Abstract Malware classification is a contemporary and ongoing challenge in cyber-security: modern obfuscation techniques are able to evade traditional static analysis, while dynamic analysis is too resource intensive to be deployed at a large-scale. One prominent line of research addresses these limitations by converting malware binaries into 2D images by heuristically reshaping them into a 2D grid before resizing using Lanczos resampling. These images can then be classified based on their textural information using computer vision approaches. While this approach can detect obfuscated malware more effectively than static analysis; the process of converting files into 2D images results in significant information loss due to both quantisation noise, caused by rounding to integer pixel values, and the introduction of 2D dependencies which do not exist in the original data. This loss of signal limits the classification performance of the downstream model. This work addresses these weaknesses by instead resizing the files into 1D signals which avoids the need for heuristic reshaping, additionally these signals do not suffer from quantisation noise due to being stored in a floating-point format. It is shown that existing 2D CNN architectures can be readily adapted to classify these 1D signals for improved performance. Furthermore, a bespoke 1D convolutional neural network, based on the ResNet architecture and squeeze-and-excitation layers, was developed to classify these signals and evaluated on the MalNet dataset. It was found to achieve state-of-the-art performance on binary, type, and family level classification with F1 scores of 0.874, 0.503, and 0.507, respectively, paving the way for future models to operate on the proposed signal modality.

Optimizing images as output of a neural network has been shown to introduce a powerful prior for image inverse tasks, capable of producing solutions of reasonable quality in a fully internal learning context, where no external datasets are involved. Two potential technical approaches involve fitting a coordinate-based Multilayer Perceptron (MLP), or a Convolutional Neural Network to produce the result image as output. The aim of this work is to evaluate the two counterparts, as well as a new framework proposed here, named Neural Knitwork, which maps pixel coordinates to local texture patches rather than singular pixel values. The utility of the proposed technique is demonstrated on the tasks of image inpainting, super-resolution, and denoising. It is shown that the Neural Knitwork can outperform the standard coordinate-based MLP baseline for the tasks of inpainting and denoising, and perform comparably for the super-resolution task.

Abstract The use of supervised Machine Learning (ML) to enhance Intrusion Detection Systems (IDS) has been the subject of significant research. Supervised ML is based upon learning by example, demanding significant volumes of representative instances for effective training and the need to retrain the model for every unseen cyber-attack class. However, retraining the models in-situ renders the network susceptible to attacks owing to the time-window required to acquire a sufficient volume of data. Although anomaly detection systems provide a coarse-grained defence against unseen attacks, these approaches are significantly less accurate and suffer from high false-positive rates. Here, a complementary approach referred to as “One-Shot Learning”, whereby a limited number of examples of a new attack-class is used to identify a new attack-class (out of many) is detailed. The model grants a new cyber-attack classification opportunity for classes that were not seen during training without retraining. A Siamese Network is trained to differentiate between classes based on pairs similarities, rather than features, allowing to identify new and previously unseen attacks. The performance of a pre-trained model to classify new attack-classes based only on one example is evaluated using three mainstream IDS datasets; CICIDS2017, NSL-KDD, and KDD Cup’99. The results confirm the adaptability of the model in classifying unseen attacks and the trade-off between performance and the need for distinctive class representations.

Digital Marketplace is a market-based framework for trading mobile communications services at a service level. It is well suited for managing a future mobile communications environment where the one-to-one mapping between network operators and subscribers no longer holds, and the subscribers are given the option to select a network operator and a wireless access technology that matches their preferences best at a service level. As with any market-based framework, it is important to analyse the selling mechanism from the economic perspective. In this paper, we address the deficiencies of previous research on the economic equilibrium of the Digital Marketplace. We achieve this by proposing an approximation to the equilibrium of the Digital Marketplace through the use of an auction with common prior.

Small-cell deployment within a wireless Heterogeneous Network (HetNet) presents backhauling challenges that differ from those of conventional macro-cells. Due to the lack of availability of fixed-lined backhaul at desired locations and due to cost saving reasons, operators may deploy a variety of backhaul technologies in a given network, combining available technologies such as fiber, xDSL, wireless backhaul and multi-hop mesh networks to backhaul small-cells. As a consequence, small-cells capacity may be non-uniform in the HetNet. Furthermore, some small-cells backhaul capacity may fluctuate if wireless backhaul is chosen. With such concerns in mind, a new network selection strategy considering small-cell backhaul capacity is proposed to ensure that users enjoy the best possible user experience especially in terms of connection throughput and fairness. The study compares performance of several common Network Selection Schemes (NSSs) such as WiFi First (WF) and Physical Data Rate (PDR) with the proposed Dynamic Backhaul Capacity Sensitive (DyBaCS) NSS in LTE-WiFi HetNets. The downlink performance of HetNet is evaluated in terms of average throughput per user and fairness among users. The effects of varying WiFi backhaul capacity form the focus for the evaluation. Results show that the DyBaCS scheme generally provides superior performance in terms of fairness and average throughput per user across the range of backhaul capacities considered.

Multi-tier, multi-hop network architecture with integrated WiMAX-WiFi radio interfaces offers an alternative means of delivering broadband wireless access services to mass users rapidly and cost-effectively. Besides providing wireless backhaul in places where wired backhaul infrastructure is not ready or too expensive, such architecture can also take advantage of the complementary features offered by the two diverse technologies. Such architecture however inspires a wide range of complex and interdependent design considerations covering network topology formation, number of radios per node, ratio between WiMAX and WiFi radio/node, number of hops at WiFi multi-hop tier and so on. This paper attempts to provide some insights on how different possible hybrid topology designs perform in terms of required node (WiFi access point/ WiMA Xbase station) density. In particular, we investigate how various designs scale towards two loading conditions namely the data rate per user and user density.

While there has been interest in modeling the group behavior of herds or flocks, much of this work has focused on simulating their collective spatial motion patterns, which have not accounted for individuality in the herd and instead assume a homogenized role for all members or subgroups of the herd. Animal behavior experts have noted that domestic animals exhibit behaviors that are indicative of social hierarchy: leader/follower type behaviors are present as well as dominance and subordination, aggression and rank order, and specific social affiliations may also exist. Both wild and domestic cattle are social species, and group behaviors are likely to be influenced by the expression of specific social interactions. In this paper, global positioning system coordinate fixes gathered from a herd of beef cows tracked in open fields over several days at a time are utilized to learn a model that focuses on the interactions within the herd as well as its overall movement. Using these data, in this way, explores the validity of existing group behavior models against actual herding behaviors. Domain knowledge, location geography, and human observations are utilized to explain the causes of these deviations from this idealized behavior.

Cognitive sensor network (CogSeNet) is an intelligent based wireless sensor network system which relies on cognitive processes to provide a dynamic capability in configuring wireless sensor network. CogSeNet is a network structure formed by sensor nodes equipped with cognitive modules allowing them to observe their operating environment and allowing a decision can be derived. A series of actions result so that the nodes can adapt and achieve certain goals by an overall policy. These goals can be as simple as to provide robust connectivity or as complex as negotiate additional resources from neighbouring network groups to forward mission-critical data. In this paper, the concept of cognitive sensor network is reviewed and a preliminary case study is illustrated.

In wireless sensor networks, end-to-end routing paths need to be established when nodes want to communicate with the desired destination. For nodes assumed to be static, many routing protocols such as Directed Diffusion have been proposed to meet this requirement efficiently. The performance of such routing protocols is relative to the given network connectivity. This paper addresses mobile sensor nodes taking into account the diversity of scattered node density and investigates how physical conditions impact on network connectivity which in turn influences routing performance. Three analysis metrics: path availability, path duration, and interavailable path time are proposed to quantify the impact of different physical conditions on network connectivity. Simulation results show that the network connectivity varies significantly as a function of different physical conditions.

TCP's downlink performance during FMIPv6-enabled IEEE802.11g handoff is examined. The use of a user-initiated Handoff Notification, sent prior to handoff, is proposed. Therefore, the correspondent node is aware of the handoff-induced disruption, hence avoiding dropping the congestion window size and triggering Fast Retransmission mechanisms. During handoff, it continues to send data packets which are buffered by the new access router. After handoff, the user notifies the handoff completion to the correspondent so that normal TCP operation resumes. The Handoff Notifications are implemented as TLVs within a TCP option. Simulation results show a network throughput increase of up to 35% over standard TCP.

Polarisation independent strained bulk RSOAs have been fabricated in the S-band for the first time. In system tests at 1.25 Gbit/s, the devices have been shown to operate over >60 nm with large return Path Loss Capabilities (PLC). The devices are capable of providing >25 dB PLC over a 60 nm span and hence the combination of two RSOAs provides PLC of >25 dB over a wavelength interval of >120 nm (1470 nm to 1590 nm). The temperature performance of the C/L band device has also been studied and a PLC of >20 dB has been shown at 60°C.

The Fast Handovers for Mobile IPv6 (FMIPv6) protocol was developed from the experience of MIPv6 and the facilities provided by link layer triggers, allowing for a proactive approach to handover that minimises packet exchange delay and packet loss. After handover, the mobile node may carry out Return Routability with the correspondent node(s) for route optimization. However, this method leaves scope to optimize handover delays derived from the signalling message exchange. This paper proposes an enhancement to FMIPv6, the Proactive Route Optimization for FMIPv6 (PRO-FMIPv6) protocol, which significantly reduces the signalling and thereby improves the overall performance of the handover process. Simulation results suggest a delay reduction up to 50% over other current proposals: the FMIPv6 protocol, Enhanced Route Optimization and Proactive Bindings for FMIPv6.

Multipath routing in mobile ad-hoc networks allows the establishment of multiple paths for routing between a source–destination pair. It exploits the resource redundancy and diversity in the underlying network to provide benefits such as fault tolerance, load balancing, bandwidth aggregation and the improvement in quality-of-service metrics such as delay. Previous work shows that on-demand multipath routing schemes achieve better performance under certain scenarios with respect to a number of key performance metrics when compared with traditional single-path routing mechanisms. A multipath routing scheme, referred to as shortest multipath source (SMS) routing based on dynamic source routing (DSR) is proposed here. The mechanism has two novel aspects compared with other on-demand multipath routing schemes: it achieves shorter multiple partial-disjoint paths and allows more rapid recovery from route breaks. The performance differentials are investigated using NS-2 under conditions of varying mobility, offered load and network size. Results reveal that SMS provides a better solution than existing source-based approaches in a truly mobile ad-hoc environment.

This paper proposes a novel multi-channel medium access control (MAC) that is based on CSMA/CA mechanism. The objective of this research is to evaluate the possibility of increasing network capacity and addressing collision problem of wireless sensor network comprising of low spec physical hardware. The proposed protocol can be implemented into wireless sensor network platform i.e. MICAz, Tmote-Sky without any additional hardware or firmware. Experiment results show that the proposed protocol can effectively improve the network performance compared with traditional single channel MAC.

In recent years, wireless sensor networks have been widely used in many types of monitoring applications. Conventionally, all sensor nodes are treated equally when they try to gain access to the air channel for packet transmission. For some applications such as in wild fire monitoring, sensor nodes

On-demand multipath routing in wireless ad-hoc networks can be effective in achieving load balancing over the network and in providing a degree of resilience to route failures. A shortest multipath source routing (SMS) protocol is proposed - a multipath extension to DSR - supporting multimedia applications. The protocol has two novel aspects compared to other on-demand multipath routing protocols: it achieves shorter multiple partial-disjoint paths and allows rapid recovery of route breaks. Simulation results show that SMS outperforms the competing protocols with respect to a number of key performance metrics.

A code acquisition technique based on active optical correlation detection is introduced for coherent optical pulse code-division multiple-access (CDMA) systems implemented through coherent correlation demodulation. Passive matched filter acquisition, commonplace in most radio CDMA systems, does not translate directly into the optical domain since synchronization between the incoming optical signal and a local optical code of the intended user at the receiver has to take place in several picosecond duration. Parallel and serial acquisition schemes under the same search algorithm are described and the effect of optical device noise, partial autocorrelation, and multiuser interference on acquisition performance is theoretically analyzed. Numerical results are given for Gold codes. In general, the degree of parallelism inherent in code acquisition techniques for radio systems allows a tradeoff between acquisition speed and hardware cost; however, in optical acquisition schemes, increasing the degree of parallelism with the concomitant hardware cost penalty does not necessarily reduce the time to acquisition. This is due to optical power budget limitations brought about by the need to split the optical signal, although optical amplifier technology can improve the performance of these parallel search schemes. The expressions for the partial correlation and multiuser interference derived in the paper can also be utilized for the analysis of other radio and optical acquisition schemes.

Passive optical matched filtered detection (MFD) has been employed in many proposed optical pulse code division multiple access (CDMA) system implementations, driving the development of unipolar pseudo-orthogonal codes (incoherent). Coherent optical pulse CDMA systems based on coherent correlation detection (CCD) through homodyne correlation detection (HCD) and self-HCD directly in the optical domain is proposed. With HCD, optical sequences from a pulsed laser, modulated by the data and encoded by an optical tapped delay-line encoder, are multiplexed in an optical fiber network. At the receiver, the optical code sequence of the intended user is locally generated. Through proper code and carrier phase synchronization, the local optical code is multiplied with the received signal chip by chip via an optical correlator consisting of a 3-dB coupler and a balanced detector. Thresholding is performed in the electrical domain after integration of the optical correlator output over one bit interval. The self HCD approach utilizes two bipolar code sequences multiplexed alternately in time, obviating the need for the generation of a local code at the receiver. The received signal is divided at the receiver, decoded by two encoders (matched to those at the transmitters), and correlated via the optical correlator. The removal for the need of the local oscillator avoids the stringent implementation issues with HCD such as optical frequency stability and carrier phase noise. Following a description of the two implementations, system performances are theoretically analyzed and a comparison of the several approaches given.

The code tracking performance of a noncoherent digital delay-locked loop (DLL) for use in coherent optical pulse CDMA systems is investigated. Tracking is fundamental to the overall performance of such systems since the incoming pulse code sequence and its local replica at the receiver have to maintain synchronism to within the chip duration that may be several pico-seconds for an optical implementation. After describing the tracking loop, the steady-state probability density function (PDF) of the tracking jitter is theoretically analyzed in the presence of multiuser interference and optical device noise, and numerical results of its variance are discussed.

This paper reviews the work carried out in the ACTS KEOPS (Keys to Optical Packet Switching) project, describing the results obtained to date. The main objective of the project is the definition, development, and assessment of optical packet switching and routing networks, capable of providing transparency to the payload bit rate, using optical packets of fixed duration and low bit rate headers in order to enable easier processing at the network/node interfaces. The feasibility of the KEOPS concept is assessed by modeling, laboratory experiments, and testbed implementation of optical packet switching nodes and network/node interfacing blocks, including a fully equipped demonstrator. The demonstration relies on advanced optoelectronic components, developed within the project, which are described.

The performance of decision-directed phase-locked loops (PLL) for use in direct-sequence code-division multiple-access (DS-CDMA) systems is investigated in the presence of phase noise, multiuser interference, and additive white Gaussian noise (AWGN). A unified and accurate analysis of the effect of these sources of noise on the PLL is carried out based on a nonlinear model (the Fokker-Planck method) since a linear analysis yields a large deviation between analytical results and actual performance at low signal-to-noise ratios (SNR). After describing the implementation of the PLL, the steady-state probability density function (PDF) of the phase estimator error in a first-order loop is derived. It is shown that a tradeoff exists between the effect due to the phase noise, the magnitude of the multiuser interference, and the AWGN as a function of loop bandwidth. The optimal loop bandwidth minimizing the impact of these sources of noise on the PLL and the requirements on the frequency uncertainty of the carrier source for a required accuracy of the phase estimator are detailed. Numerical results of the variance of the phase estimator error are discussed for Gold codes.