Optimizations in wireless ad-hoc network control protocols, such as shortest path routing and reduced topology set operations, are widely employed and recognized to decrease overhead and improve performance in benign conditions. Such optimizations, however, result in vulnerabilities that can decrease the robustness of the network when misconfigured, and can be readily exploited under various adversarial models. In this paper, we study the effects of such optimizations in the presence of misconfiguration and attacks, and we propose an Attack-Resistant Routing (ARR) framework that mitigates adversarial effects. While many other methods of combating certain control plane attacks have been proposed, our method is unique in that it assumes no prior knowledge of the mechanisms used to effect the attacks and the type of misinformation affecting the network. Rather, it alleviates the vulnerabilities introduced by various optimizations, thus increasing network robustness when the network is under attack or misconfigured. We show that ARR can withstand multiple and severe attacks and restore network performance to levels close to normal.

Cyber reconnaissance is the process of gathering information about a target network for the purpose of compromising systems within that network. Network-based deception has emerged as a promising approach to disrupt attackers' reconnaissance efforts. However, limited work has been done so far on measuring the effectiveness of network-based deception. Furthermore, given that Software-Defined Networking (SDN) facilitates cyber deception by allowing network traffic to be modified and injected on-the-fly, understanding the effectiveness of employing different cyber deception strategies is critical. In this paper, we present a model to study the reconnaissance surface of a network and model the process of gathering information by attackers as interactions with a cyber defensive system that may use deception. To capture the evolution of the attackers' knowledge during reconnaissance, we design a belief system that is updated by using a Bayesian inference method. For the proposed model, we present two metrics based on KL-divergence to quantify the effectiveness of network deception. We tested the model and the two metrics by conducting experiments with a simulated attacker in an SDN-based deception system. The results of the experiments match our expectations, providing support for the model and proposed metrics.

Traffic anomaly detection is primarily concerned with identifying malicious traffic patterns in a much larger stream of benign traffic. Traditionally, this is achieved by selecting a very specialized set of traffic-based features that are used for both training a model, as well as for detection at runtime. This paper introduces a novel method of anomaly detection that breaks the assumption that the same set of features should be used for both training and runtime detection. Building upon the concept of Learning Using Privileged Information (LUPI), this paper shows how to build a detection model that uses an extended set of features, some that are available only during training, and some also available at runtime, with results significantly superior to the traditional learning methods. We demonstrate the usage of the privileged features in detecting malicious botnet activities in a network, activities shown to be challenging to detect in past works.

Advanced targeted cyber attacks often rely on reconnaissance missions to gather information about potential targets, their characteristics and location to identify vulnerabilities in a networked environment. Advanced network scanning techniques are often used for this purpose and are automatically executed by malware infected hosts. In this paper, we formally define network deception to defend reconnaissance and develop a reconnaissance deception system, which is based on software defined networking, to achieve deception by simulating virtual topologies. Our system thwarts network reconnaissance by delaying the scanning techniques of adversaries and invalidating their collected information, while limiting the performance impact on benign network traffic. By simulating the topological as well as physical characteristics of networks, we introduce a system which deceives malicious network discovery and reconnaissance techniques with virtual information, while limiting the information an attacker is able to harvest from the true underlying system. This approach shows a novel defense technique against adversarial reconnaissance missions which are required for targeted cyber attacks such as advanced persistent threats in highly connected environments. The defense steps of our system aim to invalidate an attackers information, delay the process of finding vulnerable hosts and identify the source of adversarial reconnaissance within a network.

We introduce a new methodology for formulating, analyzing, and applying access-control policies. Policies are expressed as formal theories in the SMT (satisfiability-modulo-theories) subset of typed first-order logic, and represented in a programmable logical framework, with each theory extending a core ontology of access control. We reduce both request evaluation and policy analysis to SMT solving, and provide experimental results demonstrating the practicality of these reductions. We also introduce a class of canonical requests and prove that such requests can be evaluated in linear time. In many application domains, access requests are either naturally canonical or can easily be put into canonical form. The resulting policy framework is more expressive than XACML and languages in the Datalog family, without compromising efficiency. Using the computational logic facilities of the framework, a wide range of sophisticated policy analyses (including consistency, coverage, observational equivalence, and change impact) receive succinct formulations whose correctness can be straightforwardly verified. The use of SMT solving allows us to efficiently analyze policies with complicated numeric (integer and real) constraints, a weak point of previous policy analysis systems. Further, by leveraging the programmability of the underlying logical framework, our system provides exceptionally flexible ways of resolving conflicts and composing policies. Specifically, we show that our system subsumes FIA (Fine-grained Integration Algebra), an algebra recently developed for the purpose of integrating complex policies.

We describe a system for estimating the reliability of nodes in a mobile ad hoc network. The goal of the system is to detect insider attacks on the control plane of wireless protocols at the link and network layers, and to generate and propagate corresponding reliability estimates for nodes across the network. Our contributions are two-fold: first, we implement a cross-layer invariant-based technique for attack detection, where rules about correct combined behavior of protocols are specified based on data collected from multiple layers of the protocol stack. Next, we use the results of our attack detection techniques to compute reliability estimates for network nodes, where a reliability estimate represents the estimate of a node N for another node M. The form of our reliability estimate for a node is expressed as (t, c), where t indicates the trust for that node, and c indicates the confidence in this trust value. Reliability estimates are propagated across the network in a manner that is resilient to malicious nodes that propagate false reliability estimates, and minimizes network overheads. Our simulation results show that the above techniques result in highly accurate reliability estimates even in the presence of multiple malicious nodes in the network.

In this paper, we discuss a time synchronization approach to the time divergence problem in hybrid network emulation. Such emulation comprises primarily a discrete-event simulated network and virtual machines that send and receive traffic through the simulated network. For slower than real-time network simulations, the rate of time advance on virtual machines (real time) is faster than that of the discrete-event time. Consequently, packet transmission latency and other metrics in such hybrid network emulations will be distorted. As a result, e.g., TCP sessions between virtual machines may unduly time out. To address this problem, we have developed TimeSync, which tracks discrete-event simulation time to control time advance on virtual machines for slower than real time simulations so that time perception in the hybrid network emulation system is synchronized. We describe how TimeSync works and present our experimental evaluation and analysis.

Due to its obvious importance, fault detection and localization is a well-studied problem in communication networks, as attested by the many techniques designed to address this problem. The inherent variability, limited component reliability, and constrained resources of MANETs (Mobile Ad hoc Networks) make the problem not just more important, but also critical. Practical development and deployment considerations imply that fault detection and localization methods must i) avoid relying on overly detailed models of network protocols and traffic assumptions and instead rely on actual cross-layer measurements/observations, and ii) be applicable across different network scales and topologies with minimum adjustments. This paper demonstrates the feasibility of such goals, and proposes an important and as yet unexplored approach to fault management in MANETs: network-invariant fault detection, localization and diagnosis with limited knowledge of the underlying network and traffic models. We show how fault management methods can be derived by observing statistical network/traffic measurements in one network, and subsequently applied to other networks with satisfactory performance. We demonstrate that a carefully designed but widely applicable set of local and weak global indicators of faults can be efficiently aggregated to produce highly sensitive and specific methods that perform well when applied to MANETs with varying sizes, topologies, and traffic matrices.

Significant progress has been made in the past twenty years on the implementation of software-defined radios (SDRs) based on general purpose processors (GPPs). In contrast, there has been limited work on the analysis of the computational requirements of such SDRs. Quantifying the signal processing complexity in SDR is critical to ensuring that the system has sufficient computational resources to support reliable digital communications. Our contribution is to analyze and measure the computational cost of a Gaussian minimum shift keying (GMSK) transceiver based on GNU Radio, a widely used GPP-based SDR. Further, we introduce GNU Radio's working mechanism. To the best of our knowledge, our work is the first to provide detailed computational analysis of digital communications based on GNU Radio.

Computer networks exist to provide a communication medium for social networks, and information from social networks can help in estimating their communication needs. Despite this, current network management ignores the information from social networks. On the other hand, due to their limited and fluctuating bandwidth, mobile ad hoc networks are inherently resource-constrained. As traffic load increases, we need to decide when and how to throttle the traffic to maximize user satisfaction while keeping the network operational. The state-of-the-art for making these decisions is based on network measurements and so employs a reactive approach to deteriorating network state by reducing the amount of traffic admitted into the network. However, a better approach is to avoid congestion before it occurs, by (a) monitoring the network for early onset signals of congestive phase transition, and (b) predicting future network traffic using user and application information from the overlaying social network. We use machine learning methods to predict the amount of traffic load that can be admitted without transitioning the network to a congestive phase and to predict the source and destination of near future traffic load. These two predictions when fed into an admission control component ensure better management of constrained network resources while maximizing the quality of user experience.

Traditional network management systems are not usually able to differentiate between mobility and other causes of communication degradation in wireless mobile ad hoc networks. A fault management system needs the ability to not only detect changes in performance but also reason about their possible causes and how to fix the problems. We propose a system called TimeSAFE (Time Series Analyzer Front End) that performs time series analysis as a front end input to a central fault management system. We show how such an analysis can help to distinguish between motion, obstacles, and interference as possible causes of changes in SINR (Signal to Interference and Noise Ratio). We propose three different methods of time series analysis and also methods for dynamic order selection and dynamic window selection. We describe our implementation of TimeSAFE and provide some preliminary results of detecting changes in SINR and identifying their causes.

Due to their limited and fluctuating bandwidth, mobile ad hoc networks (MANETs) are inherently resource-constrained. As traffic load increases, we need to decide when to throttle the traffic to maximize user satisfaction while keeping the network operational. The state-of-the-art for making these decisions is based on network measurements and so employs a reactive approach to deteriorating network state by reducing the amount of traffic admitted into the network. However, a better approach is to avoid congestion before it occurs by predicting future network traffic using user and application information from the overlaying social network. We use machine learning methods to predict the source and destination of near future traffic load.

Characterized by their flexibility to be deployed in relatively short time spans and ability to function in remote and hostile environments, mobile ad hoc networks (MANETs) are becoming the basis for on-demand peer-to-peer wireless networking in the commercial and military sectors. However, the power and dynamism of MANETs renders their management a significant challenge. For example, unpredictable link qualities render quality of service assurance to the mission critical/platinum services very challenging. Likewise, lack of fixed infrastructure coupled with intermittent connectivity place a significant burden on network management systems that are expected to provide seamless recovery amidst random network failures. Additionally, the network management operations in MANETs need to be automated to a large extent. This paper discusses the challenges associated with two key MANET aspects of interest to the Industry: (a) providing and maintaining QoS guarantees and (b) fault management and self-healing in MANETs, and discusses potential solutions that can be implemented in practice.

The problem with current network management systems is that they lack the ability to state long-term, network-wide configuration objectives, and have them automatically realized in the network. Our vision for policy-based management completes the feedback loop between network monitoring and network re-configuration. The management system must be able to automatically react to network events by performing actions described in predetermined policies. These policies are created ahead of time by the network operator; once they are created and stored as part of the management system, the latter can automatically enforce these policies. This takes the human out of the loop and allows nearly fully automated network management. The system described in this paper has been implemented and used to experiment with MPLS traffic engineering in our laboratories. The results of this experimentation have shown a significant decrease in the amount of manual intervention required to manage an MPLS network as a result of using policy-based management.

Summary form only given. Tomorrow's mobile ad hoc networks emphasize adaptable and flexible networks that automatically adapt to the user's needs. Such adaptability and flexibility requires mobile networking capabilities significantly beyond what is possible with currently fielded technology. The tutorial discusses the management challenges and outlines solutions to problems that address the unique characteristics of mobile ad hoc networks. The tutorial covers the following topics: introduction to ad hoc networking; ad hoc network configuration; routing in ad hoc networks; management issues for ad hoc networks.

We present a novel technique called symbolic simulation, and its application to protocol modeling and validation. Whereas simulation produces a trace of the behavior of a system for certain fixed parameter values, symbolic simulation allows one to simulate the behavior of a system for entire ranges of parameter values. This in turn allows verification of certain properties of the system behavior for those ranges of values. This paper lays the theoretical foundation for symbolic simulation, and describes its application to proving safety and liveness properties of protocols. As an example, we have modeled a timer-based connection management protocol and validated one of its safety properties. We conclude that symbolic simulation is a useful means for modeling and validation of complex, real-time communication protocols.>