This paper investigates side-channel vulnerabilities of a wireless communication application in vehicular environments (DSRC/WAVE) protocol implementation of a traffic intersection application. A prototype roadside unit (RSU) was implemented using real DSRC devices. The functionality of the WAVE short message (Wsm)-channel is extended to include an implementation of WAVE short message protocol (WSMP) for broadcasting GPS data and RSU instructions in vehicular communications. In the example used, DSRC is used to replace an intersection stoplight. Denial of service attacks are executed that leverage DSRC RSU timing and packet size side-channels to selectively disable the stoplight. Simulations are implemented to determine our ability to stealthily drop packets so as to force two vehicles to collide. Hidden Markov models (HMM) and Support Vector Machines (SVM) are constructed from sniffed side-channel information. We use inter-packet delay time and packet size side-channel information to design our attackes. In operational networks, packets should be encrypted in order to hide the contents of the packet payloads, but packet sizes and timing are not affected by encryption. HMMs were inferred using only side-channel information. The inferred HMMs track the protocol status over time. The SVM classifier was inferred using both side-channel data and packet payloads. At run-time, though, the SVM only had access to side-channel information. Simulation experiments were implemented to test HMM and SVM ability to identify packets used to signal vehicles to stop and yield right-of-way. Timing HMM side-channel attack caused collision with 2.5% false positive rate (FPR), while the packet size one resulted 9.5% FPR.

We proposed a Traffic Analysis Resistant Network (TARN) that randomizes IP addresses in a fashion similar to Frequency Hop Spread Spectrum (FHSS), allowing users to blend into background traffic. IP hopping alone is not enough. TARN may still be susceptible to side-channel analysis. To remove the vulnerabilities, we introduce a SDX-based solution. In this work, we describe the design and implementation of TARN and experimental environment used to test TARN.

Radiation source detection is an important problem in homeland security-related applications. Deploying a network of detectors is expected to provide improved detection due to the combined, albeit dispersed, capture area of multiple detectors. Recently, localization-based detection algorithms provided performance gains beyond the simple “aggregated” area as a result of localization being enabled by the networked detectors. We propose the following three localization-based detection approaches: 1) source-attractor radiation detection (SRD); 2) triangulation-based radiation source detection (TriRSD); and 3) the ratio of square distance-based radiation source detection (ROSD-RSD). We use canonical datasets from Domestic Nuclear Detection Office's intelligence radiation sensors systems tests to assess the performance of these methods. Extensive results illustrate that SRD outperforms TriRSD and ROSD-RSD, and other existing detection algorithms based on the sequential probability ratio test and maximum likelihood estimation in terms of both false alarm and detection rates.

Target detection is one fundamental problem in many sensor network-based applications, and is typically tackled in two separate stages for sensor deployment and data fusion. We propose an integrated solution, referred to as SSEM, which combines 2-level clustering-based sensor deployment and Source Strength Estimate Map-based data fusion for the detection of a single static or moving target. SSEM conducts the first level of clustering to determine a sensor deployment scheme and the second level of clustering to divide the deployed sensors into multiple subsets. For each sensor, the source strength is estimated at each grid point of the entire region based on a signal attenuation model, and for each subset of sensors, the target location is estimated using a strength distribution map-based statistical analysis method. A final detection decision is made by thresholding the clustering degree of the target location estimates computed by all subsets of sensors. Compared with traditional grid-based target detection methods, SSEM significantly reduces the computation complexity and improves the detection performance through an integrated optimization strategy. Extensive simulation results show the performance superiority of the proposed solution over several well-known methods for target detection.

A transformation is underway in electric power and energy systems (EPESs) to provide clean distributed energy for sustainable global economic growth. Internet of Things (IoT) is at the forefront of this transformation imparting capabilities, such as real-time monitoring, situational awareness and intelligence, control, and cyber security to transform the existing EPES into intelligent cyber-enabled EPES, which is more efficient, secure, reliable, resilient, and sustainable. Additionally, digitizing the electric power ecosystem using IoT improves asset visibility, optimal management of distributed generation, eliminates energy wastage, and create savings. IoT has a significant impact on EPESs and offers several opportunities for growth and development. There are several challenges with the deployment of IoT for EPESs. Viable solutions need to be developed to overcome these challenges to ensure continued growth of IoT for EPESs. The advancements in computational intelligence capabilities can evolve an intelligent IoT system by emulating biological nervous systems with cognitive computation, streaming and distributed analytics including at the edge and device levels. This review paper provides an assessment of the role, impact and challenges of IoT in transforming EPESs.

Multi-resolution grid computation is a technique used to speed up source localization with a Maximum Likelihood Estimation (MLE) algorithm. In the case where the source is located midway between grid points, the MLE algorithm may choose an incorrect location, causing following iterations of the search to close in on an area that does not contain the source. To address this issue, we propose a modification to multi-resolution MLE that expands the search area by a small percentage between two consecutive MLE iterations. At the cost of slightly more computation, this modification allows consecutive iterations to accurately locate the target over a larger portion of the field than a standard multi-resolution localization. The localization and computation performance of our approach is compared to both standard multi-resolution and single-resolution MLE algorithms. Tests are performed using seven data sets representing different scenarios of a single radiation source located within an indoor field of detectors. Results show that our method (i) significantly improves the localization accuracy in cases that caused initial grid selection errors in traditional MLE algorithms, (ii) does not have a negative impact on the localization accuracy in other cases, and (iii) requires a negligible increase in computation time relative to the increase in localization accuracy.

Botnets are groups of compromised computers that botmasters (botherders) use to launch attacks over the Internet. To avoid detection, botnets use DNS fast flux to change the mapping between IP addresses and domain names periodically. Domain generation algorithms (DGAs) are employed to generate a large number of domain names. Detection techniques have been proposed to identify malicious domain names generated by DGAs. Three metrics, Kullback-Leibler (KL) distance, Edit distance (ED), and Jaccard index (JI), are used to detect botnet domains with up to 100% detection rate and 2.5% false-positive rate. In this paper, we propose two DGAs that use hidden Markov models (HMMs) and probabilistic context-free grammars (PCFGs), respectively. Experiment results show that DGA detection metrics (KL, JI, and ED) and detection systems (BotDigger and Pleiades) have difficulty detecting domain names generated using the proposed approaches. Game theory is used to optimize strategies for both botmasters and security personnel. Results show that, to optimize DGA detection, security personnel should use the ED detection technique with probability 0.78 and JI detection with probability 0.22, and botmasters should choose the HMM-based DGA with probability 0.67 and PCFG-based DGA with probability 0.33.

Provenance systems are used to capture history metadata, applications include ownership attribution and determining the quality of a particular data set. Provenance systems are also used for debugging, process improvement, understanding data proof of ownership, certification of validity, etc. The provenance of data includes information about the processes and source data that leads to the current representation. In this paper we study the security risks provenance systems might be exposed to and recommend security solutions to better protect the provenance information.

Cryptocurrencies have emerged as important financial software systems. They rely on a secure distributed ledger data structure; mining is an integral part of such systems. Mining adds records of past transactions to the distributed ledger known as Blockchain, allowing users to reach secure, robust consensus for each transaction. Mining also introduces wealth in the form of new units of currency. Cryptocurrencies lack a central authority to mediate transactions because they were designed as peer-to-peer systems. They rely on miners to validate transactions. Cryptocurrencies require strong, secure mining algorithms. In this paper we survey and compare and contrast current mining techniques as used by major Cryptocurrencies. We evaluate the strengths, weaknesses, and possible threats to each mining strategy. Overall, a perspective on how Cryptocurrencies mine, where they have comparable performance and assurance, and where they have unique threats and strengths are outlined.

In this paper, we present a normalized statistical metric space for hidden Markov models (HMMs). HMMs are widely used to model real-world systems. Like graph matching, some previous approaches compare HMMs by evaluating the correspondence, or goodness of match, between every pair of states, concentrating on the structure of the models instead of the statistics of the process being observed. To remedy this, we present a new metric space that compares the statistics of HMMs within a given level of statistical significance. Compared with the Kullback-Leibler divergence, which is another widely used approach for measuring model similarity, our approach is a true metric, can always return an appropriate distance value, and provides a confidence measure on the metric value. Experimental results are given for a sample application, which quantify the similarity of HMMs of network traffic in the Tor anonymization system. This application is interesting since it considers models extracted from a system that is intentionally trying to obfuscate its internal workings. In the conclusion, we discuss applications in less-challenging domains, such as data mining.

Hidden Markov models (HMMs) are used to analyze real-world problems. We consider an approach that constructs minimum entropy HMMs directly from a sequence of observations. If an insufficient amount of observation data is used to generate the HMM, the model will not represent the underlying process. Current methods assume that observations completely represent the underlying process. It is often the case that the training data size is not large enough to adequately capture all statistical dependencies in the system. It is, therefore, important to know the statistical significance level for that the constructed model representing the underlying process, not only the training set. In this paper, we present a method to determine if the observation data and constructed model fully express the underlying process with a given level of statistical significance. We use the statistics of the process to calculate an upper bound on the number of samples required to guarantee that the model has a given level significance. We provide theoretical and experimental results that confirm the utility of this approach. The experiment is conducted on a real private Tor network.

Recent research has exposed timing side channel vulnerabilities in many security applications. Hidden Markov models (HMMs) have used timing data to extract passwords from cryptographically protected communications tunnels. We extend that work to show how HMM models of protocols can be extracted directly from observations of protocol timing artifacts with no a priori knowledge. Since our approach uses symbolic reasoning, an important question is how to best translate continuous data observations to symbolic data. This translation is problematic when observation variance makes continuous to symbolic translation unreliable. We examine this problem and show that the HMMs we infer compensate automatically for significant observation jitter and symbol misclassification. Experimental verification is presented.

Game theory typically considers two types of imperfect information when analyzing conflicts: 1) chance moves and 2) information sets. This correspondence paper considers games where players compete on many fronts without having sufficient bandwidth to collect the game trees describing all the conflicts. The player therefore needs to prioritize between subgames without having detailed information about the subgames. We address this problem by using two combinatorial game theory tools: 1) surreal numbers and 2) thermographs. We consider the global conflict as a sum-of-games problem, which is known to be intractable (PSPACE complete). Known combinatorial game theory heuristics can analyze surreal-number encodings of games using thermographs to find solutions that are within a known constant offset of the optimal solution. To apply the combinatorial game theory to this domain, we first integrate chance moves into surreal-number encodings of games by showing that the expected values of surreal numbers are surreal numbers. We then show that, of the three commonly used sum-of-games heuristics, only hotstrat is applicable to this domain. Simulations compare solutions found using hotstrat to solution approaches used by other researchers on a similar problem (maximin, maximax, and mean). The simulations show that the hotstrat solutions dominate the existing approaches.

In this paper, we consider how we can detect patterns in data streams that are serial Markovian, where target behaviors are Markovian, but targets may switch from one Markovian behavior to another. We want to reliably and promptly detect behavior changes. Traditional Markov-model-based pattern detection approaches, such as hidden Markov models, use maximum likelihood techniques over the entire data stream to detect behaviors. To detect changes between behaviors, we use statistical pattern matching calculations performed on a sliding window of data samples. If the window size is very small, the system will suffer from excessive false-positive rates. If the window is very large, change-point detection is delayed. This paper finds both necessary and sufficient bounds on the window size. We present two methods of calculating window sizes based on the state and transition structures of the Markov models. Two application examples are presented to verify our results. Our first example problem uses simulations to illustrate the utility of the proposed approaches. The second example uses models extracted from a database of consumer purchases to illustrate their use in a real application.

We propose a binary decision fusion rule that reaches a global decision on the presence of a target by integrating local decisions made by multiple sensors. Without requiring a priori probability of target presence, the fusion threshold bounds derived using Chebyshev's inequality ensure a higher hit rate and lower false alarm rate compared to the weighted averages of individual sensors. The Monte Carlo-based simulation results show that the proposed approach significantly improves target detection performance, and can also be used to guide the actual threshold selection in practical sensor network implementation under certain error rate constraints.

In this paper, we consider how to search for a mobile evader in a large heterogeneous region when sensors are used for detection. Sensors are modeled using probability of detection. Due to environmental effects, this probability will not be constant over the entire region. We map this problem to a graph-search problem, and even though deterministic graph search is NP-complete, we derive a tractable optimal probabilistic search strategy. We do this by defining the problem as a dynamic game played on a Markov chain. We prove that this strategy is optimal in the sense of Nash. Simulations of an example problem illustrate our approach and verify our claims.

Markov models are commonly used to analyze real-world problems. Their combination of discrete states and stochastic transitions is suited to applications with deterministic and stochastic components. Hidden Markov models (HMMs) are a class of Markov models commonly used in pattern recognition. Currently, HMMs recognize patterns using a maximum-likelihood approach. One major drawback with this approach is that data observations are mapped to HMMs without considering the number of data samples available. Another problem is that this approach is only useful for choosing between HMMs. It does not provide a criterion for determining whether or not a given HMM adequately matches the data stream. In this paper, we recognize complex behaviors using HMMs and confidence intervals. The certainty of a data match increases with the number of data samples considered. Receiver operating characteristic curves are used to find the optimal threshold for either accepting or rejecting an HMM description. We present one example using a family of HMMs to show the utility of the proposed approach. A second example using models extracted from a database of consumer purchases provides additional evidence that this approach can perform better than existing techniques.

Two-player pursuit-evasion games in the literature typically either assume both players have perfect knowledge of the opponent's positions or use primitive sensing models. This unrealistically skews the problem in favor of the pursuer who needs only maintain a faster velocity at all turning radii. In real life, an evader usually escapes when the pursuer no longer knows the evader's position. In our previous work, we modeled pursuit evasion without perfect information as a two-player bimatrix game by using a realistic sensor model and information theory to compute game-theoretic payoff matrices. That game has a saddle point when the evader uses strategies that exploit sensor limitations, whereas the pursuer relies on strategies that ignore the sensing limitations. In this paper, we consider, for the first time, the effect of many types of electronic countermeasures (ECM) on pursuit-evasion games. The evader's decision to initiate its ECM is modeled as a function of the distance between the players. Simulations show how to find optimal strategies for ECM use when initial conditions are known. We also discuss the effectiveness of different ECM technologies in pursuit-evasion games.

Random key predistribution security schemes are well suited for use in sensor networks due to their low overhead. However, the security of a network using predistributed keys can be compromised by cloning attacks. In this attack, an adversary breaks into a sensor node, reprograms it, and inserts several copies of the node back into the sensor network. Cloning gives the adversary an easy way to build an army of malicious nodes that can cripple the sensor network. In this paper, we propose an algorithm that a sensor network can use to detect the presence of clones. Keys that are present on the cloned nodes are detected by looking at how often they are used to authenticate nodes in the network. Simulations verify that the proposed method accurately detects the presence of clones in the system and supports their removal. We quantify the extent of false positives and false negatives in the clone detection process.

Researchers use random graph models to analyze complex networks that have no centralized control such as the Internet, peer-to-peer systems, and mobile ad hoc networks. These models explain phenomena like phase changes, clustering, and scaling. It is necessary to understand these phenomena when designing systems where exact node configurations cannot be known in advance. This paper presents a method for analyzing random graph models that combine discrete mathematics and probability theory. A graph connectivity matrix is constructed where each matrix element is the Bernoulli probability that an edge exists between two given nodes. We show how to construct these matrices for many graph classes, and use linear algebra to analyze the connectivity matrix. We present an application that uses this approach to analyze network cluster self-organization for sensor network security. We conclude by discussing the use of these concepts in mobile systems design.

This paper describes how pedigree is used to support and enhance situation and threat assessment. It is based on the findings of the technology group of the Data Fusion Levels Two and Three Workshop sponsored by the Office of Naval Research held in Arlington, VA from 15-18 Nov. 2005. It identifies areas that need improvement in situation assessment and threat assessment, such as interoperability, automation, pedigree management, system usability, reliability, and uncertainty. The concept of pedigree must include "standard" metadata, lineage, plus a computational model of the quality of the information. The system must automatically propagate changes and update to derived products when source information or source-pedigree information changes. Several other processes must be automated: generate pedigree, identify and auto fill gaps, fuse pedigree, update pedigree, display of information quality and confidence. The paper concludes with suggestions for future research and development.

This paper considers the spread of worms in computer networks using insights from epidemiology and percolation theory. We provide three new results. The first result refines previous work showing that epidemics occur in scale-free graphs more easily because of their structure. We argue, using recent results from random graph theory that for scaling factors between 0 and approximately 3.4875, any computer worm infection of a scale-free network will become an epidemic. Our second result uses this insight to provide a mathematical explanation for the empirical results of Chen and Carley, who demonstrate that the Countermeasure Competing strategy can be more effective for immunizing networks to viruses or worms than traditional approaches. Our third result uses random graph theory to contradict the current supposition that, for very large networks, monocultures are necessarily more susceptible than diverse networks to worm infections.

While the machine neutral Java bytecodes are attractive for code distribution in the highly heterogeneous embedded domain, the well-documented and standardized features also make it difficult to protect these codes. In fact, there are several tools to reverse engineer Java bytecodes. The focus of this work is the design of a substitution-based bytecode obfuscation approach that prevents code from being executed on unauthorized devices. Furthermore, we also improve the resilience of this substitution-based approach to frequency-based attacks. Using various Java class files, we show that our approach is 2.5 to 3 times less computationally intensive as compared to a traditional encryption based approach. Our experiments reveal that the protected class files could not execute on unauthorized clients.

This paper presents distributed adaptation techniques for use in wireless sensor networks. As an example application, we consider data routing by a sensor network in an urban terrain. The adaptation methods are based on ideas from physics, biology, and chemistry. All approaches are emergent behaviors in that: (i) perform global adaptation using only locally available information, (ii) have strong stochastic components, and (iii) use both positive and negative feedback to steer themselves. We analyze the approaches' ability to adapt, robustness to internal errors, land power consumption. Comparisons to standard wireless communications techniques are given.

The severe power, time and processing constraints on ad hoc wireless sensor networks for area surveillance require in-situ adaptations to conserve resources and optimize performance. In particular, it may be necessary to make dynamic tradeoffs between centralized processing algorithms, like beamforming, and knowledge based distributed processing algorithms like dynamic space-time clustering (DSTC) that rely on local processing of raw sensor data. Beamforming methods can achieve high levels of accuracy in estimating direction of arrival with a sound wave even when the source is in the far field. Hence accurate localization can be achieved with a relatively sparse sensor network. However, beamforming has severe limitations when the number of nodes increases. It requires orders of magnitude higher energy for transporting the entire time series over the network. DSTC methods, on the other hand, work well when the number of nodes is large because clusters can be formed within a smaller space-time window. This work examines the operational domains of the two centralized and distributed algorithms by analyzing sources of error, dependence on sensor density, sensor geometries, energy usage, control logic for data processing and the effects of network topology on the two algorithms. Based on this analysis, we develop hybrid algorithms that take advantage of the operational characteristics of each one in designing a high performance sensor network.

The highly distributed infrastructure provided by sensor networks supports fundamentally new ways of designing surveillance systems. In this paper, we discuss sensor networks for target classification and tracking. Our formulation is anchored on location-aware data routing to conserve system resources, such as energy and bandwidth. Distributed classification algorithms exploit signals from multiple nodes in several modalities and rely on prior statistical information about target classes. Associating data to tracks becomes simpler in a distributed environment, at the cost of global consistency. It may be possible to filter clutter from the system by embedding higher level reasoning in the distributed system. Results and insights from a recent field test at 29 Palms Marine Training Center are provided to highlight challenges in sensor networks.

The image registration problem of finding a mapping that matches data from multiple cameras is computationally intensive. Current solutions to this problem tolerate Gaussian noise, but are unable to perform the underlying global optimization computation in real time. This paper expands these approaches to other noise models and proposes the Terminal Repeller Unconstrained Subenergy Tunneling (TRUST) method, originally introduced by B.C. Cetin et al. (1993), as an appropriate global optimization method for image registration. TRUST avoids local minima entrapment, without resorting to exhaustive search by using subenergy-tunneling and terminal repellers. The TRUST method applied to the registration problem shows good convergence results to the global minimum. Experimental results show TRUST to be more computationally efficient than either tabu search or genetic algorithms.

The Internet supports migration of code from node to node. A number of paradigms exist for distributed computing and mobile code, including client/server, remote evaluation, code-on-demand, and mobile agents. We find them overly-restrictive views of reality. We propose a model that can express previous paradigms as special cases. We derive a model using cellular automata (CA) abstractions to study relations between local node behavior and global system behavior. Example mobile code systems are provided and existing paradigms are expressed in terms of the model. These examples include network attacks such as viruses, worms, and distributed denial of service (DDoS). A distributed system simulation tool based on the model is described. Simulation results provide insights gained from this work.