Today, wireless mesh networks (WMNs) are deployed globally to support various applications, such as industrial automation, military operations, and smart energy. Significant efforts have been made in the literature to facilitate their deployments and optimize their performance. However, configuring a WMN well is challenging because the network configuration is a complex process, which involves theoretical computation, simulation, and field testing, among other tasks. Our study shows that the models for network configuration prediction learned from simulations may not work well in physical networks because of the simulation-to-reality gap. In this paper, we employ deep learning-based domain adaptation to close the gap and leverage a teacher-student neural network and a physical sampling method to transfer the network configuration knowledge learned from a simulated network to its corresponding physical network. Experimental results show that our method effectively closes the gap and increases the accuracy of predicting a good network configuration that allows the network to meet performance requirements from 30.10% to 70.24% by learning robust machine learning models from a large amount of inexpensive simulation data and a few costly field testing measurements.

As a leading industrial wireless standard, WirelessHART has been widely implemented to build wireless sensor-actuator networks (WSANs) in industrial facilities, such as oil refineries, chemical plants, and factories. For instance, 54,835 WSANs that implement the WirelessHART standard have been deployed globally by Emerson process management, a WirelessHART network supplier, to support process automation. While the existing research to improve industrial WSANs focuses mainly on enhancing network performance, the security aspects have not been given enough attention. We have identified a new threat to WirelessHART networks, namely smart selective jamming attacks, where the attacker first cracks the channel usage, routes, and parameter configuration of the victim network and then jams the transmissions of interest on their specific communication channels in their specific time slots, which makes the attacks energy efficient and hardly detectable. In this paper, we present this severe, stealthy threat by demonstrating the step-by-step attack process on a 50-node network that runs a publicly accessible WirelessHART implementation. Experimental results show that the smart selective jamming attacks significantly reduce the network reliability without triggering network updates.

Today more and more bus companies are providing real-time bus locations to their riders to improve passenger experience and increase ridership. Most of the existing bus localization systems rely on the Global Navigation Satellite System (GNSS), such as the Global Positioning System (GPS). However, it is costly to install GNSS receivers and retrofit existing buses to power them, which prevents them to be adopted by those bus operators with tight budgets. There has been increasing interest in developing GPS-free localization schemes that leverage the wireless signals transmitted by the buses to localize them. Such schemes often require the received signal strength (RSS) measured at multiple base stations and therefore are not applicable to a small transportation service with a single base station, such as the shuttle service for a university campus. This paper presents a novel approach that leverages the LoRa link characteristics measured by a single base station and deep learning to localize a campus shuttle when it approaches a stop. Experimental results show that our solution provides a detection accuracy of no less than 92.07% and significantly outperforms all baselines without requiring new hardware and introducing additional communication overhead.

IEEE 802.15.4-based wireless sensor-actuator networks have been widely adopted by process industries in recent years because of their significant role in improving industrial efficiency and reducing operating costs. Today, industrial wireless sensor-actuator networks are becoming tremendously larger and more complex than before. However, a large, complex mesh network is hard to manage and inelastic to change once the network is deployed. In addition, flooding-based time synchronization and information dissemination introduce significant communication overhead to the network. More importantly, the deliveries of urgent and critical information such as emergency alarms suffer long delays, because those messages must go through the hop-by-hop transport. A promising solution to overcome those limitations is to enable the direct messaging from a long-range radio to an IEEE 802.15.4 radio. Then messages can be delivered to all field devices in a single-hop fashion. This article presents our study on enabling the cross-technology communication from LoRa to ZigBee using the energy emission of the LoRa radio as the carrier to deliver information. Experimental results show that our cross-technology communication approach provides reliable communication from LoRa to ZigBee with the throughput of up to 576.80 bps and the bit error rate of up to 5.23% in the 2.4 GHz band.

Low-power wireless mesh networks (LPWMNs) have been widely used in wireless monitoring and control applications. Although LPWMNs work satisfactorily most of the time thanks to decades of research, they are often complex, inelastic to change, and difficult to manage once the networks are deployed. Moreover, the deliveries of control commands, especially those carrying urgent information such as emergency alarms, suffer long delay, since the messages must go through the hop-by-hop transport. Recent studies show that adding low-power wide-area network radios such as LoRa onto the LPWMN devices (e.g., ZigBee) effectively overcomes the limitation. However, users have shown a marked reluctance to embrace the new heterogeneous communication approach because of the cost of hardware modification. In this article, we introduce LoRaBee, a novel LoRa to ZigBee cross-technology communication (CTC) approach, which leverages the energy emission in the Sub-1 GHz bands as the carrier to deliver information. Although LoRa and ZigBee adopt distinct modulation techniques, LoRaBee sends information from LoRa to ZigBee by putting specific bytes in the payload of legitimate LoRa packets. The bytes are selected such that the corresponding LoRa chirps can be recognized by the ZigBee devices through sampling the received signal strength. Experimental results show that our LoRaBee provides reliable CTC communication from LoRa to ZigBee with the throughput of up to 281.61 bps in the Sub-1 GHz bands.

As a leading industrial wireless standard, WirelessHART has been widely implemented to build wireless sensor-actuator networks (WSANs) in industrial facilities, such as oil refineries, chemical plants, and factories. For instance, 54,835 WSANs that implement the WirelessHART standard have been deployed globally by Emerson process management, a WirelessHART network supplier, to support process automation. While the existing research to improve industrial WSANs focuses mainly on enhancing network performance, the security aspects have not been given enough attention. We have identified a new threat to WirelessHART networks, namely smart selective jamming attacks, where the attacker first cracks the channel usage, routes, and parameter configuration of the victim network and then jams the transmissions of interest on their specific communication channels in their specific time slots, which makes the attacks energy efficient and hardly detectable. In this paper, we present this severe, stealthy threat by demonstrating the step-by-step attack process on a 50-node network that runs a publicly accessible WirelessHART implementation. Experimental results show that the smart selective jamming attacks significantly reduce the network reliability without triggering network updates.

Traditionally, satellite and cellular technologies have been used in establishing the long-distance links that collect real-time data from running vehicles to the base station. However, the systems that implement those technologies are often too costly for use in small communities, such as monitoring shuttles that circle a university campus. Recently, LoRa has been used as a low-cost alternative that provides the capability of long-range data collection for low data rate applications. In this paper, we present a low-cost LoRa-based wireless network that collects real-time data from six shuttles circling our university campus and has operated in the real world for more than a year. The selection of the LoRa Spreading Factor (SF) poses a significant challenge because of its effects on two conflicting network performance metrics. A larger SF provides higher network reliability at the cost of lower throughput. To address this challenge, we develop a runtime SF control solution that employs the K-Nearest Neighbors (KNN) algorithm to adapt the SF configuration based on the current link condition. Experimental results show that our approach significantly increases the data collection throughput while meeting the application reliability requirement compared to the state of the art.

Industrial networks typically connect hundreds or thousands of sensors and actuators in industrial facilities, such as manufacturing plants, steel mills, and oil refineries. Although the typical industrial Internet of Things (IoT) applications operate at low data rates, they pose unique challenges because of their critical demands for reliable and real-time communication in harsh industrial environments. IEEE 802.15.4-based wireless sensor-actuator networks (WSANs) technology is appealing for use to construct industrial networks because it does not require wired infrastructure and can be manufactured inexpensively. Battery-powered wireless modules easily and inexpensively retrofit existing sensors and actuators in industrial facilities without running cables for communication and power. To address the stringent real-time and reliability requirements, WSANs made a set of unique design choices such as employing the Time-Synchronized Channel Hopping (TSCH) technology. These designs distinguish WSANs from traditional wireless sensor networks (WSNs) that require only best effort services. The function-based channel hopping used in TSCH simplifies the network operations at the cost of security. Our study shows that an attacker can reverse engineer the channel hopping sequences and graph routes by silently observing the transmission activities and put the network in danger of selective jamming attacks. The cracked knowledge on the channel hopping sequences and graph routes is an important prerequisite for launching selective jamming attacks to TSCH networks. To our knowledge, this article represents the first systematic study that investigates the security vulnerability of TSCH channel hopping and graph routing under realistic settings. In this article, we demonstrate the cracking process, present two case studies using publicly accessible implementations (developed for Orchestra and WirelessHART), and provide a set of insights.

Wireless sensor-actuator network (WSAN) technology is gaining rapid adoption by industrial Internet of Things applications in recent years. A WSAN typically connects sensors, actuators, and controllers in industrial facilities, such as steel mills, oil refineries, chemical plants, and infrastructures implementing complex monitoring and control processes. IEEE 802.15.4–based WSANs operate at low power and can be manufactured inexpensively, which makes them ideal where battery lifetime and costs are important. Recent studies have shown that the selection of network parameters has a significant effect on network performance. However, the current practice of parameter selection is largely based on experience and rules of thumb involving a coarse-grained analysis of expected network load and dynamics or measurements during a few field trials, resulting in non-optimal decisions in many cases. In this work, we develop P-SAFE (Parameter Selection and Adaptation FramEwork), which optimally selects the network parameters based on the application quality-of-service demands and adapts the parameter configuration at runtime to consistently satisfy the dynamic requirements. We implement P-SAFE and evaluate it on three physical testbeds. Experimental results show that our solution can significantly better meet the application quality-of-service demand compared to the state of the art.

As a key response to the Fourth Industrial Revolution, IEEE 802.15.4-based wireless sensor-actuator network (WSAN) technology is gaining rapid adoption in process industries because of its advantage in lowering deployment and maintenance cost and effort in industrial facilities, such as steel mills, oil refineries, and chemical plants. Although most industrial applications operate at low data rates, they often require their underlying networks to provide real-time and reliable data deliveries in harsh industrial environments. IEEE 802.15.4-based WSANs are appealing for use in industrial networks, since they operate at low-power and can be manufactured inexpensively. To meet the stringent real-time and reliability requirements, WSANs, such as WirelessHART networks, make a set of unique design choices such as employing the Time Slotted Channel Hopping (TSCH) and graph routing that distinguish themselves from traditional wireless sensor networks designed for best effort services. However, the security aspects of this increasingly important class of wireless networks are insufficiently investigated in the literature. Our recent work shows that an attacker can reverse engineer the TSCH channel hopping sequences by silently observing the channel activities and put the network in danger of selective jamming attacks, where the attacker jams only the transmission of interest on its specific communication channel in its specific time slot, which makes the attacks energy-efficient and hardly detectable. A critical step for an attacker to launch selective jamming is to identify the routing paths. Our study shows that an attacker can crack the routes used by the graph routing in WirelessHART networks by silently observing the packet transmission activities. In this poster proposal, we present a vulnerability analysis and our case study performed on a 50-device physical testbed using a publicly accessible WirelessHART implementation.

Low-power wireless mesh networks (LPWMNs) have been widely used in wireless monitoring and control applications. Although LPWMNs work satisfactorily most of the time thanks to decades of research, they are often complex, inelastic to change, and difficult to manage once the networks are deployed. Moreover, the deliveries of control commands, especially those carrying urgent information such as emergency alarms, suffer long delay, since the messages must go through the hop-by-hop transport. Recent studies show that adding low-power wide-area network (LPWAN) radios such as LoRa onto the LPWMN devices (e.g., ZigBee) effectively overcomes the limitation. However, users have shown a marked reluctance to embrace the new heterogeneous communication approach because of the cost of hardware modification. In this paper, we introduce LoRaBee, a novel LoRa to ZigBee cross-technology communication (CTC) approach, which leverages the energy emission in the Sub-1 GHz bands as the carrier to deliver information. Although LoRa and ZigBee adopt distinct modulation techniques, LoRaBee sends information from LoRa to ZigBee by putting specific bytes in the payload of legitimate LoRa packets. The bytes are selected such that the corresponding LoRa chirps can be recognized by the ZigBee devices through sampling the received signal strength (RSS). Experimental results show that our LoRaBee provides reliable CTC communication from LoRa to ZigBee with the throughput of up to 281.61bps in the Sub-1 GHz bands.

Wireless Sensor-Actuator Network (WSAN) technology is gaining rapid adoption in process industries in recent years. A WSAN typically connects sensors, actuators, and controllers in industrial facilities, such as steel mills, oil refineries, chemical plants, and infrastructures implementing complex monitoring and control processes. IEEE 802.15.4 based WSANs operate at low-power and can be manufactured inexpensively, which make them ideal where battery lifetime and costs are important. Recent studies have shown that the selection of network parameters has a significant effect on the network performance. However, the current practice of parameter selection is largely based on experience and rules of thumb involving a coarse-grained analysis of expected network load and dynamics or measurements during a few field trials, resulting in non-optimal decisions in many cases. In this work, we develop the Parameter Selection and Adaptation FramEwork (P-SAFE) that optimally configures the network parameters based on the application Quality of Service (QoS) demand and adapts the configuration at runtime to consistently satisfy the dynamic requirements. We implement P-SAFE and evaluate it on three physical testbeds. Experimental results show our solution can significantly better meet the application QoS demand compared to the state of the art.

Wireless sensor-actuator networks (WSANs) technology is appealing for use in the industrial Internet of Things (IoT) applications because it does not require wired infrastructure. Battery-powered wireless modules easily and inexpensively retrofit existing sensors and actuators in the industrial facilities without running cabling for communication and power. The IEEE 802.15.4-based WSANs operate at low-power and can be manufactured inexpensively, which makes them ideal where battery lifetime and costs are important. Almost, a decade of realworld deployments of WirelessHART standard has demonstrated the feasibility of using its core techniques including reliable graph routing and time slotted channel hopping (TSCH) to achieve reliable low-power wireless communication in the industrial facilities. Today, we are facing the fourth Industrial Revolution as proclaimed by political statements related to the Industry 4.0 Initiative of the German Government. There exists an emerging demand for deploying a large number of field devices in an industrial facility and connecting them through the WSAN. However, a major limitation of current WSAN standards is their limited scalability due to their centralized routing and scheduling that enhance the predictability and visibility of network operations at the cost of scalability. This paper decentralizes the network management in WirelessHART and presents the first Distributed Graph routing and autonomous Scheduling (DiGS) solution that allows the field devices to compute their own graph routes and transmission schedules. The experimental results from two physical testbeds and a simulation study shows our approaches can significantly improve the network reliability, latency, and energy efficiency under dynamics.

Wireless Sensor-Actuator Networks (WSANs) technology is appealing for use in industrial IoT applications because it does not require wired infrastructure. Battery-powered wireless modules easily and inexpensively retrofit existing sensors and actuators in industrial facilities without running cabling for communication and power. IEEE 802.15.4 based WSANs operate at low-power and can be manufactured inexpensively, which makes them ideal where battery lifetime and costs are important. Almost a decade of real-world deployments of WirelessHART standard has demonstrated the feasibility of using its core techniques including reliable graph routing and Time Slotted Channel Hopping (TSCH) to achieve reliable low-power wireless communication in industrial facilities. Today we are facing the 4th Industrial Revolution as proclaimed by political statements related to the Industry 4.0 Initiative of the German Government. There exists an emerging demand for deploying a large number of field devices in an industrial facility and connecting them through a WSAN. However, a major limitation of current WSAN standards is their limited scalability due to their centralized routing and scheduling that enhance the predictability and visibility of network operations at the cost of scalability. This paper decentralizes the network management in WirelessHART and presents the first Distributed Graph routing and autonomous Scheduling (DiGS) solution that allows the field devices to compute their own graph routes and transmission schedules. Experimental results from two physical testbeds and a simulation study show our approaches can significantly improve the network reliability, latency, and energy efficiency under dynamics.