Abstract In the hybrid simulation research, we investigate a new approach to build software virtual networks (SVNs) that are indistinguishable from their equivalent real live networks (LNs). We define the concept of ‘Network's Interactive Turing Test' based on the similar concept used in the artificial intelligence areas. Our goal is to actualize the interactive and indistinguishablereal–virtual interface pair(RVIP) for large‐scale computer network simulations. By RVIP's support, a single SVN is indistinguishable from its equivalent LN. In the entire hybrid system, multiple LNs and multiple SVNs are connected using many RVIPs in an arbitrary topology and at real time. To actualize RVIP, the following necessary conditions must be satisfied: (i) the performance of the underlying simulation platform must be faster than real time; (ii) all needed changes incurred by introducing any SVN into an LN scenario are put on the simulation's side. To interact with an SVN, RVIP requires that no change is made on any live node; (iii) an SVN doesnotexchange simulation events with LNs, that is, only standard IP protocol interactions between SVN and LN are allowed. (iv) Any LN can be dynamically plugged into the hybrid scenario at real time, just like being plugged into an equivalent purely LN. Compared with existing hybrid simulation efforts on NS‐3, QualNet's EXata and OPNET's system‐in‐the‐loop, in this paper, we use the actual RVIP implementation to show that RVIP is a better candidate to pass the Network's Interactive Turing Test owing to the following two advantages: (i) an interactive network tester can easily distinguish the existing hybrid networks from the LNs by using a live topology thatcannotbe simulated, for example, by including the entire live Internet. But RVIP is not vulnerable to such tests. RVIP can support hybrid scenarios with multiple SVNs and multiple LNs connected by an arbitrary network topology, and with the LNs on and off at anytime. (ii) Performance‐wise, our studies show that RVIP provides more efficient support in terms of common metrics such as larger throughput limit and smaller extra latency; thus, the simulated SVNs are more indistinguishable from their live counterparts. Copyright © 2014 John Wiley & Sons, Ltd.

In this work we investigate real-virtual interface pair (RVIP), a new interface system proposed for hybrid network simulation. In the hybrid system, multiple live networks (LNs) and multiple software virtual networks (SVNs) are connected together via standard IP protocols in an arbitrary topology and at real time. RVIP seeks to implement a new Turing-indistinguishable mode so that an LN and its counterpart SVN are indistinguishable in regards to a third-party live node. To realize the new mode, three necessary conditions must be satisfied: (1) All needed changes incurred by introducing an SVN into a live network scenario are put on the simulation's side, RVIP requires that no change is made on any live node; (2) An SVN does not exchange simulation events with LNs, that is, only standard IP protocol interactions between SVN and LN are allowed. (3) Any LN can be dynamically plugged into the hybrid scenario at real time, just like being plugged into an equivalent purely live network.

We draw an analogy of biological cyanide poisoning to security attacks in self-organizing mobile ad hoc networks. When a circulatory system is treated as an enclosed network space, a hemoglobin is treated as a mobile node, and a hemoglobin binding with cyanide ion is treated as a compromised node (which cannot bind with oxygen to furnish its oxygen-transport function), we show how cyanide poisoning can reduce the probability of oxygen/message delivery to a "negligible" quantity. Like modern cryptography, security problem in our network-centric model is defined on the complexity-theoretic concept of "negligible", which is asymptotically sub-polynomial with respect to a pre-defined system parameter x. Intuitively, the parameter x is the key length n in modern cryptography, but is changed to the network scale, or the number of network nodes N, in our model. Based on this new analytic model, we show that RP (n-runs) complexity class with a virtual oracle can formally model the cyanide poisoning phenomenon and similar network threats. This new analytic approach leads to a new view of biological threats from the perspective of network security and complexity theoretic study.

Underwater environment represents a challenging and promising application scenario for sensor networks. Due to hard constraints imposed by acoustic communications and to high power consumption of acoustic modems, in underwater sensor networks (USN) energy saving becomes even more critical than in traditional sensor networks. In this paper the authors propose delay-tolerant data dolphin (DDD), an approach to apply delay-tolerant networking in the resource-constrained underwater environment. DDD exploits the mobility of a small number of capable collector nodes (namely dolphins) to harvest information sensed by low power sensor devices, while saving sensor battery power. DDD avoids energy-expensive multi-hop relaying by requiring sensors to perform only one-hop transmissions when a dolphin is within their transmission range. The paper presents simulation results to evaluate the effectiveness of randomly moving dolphins for data collection.

Introducing node mobility into the network also introduces new anonymity threats. This important change of the concept of anonymity has recently attracted attentions in mobile wireless security research. This paper presents identity-free routing and on-demand routing as two design principles of anonymous routing in mobile ad hoc networks. We devise ANODR (ANonymous On-Demand Routing) as the needed anonymous routing scheme that is compliant with the design principles. Our security analysis and simulation study verify the effectiveness and efficiency of ANODR.

In this paper we enhance the Digital Content Mediator (DCM) approach, a legitimate online service that uses financial incentives as an effective weapon to fight against online piracy. We provide needed network security support for the DCM service. The DCM mediator is a trusted notary to ensure fair and legitimate deals between digital content selling peers and buying peers. (1) In our design, the mediator sees no raw bits of digital contents. This saves storage and communication resource for the central mediator. (2) For the seller and buyer in a DCM-legitimized transaction, one wants payment and the other wants the content. The DCM protocol ensures that neither of them can stop the protocol in the middle to steal its service without serving the other party. (3) A digital content may have many legitimate copies from large amount of sellers. In a large-scale random network like the Internet, transaction fairness is defined as the condition that a buyer wants to buy the copy from the seller with shortest downloading delay (i.e., largest seller-to-buyer pairwise bandwidth) given the same amount of financial charge. DCM employs flow network security countermeasures to ensure that a seller keeps its bandwidth promises. Our experiments on the Internet confirm the effectiveness of our design.

In this paper we study multi-hop ad hoc routing in a Underwater Sensor Network (UWSN), a novel network paradigm for ad hoc underwater investigation with a large number of low cost underwater sensors. In UWSN, sensors are mobile with water current and dispersion, and use a wireless acoustic channel for communications. However, the large propagation latency and very low bandwidth of an acoustic channel could cause widespread collisions. Moreover, the mobility of sensors requires route management and causes additional traffic, thus worsening the situation. In this paper, we propose Under-Water Diffusion (UWD), a multi-hop ad hoc routing and in-network processing protocol. Since any on-demand flood or proactive exchange is considered harmful in underwater, UWD uses no proactive routing message exchange and negligible amount of ondemand floods in the environment with homogeneous GPSfree nodes and random node mobility. We validate UWD through both the mathematical analysis and simulations.

Multicast communication is an efficient means to support key network applications such as real-time teleconferencing and data dissemination. In this paper we devise a security architecture for multicast communications in mobile ad hoc networks (MANETs). Our design is both suitable in MANET environment and compliant to the IETF standard multicast group security architecture (MGSA). Because centralized servers are vulnerable to network dynamics and security attacks in a distributed MANET, we distribute the function of MGSA's group control key server (GCKS) to a dedicated subset of mobile backbone nodes in MANET. Unlike distributed GCKS nodes in stationary infrastructure networks, our GCKS backbone nodes are mobile, fully distributed and adaptive to network dynamics, in particular the constant and instant changes in network topology, node density and node mobility. We study the characteristics of our GCKS backbone design and its impacts on ad-hoc multicast security research. Our simulation study and Linux implementation confirm the effectiveness of the new MANET MGSA design

Mobile ad hoc networks require anonymous communications in order to thwart new wireless passive attacks; and to protect new assets of information such as nodes' locations, motion patterns, network topology and traffic patterns in addition to conventional identity and message privacy. In particular, in wireless ad hoc networks mobile nodes must rely on ad hoc routing to keep network functional for communication. The transmitted routing messages and cached active routing entries leave plenty of opportunities for eavesdroppers. To address the new challenges, several anonymous routing schemes have been proposed recently. However, in various network scenarios, how the different cryptographic operations impact the routing performance remains unclear. In this paper we investigate the impact from cryptographic operations needed for the anonymous features. The overhead considered includes both increased control packet size and prolonged processing delay. The protocols taken into account include ANODR, AnonDSR, ASR, MASK, and SDAR. We present results based on extensive simulation study. We use the standard/unprotected on-demand scheme AODV in the comparison to show how much cost is paid by each anonymous on-demand scheme. Our simulation study shows that various design choices in anonymous routing indeed trade performance with anonymity protection. We conclude that extensive performance study is needed to evaluate the practicality of any enhancement of these proposed schemes and any new anonymous routing schemes

Abstract Privacy in mobile ad hoc networks has new semantics in addition to the conventional notions for infrastructure networks. Mobility enabled by wireless communication has significantly changed privacy issues and anonymity research in many ways. In particular, mobility requires ad hoc routing schemes to transmit messages frequently in an open wireless medium. The routing traffic facilitates adversaries in conducting various attacks threatening the network security and privacy. In this work, we focus on passive routing attacks. We present an extensive study on new anonymity threats and classify the corresponding security demands into three new categories: (1)venue anonymity; (2)privacy of ad hoc network topology; and (3)privacy of motion pattern. These new aspects are all introduced by mobility and left unaddressed in fixed infrastructure. This leads us to investigate new design principles. Our study suggests thaton‐demand routing,identity‐free routing, andneighborhood traffic mixingare better design choices to defend against the new anonymity threats in mobile networks. The paper also demonstrates through examples on the visualization of the mobile anonymity attacks and on the quantification of the effectiveness of the attacks. Copyright © 2006 John Wiley & Sons, Ltd.

Introducing node mobility into the network also introduces new anonymity threats. Nevertheless, this important change of the concept of anonymity has not been studied in state-of-art network security research. This paper presents the needed study. Then we show that anonymous routing in mobile networks has great impact on routing performance. We calls for the attention to devise new and efficient anonymous routing schemes for mobile ad hoc networks.

Mobile ad hoc networks (MANETs) are vulnerable to routing attacks, especially attacks launched by non-cooperative (selfish or compromised) network members and appear to be protocol compliant. For instance, since packet loss is common in mobile wireless networks, the adversary can exploit this fact by hiding its malicious intents using compliant packet losses that appear to be caused by environmental reasons.In this paper we study two routing attacks that use non-cooperative network members and disguised packet losses to deplete ad hoc network resources and to reduce ad hoc routing performance. These two routing attacks have not been fully addressed in previous research. We propose the design of "self-healing community" to counter these two attacks. Our design exploits the redundancy in deployment which is typical of most ad hoc networks; Namely, it counters non-cooperative attacks using the probabilistic presence of nearby cooperative network members.To realize the new paradigm, we devise localized simple schemes to (re-)configure self-healing communities in spite of random node mobility. We develop a general analytic model to prove the effectiveness of our design. Then we implement our secure ad hoc routing protocols in simulation to verify the cost and overhead incurred by maintaining the communities. Our study confirms that the community-based security is a cost-effective strategy to make off-the-shelf ad hoc routing protocols secure.

Restricting network access of routing and packet forwarding to well-behaving nodes and denying access from misbehaving nodes are critical for the proper functioning of a mobile ad-hoc network where cooperation among all networking nodes is usually assumed. However, the lack of a network infrastructure, the dynamics of the network topology and node membership, and the potential attacks from inside the network by malicious and/or noncooperative selfish nodes make the conventional network access control mechanisms not applicable. We present URSA, a ubiquitous and robust access control solution for mobile ad hoc networks. URSA implements ticket certification services through multiple-node consensus and fully localized instantiation. It uses tickets to identify and grant network access to well-behaving nodes. In URSA, no single node monopolizes the access decision or is completely trusted. Instead, multiple nodes jointly monitor a local node and certify/revoke its ticket. Furthermore, URSA ticket certification services are fully localized into each node's neighborhood to ensure service ubiquity and resilience. Through analysis, simulations, and experiments, we show that our design effectively enforces access control in the highly dynamic, mobile ad hoc network.

Recent events show that distributed denial-of-service (DDoS) attack imposes great threat to availability of Internet services. In this paper, we study and evaluate DDoS attacks in a random flow network model, a novel and general approach to DDoS attack prevention and tolerance. The model can be used to evaluate the effectiveness of a DDoS countermeasure framework. Following the random flow network model and state-of-art Internet topology and traffic models, our simulation reveals that general relationship among several metrics derived from the model. Based on the simulation results, we suggest to build a more complete and effective DDoS countermeasure framework using complementary solutions to achieve DDoS attack detection, prevention, and tolerance at same time.

We present a valid-time extension of SQL and investigate its efficient implementation on an object-relational database system. We propose an approach, where temporal queries are expressed using a point-based time model, which only requires minimal extensions to SQL: 1999. Our prototype system called TENORS (for Temporal ENhanced Object-Relational System) maps the external point-based temporal queries and data model into equivalent internal representations based on time intervals. We describe the mapping of queries from external views to internal relations, and the temporal clustering and indexing methods used to support these queries on DB2.

In hostile environments, the enemy can launch traffic analysis against interceptable routing information embedded in routing messages and data packets. Allowing adversaries to trace network routes and infer the motion pattern of nodes at the end of those routes may pose a serious threat to covert operations. We propose ANODR, an anonymous on-demand routing protocol for mobile ad hoc networks deployed in hostile environments. We address two closely related problems: For route anonymity, ANODR prevents strong adversaries from tracing a packet flow back to its source or destination; for location privacy, ANODR ensures that adversaries cannot discover the real identities of local transmitters. The design of ANODR is based on "broadcast with trapdoor information", a novel network security concept which includes features of two existing network and security mechanisms, namely "broadcast" and "trapdoor information". We use simulations and implementation to validate the effectiveness of our design.

Ubiquitous computing across a variety of wired and wireless connections still lacks an effective security architecture. In our research work, we address the specific issue of designing and building a security architecture for application session handoff, a functionality which we envision will be a key component enabling ubiquitous computing. Our architecture incorporates a number of proven approaches into the new context of ubiquitous computing. We employ the Bell-LaPadula (1976) and capability models to realise access control and adopt public key infrastructure (PKI)-based approaches to provide efficient and authenticated end-to-end security. To demonstrate the effectiveness of our design, we implemented an application enabled with this security architecture and showed that it incurred low latency.

Mobile ad hoc networking offers convenient infrastructure-free communication over the shared wireless channel. However, the nature of ad hoc networks makes them vulnerable to security attacks. Examples of such attacks include passive eavesdropping over the wireless channel, denial of service attacks by malicious nodes as well as attacks from compromised nodes or stolen devices. Unlike their wired counterpart, infrastructureless ad hoc networks do not have a clear line of defense, and every node must be prepared for encounters with an adversary. Therefore, a centralized or hierarchical network security solution does not work well. This work provides scalable, distributed authentication services in ad hoc networks. Our design takes a self-securing approach, in which multiple nodes (say, k) collaboratively provide authentication services for any node in the network. This paper follows the design guidelines of [7] and makes several new contributions. We first formalize a localized trust model that lays the foundation for the design, and then expand the adversary model that the system should handle. We further propose refined localized certification services, and develop a new scalable solution of share updates to resist more powerful adversaries. Finally, the new solution is evaluated through simulations. 1

Abstract Secure communication is critical in military environments in which the network infrastructure is vulnerable to various attacks and compromises. A conventional centralized solution breaks down when the security servers are destroyed by the enemies. In this paper we design and evaluate a security framework for multilevel ad hoc wireless networks with unmanned aerial vehicles (UAVs). In battlefields, the framework adapts to the contingent damages on the network infrastructure. Depending on the availability of the network infrastructure, our design is composed of two modes. In infrastructure mode, security services, specifically the authentication services, are implemented on UAVs that feature low overhead and flexible managements. When the UAVs fail or are destroyed, our system seamlessly switches to infrastructureless mode, a backup mechanism that maintains comparable security services among the surviving units. In the infrastructureless mode, the security services are localized to each node's vicinity to comply with the ad hoc communication mechanism in the scenario. We study the instantiation of these two modes and the transitions between them. Our implementation and simulation measurements confirm the effectiveness of our design. Copyright © 2002 John Wiley & Sons, Ltd.

Providing security support for mobile ad-hoc networks is challenging for several reasons: (a) wireless networks are susceptible to attacks ranging from passive eavesdropping to active interfering, occasional break-ins by adversaries may be inevitable in a large time window; (b) mobile users demand "anywhere, anytime" services; (c) a scalable solution is needed for a large-scale mobile network. In this paper, we describe a solution that supports ubiquitous security services for mobile hosts, scales to network size, and is robust against break-ins. In our design, we distribute the certification authority functions through a threshold secret sharing mechanism, in which each entity holds a secret share and multiple entities in a local neighborhood jointly provide complete services. We employ localized certification schemes to enable ubiquitous services. We also update the secret shares to further enhance robustness against break-ins. Both simulations and implementation confirm the effectiveness of our design.