The rapid growth of Internet of Things (IoT) devices increases the need for robust and efficient device identification techniques to safeguard network security and integrity. Device fingerprinting emerges as a promising approach for identifying IoT devices; however, existing methods require substantial computational and memory resources, which limits their suitability for real-time and resource-constrained environments. This study presents a novel IoT device fingerprinting technique based on the frequency of communication, leveraging the inherent communication patterns of IoT devices. The proposed technique is computationally lightweight, resource-efficient, and adaptable to dynamic network environments. To enhance transparency and trust, this work incorporates explainable machine learning techniques by leveraging feature importance scores to improve the interpretability of classification decisions and reveal the contribution of communication frequency features to model predictions. Experimental evaluation using multiple benchmark datasets shows that the proposed technique has excellent performance, achieving an accuracy of up to 99.9% and demonstrating minimal inference time (as low as 0.001 seconds). It significantly outperforms existing methods by reducing computational overhead and offers a practical and scalable solution for real-world IoT deployments.

In this paper, we propose a novel approach for rate adaptation in 802.11 wireless networks based on the re-inforcement learning algorithm, REINFORCE. Our approach leverages a more comprehensive set of observations, including received signal strength, contention window size, current MCS and throughput, enabling a nuanced response to varying network conditions and hence leads to optimal network throughput. The unique application of REINFORCE allows our methodology to iteratively learn optimal actions under different states, resulting in enhanced rate adaptation in dynamically changing environments. We utilize ns-3, a discrete-event network simulator, in conjunction with ns3-ai, a reinforcement learning gym, to implement and evaluate our approach (named ReinRate) under varying network scenarios, with and without interference from competing transmitters. The extensive simulations conducted under static and dynamic scenarios clearly demonstrate our method's superiority over traditional strategies like the Minstrel and Ideal rate adaptation algorithms, with up to 102.5% and 30.6% higher network throughput in network scenarios without interference, and by up to 35.1% and 66.6% in network scenarios with interference.

The widespread availability of Wi-Fi networks in our workplaces, schools, hotels, and public spaces provides us with access to the Internet from just about anywhere. An increasing range of devices are being developed with Wi-Fi capabilities including devices such as surveillance or "spy" cameras that allow for remote viewing of a live feed. News reports have shown hidden cameras being placed illegally, or without consent, in places including hotel rooms, workplaces, schools, and rental homes. This is a malicious invasion of privacy and has potential to facilitate extortion or blackmail. Current methods of finding hidden cameras typically involve manual surveying of the environment, radio frequency detectors, or the use of some smartphone cameras that cause infrared light to become visible. These methods can be ineffective, unreliable, or incur extra costs for hardware. The addition of Wi-Fi functionality in these maliciously placed devices, while enabling ease of remote viewing and access for the intruder, also creates a means of identifying and localizing them. In this paper, we investigate potential signal metrics to detect and localize hidden Wi-Fi cameras. We use signal metrics such as Received Signal Strength Indicator (RSSI), Channel State Information (CSI) and Power Delay Profile (PDP) to determine the direction of the received Wi-Fi signal as well as estimate the distance to the hidden Wi-Fi camera. Our results show that these signal metrics can be used to detect and localize a hidden Wi-Fi device, with the CSI and PDP signal metrics achieving the best performance in scenarios with line-of-sight and non-line-of-sight to the hidden camera.

In the area of mobile ad-hoc networks and wireless mesh networks, sequence numbers are often used in routing protocols to avoid routing loops. It is commonly stated in protocol specifications that sequence numbers are sufficient to guarantee loop freedom if they are monotonically increased over time. A classical example for the use of sequence numbers is the popular Ad hoc On-Demand Distance Vector (AODV) routing protocol. The loop freedom of AODV is not only a common belief, it has been claimed in the abstract of its RFC and at least two proofs have been proposed. AODV-based protocols such as AODVv2 (DYMO) and HWMP also claim loop freedom due to the same use of sequence numbers.

Many wireless network protocols and algorithms rely on estimations of the link capacity in order to make informed decisions on routing data packets, selection of the optimal transmission rate, flow and admission control. In this paper we present an investigation into our Effective Link Capacity (ELC) metric which combines the use of MAC layer monitoring with knowledge of the network timing specifications to provide an accurate model of link conditions. We subject the resulting metric to an experimental investigation across a range of conditions using a conducted testbed. We demonstrate that commodity wireless devices do not conform to the IEEE 802.11 specification, thus making modeling difficult. Given that ELC and the IEEE 802.11s Airtime link metric are directly related, we compare their accuracy in estimating the link capacity. We demonstrate that ELC significantly outperforms two widely-used implementations of Airtime.

This paper presents a practical and low-cost approach to estimate the maximum achievable wireless link bandwidth based on the prevailing link conditions in an IEEE 802.11 network. This approach works by observing the number of bits successfully delivered over a link, divided by the corresponding channel occupancy time. The method is passive and does not introduce any extra overhead on the channel, and is based on the timing model of the IEEE 802.11 MAC layer. All required parameters are obtained locally at the sending node from the MAC layer. We evaluate the accuracy of the proposed method via a full implementation and experiments on our conducted testbed, which provides a more controlled environment and increased repeatability of experiments, compared to over-the-air wireless testbeds. The experiment results show that our method can accurately estimate the link bandwidth with both saturated and low traffic load across links with different transmission rates and link qualities. In addition, results also show that our method is able to track the link bandwidth as its link quality changes.

In this paper we present a rigorous analysis of the Ad hoc On-Demand Distance Vector (AODV) routing protocol using a formal specification in AWN (Algebra for Wireless Networks), a process algebra which has been specifically tailored for the modelling of Mobile Ad Hoc Networks and Wireless Mesh Network protocols. Our formalisation models the exact details of the core functionality of AODV, such as route discovery, route maintenance and error handling. We demonstrate how AWN can be used to reason about critical protocol correctness properties by providing a detailed proof of loop freedom. In contrast to evaluations using simulation or other formal methods such as model checking, our proof is generic and holds for any possible network scenario in terms of network topology, node mobility, traffic pattern, etc. A key contribution of this paper is the demonstration of how the reasoning and proofs can relatively easily be adapted to protocol variants.

The ability to accurately estimate wireless link quality is critical to the performance of routing protocols and rate adaptation algorithms in wireless mesh networks. Current link quality estimation methods utilize the packet delivery ratio (PDR) measurement of periodic broadcast probes sent at the lowest transmission rate. However, the estimated link quality does not readily translate to the performance of unicast data traffic at higher transmission rates. In this paper, we propose the use of a measurement-based signal-to-noise ratio (SNR) model to estimate wireless link quality in terms of its PDR performance. Using broadcast traffic measurements at the lowest transmission rate, we construct an "SNR profile'' that characterizes the relationship between the PDR metric and the SNR values computed at a node. We show how we can use the SNR profile to predict the PDR performance at different transmission rates. More importantly, we argue that the frame delivery ratio (FDR) at the MAC layer is a better link quality metric compared to PDR, and show that our proposed approach can use an SNR profile generated with broadcast traffic, to accurately estimate the FDR performance of unicast data traffic at different transmission rates. This then allows us to also accurately estimate the maximum achievable throughput of the wireless link at those rates.

In 802.11-based wireless networks, the ability to accurately predict the impact of interference via the use of an interference model is essential to better and more efficient channel assignment algorithms and data routing protocols. Recently, there have been several works that proposed new interference models utilizing the well-known concept of signal-to-interference-plus-noise ratio (SINR). Using active measurements, these models construct a profile that maps either the measured received signal strength (RSS) or the computed SNR or SINR values at a receiver, to its packet delivery ratio (PDR) performance. The profile is then used by the models to predict the PDR performance in more complex scenarios involving multiple interferers. While comparison with other basic models (e.g. hop-based and distance-based) have been made in these works, there has as yet been no comprehensive comparison on the accuracy of these measurement-based SINR interference models. In this paper, we systematically evaluate the performance of three measurement-based SINR interference models in predicting the interference impact on the successful reception of packets. Our evaluations cover various interference scenarios with both 802.11 and non-802.11 interferers, in experiments carried out in both our conducted testbed and an over-the-air testbed. Our results show that an interference model that utilizes an SINR profile can accurately predict the PDR performance with a maximum root-mean-square error (RMSE) of 10.8% across all our evaluations. In contrast, interference models that rely on the SNR profile and the RSS profile perform poorly, with a maximum RMSE of 61.7% and 66.1% respectively.

Interference is a crucial factor that impacts the overall throughput performance of IEEE 802.11-based wireless networks. As such, understanding interference characteristics is essential towards the optimal management and operation of these networks. In this paper, we use a conducted testbed (that allows us to completely control the signal propagation and received signal strength) to systematically evaluate the impact of interference in terms of the carrier-sensing interference and the receiver interference. Our results show that carrier-sensing interference does not conform to the often-used binary model of "either carrier-sense or no carrier-sense", and that the sum of the normalized sending rates of nodes that can fully carrier-sense each other is greater than 1.0. In terms of receiver interference, our results show that while the interference impact on a data link's throughput is approximately linear with respect to the offered load of the interferer node, its relationship with respect to the offered load of the data sender is non-linear. Our results also show that the combined interference impact of multiple interferer nodes cannot be predicted by just using independent measurements of the interference impact of individual interferer nodes. The results in this paper indicate that commonly made underlying assumptions of interference models are not valid, and consequently show the limitations of the corresponding models.

HELLO messages are widely used for neighbor discovery in routing protocols for wireless multihop networks. In this paper, we provide mathematical and experimental proofs that the current strategy of declaring a link down based on observations that a specific number of HELLO messages are lost, is not a correct strategy. In our mathematical analysis, we characterized the error bursts over wireless links by extending the Gilbert bit error model, and validate our model using HELLO loss data from our wireless mesh testbed. Our analysis shows that error burst lengths follow a geometric distribution, i.e. the probability of additional losses in the burst does not depend on the observed losses. We propose an alternative link break detection strategy where a link break is declared when the observed mean error burst length for the link is longer than the mean route recovery time. Our testbed results show that running the AODV routing protocol with our proposed strategy yields better throughput and lower control message overhead, compared to the case where AODV relies on its default settings of declaring link breaks when two consecutive HELLO messages are lost.

Drive-thru Internet systems are multiple-access wireless networks in which users in moving vehicles can connect to a roadside access point (AP) to obtain Internet connectivity for some period of time as the vehicles pass through the AP's coverage range. In order to evaluate the type of communication services and the quality-of-service that these systems can provide, in this paper, we investigate the data communication performance of a vehicle in Drive-thru Internet systems. In particular, we derive analytical models with tractable solutions to characterize the average and the distribution of the number of bytes downloaded by a vehicle by the end of its sojourn through an AP's coverage range, in the presence of other vehicles contending for the same AP's resources. Our models are able to quantify the impact of road traffic density, vehicle speed, service penetration rate, AP's transmission range and the corresponding bit rate, on the amount of data downloaded by an individual vehicle. In terms of analysis technique, we map the study of our vehicular data downloading process into the transient analysis of a series of Markov reward processes. Our use of Markov reward model is novel in the sense that we only select from the corresponding Markov chain, a subset of relevant sample paths that matches the required behavior of our vehicular flow model. We also validate our proposed analytical models through extensive simulations, driven by empirical vehicular traffic traces. We believe our work offers a unique analytical framework based on which the interplay between vehicular traffic parameters and a vehicle's data communication performance in a Drive-thru Internet system can be studied and optimized in a systematic, quantitative manner.

This paper presents the results of an independent evaluation of four different commercial wireless mesh network systems using IEEE 802.11 radios in the context of small-scale, rapid deployment scenarios in public safety and emergency applications. To ensure repeatability and fairness in our evaluation, we designed and built a conducted wireless evaluation platform which provides a controlled test environment. Using our conducted test-bed, we investigated the performance of the different wireless mesh products in terms of their singlehop and multi-hop capacity under varying link conditions, and their ability to handle link failures. We have also conducted an outdoor multi-hop capacity test with the wireless mesh products, and compared the outdoor performance with the lab-based results. The test scenarios and the corresponding results demonstrate the flexibility and advantages of our conducted test-bed in fleshing out the performance differences of the evaluated mesh products. From our test results, we observed the differences in the MAC auto-rate behaviour of the different mesh network systems, as well as the throughput performance stability in one of the vendor's mesh routers. Our results also show that the multi-hop throughput performance of an unplanned (or rapid) network deployment can be substantially lower (ranging from 44% to 67%) compared to that of a planned network deployment.

The performance of 802.11-based multi-channel wireless mesh networks is affected by the interference due to neighboring nodes operating on same or adjacent channels. In this paper, we have performed extensive measurements on our conducted testbed to evaluate the effects of adjacent channel interference (ACI) in 802.11 networks, under the exposed terminal and hidden terminal scenarios. By varying the path loss and the channel separation distance between two nodes, we investigate the effective attenuation needed in order to completely eliminate the ACI between the two nodes. Using node throughput as a metric, our results confirm that for low path loss between two 802.11 nodes, there still exists interference between the two nodes even though they are operating on non-overlapping channels. Our results also show that we require 37 dB - 45 dB less attenuation to completely eliminate the ACI between two nodes operating on non-overlapping channels, compared to when both nodes are operating on the same channel. Our results are useful to network planners in terms of the placement of mesh nodes and the assignment of channels on the nodes in an 802.11-based multi-channel wireless mesh network.

As we continue to see the increasing global-scale deployment of Internet Protocol version 6 (IPv6) networks, it is equally important to evaluate the performance of these IPv6 networks. In this paper, we present comprehensive empirical measurements of the IPv6 network performance from an end- user's perspective. In particular, by sending probing traffic from our dual-stack IPv6/IPv4 testbed to over 2,000 dual-stack hosts worldwide, we quantify the performance differences of using IPv6 vs. IPv4, in terms of various network metrics like network connectivity, hop count, RTT, throughput, operating systems dependencies as well as the address configuration latency. We also investigate the performance impact of using IPv6 tunneling brokers instead of native IPv6 services. Whenever possible, we also compare our measurement results with previously published ones to reflect on the progress of IPv6 deployment/performance improvements in the past few years. In general, our results indicate that in these past few years, the IPv6 backbone has improved considerably to provide more than 95% network connectivity to various IPv6 sites. The end-user-perceived performance offered by some IPv6 tunnel brokers are also comparable to that of native IPv6 services.

This paper presents the findings of an extensive measurement study on multiple commercial 3G networks. We have investigated the performance of those 3G networks in terms of their data throughput, latency, video and voice calls handling capacities, and their ability to provide service guarantees to different traffic classes under saturated and lightly-loaded network conditions. Our findings point to the diverse nature of the network resources allocation mechanisms and the call admission control policies adopted by different operators. It is also found that the 3G network operators seem to have extensively customized their network configurations in a cell-by-cell manner according to the individual site's local demographics, projected traffic demand and the target coverage area of the cell. As such, the cell capacity varies widely not only across different operators but also across different measurement sites of the same operator. The results also show that it is practically impossible to predict the actual capacity of a cell based on known theoretical models and standard parameters, even when supplemented by key field measurements such as the received signal-to-noise ratio (Ec/N0)

This paper presents the findings of an extensive measurement study on multiple commercial 3G UMTS networks. We have investigated the performances of those 3G networks in terms of their data throughput, latency, video and voice calls handling capacities, and their ability to provide service guarantees to different traffic classes under various loading conditions. Our findings indicate the diverse nature of network resources allocation and call admission control policies employed by different operators. It is also found that the 3G network operators seem to have extensively customized their network configurations in a cell-by-cell manner according to the individual site's local demographics, projected traffic demand and the target coverage area of the cell. As such, the cell capacity varies widely not only across different operators but also across different measurement sites of the same operator. Even for the same site, the capacity can easily change by more than 10% across multiple measurements taken at different time of the day. The results also show that it is practically impossible to predict the actual capacity of a cell based on known theoretical models and standard parameters, even when supplemented by key field measurements such as the received signal-to-noise ratio (Ec/N0).

This paper proposes an energy-efficient and receiver-driven, TDMA-based MAC protocol (RMAC) for wireless sensor networks. By placing the ownership of the timeslots in the hands of the receiver nodes and letting the receiver nodes assign the timeslots to their neighboring sender nodes, RMAC not only eliminates the need for the sender nodes to explicitly wake-up a receiver node for data transmission, but also eliminates any collision or contention overhead among the sender nodes. Our simulation results show that RMAC outperforms other sender- driven, TDMA-based MAC protocols in terms of the packet latency and power consumption. We also devised a mechanism to enable unused timeslots to be "stolen" by other sender nodes and show that in the case of uniform timeslots assignment among the sender nodes, "timeslots stealing" increases the network capacity by as much as 200%. In addition, we propose a simple timeslots reassignment procedure to allow the receiver nodes to redistribute the timeslots among the sender nodes according to their offered traffic load, and show that it enables the network to efficiently reduce the packet latency in the face of asymmetric, bursty traffic patterns.

Data reliability and real-time delivery of critical information are very crucial in many wireless sensor network applications such as intruder detection and surveillance. In this paper, we explore different mechanisms to provide differentiated services for time-critical information flows. We compare their performances in terms of the packet delivery ratio and end-to-end latency for a high-priority information flow. Our simulation and delay analysis results show that an approach where the wireless medium is reserved along the path from the source to the sink for a high-priority information flow, can provide guaranteed and low latency delivery for a high-priority flow, with acceptable delay impact to the low-priority flows.