that critical sections of FPS games can be preserved. This can allow a variety of network architectures to better deliver higher perceptual experience when deployed on the Internet. Overall, our results have implications for FPS game-design, network provisioning, and game quality evaluation.

IEEE 802.22 networks consist of base stations and consumer premise equipments (CPEs) where the base station in each cell opportunistically accesses and allocates (uplink and downlink) channels to all the CPEs in its cell. Information on white space (unused primary channels) availability is reported by the CPEs to the base stations. Thus, a base station's effectiveness to allocate channels are based on its ability to gauge the spectrum usage at various locations. In this paper, we propose a channel usage estimation framework where a base station uses the spectrum reports from other neighboring base stations to estimate the spectrum usage scenario at any arbitrary location within its cell. Our estimation framework is based on Shepard's interpolation technique for irregular points. We propose a channel allocation scheme that minimizes interference among CPEs and maximizes white space utilization. Through simulation experiments, we demonstrate the accuracy of the estimation technique, utilization of the available spectrum, and efficiency of allocation scheme. We also show that our scheme achieves very low false positives and no false negatives. Finally, we show that the optimal number of base stations that need to be consulted is in accordance with Shepard's bounds1.

The main challenge in resource allocation in cognitive radio based IEEE 802.22 networks is the absence of predefined control channels. Moreover, the fleeting nature of the available spectrum also hinders the communication as the radios must relinquish the acquired channels once the primary users of those channels return. In this paper, we propose a performance metrics based data channel allocation scheme for IEEE 802.22 networks where the base station allocates interference free channels to the consumer premise equipments using a spectrum map. The base station creates the spectrum map by using the raw spectrum usage data that are shared by a small subset of consumer premise equipments. The usage data are fused at the base station using a modified version of Shepard's interpolation technique. We construct a continuous and differentiable spatial distribution of spectrum usage that the base station consults to estimate the spectrum occupancy vector at any arbitrary location in its cell. Such spectrum usage is then utilized to proactively evaluate some key network and radio performance metrics which in turn help allocating the best candidate channel to a given consumer premise equipment ensuring highest achievable performance.

The open philosophy of cognitive radio networks makes them vulnerable to various types of attacks which compromises the efficiency of these networks. One such attack is the Spectrum Sensing Data Falsification (SSDF) attack where malicious nodes report false spectrum occupancy data to others which when used leads to inference that is far from the true spectrum occupancy. Thus, there is a need to identify the malicious nodes or at least find the trustworthiness of nodes such that the data sent by malicious nodes could be filtered out. This paper proposes a scheme for trust based fusion by monitoring anomalies in advertised spectrum usage reports by secondary nodes. Such monitoring leads to evaluation of trust of a node by its neighbors. The calculated trust is then used to determine if a neighbor node's advertised data could be used for fusion or not. We provide a heuristic trust threshold for nodes to disregard malicious nodes while fusing the data, which holds good for any probability of attack. To validate our model we conduct extensive simulation experiments. Our results show that majority of the nodes are able to fuse data with greater accuracy for various probabilities or intensities of attack. We also compare our results with blind fusion scheme and observe improvement in accuracy of fusion from individual nodes' as well as overall network's perspective. We also report a very counter-intuitive observation: at lower probabilities of attack, a malicious node's contribution to the overall gain in cooperation is more than the damage done.

Byzantine attacks have been identified as one of the key vulnerabilities in cognitive radio networks, where malicious nodes advertise false spectrum occupancy data in a cooperative environment. In such cases, the resultant fused data is very different from the actual scenario. Thus, there is a need to identify the malicious nodes or at least find the trustworthiness of nodes such that the data sent by malicious nodes could be filtered out. The process is complicated by presence of noise in the channel which makes it harder to distinguish anomalies caused by malicious activity and those caused due to unreliable noisy channels.

Cognitive radio based IEEE 802.22 wireless regional area networks have been proposed to harness the highly underutilized sub 900 MHz TV bands. In such networks, both base stations and the consumer premise equipments (CPEs) continuously perform spectrum sensing and transmit only on those channels which are not being used by the primary incumbents. In this paper, we propose a heuristic for an efficient channel allocation by a base station to the CPEs in that cell. Due to the lack of dedicated control channels, the BS and CPEs within a cell go through a process of exchanging control messages on free channels. The benefit of such sharing of their mutual spectrum usage helps the base station make informed decisions on the allocation of uplink and downlink channels to CPEs. This, in turn, guarantees no interference to and from the primary licensed incumbents. For validation of the proposed allocation scheme, we conducted simulation experiments. The results show how the proposed scheme ensures allocation to almost all the CPEs in a cell and how the nature of allocation is dependent on the total number of channels scanned, probability of getting a free channel and number of CPEs in the cell.