This paper introduces D-SYNC, a cutting-edge framework for enhancing the security and reliability of vehicle localization systems. D-SYNC offers an innovative solution to utilize dashcam footage for vehicle localization in the scenario of the primary localization system, GPS, under security attacks or simply failing to work. D-SYNC synchronizes the visual data from dashcam recordings with geotagged satellite imagery, achieving reliable vehicle positioning and trajectory mapping without precise dashcam-to-satellite alignment. D-SYNC introduces novel designs to address critical challenges, such as the limited field of vision in dashcam videos during real-world driving and how to correlate the significantly distinct spatial and temporal patterns between dashcam sequences and satellite images. Moreover, a novel geo-assisted loss function is introduced in D-SYNC that further elevates the performance of the localization process. D-SYNC surpasses existing methods and significantly increases vehicle localization accuracy. It achieves a 91% top-1 retrieval accuracy in urban environments and a 34% improvement in sub-10 meter localization error compared to benchmarks, relying solely on dashcam and satellite imagery.

The robustness, security, and safety of artificial intelligence (AI) systems have become growing concerns, particularly as deep learning models are increasingly deployed in critical applications. Among emerging threats, backdoor attacks pose a serious risk by embedding hidden malicious behaviors into otherwise well-performing models. Although recent advances in detection techniques have improved defenses for computer vision systems, our findings demonstrate that even simple but carefully designed poisoning strategies can successfully evade these defenses. In this paper, we introduce GhostBackdoor, a novel backdoored model trained using a custom loss function and targeted data augmentation. The proposed loss function aligns neuron activations between clean and poisoned inputs, effectively masking activation anomalies, while the augmentation enforces strict location- and pattern-specific triggers that activate the backdoor only under specific conditions. After training, the model maintains behavior indistinguishable from a clean model unless exposed to the designated trigger with the specific pattern and at the designed locations. We evaluate GhostBackdoor against a broad range of leading defense mechanisms, most of which fail to detect the implanted backdoor. Our results highlight how the vast hypothesis space of deep learning models can be exploited to conceal malicious activations, underscoring the need for more robust security strategies in AI-driven systems, including those used in Internet of Things (IoT) applications.

Privacy-preserving Machine Learning as a Service (MLaaS) enables the powerful cloud server to run its well-trained neural model upon the input from resource-limited client, with both of server's model parameters and client's input data protected. While computation efficiency is critical for the practical implementation of privacy-preserving MLaaS and it is inspiring to witness recent advances towards efficiency improvement, there still exists a significant performance gap to real-world applications. In general, state-of-the-art frameworks perform function-wise efficiency optimization based on specific cryptographic primitives. Although it is logical, such independent optimization for each function makes noticeable amount of expensive operations unremovable and misses the opportunity to further accelerate the performance by jointly considering privacy-preserving computation among adjacent functions. As such, we propose COIN: Conjunctive Optimization with Interleaved Nexus, which remodels mainstream computation for each function to conjunctive counterpart for composite function, with a series of united optimization strategies. Specifically, COIN jointly computes a pair of consecutive nonlinear-linear functions in the neural model by reconstructing the intermediates throughout the whole procedure, which not only eliminates the most expensive crypto operations without invoking extra encryption enabler, but also makes the online crypto complexity independent of filter size. Experimentally, COIN demonstrates 11.2x to 29.6x speedup over various function dimensions from modern networks, and 6.4x to 12x speedup on the total computation time when applied in networks with model input from small-scale CIFAR10 to large-scale ImageNet.

This paper proposes SEER, a novel backdoor detection algorithm for vision-language models, addressing the gap in the literature on multi-modal backdoor detection. While backdoor detection in single-modal models has been well studied, the investigation of such defenses in multi-modal models remains limited. Existing backdoor defense mechanisms cannot be directly applied to multi-modal settings due to their increased complexity and search space explosion. In this paper, we propose to detect backdoors in vision-language models by jointly searching image triggers and malicious target texts in feature space shared by vision and language modalities. Our extensive experiments demonstrate that SEER can achieve over 92% detection rate on backdoor detection in vision-language models in various settings without accessing training data or knowledge of downstream tasks.

Machine Learning as a Service (MLaaS) is an innovative framework that enables a broad range of users to capitalize on the powerful Artificial Intelligence (AI) technologies. Nevertheless, MLaaS raises a privacy concern for both the client data and server model. To address this issue, several Secure Inference (SI) frameworks for MLaaS have been proposed in the literature that take advantage of Homomorphic Encryption (HE) operations. However, the computation cost of these frameworks is still high, especially for real-time applications. In this paper, we propose a novel system called input structure optimization for neural networks (TILE) to accelerate SI. The goal of TILE is to reduce both linear and non-linear computation costs, as well as non-linear communication costs in MLaaS, while maintaining the model accuracy. TILE defines two novel HE-friendly input structures: Internal Tile and External Tile Structures, aimed at reducing the HE operations for SI. We also develop a search mechanism to identify optimal application locations for these input structures. We apply TILE to widely used models such as VGG and ResNet, and datasets including Cifar10 and Tiny-ImageNet. The experimental results demonstrate that TILE effectively reduces the computation time, with up to 51.57% reduction for a state-of-the-art SI framework. Furthermore, TILE can also be applied to models that have already been pruned to significantly reduce the computation time, to further reduce the overall computation time by 25.90%.

To enable common users to capitalize on the power of deep learning, Machine Learning as a Service (MLaaS) has been proposed in the literature, which opens powerful deep learning models of service providers to the public. To protect the data privacy of end users, as well as the model privacy of the server, several state-of-the-art privacy-preserving MLaaS frameworks have also been proposed. Nevertheless, despite the exquisite design of these frameworks to enhance computation efficiency, the computational cost remains expensive for practical applications. To improve the computation efficiency of deep learning (DL) models, model pruning has been adopted as a strategic approach to remarkably compress DL models. However, for practical deep neural networks, a problem called pruning structure inflation significantly limits the pruning efficiency, as it can seriously hurt the model accuracy. In this paper, we propose MOSAIC, a highly flexible pruning framework, to address this critical challenge. By first pruning the network with the carefully selected basic pruning units, then assembling the pruned units into suitable HE Pruning Structures through smart channel transformations, MOSAIC achieves a high pruning ratio while avoiding accuracy reduction, eliminating the problem plagued by the pruning structure inflation. We apply MOSAIC to popular DL models such as VGG and ResNet series on classic datasets such as CIFAR-10 and Tiny ImageNet. Experimental results demonstrate that MOSAIC effectively and flexibly conducts pruning on those models, significantly reducing the Perm, Mult, and Add operations to achieve the global cost reduction without any loss in accuracy. For instance, in VGG-16 on Tiny ImageNet, the total cost is reduced to 21.14% and 29.49% under the MLaaS frameworks GAZELLE and CrypTFlow2, respectively.

Machine Learning as a Service (MLaaS) has paved the way for numerous applications for resource-limited clients, such as IoT/mobile users. However, it raises a great challenge for privacy, including both the data privacy of clients and model privacy of the server. While there have been extensive studies on privacy-preserving MLaaS, a direct adoption of current frameworks leads to intractable efficiency bottleneck for MLaaS with resource constrained clients. In this paper, we focus on MLaaS with resource constrained clients and propose a novel privacy-preserving framework called SPOT to address a unique challenge, the memory constraint of such clients, such as IoT /mobile devices, which results in significant computation stalls at the server in privacy-preserving MLaaS. We develop 1) a novel structure patching scheme to enable independent computations for sequential inputs at the server to eliminate the computation stall, and 2) a patch overlap tweaking scheme to minimize overlapped data between adjacent patches and thus enable more efficient computation with flexible cryptographic parameters. SPOT demonstrates significant improvement on computation efficiency for MLaaS with IoT /mobile clients. Compared with the state-of-the-art framework for privacy-preserving MLaaS, SPOT achieves up to 2 × memory utilization boost and a speedup up to 3 × on computation time for modern neural networks such as ResNet and VGG.

Privacy-preserving Machine Learning as a Service (MLaaS) enables the resource-limited client to cost-efficiently obtain inference output of a well-trained neural model that is possessed by the cloud server, with both client’s input and server’s model parameters protected. While efficiency plays a core role for practical implementation of privacy-preserving MLaaS and it is encouraging to witness recent advances towards efficiency improvement, there still exists a significant performance gap to real-world applications. The basic logic in state-of-the-art frameworks involves an individual computation for each function of the neural model, based on specific cryptographic primitives. While it is definitely logical, we look back to the necessity of this function-wise methodology and initiate the comprehensive exploration towards allied optimization for efficient privacy-preserving MLaaS. Under such fresh perspective, we remodel the computation process that is always from input to output of the same function in mainstream works, to the allied counterpart that is from one function’s input associated with the start of expensive overhead to another function’s output enabling effective circumvention of unnecessary cost within the procedure. As such we propose FIT (Function Input Tuning) which features by a computation module for composite function with a series of joint optimization strategies. Theoretically, FIT not only eliminates the most expensive crypto operations without invoking extra encryption enabler, but also makes the running-time crypto complexity independent of filter size. Experimentally, FIT demonstrates tens of times speedup over various function dimensions from modern models, and 4.5× to 35.5× speedup on the total computation time when plugged in neural networks with data from small-scale MNIST to large-scale ImageNet.

This paper presents an experimental study on mmWave beam profiling on a mmWave testbed, and develops a machine learning model for beamforming based on the experiment data. The datasets we have obtained from the beam profiling and the machine learning model for beamforming are valuable for a broad set of network design problems, such as network topology optimization, user equipment association, power allocation, and beam scheduling, in complex and dynamic mmWave networks. We have used two commercial-grade mmWave testbeds with operational frequencies on the 27 Ghz and 71 GHz, respectively, for beam profiling. The obtained datasets were used to train the machine learning model to estimate the received downlink signal power, and data rate at the receivers (user equipment with different geographical locations in the range of a transmitter (base station). The results have showed high prediction accuracy with low mean square error (loss), indicating the model's ability to estimate the received signal power or data rate at each individual receiver covered by a beam. The dataset and the machine learning based beamforming model can assist researchers in optimizing various network design problems for mmWave networks.

Federated Learning (FL) has been adopted in practical network applications and plays a critical role. As FL allows participants to contribute to the global model by training locally with private data, it is known particularly vulnerable to neural backdoor attacks. This paper proposes a new defense, ScanFed, against neural backdoor attacks to FL systems. It leverages the synchronous nature of FL to effectively single out malicious neuron candidates and further validate if they indeed hijack the model's behaviors. Compared to existing neural backdoor defenses, ScanFed has the following distinct properties. First, it is extremely computation-friendly that is six orders of magnitude faster than state-of-the-art behavior-based backdoor defenses, rendering it highly suitable for large-scale FL systems. Second, it inherits the precise nature of behavior-based backdoor detection, making it significantly more effective than similarity-based defenses against advanced attacks. Third, it is robust to biased models uploaded by clients with non-IID (Independent and Identically Distributed) data, which is very common in practical FL systems. In addition, it is a plug-n-play scheme that can be seamlessly integrated into existing FL systems. To the best of our knowledge, this is the first behavior-based defense that enables scalable, efficient and accurate neural backdoor detection of FL systems in non-IID scenarios. This work delivers a ScanFed prototype and fully tests it in various settings of datasets, neural architectures, and backdoor attacks. The experiments demonstrate ScanFed achieves competitive accuracy and minimal detection time.

GPS spoofing is a great threat to the safety of transportation systems as well as other systems that rely on GPS for navigation. This paper proposes a novel computer vision based approach for GPS spoofing detection, termed SEquential dashcam-based vEhicle localization frameworK (SEEK). SEEK utilizes vehicle dashcam images to identify a vehicle's true location and detects possible GPS spoofing attacks through verifying if the reported GPS locations of the vehicle are correct. However, it is nontrivial to use dashcam images for vehicle localization due to multiple challenges caused by real-world driving, including the complicated lighting/weather conditions, season/timing variations of the images, large blockage ratio in the images, and varying driving speeds. SEEK features a unique design with novel schemes to address complicated lighting/weather conditions, transform images to align with season changes, reduce blockage, and adopt a sequential image matching scheme. The performance evaluation shows that SEEK significantly outperforms the previous GPS spoofing detection scheme, and achieves a detection accuracy of up to 94%.

Digital identity management (DIM) systems have become challenging, especially, given the current progression in ubiquitous environments enclosing cooperative Internet of Things (IoT) devices, individuals, and organizations. Self-sovereign identity (SSI) has recently surfaced to manifest the notion of decentralized DIMs enlivened by users’ autonomy. This article presents a proactive, trustworthy solution for managing digital users’ data and identity information without risking its integrity, security, privacy, and confidentiality. Accordingly, we propose a decentralized SSI-enabled cloud storage model that enables secure access control and frequent data integrity checking (IC) mechanism. The presented model ensures the resiliency of SSI-enabled operations, including users’ registration, data identification, external information distribution, IC operations, identity information authentication and verification, and decentralized external and shareable operations.

The pandemics, such as COVID-19 are worldwide health risks and result in catastrophic impacts on the global economy. To prevent the spread of pandemics, it is critical to trace the contacts between people to identify the infection chain. Nevertheless, the privacy concern is a great challenge to contact tracing. Moreover, existing contact tracing apps cannot obtain the macro-level infection risk information, e.g., the hotspots where the infection occurs, which, however, is critical to optimize healthcare planning to better control and prevent the outbreak of pandemics. In this article, we develop a novel privacy-preserved pandemic tracing system, privacy-preserved pandemic infection risk computation (PRISC), to compute the infection risk through cellular-enabled IoT devices. In the PRISC system, there are three parties: 1) a mobile network operator (MNO); 2) a social network provider; and 3) the department of health. The physical contact records between users are obtained by the MNO from the users’ cellular-enabled IoT devices. The social contacts are obtained by the social network provider, while the health department has the records of pandemic patients. The three parties work together to compute a heatmap of pandemic infection risk in a region, while fully protecting the data privacy of each other. The heatmap provides both macro and micro-level infection risk information to help control pandemics. The experiment results indicate that PRISC can compute an infection risk score within a couple of seconds and a few mega-bytes (MBs) communication cost, for data sets with 100000 users.

We report a new neural backdoor attack, named Hibernated Backdoor, which is stealthy, aggressive and devastating. The backdoor is planted in a hibernated mode to avoid being detected. Once deployed and fine-tuned on end-devices, the hibernated backdoor turns into the active state that can be exploited by the attacker. To the best of our knowledge, this is the first hibernated neural backdoor attack. It is achieved by maximizing the mutual information (MI) between the gradients of regular and malicious data on the model. We introduce a practical algorithm to achieve MI maximization to effectively plant the hibernated backdoor. To evade adaptive defenses, we further develop a targeted hibernated backdoor, which can only be activated by specific data samples and thus achieves a higher degree of stealthiness. We show the hibernated backdoor is robust and cannot be removed by existing backdoor removal schemes. It has been fully tested on four datasets with two neural network architectures, compared to five existing backdoor attacks, and evaluated using seven backdoor detection schemes. The experiments demonstrate the effectiveness of the hibernated backdoor attack under various settings.

In order to protect user privacy in Machine Learning as a Service (MLaaS), a series of ingeniously designed privacy-preserving frameworks have been proposed. The state-of-the-art approaches adopt Homomorphic Encryption (HE) for linear function and Garbled Circuits (GC)/Oblivious Transfer (OT) for nonlinear operation to improve computation efficiency. Despite the encouraging progress, the computation cost is still too high for practical applications. This work represents the first step to effectively prune privacy-preserving deep learning models to reduce computation complexity. Although model pruning has been discussed extensively in the machine learning community, directly applying the plaintext model pruning schemes offers little help to reduce the computation in privacy-preserving models. In this paper we propose Hunter, a structured pruning method that identifies three novel HE-friendly structures, i.e., internal structure, external structure, and weight diagonal to guide the pruning process. Hunter outputs a pruned model that, without any loss in model accuracy, achieves a significant reduction in HE operations (and thus the overall computation cost) in the privacy-preserving MLaaS. We apply Hunter in various deep learning models, e.g., AlexNet, VGG and ResNet over classic datasets including MNIST, CIFAR-10 and ImageNet. The experimental results demonstrate that, without accuracy loss, Hunter efficiently prunes the original networks to reduce the HE Perm, Mult, and Add operations. For example, in the state-of-the-art VGG-16 on ImageNet with 10 chosen classes, the total number of Perm is reduced to as low as 2% of the original network, and at the same time, Mult and Add are reduced to only 14%, enabling a significantly more computation-efficient privacy-preserving MLaaS.

Intelligent Reflecting Surface (IRS) has been demonstrated as a promising and innovative technology for next-generation wireless communications. It can be utilized to flexibly re-configure the fundamental communication environment to realize low-cost, energy-saving, and low-interference wireless communications. On the other hand, malicious users may also utilize the powerful capability of the IRS to re-configure the communication environment to achieve an advantageous position to launch security attacks such as eavesdropping and jamming wireless networks. Therefore, while the integration of IRS into wireless communications brings promising new opportunities, it also raises significant concerns from the security perspective. This issue has not been thoroughly studied in the literature. In this paper, we first introduce the recent works of using IRS in wireless communications by grouping them into two categories: 1) securing communication via IRS and 2) launching attacks using IRS. We then derive a critical performance metric, the Signal-to-Noise Ratio (SNR), for evaluating IRS-assisted wireless communication systems. Next, we present four typical scenarios of utilizing IRS for security or threats to wireless communications. At last, we evaluate the IRS-assisted system with regard to the SNR performance affected by the IRS in those four scenarios toward a deeper understanding of the potential of IRS-assisted wireless communication systems in terms of security and threats.

While deep learning (DL)-based network traffic classification has demonstrated its success in a range of practical applications, such as network management and security control to just name a few, it is vulnerable to adversarial attacks. This paper reports TrojanFlow, a new and practical neural backdoor attack to DL-based network traffic classifiers. In contrast to traditional neural backdoor attacks where a designated and sample-agnostic trigger is used to plant backdoor, TrojanFlow poisons a model using dynamic and sample-specific triggers that are optimized to efficiently hijack the model. It features a unique design to jointly optimize the trigger generator with the target classifier during training. The trigger generator can thus craft optimized triggers based on the input sample to efficiently manipulate the model’s prediction. A well-engineered prototype is developed using Pytorch to demonstrate TrojanFlow attacking multiple practical DL-based network traffic classifiers. Thorough analysis is conducted to gain insights into the effectiveness of TrojanFlow, revealing the fundamentals of why it is effective and what it does to efficiently hijack the model. Extensive experiments are carried out on the well-known ISCXVPN2016 dataset with three widely adopted DL network traffic classifier architectures. TrojanFlow is compared with two other backdoor attacks under five state-of-the-art backdoor defenses. The results show that the TrojanFlow attack is stealthy, efficient, and highly robust against existing neural backdoor mitigation schemes.

As the number of IoT devices has increased rapidly, IoT botnets have exploited the vulnerabilities of IoT devices. However, it is still challenging to detect the initial intrusion on IoT devices prior to massive attacks. Recent studies have utilized power side-channel in-formation to identify this intrusion behavior on IoT devices but still lack accurate models in real-time for ubiquitous botnet detection. We propose the first online intrusion detection system called DeepAuditor for multiple IoT devices via power auditing. To de-velop the real-time system, we propose a lightweight power auditing device called Power Auditor. We also design a distributed CNN classifier for online inference in a laboratory setting. In order to protect data leakage and reduce networking redundancy, we then propose a privacy-preserved inference protocol via Packed Homo-morphic Encryption and a sliding window protocol in our system. The classification accuracy and processing time are measured, and the proposed classifier outperforms a baseline classifier, especially against unseen patterns. We also demonstrate that the distributed CNN design is secure against any distributed components. Over-all, the measurements are shown to the feasibility of our real-time distributed system for intrusion detection on IoT devices.

As the number of IoT devices has increased rapidly, IoT botnets have exploited the vulnerabilities of IoT devices. However, it is still challenging to detect the initial intrusion on IoT devices prior to massive attacks. Thus, a new approach that monitors these ini-tial intrusions is needed. Power side-channel information can be used because it does not require any modification in programming languages or operating systems on diverse IoT devices. We propose a distributed power side-channel auditing system for online IoT intrusion detection. To meet the real-time requirement, we develop a lightweight power auditing device. We then design a distributed CNN classifier for online inference in a laboratory setting. Two distributed protocols are also proposed in order to protect data leakage and reduce networking redundancy. In this work, we demonstrate the feasibility of our real-time distributed system for intrusion detection on IoT devices.

Despite many conveniences of using IoT devices, they have suffered from various attacks due to their weak security. Besides well-known botnet attacks, IoT devices are vulnerable to recent covert-channel attacks. However, no study to date has considered these IoT covert-channel attacks. Among these attacks, researchers have demonstrated exfiltrating users' private data by exploiting the smart bulb's capability of infrared emission.

Physical layer security has attracted lots of attention with the expansion of wireless devices to the edge networks in recent years. Due to limited authentication mechanisms, MAC spoofing attack, also known as the identity attack, threatens wireless systems. In this paper, we study a new type of MAC spoofing attack, the virtual MAC spoofing attack, in a tight environment with strong spatial similarities, which can create multiple counterfeits entities powered by the virtualization technologies to interrupt regular services. We develop a system to effectively detect such virtual MAC spoofing attacks via the deep learning method as a countermeasure. A deep convolutional neural network is constructed to analyze signal level information extracted from Channel State Information (CSI) between the communication peers to provide additional authentication protection at the physical layer. A significant merit of the proposed detection system is that this system can distinguish two different devices even at the same location, which was not well addressed by the existing approaches. Our extensive experimental results demonstrate the effectiveness of the system with an average detection accuracy of 95%, even when devices are co-located.

In a ubiquitous environment enclosing cooperative Internet-of-Things (IoT) devices, individuals, and entities, digital identity management (DIM) becomes critical and challenging. DIM pertains to device identities authentication and verification to enable trustworthy service exchange, data collection, and decision making. DIM is the supporting pillar for all online services and the foundation for security and authentication mechanisms. Due to the extreme heterogeneity, scale, and configuration complexity of such environments, enabling trustworthy DIM is crucial and seriously challenging. In an IoT context, devices use local digital identities stored within a tamper-proof unit and verified by a centralized authority for authentication. The recent attacks on IoT systems showed how vulnerable such a design is. It is also an inherent problem that influences humans. From that, self-sovereign identity (SSI) has emerged as a decentralized DIM approach embracing the concept of portable self-possession identity. SSI was presented to couple the digital identity from the owner to enable large-scale cooperation. However, digital identity storage and verification still occur on the device and in a centralized manner. Utilizing a local single-point-of-failure storage memory for verifiable credentials is one of the considerable drawbacks in contemporary SSI. In this regard, this article introduces decentralized trustworthy-self-sovereign identity management (DT-SSIM), a novel decentralized trustworthy SSI management framework. DT-SSIM integrates the secret share scheme with the blockchain-based smart contracts technologies to provide transparent and trustworthy SSI-based DIM services for IoT. Storing IoT identity credentials outside the devices’ local storage preserves the identity credentials from being tampered with or misused. Evaluations and discussions show the resiliency assessment of the system and the cost and estimated running times for verification processes in DT-SSIM.

The channel-hopping (CH) based rendezvous is an important technique in next-generation wireless cognitive radio networks (CRNs) where spectrum efficiency is desired. It allows unlicensed secondary users (SUs) to dynamically schedule rendezvous channels using their assigned CH sequence. Rendezvous is an essential operation for radios in CRNs to meet and establish a communication link, or find a common channel. Thus, radios can exchange information and communicate on a channel.In this paper, we propose a rendezvous protocol called K-Group Random Channel Hopping (K-RCH) which is based on the symmetric-role model. K-RCH assigns nodes into groups. Each group contains at least two nodes, which means our model is general and can fit both pairwise or multi-user rendezvous. K-RCH increases the chance of rendezvous by synchronizing channel hopping patterns of nodes in the same group and allowing for multi-round rendezvous. K-RCH considers a heterogeneous channel availability model and is suitable for complicated communication environments. Our simulation results show that K-RCH achieves a much shorter rendezvous time than most existing rendezvous protocols. The expected time to rendezvous (ETTR) is reduced by more than 85% as compared to the Jump-Stay strategy and the TENOR protocol. The ETTR decreases with an increasing number of SUs.

The data poisoning attack has raised serious security concerns on the safety of deep neural networks, since it can lead to neural backdoor that misclassifies certain inputs crafted by an attacker. In particular, the sample-targeted backdoor attack is a new challenge. It targets at one or a few specific samples, called target samples, to misclassify them to a target class. Without a trigger planted in the backdoor model, the existing backdoor detection schemes fail to detect the sample-targeted backdoor as they depend on reverse-engineering the trigger or strong features of the trigger. In this paper, we propose a novel scheme to detect and mitigate sample-targeted backdoor attacks. We discover and demonstrate a unique property of the sample-targeted backdoor, which forces a boundary change such that small "pockets" are formed around the target sample. Based on this observation, we propose a novel defense mechanism to pinpoint a malicious pocket by "wrapping" them into a tight convex hull in the feature space. We design an effective algorithm to search for such a convex hull and remove the backdoor by fine-tuning the model using the identified malicious samples with the corrected label according to the convex hull. The experiments show that the proposed approach is highly efficient for detecting and mitigating a wide range of sample-targeted backdoor attacks.

This paper reports a new clean-label data poisoning backdoor attack, named Invisible Poison, which stealthily and aggressively plants a backdoor in neural networks. It converts a regular trigger to a noised trigger that can be easily concealed inside images for training NN, with the objective to plant a backdoor that can be later activated by the trigger. Compared with existing data poisoning backdoor attacks, this newfound attack has the following distinct properties. First, it is a blackbox attack, requiring zero-knowledge of the target model. Second, this attack utilizes "invisible poison" to achieve stealthiness where the trigger is disguised as `noise', and thus can easily evade human inspection. On the other hand, this noised trigger remains effective in the feature space to poison training data. Third, the attack is practical and aggressive. A backdoor can be effectively planted with a small amount of poisoned data and is robust to most data augmentation methods during training. The attack is fully tested on multiple benchmark datasets including MNIST, Cifar10, and ImageNet10, as well as application specific data sets such as Yahoo Adblocker and GTSRB. Two countermeasures, namely Supervised and Unsupervised Poison Sample Detection, are introduced to defend the attack.

Deep learning (DL) has demonstrated superior success in various of applications, such as image classification, speech recognition, and anomalous detection. The unprecedented performance gain of DL largely depends on tremendous training data, high-performance computation resources, and well-designed model structures. However, privacy concerns raise from such necessities. First, as the training data are usually distributed among multiple parties, directly exposing and collecting such large amount of data could violate the laws especially for private information, such as personal identities, medical records, and financial profiles. Second, locally deploying advantageous computation resources is costly for individual party having partial data. Third, direct release of well-trained model parameters threatens the information about training data or the intellectual property of model owners. Therefore, individual party prefers outsourcing computation (data) in a secure way to powerful cloud servers such as Microsoft Azure, and how to enable the cloud servers to perform DL algorithms without revealing data owners’ private information and model owners’ valuable parameters is emerging as an urgent task, which is termed as privacy-preserving (outsourcing) DL. In this article, we review the state-of-the-art researches in privacy-preserving DL based on multiparty secure computation with data encryption and summarize these techniques in both training phase and inference phase. Specifically, we categorize the techniques with respect to the linear and nonlinear computations, which are the two basic building blocks in DL. Following a comprehensive overview of each research scheme, we present primary technical hurdles needed to be addressed and discuss several promising directions for future research.

The millimeter wave (mmWave) band offers vast bandwidth and plays a key role for next generation wireless networks. However, the mmWave network raises a great challenge for user association and scheduling, due to the limited power budget and beamformers, diverse user traffic loads, user quality of service requirement, etc. In this paper, we propose a novel framework for user association and scheduling in multi-base station mmWave networks, termed the clustering Based dOwnlink UE assOciation, Scheduling, beamforming with power allocaTion (BOOST). The objective is to reduce the downlink network transmission time, subject to the base station power budget, number of beamformers, user traffic loads, and the quality of service requirement at users. We compare BOOST with three state-of-the-art user scheduling schemes. On average, BOOST reduces the transmission time by 37, 30, and 26 percent, and achieves a sum rate gain of 56, 43, and 34 percent, respectively.

This work proposes GangSweep, a new backdoor detection framework that leverages the super reconstructive power of Generative Adversarial Networks (GAN) to detect and ''sweep out'' neural backdoors. It is motivated by a series of intriguing empirical investigations, revealing that the perturbation masks generated by GAN are persistent and exhibit interesting statistical properties with low shifting variance and large shifting distance in feature space. Compared with the previous solutions, the proposed approach eliminates the reliance on the access to training data, and shows a high degree of robustness and efficiency for detecting and mitigating a wide range of backdoored models with various settings. Moreover, this is the first work that successfully leverages generative networks to defend against advanced neural backdoors with multiple triggers and their polymorphic forms.

The millimeter wave (mmWave) frequency band is a promising candidate for next generation cellular and wireless networks. To compensate the significantly higher path loss due to the higher frequency, the mmWave band usually uses the beamforming technology. However, this makes the network topology control a great challenge. In this paper, we propose a novel framework for network topology control in mmWave networks, termed Beamforming Oriented tOpology coNtrol (BOON). The objective is to reduce total transmit power of base stations and interference between beams. BOON smartly groups nearby user equipment into clusters, constructs sets from user equipment clusters, and associates user equipment to base stations and beams. We compare BOON with three existing topology control schemes in terms of transmit power, network sum rate, signal to interference and noise ratio, and computation complexity. The results indicate that overall BOON significantly outperforms them. In particular, on average BOON uses only 10, 32, and 25 percent transmit power of other three schemes, respectively, to achieve the same network sum rate.

An on-demand spectrum access cognitive radio network offers spectrum services to users, so that users can dynamically set up application-oriented virtual topologies to support user applications. In this paper, we develop a mathematical model for the on-demand spectrum access architecture for cognitive radio networks based on the citizens broadband radio service (CBRS). The model can be used to estimate the blocking probability of spectrum demands from priority access license users, the network capacity, and the number of free spectrum bands available for lower priority general authorized access users. The performance evaluation indicates that the results from the mathematical model match simulation results well, which validates the accuracy of our model.

This work proposes an innovative approach, named CapJack, to detect in-browser malicious cryptocurrency mining activities by using the latest CapsNet technology. To the best of our knowledge, this is the first work to introduce CapsNet to the field of malware detection through system behavioral analysis. It is particularly effective to detect malicious miners under multitasking environments where multiple applications run simultaneously. Experimental data show appealing performance of CapJack, with a detection rate of as high as 87% instantly and 99% within a window of 11 seconds.

Spectrum sharing is a key technology to relieve the ever-increasing spectrum demand and realize the full potential of radio spectrum. In this paper, we study spectrum sharing between higher priority users and lower priority users under geo-location based spectrum sharing systems. We consider a dynamic spectrum allocation scheme that allocates spectrum to a higher priority user based on its spectrum need that can be determined by its traffic load. The lower priority users utilize the unallocated spectrum. In addition to studying the performance of higher priority users with this dynamic spectrum allocation scheme, we also investigate the impact of this scheme on spectrum availability and stability of lower priority users. We develop a mathematical model to analyze the performance. The simulation results indicate that spectrum sharing is efficient, and the spectrum is abundant and relatively stable to lower priority users, even when the system is moderately loaded with higher priority users.

Identity-based attacks such as MAC spoofing are common in wireless networks. The recently developed virtualization technologies bring a new type of MAC spoofing attack, virtual MAC spoofing. This makes it even more challenging to detect such attacks, especially in a tight environment with spatial similarities. In this paper, we design, implement and evaluate a system to effectively detect virtual MAC spoofing attacks via deep learning. A deep convolutional neural network is constructed to extract physical features from CSI obtained from packet transmissions, to detect virtual MAC spoofing attacks. An important merit of the proposed detection system is that this system can distinguish two devices even at the same location, which was not well addressed by previous approaches. Our extensive experimental results demonstrate the effectiveness of the system with an average detection accuracy of 95%, even when devices are co-located.

Privacy is a fundamental challenge for a variety of smart applications that depend on data aggregation and collaborative learning across different entities. In this paper, we propose a novel privacy-preserved architecture where clients can collaboratively train a deep model while preserving the privacy of each client’s data. Our main strategy is to carefully partition a deep neural network to two non-colluding parties. One party performs linear computations on encrypted data utilizing a less complex homomorphic cryptosystem, while the other executes non-polynomial computations in plaintext but in a privacy-preserved manner. We analyze security and compare the communication and computation complexity with the existing approaches. Our extensive experiments on different datasets demonstrate not only stable training without accuracy loss, but also 14 to 35 times speedup compared to the state-of-the-art system.

While the Internet of Things (IoT) is embraced as important tools for efficiency and productivity, it is becoming an increasingly attractive target for cybercriminals. This work represents the first endeavor to develop practical Puncturable Attribute Based Encryption schemes that are light-weight and applicable in IoTs. In the proposed scheme, the attribute-based encryption is adopted for fine grained access control. The secret keys are puncturable to revoke the decryption capability for selected messages, recipients, or time periods, thus protecting selected important messages even if the current key is compromised. In contrast to conventional forward encryption, a distinguishing merit of the proposed approach is that the recipients can update their keys by themselves without key re-issuing from the key distributor. It does not require frequent communications between IoT devices and the key distribution center, neither does it need deleting components to expunge existing keys to produce a new key. Moreover, we devise a novel approach which efficiently integrates attribute-based key and punctured keys such that the key size is roughly the same as that of the original attribute-based encryption. We prove the correctness of the proposed scheme and its security under the Decisional Bilinear Diffie-Hellman (DBDH) assumption. We also implement the proposed scheme on Raspberry Pi and observe that the computation efficiency of the proposed approach is comparable to the original attribute-based encryption. Both encryption and decryption can be completed within tens of milliseconds.

In this paper, we report a newfound vulnerability on smartphones due to the malicious use of unsupervised sensor data. We demonstrate that an attacker can train deep Convolutional Neural Networks (CNN) by using magnetometer or orientation data to effectively infer the Apps and their usage information on a smartphone with an accuracy of over 80%. Furthermore, we show that such attacks can become even worse if sophisticated attackers exploit motion sensors to cluster the magnetometer or orientation data, improving the accuracy to as high as 98%. To mitigate such attacks, we propose a noise injection scheme that can effectively reduce the App sniffing accuracy to only 15% and at the same time has negligible effect on benign Apps.

Spectrum sensing plays a critical role in cognitive radio networks. Most of existing works on spectrum sensing adopted energy detection which takes samples on a band and then compares the summation with a threshold to determine the state of the band. However, if a licensed band is subdivided by the primary users, such as in the unlicensed WiFi band, the energy detection faces a challenge. The threshold used to decide if there is a PU signal on the band now depends on the number of sub-bands that are being used by primary users, since the received signal power on the band is now dependent on the number of used sub-bands. In this work, we propose a wavelet based spectrum sensing approach that does not depend on the number of used sub-bands and adaptively detects PU signals on a licensed band. We use the measured real world signals to test the approach. The simulation results indicate that the proposed approach can effectively detect the PU signal on a licensed band without needing the knowledge of band subdivision. In addition, the comparative study with the existing techniques is performed to evaluate two performance metrics, true detection and false alarm, for primary users signal detection.

The current opportunistic spectrum access architecture suffers from several technical barriers. Capitalizing on recent spectrum policy evolution and technology advances, we propose an application-oriented spectrum sharing architecture, termed on-demand spectrum access, to eliminate the barriers bothering the opportunistic spectrum access architecture. We consider a spectrum service provider that has a mesh infrastructure network and offers on-demand spectrum services to users. The users can dynamically set up application-oriented virtual topologies to carry out specific applications such as video conferences. We develop an efficient online spectrum service provision algorithm, termed Provision based on Onion Subsetting. The time complexity and the correctness are analyzed. We evaluate the performance of the on-demand spectrum access architecture under the provision algorithm through simulations.

Spectrum sensing is a critical component for cognitive radio networks. Most of the spectrum sensing algorithms and performance analysis, however, assume that the secondary users are stationary. In this paper, we investigate the performance analysis of spectrum sensing by mobile secondary users. Two performance metrics, false alarm probability and miss detection probability, are thoroughly investigated. In addition, a new performance metric, expected transmission time, is designed to factor the secondary users' mobility. The random waypoint based mobility model is adopted for secondary users. For spectrum sensing by mobile secondary users, a critical variable is the distance between the primary user and mobile secondary users. We mathematically model this distance, and derive its probability distribution. At last, the expressions are derived for all three performance metrics, the false alarm probability, the miss detection probability, and the expected transmission time. Extensive simulations are performed, and the results are consistent with the theoretical analysis. It is concluded that the mobility of secondary users has significant impact on miss detection probability, but not on false alarm probability.

In this paper, we address the challenge of providing secondary users access to licensed spectrum when there are active primary user transmissions. The motivation is to eliminate the disruption to secondary user communications by the resurgence of primary user transmissions. We propose a novel protocol, termed spectrum co-access protocol (SCAP), for secondary users to transparently and simultaneously access spectrum with primary users. This protocol enables mutually beneficial coexistence between the primary user network and the secondary user network. Through spectrum co-access, SCAP creates a virtual SU control channel in licensed spectrum that is transparent to the PU. The result is a unique medium access control protocol that allows for transparent simultaneous spectrum access between the SU and PU networks. The performance evaluation indicates that SCAP provides significant performance improvement for the SU network over the existing opportunistic spectrum access scheme.

Promising to significantly improve spectrum utilization, cognitive radio networks (CRNs) have attracted a great attention in the literature. Nevertheless, a new security threat known as the primary user emulation (PUE) attack raises a great challenge to CRNs. The PUE attack is unique to CRNs and can cause severe denial of service (DoS) to CRNs. In this paper, we propose a novel PUE detection system, termed Signal activity Pattern Acquisition and Reconstruction System. Different from current solutions of PUE detection, the proposed system does not need any a priori knowledge of primary users (PUs), and has no limitation on the type of PUs that are applicable. It acquires the activity pattern of a signal through spectrum sensing, such as the ON and OFF periods of the signal. Then it reconstructs the observed signal activity pattern through a reconstruction model. By examining the reconstruction error, the proposed system can smartly distinguish a signal activity pattern of a PU from a signal activity pattern of an attacker. Numerical results show that the proposed system has excellent performance in detecting PUE attacks.

Virtual backbones have brought about many benefits for routing and data transmission in traditional wireless networks. In cognitive radio networks (CRNs), virtual backbones can also play a critical role, and would increase the efficiency of routing and data transport. However, the virtual backbone construction for CRNs is more challenging than for traditional wireless networks due to opportunistic spectrum access. Moreover, when no common control channel is available to exchange the control information, this problem is even more difficult. In this paper, we propose a novel approach for constructing virtual backbones in CRNs, without relying on a common control channel. Our approach first utilizes the geographical information to let the nodes of a CRN self-organize into cells. Next, the nodes in each cell form into clusters, and a virtual backbone is established over the cluster heads. The virtual backbone is then applied to carry out the end-to-end data transmission. The proposed virtual backbone construction approach requires only limited exchange of control messages. It is efficient and highly adaptable under the opportunistic spectrum access. We analyze the capacity between an active node and a passive node in a single area. Our approach is testified through evaluation of the cost, and also through comparison with other models.

Cognitive radio networks are a promising solution to the spectrum scarcity issue. In cognitive radio networks, because of the low reliability of individual spectrum sensing by a single secondary user, cooperative spectrum sensing is critical to accurately detect the existence of a primary user signal. However, cooperative spectrum sensing is vulnerable to the spectrum sensing data falsification (SSDF) attack. Specifically, a malicious user can send a falsified sensing report to mislead other (benign) secondary users to make an incorrect decision on the PU activity. Therefore, detecting the SSDF attack or identifying the malicious sensing reports is extremely important for robust cooperative spectrum sensing. This paper proposes a distributed density based SSDF detection (DBSD) scheme to countermeasure the SSDF attack. DBSD can effectively exclude the malicious sensing reports from SSDF attackers, so that a benign secondary user can effectively detect the PU activity in distributed cooperative spectrum sensing. Furthermore, DBSD can also exclude abnormal sensing reports from ill-functioned secondary users. Simulation results show that DBSD achieves very good performance in cooperative spectrum sensing.

The advantages of virtual backbones have been proven in wireless networks. In cognitive radio networks (CRNs), virtual backbones can also play a critical role in both routing and data transport. However, the virtual backbone construction for CRNs is more challenging than for traditional wireless networks because of the opportunistic spectrum access. Moreover, when no common control channel is available to exchange the control information, this problem is even more difficult. In this paper, we propose a novel approach for constructing virtual backbones in CRNs, without relying on a common control channel. Our approach first utilizes the geographical information to let the nodes of a CRN self-organize into cells. Next, the nodes in each cell form into clusters, and a virtual backbone is established over the cluster heads. The virtual backbone is then applied to carry out the end-to-end data transmission. The proposed virtual backbone construction approach requires only limited exchange of control messages. It is efficient and highly adaptable under the opportunistic spectrum access. We evaluate our approach through extensive simulations.

Cognitive radio is viewed as a disruptive technology innovation to improve spectrum efficiency. The deployment of coexisting cognitive radio networks, however, raises a great challenge to the medium access control (MAC) protocol design. While there have been many MAC protocols developed for cognitive radio networks, most of them have not considered the coexistence of cognitive radio networks, and thus do not provide a mechanism to ensure fair and efficient coexistence of cognitive radio networks. In this paper, we introduce a novel MAC protocol, termed fairness-oriented media access control (FMAC), to address the dynamic availability of channels and achieve fair and efficient coexistence of cognitive radio networks. Different from the existing MACs, FMAC utilizes a three-state spectrum sensing model to distinguish whether a busy channel is being used by a primary user or a secondary user from an adjacent cognitive radio network. As a result, secondary users from coexisting cognitive radio networks are able to share the channel together, and hence to achieve fair and efficient coexistence. We develop an analytical model using two-level Markov chain to analyze the performance of FMAC including throughput and fairness. Numerical results verify that FMAC is able to significantly improve the fairness of coexisting cognitive radio networks while maintaining a high throughput.

The existing dynamic spectrum access network architecture fails to offer incentives to primary users (PUs). Therefore, PUs are unwilling to cooperate with secondary users (SUs) and intend to set up stringent requirements on SUs' spectrum access. This diminishes the benefit of dynamic spectrum access and hinders its commercialization success. In this paper, we propose a novel architecture for dynamic spectrum access networks, termed incentivized cooperative dynamic spectrum access network (IC-DSAN), to motivate PUs to cooperate with SUs, such that both PUs and SUs achieve significantly higher performance. In an IC-DSAN, SU nodes serve as relays between PU nodes and while relaying PU packets, utilize network coding to encode SU packets onto PU packets, i.e., SU packets get a `free ride' via network coding. To further improve the performance, we propose a new network coding scheme termed coding over coded packets. At last, an optimization model is developed to analyze the throughput gain of IC-DSAN. The performance evaluation indicates that the throughputs of both PUs and SUs significantly increase.

In cognitive radio networks, cooperative spectrum sensing is critical for secondary users to accurately detect primary users. However, it is vulnerable to attacks from malicious users, which intentionally report incorrect sensing results, to mislead other secondary users or the fusion center in decision making. Therefore, detection of malicious users is extremely important for spectrum sensing. This paper proposes a decentralized scheme to detect malicious users in cooperative spectrum sensing. The scheme utilizes spatial correlation of received signal strengths among secondary users in close proximity and is based on robust outlier-detection technique. We have also proposed a neighborhood majority voting approach for the secondary users to decide if a specific user is malicious. Simulation results show that the proposed scheme can achieve a very good performance in detecting malicious users.

Recently there have been various studies on dynamic spectrum access (DSA) approaches, e.g., opportunistic spectrum access and spectrum auction, to address spectrum scarcity and inefficient spectrum utilization caused by today's static spectrum allocation policy. In this paper, we propose a new approach, demand spectrum access as a service (DSAS), to achieve DSA. We consider a spectrum service provider that dynamically offers spectrum service to users such that the users can set up dynamic topologies for data communication, e.g., transport a bulk data flow between two nodes, or carry out a video conference among a set of nodes. Through DSAS, the precious spectrum is dynamically shared and efficiently utilized by users. In this paper, we consider two spectrum services, SameBand and DiffBand, and develop efficient online algorithms to allocate spectrum for the two services, so that users can set up dynamic topologies. The performance of the algorithms is evaluated through both analysis and simulation.

Spectrum sensing plays a critical role in cognitive radio networks (CRNs). The majority of spectrum sensing algorithms aim to detect the existence of a signal on a channel, i.e., they classify a channel into either busy or idle state, referred to as a two-state sensing model in this paper. While this model works properly when there is only one CRN accessing a channel, it significantly limits the potential and fairness of spectrum access when there are multiple co-existing CRNs. This is because if the secondary users (SUs) from one CRN are accessing a channel, SUs from other CRNs would detect the channel as busy and hence be starved. In this paper, we propose a three-state sensing model that distinguishes the channel into three states: idle, occupied by a primary user, or occupied by a secondary user. This model effectively addresses the fairness concern of the two-state sensing model, and resolves the starvation problem of multiple co-existing CRNs. To accurately detect each state of the three, we develop a two-stage detection procedure. In the first stage, energy detection is employed to identify whether a channel is idle or occupied. If the channel is occupied, the received signal is further analyzed at the second stage to determine whether the signal originates from a primary user or an SU. For the second stage, we design a statistical model and use it for distance estimation. For detection performance, false alarm and miss detection probabilities are theoretically analyzed. Furthermore, we thoroughly analyze the performance of throughput and fairness for the three-state sensing model compared with the two-state sensing model. In terms of fairness, we define a novel performance metric called all-level fairness for all(ALFA) to characterize fairness among CRNs. Extensive simulations are carried out under various scenarios to evaluate the three-state sensing model and verify the aforementioned theoretical analysis.

Covert channel is used to secretly transfer information. In covert timing channels, all messages are decoded based on the arrival time of packets at the receiver side. In covert communications, synchronization between the sender and receiver plays a key role in decoding accuracy. Lost, duplicated, and out-of-order arrived packets may cause the loss of synchronization between the sender and receiver. In this study, a synchronization scheme, which is based on Phase Lock Loop (PLL), is proposed to build an effective covert timing channel. The scheme is software based and implemented in the transport layer. This is the first effort of using PLL for building a covert channel. Simulation results show that the scheme can achieve high decoding rate. Moreover, the covert timing channel built by the scheme is not affected by packet loss, duplication, and out-of-order arrival.

The overlay approach to dynamic spectrum access recently proposed in information theory allows both primary users (PUs) and secondary users (SUs) to simultaneously access the same spectrum with comparable power levels. However, the information theory approach is based on idealized assumptions that are difficult to be satisfied in practice. We propose a practical scheme with the overlay flavor for multi-hop wireless networks subject to two challenging design constraints: (1) PUs can not be modified, and (2) the performance of PUs can not degrade. Using the notion of credit in our scheme, SUs first help with the traffic delivery for PUs, and in return SUs later are allowed to access the spectrum in a manner disruptive to PUs. Specifically, SUs earn credit for helping PUs and consume credit for disrupting PUs. Moreover, we propose a distributed credit diffusion algorithm for SUs to share credit, and we modify a widely used reactive routing protocol to satisfy the design constraints. This overlay scheme is then integrated with the widely used interweave scheme to form the Credit-based Overlay and Interweave (CONI) protocol. Simulation results show that CONI can significantly benefit both PUs and SUs.

In this paper, we present a rendezvous scheme for dynamic spectrum access (DSA) networks that can achieve approximately optimal throughput while not relying on a common control channel. Compared with existing rendezvous schemes for DSA networks that use a common control channel, the proposed scheme avoids congestion and jamming of the control channel, and also reduces control complexity and overhead in DSA. We prove that the proposed rendezvous scheme achieves approximately optimal throughput, and analyze the convergence time of this scheme to obtain the approximately optimal throughput.

A vast number of broadcasting protocols have been developed for wireless networks. However, most of these protocols assume a single-radio single-channel network model. Employing multiple channels can effectively improve the network capacity in wireless mesh networks. This paper considers minimum cost broadcast (MCB) problem in multi-radio multi-channel wireless mesh networks. We first present the multi-radio multi-channel network model, and then formulate the MCB problem using an integer linear programming model. Our model considers two cases of MCB. In the first case, there already exists a channel assignment in the network, and the formulation minimizes the broadcast cost and reduces interference amongst the adjacent neighbors. In the second case, each node has a set of available channels to be selected. We jointly consider channel assignment and the MCB problem. The joint channel assignment and MCB formulation fully exploits the channel diversity, and also further reduces interference in the network. We propose corresponding centralized and distributed heuristic algorithms to minimize the number of broadcast transmissions with full reliability. In our heuristic algorithms, each node participates in the broadcasting if chosen to maintain the network connectivity or to achieve maximum coverage. Extensive numerical results are presented to demonstrate the performance.

Cognitive radio networking is emerging as a promising paradigm for future wireless networks. In this paper, the delay performance of cognitive radio networks supporting heterogeneous traffic is analyzed. In order to guarantee primary users' (PUs) licensed membership, packets from PUs are distinguished from secondary users (SUs) by employing an absolute priority scheme. Meanwhile, various delay requirements over the packets from SUs are fully considered. The packets from SUs are classified into either delay-sensitive packets or delay-insensitive packets. Moreover, a novel relative priority strategy is designed between these two types of traffic by proposing a “transmission window” strategy. The delay performance of both a single-PU scenario and a multiple-PU scenario is thoroughly investigated employing queueing theory. In the multiple-PU scenario, a dynamic and adaptive channel selection scheme based on learning automata is developed with the objective of reducing the average delay for all SU packets. Numerical experiments are conducted and the results demonstrate the delay performance with respect to varied transmission window sizes. The results in the multiple-PU scenario verify that the proposed learning automata channel selection scheme significantly improves the delay performance of SU packets.

In dynamic spectrum access (DSA), secondary users (SUs) dynamically search and access spectrum bands unused by primary users to communicate. We propose a DSA scheme where it does not require a control channel for coordination and SU nodes do not need to exchange control messages to rendezvous. Every SU node selects its operational channel independently. When a node wants to rendezvous with another node, the former estimates the operational channel of the latter. The scheme ensures that such rendezvous has a high probability of success, while operational channels are diversified to reduce co-channel interference and hence increase throughput. We develop a mathematical model to analyze the performance of the scheme. Both analytical and simulation results show that the scheme achieves very good performance.

The dynamic spectrum access (DSA) capability of cognitive radio networks (CRN) promises to resolve both the spectrum scarcity and the low spectrum utilization problems caused by today's static spectrum access (SSA) policy. With DSA, CRN nodes search the dynamically accessible spectrum bands for communication. In this paper, we study a random DSA scheme, where each node randomly selects its operating band based on the locally detected accessible spectrum bands. This scheme does not need the coordination or exchange of control messages to select a communication band between a sender and a receiver, and is desirable in certain scenarios. We analyze the performance of this random DSA scheme. Numerical results show that the random DSA scheme can achieve 60% of the theoretical maximum performance.

Dynamic spectrum access (DSA) promises to resolve spectrum scarcity and low spectrum utilization caused by today's static spectrum access (SSA) policy. In DSA, secondary users dynamically search and access spectrum bands that are temporarily unused by primary users. In this paper, we propose a control-free DSA algorithm for cognitive radio networks (CRN). Our algorithm enables each CRN node to select its operation band without coordination and exchange of control messages with neighbors. The contribution of our algorithm is that such an independently selected band can reach neighbors with high probability, while streamlining control complexity and overhead in DSA. We develop an analytical model to evaluate performance. Numerical results show that our control-free DSA algorithm can achieve very good performance.

In this paper we present throughput analysis for a contention-based dynamic spectrum sharing model. We consider two scenarios of allocating channels to primary users, fixed allocation and random allocation. In fixed allocation, the number of primary users allocated to a channel is fixed all the time, but the number of users in different channels may be different. In random allocation, each primary user dynamically and randomly selects a channel in each time slot. We assume that the spectrum band of primary users is divided into multiple channels and the time is slotted. Primary users allocated to a specific channel compete to access this channel in each time slot. Secondary users are able to dynamically detect the idle channels in each time slot, and compete to access these channels. We develop analytical models for the throughput of primary users and secondary users in both scenarios and examine the impact of the number of secondary users on the throughput of the system. For a given number of primary users, channels and traffic generation probability, we aim to find the number of secondary users to maximize the total throughput of both primary users and secondary users. Our solutions match closely with the numerical results.

The spectrum-agile cognitive radio has been developed to significantly increase spectrum utilization and relieve the spectrum exhaustion problem, by enabling secondary users to dynamically access the licensed spectrum bands. As such cognitive radio will be a key feature of future wireless technologies. In this paper, we propose an architecture for cognitive radio network (CRN). Our architecture uses one radio per node and does not need a common control channel, and is highly adaptable and resilient to maintain connectivity between neighboring nodes. In particular, we present a channel selection algorithm that not only spreads nodes into different channels to reduce cochannel interference, but also enables a node to easily compute the channel of a neighbor without the need to negotiate with the neighbor, which is highly desirable for CRN, as a channel may become inaccessible abruptly due to that the licensed user suddenly starts using it. Simulation results show that our CRN model and channel selection algorithm are highly adaptable and resilient to dynamic channels, and can achieve a close performance to the scheme that uses an extra radio and a static control channel to exchange channel information.

Opportunistic spectrum access presents a new approach to wireless spectrum utilization and management. In this paper, we propose a non-cooperative based OSA approach: learning-based approach to allow multiple secondary users to achieve maximal throughput in an unslotted opportunistic spectrum access (OSA) network. In this approach, collisions among secondary users are taken into consideration while making channel sensing decisions. Spectrum maps for secondary users are estimated based on occurrence of collisions. Our approach allows secondary users to achieve maximal throughput by seeking independent spectrum opportunities without exchanging any control information among secondary users. Numerical results show that the learning-based approach obtains near-optimal performance in most of the scenarios.

A new scheduling algorithm called serialised batch scheduling (SBS) for optical burst switching (OBS) networks is proposed. SBS aggregates and serialises bursts along a shared path into one composite burst, which is switched as one unit. There are two major processes in SBS, namely, batching and serialising. While the batching process chooses a set of bursts to form the composite burst, the serialising process determines how to organise the OBS bursts within the composite burst and generates a corresponding control packet for this burst. Several SBS batching and serialising schemes are introduced and analysed here. The study by the authors shows that the guard band and burst overlap can be reduced in the SBS and, thus, the packet loss rate and the number of switch reconfigurations can be significantly reduced. In addition, it is indicated that the proposed SBS algorithm can be coupled with other OBS scheduling algorithms and reduce the requirements for a high-speed optical switch in OBS networks.

In this paper, a new scheduling algorithm, Serialized Batch Scheduling (SBS) for Optical Burst Switching (OBS) networks is proposed. SBS aggregates and serializes bursts along shared path into one composite burst which is switched as a single unit. There are two important processes in SBS namely, batching and serializing. While the batching process chooses proper set of bursts to form the composite burst, the serializing process determines how to organize the OBS bursts within the composite burst and generates a corresponding composite control packet. Several SBS batching and serializing schemes are introduced and analyzed. Our study shows that the guard band and bursts overlap can be reduced in the proposed SBS, and therefore, the packet loss rate and the number of switch reconfigurations can be significantly reduced.

Traffic grooming in wavelength division multiplexing (WDM) optical networks refers to routing and aggregating low-rate client traffic onto wavelength granularity lightpaths. When client traffic randomly arrives/departs, it is called dynamic traffic grooming. This paper focuses on dynamic traffic grooming when the optical network has sparse wavelength conversion, and aims to examine the impact of wavelength conversion and converter placement on dynamic traffic grooming. We have developed both an analytical model for performance evaluation, and an adaptive traffic load-based (ATL) heuristic algorithm for converter placement, accompanied with a discussion of various converter placement heuristics. Numerical results indicate that the ATL heuristic can obtain similar performance as the greedy heuristic with lower computation complexity.

With the huge capacity, wavelength division multiplexing (WDM) optical networks are predominantly used as the transport infrastructure to carry inter-domain traffic for client networks. WDM optical networks offer wavelength granularity high-capacity optical connections, whereas client traffic flows are usually at sub-wavelength granularity. Traffic grooming in WDM optical networks refers to the aggregation of low-rate client traffic flows onto high-capacity optical connections. When client traffic randomly arrives/departs, it is called dynamic traffic grooming. This paper focuses on wavelength converter placement for dynamic traffic grooming in optical networks. We propose an adaptive traffic load based converter placement heuristic and also study several other heuristics. The numerical results indicate that the adaptive traffic load based heuristic can obtain a similar performance as the greedy heuristics, in both blocking probabilities and throughputs, with lower computation complexity.

Situation management is a rapidly evolving science where managed sources are processed as realtime streams of events and fused in a way that maximizes comprehension, thus enabling better decisions for action. Sensor networks provide a new technology that promises ubiquitous input and action throughout an environment, which can substantially improve information available to the process. Here we describe a program of NASA that requires improvements in sensor networks and situation management. We present an approach for massively deployed sensor networks that does not rely on centralized control but is founded in lessons learned from the way biological ecosystems are organized. In this approach, fully distributed data aggregation and integration can be performed in a scalable fashion where individual motes operate based on local information, making local decisions that achieve globally-meaningful effects. This exemplifies the robust, fault-tolerant infrastructure required for successful situation management systems

This paper studies how to assign radio interfaces to work on multiple channels in multi-channel and multi-interface wireless networks. Different from previous studies that focused on the MAC layer, we study this problem from a global perspective. We use a layered graph to model multi-channel wireless networks, and develop effective interface assignment and routing path computation algorithms based on the layered graph. We have evaluated the performance of our algorithm and compared it to a sequential interface assignment algorithm. The numerical results show that our algorithm significantly outperforms the sequential interface assignment.

In this paper, we propose a general scheduled traffic model, sliding scheduled traffic model. In this model, the setup time t/sub s/ of a demand whose holding time is T time units is not known in advance. Rather t/sub s/ is allowed to begin in a pre-specified time window [l,T] subject to the constraint that l/spl les/t/sub s//spl les/r-T. We then consider two problems: (1) how to properly place a demand within its associated time window to reduce overlapping in time among a set of demands; and (2) route and assign wavelengths (RWA) to a set of demands under the proposed sliding scheduled traffic model in mesh reconfigurable WDM optical networks without wavelength conversion. In addition, we consider how to rearrange a demand by negotiating a new setup time that minimizes the demand schedule change in case that the demand is blocked. To maximize temporal resource reuse, we propose a demand time conflict reduction algorithm to solve the first problem. Two algorithms, window based RWA algorithm and traffic matrix based RWA algorithm, are then proposed for the second problem. We compare the proposed RWA algorithms against a customized tabu search scheme. Simulation results show that the proposed demand time conflict reduction algorithm can resolve well over 50% of time conflicts and the space-time RWA algorithms are effective in satisfying demand requirements and minimizing total network resources used, d.

We study survivable service provisioning under a scheduled traffic model in wavelength convertible WDM optical mesh networks. In this model, a set of demands is given, and the setup time and teardown time of each demand are known in advance. We formulate the problem as integer linear programs that maximally exploit network resource reuse in both space and time. The objective is to minimize the total number of wavelength-links used by working paths and protection paths of all traffic demands while 100% restorability is guaranteed against any single failures. Our simulation results indicate that joint optimization of resource sharing in space and time enabled by our connection holding-time aware protection schemes can achieve significantly better resource utilization than schemes that are holding-time unaware

With the huge capacity, wavelength division multiplexing (WDM) optical networks are predominantly used as the transport infrastructure to carry inter-domain traffic for client networks. Traffic grooming refers to the aggregation of low-speed client traffic flows onto high-capacity optical connections, to achieve cost-effective traffic transport. In this paper, we propose a route segment technique to efficiently compute the client traffic blocking probability in dynamic traffic grooming, where client traffic randomly arrives/departs. In our experiments, the blocking probabilities computed by this technique closely match the results obtained by simulations.

Traffic grooming in wavelength division multiplexing (WDM) optical networks controls how to consolidate client calls with sub-wavelength data rates onto lightpaths. It can be classified into static or dynamic traffic grooming depending on whether the client traffic is static or dynamic. The principal problem in traffic grooming is to construct a logical topology to route client traffic over a given physical topology. For dynamic traffic grooming, the logical topology may be dynamically configured, or designed a priori given the stationary traffic demands between client nodes (and reconfigured on relatively large time scale, e.g., on the order of hours, to adapt to traffic demands changes). Both approaches have their pros and cons. This paper studies the latter case and develops a heuristic algorithm to design logical topology, constrained by client traffic blocking probability requirement and the maximum by-pass traffic amount allowed at each client node. We have compared logical topologies designed the heuristic and an ILP model. The heuristic performance is impressive.

Traffic grooming is an operation to consolidate client traffic onto lightpaths in the interworking of the optical network and client networks. Depending on whether the client traffic is static or dynamic, it can be classified into static and dynamic traffic grooming. This paper studies how to design logical topology (using minimum network resource) for dynamic traffic grooming, to meet the given traffic blocking probability requirements. We will formulate this problem into an integer linear programming (ILP) problem. In the formulation, we will consider wavelength assignment for lightpaths, and wavelength conversion in the optical network. The formulation is demonstrated to be highly effective for small to medium-size networks. Furthermore, for large networks, we propose a simple heuristic that can obtain near-optimal performance.

The optical connections (lightpaths) offered to the client by optical networks have large capacities. On the other hand, the client traffic flows require smaller and heterogeneous bandwidths. Due to this bandwidth gap, client traffic flows are aggregated onto lightpaths to improve network utilization and reduce cost, which is called traffic grooming. In this paper, we develop an analytical model using the single-service reduced load approximation to compute traffic loss probabilities in grooming of dynamic traffic. The model can address arbitrary alternate routing, and arbitrary wavelength conversion in the optical network. We have compared this model with a previous work that uses the multi-service reduced load approximation, with regard to computation time and calculated blocking probabilities. The results obtained by the single-service model are very close to those by the multi-service model, and the computation time can be significantly improved. On the other hand, the results calculated by the (both single and multi-service) analyses match those obtained by the simulation.

Traffic grooming is an important task in interworking between the wavelength-division multiplexing (WDM) optical network that supplies "pipes" at the wavelength granularity, and the attached client networks that usually require connections of subwavelength granularity. The focus of this paper is to conduct performance analysis of grooming dynamic client traffic in WDM optical networks with a mesh topology. This paper first briefly introduces the traffic grooming problem in WDM optical networks and the issues related to performance analysis. It then develops two link blocking models, an exact model based on the stochastic knapsack problem and an approximation model based on an approximate continuous time Markov chain (CTMC). The end-to-end performance analysis is conducted using the reduced load approximation. The result obtained from analysis is shown to be accurate compared with the numerical result obtained from simulation.

The paper develops a theoretical performance analysis model for the online single-hop traffic grooming algorithm in the mesh topology wavelength division multiplexing (WDM) optical network. This is done by developing a link blocking model for traffic grooming based on the continuous time Markov chain and queueing theory, and by extending the Erlang fixed-point approximation for traffic grooming analysis. The results obtained from the analytic model are shown to match well with the numerical results obtained from simulations.

Optical circuit switching (OCS) is a sophisticated technology widely deployed in current optical networks, and has many advantages in the transport of stable and long-duration traffic flows. However, it is not suitable for bursty data traffic. On the other hand, an alternative technology, optical burst switching (OBS), well addresses bursty IP traffic transport, but is not suitable for stable and large flows. To transport both types of traffic effectively, a hybrid optical switching approach is proposed which combines OCS and OBS to exploit the merits of both technologies. The performance has been evaluated in terms of throughput and blocking probability.

With the "bandwidth-on-demand" as a promising service provisioning model for next-generation IP over WDM optical networks, online traffic grooming emerges as a fundamental issue. This paper studies the performance analysis of the multihop online traffic grooming algorithm in mesh WDM optical networks, and develops a theoretical performance analysis model.

We propose an agent-based traffic grooming and management mechanism for IP over wavelength division multiplexing (WDM) optical networks. The agent-based mechanism effectively manages the traffic aggregation across the optical core between the IP client networks. It offers the benefit of efficient resource usage and reduced connectivity complexity for IP over WDM optical networks. We have studied this mechanism and evaluated its performance over various traffic patterns.

In survivable WDM optical networks, one of the critical issues is route computation. Although there is a possibility to optimize the route computation (together with the wavelength assignment) for static traffic pattern, it is impossible to perform such optimization for incremental and dynamic traffic. The conventional approach first computes the working path and then computes an edge-disjoint protection path using the shared risk link groups (SRLGs) information of the working path. We propose a joint working and protection path selection approach. Our approach tries to find multiple pairs of candidate working and protection paths. Then the pair with the minimum cost sum is selected. We have evaluated the performance benefit gained from the joint path selection approach with a single service class dynamic traffic supporting 1:1 protection scheme.