Controller Area Network (CAN) bus has been the fundamental communication method to interconnect the critical powertrain and body domains in vehicles for decades. Typical in-vehicle CAN buses employ rule-based Intrusion Detection Systems (IDS) to prevent non-compliant CAN messages for security enhancement. However, as the progress of connected autonomous vehicular techniques, more undiscovered vulnerabilities behind CAN IDS are gradually exposed, causing severe threats to vehicle safety, even threatening human life. To address it, fuzzing has become an efficient security testing method to automatically explore unknown vulnerabilities underlying the in-vehicle CAN bus. Existing fuzzing methods either conduct time-consuming random testing that is easily detected by IDS, causing inefficient vulnerability exploration, or rely on precious expert experience for higher efficiency. Instead, this paper turns to seek the power of deep generative models that automatically learn the data communication protocol for compliant fuzzing sample generation. Such a method both releases the experts' knowledge of reverse engineering, and can generate compliant samples to bypass typical rule-based IDS. To further improve the efficiency of exploring exceptions based on the generated samples, we optimize the reward function of SeqGAN with Extreme Value Theory (EVT), to fit the distribution of exception samples. With the trained model, we design a fuzzing system GFuzz4CAN, and conduct extensive experiments for evaluation. Experimental results on open-source datasets and a CAN bus device demonstrate that GFuzz4CAN can achieve$2 \sim 11 \mathrm{x}$higher efficiency compared to byte-level random fuzzing, and is feasible to identify 2 vulnerabilities on the device.

The Network Function Virtualization (NFV) service chaining problem, which involves locating Virtual Network Functions (VNFs) in an NFV-enabled network and routing network demands through their required VNFs, is key to the success of NFV. Solving the chaining problem can efficiently reduce required network resources, and thus reducing capital expenditures (CAPEX) and operational expenditures (OPEX). Previous works mainly focus on finding heuristic solutions, rather than investigating the intrinsic features of the problem. In this paper, we investigate the features of the problem from both theoretical and numerical points of view, by shrinking the NFV service chaining problem into a particular version and conducting tests to study what makes the NFV service chaining problem fundamentally difficult to solve. Results reveal that the demand routing part of the problem has a significant impact on solving the mathematical formulated problem, i.e., finding a feasible routing can be time-consuming. We further propose constructive methods that improve upon the mathematical formulation, which make the time of finding the optimal solution be reduced in most cases.

The diversity of IoT applications implies the requirement of reliable yet efficient MAC solutions for supporting transmissions for various traffic patterns. In this paper, we propose GoMacH, an efficient MAC protocol that provides high reliability and throughput for handling various traffic loads in IoT. GoMacH seamlessly integrates several outstanding techniques. It adopts the phase-lock scheme to achieve low-power, duty-cycled communication. It also utilizes a dynamic slots allocation scheme for providing accurate and instantaneous throughput boost. Furthermore, like in TSCH, GoMacH spreads its communications onto IEEE 802.15.4's 16 channels, leading to high reliability. GoMacH has been implemented in open source on RIOT OS, and has also been seamlessly integrated into IETF's 6LoWPAN/RPL/UDP stack. Experimental results on SAMR21-xpro test-beds verify the practicality of GoMacH and its capabilities for consistently providing high throughput, high delivery ratio, and low radio duty-cycle.

Using low duty-cycle is the most common technique to extend the system lifetime in WSNs. However, it also implies limited throughput and long delay and the penalty is even higher under variable traffic patterns. In this paper, we present iQueue-MAC, a hybrid CSMA/TDMA MAC that adapts to variable/bursty traffic. With light load, iQueue-MAC uses a contention-based CSMA mechanism that provides low delay with scattered transmissions. When traffic increases, detected by a forming backlog in the sender, iQueue-MAC changes to a contention-free TDMA mechanism allocating transmission slots. Thus, iQueue-MAC mitigates packet buffering and reduces packet delay, combining the best of TDMA and CSMA. In this paper we also show how iQueue-MAC can operate in both single and multi channel modes. We implemented it on SIM32W108 chips together with other reference WSN protocols for comparison. iQueue-MAC exhibits similar figures during light traffic. However, with bursty traffic its throughput can be five times that of CoSenS and Ri-MAC-MC and its delay 20 times lower. Finally, iQueue-MAC is able to effectively use multiple channels, duplicating its throughput when compared to single channel operation.

Strict quality of service requirements of industrial applications, challenged by harsh environments and huge interference especially in multi-vendor sites, demand incorporation of cognition in industrial wireless sensor networks (IWSNs). In this paper, a distributed protocol of light complexity for congestion regulation in cognitive IWSNs is proposed to improve the channel utilization while ensuring predetermined performance for specific devices, called primary devices. By sensing the congestion level of a channel with local measurements, a novel congestion control protocol is proposed by which every device decides whether it should continue operating on the channel, or vacate it in case of saturation. Such a protocol dynamically changes the congestion level based on variations of non-stationary wireless environment as well as traffic demands of the devices. The proposed protocol is implemented on STM32W108 chips that offer IEEE 802.15.4 standard communications. Experimental results confirm substantial performance enhancement compared to the original standard, while imposing almost no signaling/computational overhead. In particular, channel utilization is increased by 56% with fairness and delay guarantees. The presented results provide useful insights on low-complexity adaptive congestion control mechanism in IWSNs.

Duty-cycling technique has been widely adopted in MAC protocols for wireless sensor networks to conserve energy. However, low duty-cycle also leads to limited throughput in most of existing solutions. In this paper, we propose iQueue-MAC to provide immediate yet energy-efficient throughput enhancement for dealing with burst or heavy traffic. Combined with CSMA/CA, iQueue-MAC makes use of queue length of each sensor node and allocates suitable TDMA slots to them for packets transmission. During light traffic period, no extra slots will be allocated; iQueue-MAC acts like other low duty-cycle MACs to conserve power. While in burst or heavy traffic period, iQueue-MAC senses the build up of packet queues and dynamically schedules adequate number of slots for packet transmission. We have implemented iQueue-MAC on STM32W108 chips that offer IEEE 802.15.4 standard communication. We set up several real-world experimental scenarios, including a 46 nodes multi-hop test-bed for simulating a general application, and conducted numerous experiments to evaluate iQueue-MAC, in comparison with other traffic adaptive duty-cycle protocols, such as multi-channel version RI-MAC and CoSenS. Results clearly show that iQueue-MAC outperforms multi-channel version of RI-MAC and CoSenS in terms of packet delay and throughput.

We present the design, implement and evaluation of a sensing platform for on-line multi-target tracking based on acoustic array networks, named Integrated Acoustic Array Sensor Network Tracker (IAASNT). To provide on-line multi-target tracking service, a well-designed system structure is proposed, composed by supporting components and associations between each part. Among these, IAASNT's multi-level low-power management and integrated tracking frame set it different from other related platforms. The integrated tracking frame is the core of the system and has been carefully designed, to achieve a self-acting tracking service. Finally, a series of experiments on system have been done to evaluate the performance of IAASNT. The tracking experiments on system show a perfect tracking performance in both noise-free and noisy environment, and the tracking precision can be within 5.8m in 300*300m area.