Abstract Logging has become a fundamental feature within the modern computer operating systems because of the fact that logging may be used through a variety of applications and fashion, such as system tuning, auditing, and intrusion detection systems. Syslog daemon is the logging implementation in Unix/Linux platforms, while Windows Event Log is the logging implementation in Microsoft Windows platforms. These logging implementations provide application program interfaces that, in turn, simplify logging functions from data collection to data storage. In this paper, we survey Unix, Linux, and Windows logging mechanisms and introduce their security issues. Copyright © 2016 John Wiley & Sons, Ltd.

We introduce TORP - TinyOS Opportunistic Routing Protocol for Wireless Sensor Networks (WSNs). The main motivation is that when a data packet is transmitted, the multiple relay nodes cooperatively select the one which is closest to the destination node to continue forwarding the data packet. TORP attempts to save energy versus traditional deterministic routing protocols by selecting the next forwarding node dynamically based on the results of the packet delivery to neighboring nodes. We present the details of TORP design to illustrate how to select the next forwarding nodes by avoiding duplicate packet transmissions. Utilizing TelosB motes, we compare the performance of TORP against the Collection Tree Protocol. We present the performance results and the in-depth analysis in terms of throughput, hops per transmission, and power consumption.

Energy efficiency is a major design goal for resource-constraint Wireless Sensor Networks (WSNs). In this paper, an energy efficient clustering approach is employed to meet this design goal. Moreover, given the fact that most of the existing clustering algorithms do not address the hot spot problem that arises in the vicinity of the base station, an unequal clustering mechanism is implemented among nodes at different distances from the base station. In this way, the hot spot problem is mitigated by evenly distributing energy consumption in WSNs. We further use simulation to carry out performance evaluation and present analysis.

Delay/disruption-tolerant networking (DTN) technology offers a new solution to highly stressed communications in space environments, especially those with long link delay and frequent link disruptions in deep-space missions. To date, little work has been done in evaluating the performance of the available “convergence layer” protocols of DTN, especially the Licklider Transmission Protocol (LTP), when they are applied to an interplanetary Internet (IPN). In this paper, we present an experimental evaluation of the Bundle Protocol (BP) running over various “convergence layer” protocols in a simulated cislunar communications environment characterized by varying degrees of signal propagation delay and data loss. We focus on the LTP convergence layer (LTPCL) adapter running on top of UDP/IP (i.e., BP/LTPCL/UDP/IP). The performance of BP/LTPCL/UDP/IP in realistic file transfers over a PC-based network test bed is compared to that of two other DTN protocol stack options, BP/TCPCL/TCP/IP and BP/UDPCL/UDP/IP. A statistical method of$t$-test is also used for analysis of the experimental results. The experiment results show that LTPCL has a significant performance advantage over Transmission Control Protocol convergence layer (TCPCL) for link delays longer than 4000 ms regardless of the bit error rate (BER). For a very lossy channel with a BER of around 10$^{-5}$, LTPCL has a significant goodput advantage over TCPCL at all the link delay levels studied, with an advantage of around 3000 B/s for delays longer than 1500 ms. LTPCL has a consistently significant goodput advantage over UDPCL, around 2500–3000 B/s, at all levels of link delays and BERs.

Abstract In this paper, we use a multiple recursive generator (MRG) to generate sequences of numbers with very long periods, i.e., pseudo‐random sequences. The MRG effectively constructs a block cipher which satisfies important quality requirements such as security, long period, randomness, and efficiency. We compare our approach with another lightweight block cipher based on a linear congruential generator (LCG) and analyze the efficiency in terms of the number of basic operations that are being performed. We also study the effects of using special classes of MRG which hold certain portability and efficiency properties, and analyze their advantages in this context. The proposed cipher is a lightweight cipher, which is very useful for resource limited resources such as sensor nodes in sensor networks, radio frequency identification (RFID) tags, etc. Copyright © 2010 John Wiley & Sons, Ltd.

In wireless sensor networks, some sensor nodes are put in sleep mode while other sensor nodes are in active mode for sensing and communication tasks in order to reduce energy consumption and extend network lifetime. This approach is a special case (k=2) of a randomized scheduling algorithm, in which k subsets of sensors work alternatively. In this paper, we first study the randomized scheduling algorithm via both analysis and simulations in terms of network coverage intensity, detection delay, and detection probability. We further study asymptotic coverage and other properties. Finally, we analyze a problem of maximizing network lifetime under quality of service constraints such as bounded detection delay, detection probability, and network coverage intensity. We prove that the optimal solution exists, and provide conditions of the existence of the optimal solutions.

Recent years have witnessed widespread use of mobile devices such as cell phones, laptops, and PDAs. In this paper, we propose an architecture called Mobi-Watchdog to detect mobility anomalies of mobile devices in wireless networks that track their locations regularly. Given the past mobility records of a mobile device, Mobi-Watchdog uses clustering techniques to identify the high-level structure of its mobility and then trains a HHMM (hierarchical hidden Markov model). Mobi-Watchdog raises an alert by requesting the device holder to reauthenticate himself when it finds an observed mobility trace significantly deviates from the trained model. The time complexity of the original generalized Baum-Welch algorithm, which is used for HHMM parameter reestimation, scales linearly with T3, where T is the number of locations in an observed sequence. Such a high computational cost can significantly impede deployment of Mobi-Watchdog in large-scale wireless networks in practice. To achieve better scalability, we modify this algorithm to make it scale linearly with T instead. Experimental results with realistic mobility traces demonstrate that Mobi-Watchdog detects mobility anomalies with high probability and reasonably low false alarm rates. We also show that Mobi-Watchdog has very low computational overhead, which makes it a viable candidate for mobility anomaly detection in large wireless networks.

In this paper, we propose to use a Multiple Recursive Generator (MRG) to generate sequences of numbers with very long periods, i.e., pseudo-random sequences. The MRG effectively constructs a block cipher which satisfies important quality requirements such as security, long period, randomness, and efficiency. The proposed cipher is a light weight cipher, which is very useful for resource limited resources such as sensor nodes in sensor networks, RFID tags, etc.

In this paper, based on our proposed mal-packet self-propagation models in wireless sensor networks, we use TOSSIM to study their propagation dynamics. We also present a preliminary study of the feasibility of mal-packet defense in sensor networks. Specifically, based on random graph theory and percolation theory, we propose the immunization of the highly-connected nodes in order to partition the network into as many separate pieces as possible, thus preventing or slowing down the mal-packet propagation. We study the percolation threshold of different network densities and the effectiveness of immunization in terms of connection ratio, remaining link ratio, and distribution of component sizes. We also present an analysis of the distribution of component sizes.

Worms have become an emergent threat towards information confidentiality, integrity, and service availability. While playing an important role for people to interact with surrounding environments, wireless sensor networks suffer from growing security concerns posed by worms because of sensor networks' low physical security, lack of resilience and robustness of underlying operating systems, and the ever increased complexity of deployed applications. In this paper, we study worm propagation in 802.15.4 based wireless sensor networks. First we present a baseline worm model in the context of wireless sensor networks. Then we describe a preliminary study of the impact of various protocol parameters and network scenarios on worm propagation dynamics. Our simulation study can provide insight into deriving a suitable model to characterize worm propagation in sensor networks.

Icebergs denote data items whose total frequency of occurrence is greater than a given threshold. When data items are scattered across a large number of network nodes, searching for global icebergs becomes a challenging task especially in bandwidth limited wireless networks. Existing solutions require a central server for ease of algorithm design and/or use random sampling to reduce bandwidth cost. In this paper, we present a new distributed algorithm to search for global icebergs without any centralized control or random sampling. A new type of Bloom filter, called linked counting Bloom filter, is designed to check the membership of a set and to store the accumulative frequency of data items. We evaluate the performance of our distributed algorithm with real data sets.

Wireless sensor networks are widely used for monitoring applications. The monitored area and the intrusion object are mostly three dimensional. In this paper, we are particularly interested in a sensor network used for monitoring a field to detect intrusion objects such as submarine in some sea area, or goods on shelves in warehouse. In these applications, sensors float in different depth of water or on different height of shelves in three dimensional situations. Since sensor nodes have limited energy supply, sensor networks may be configured to put some sensor nodes in sleep mode to save energy. This is a special case of a randomized scheduling algorithm. In this paper, we study the performance of several randomized scheduling algorithms in terms of intrusion coverage intensity when an intrusion object is considered to occupy a three dimensional space. We study the impact of the size of intrusion object on the sensor networkpsilas configuration.

Secure in-network aggregation in wireless sensor networks is a necessary and challenging task. In this paper, based on an extended Kalman filter which can facilitate us to set up a normal range of the neighbor's future transmitted aggregated values, we further apply an algorithm of combining cumulative summation and generalized likelihood ratio, which can utilize the cumulative sum of the deviations between measured values and estimated values, and derive a normal range which is more sensitive to attacks. We conduct experiments and simulations to evaluate our proposed local detection mechanisms under different aggregation functions.

Secure in-network aggregation in wireless sensor networks (WSNs) is a necessary and challenging task. In this paper, we address this research problem from an intrusion detection perspective. We propose that system monitoring modules, which provide one of the most important functionalities for WSNs, should be integrated with intrusion detection modules. Under this architecture, we first propose an extended Kalman filter (EKF) based mechanism to detect false injected data. Specifically, by monitoring behaviors of nodes' neighbors and using EKF to predict their future state (the real in-network aggregated value), we aim at setting up the normal range of neighbors' future transmitted aggregated values. We illustrate how we use EKF to create effective local detection mechanisms. Using different aggregation functions (average, sum, max, and min), we analyze how to obtain the threshold in theory. We then illustrate how our proposed local detection approach can work together with the system monitoring module to differentiate between malicious events and emergency events. We conduct simulations to evaluate performance of local detection mechanisms, including false positive rate and detection rate, under different aggregation functions.

Some work has been done in evaluating the performance of the rate-based SCPS-pure rate control and the store-and-forward CFDP protocol. In this paper, we present an experimental performance comparison between SCPS-pure rate control and the CFDP in the deferred mode over a simulated error-pone, long-delayed, point-to-point cislunar communication link. The focus of this work is to see which protocol is more effective in coping with a long cislunar-link delay, especially when hybridized with a high bit-error-rate (BER), and which one has throughput performance advantage over another. The comparison results show that SCPS-pure rate control has a better performance than CFDP-TCP and Linux-TCP over both symmetric and asymmetric cislunar communication channels with all BERs, and its throughput advantage is higher than 3000 bytes/s over both symmetric and asymmetric channels at all levels of BER The advantage is more significant over asymmetric cislunar channel with a high BER around 10-5. The rate-based SCPS-pure rate control is more effective in coping with a long cislunar link delay, especially when hybridized with a high BER. CFDP-TCP and Linux-TCP do not have significant performance difference in any cases.

In wireless sensor networks, in order to minimize energy consumption and extend network lifetime, some sensors are put in the sleep mode while the other sensor nodes are in the active mode for the sensing and communication tasks. In a randomized scheduling algorithm, a set of sensors work alternatively. In this paper, we provide an analytical model for the randomized scheduling algorithm, and derive detection delay and detection probability. Simulations are conducted to validate analytical results.

Mobility databases such as home location register and visitor location register are adopted to support mobility management in personal communications services networks. If a visitor location register fails or crashes, the subscribers' services will be seriously degraded due to the loss or corruption of location information. In this paper, we optimize utilization of demand re-registration messages for an adaptivep-persistent backoff database failure restoration scheme. An analytical model is developed and validated with simulations to obtain the optimal utilization using appropriate parameters so that the failed visitor location register is restored with the fastest speed. Some interesting aspects on the performance are studied and their deep insights are observed, such as effects of message sizes on choices of system parameters, effects of the inaccurate estimated number of stations, etc. One observation is that optimizations of utilization and successful transmission probability are two different goals, and a value to achieve the optimal successful transmission probability does not necessarily ensure optimal utilization. Furthermore, we also propose a scheme how to handle the problem with inaccurate (estimated) number of stations.

Location information is an important feature of users' mobility profile in cellular mobile networks. In this paper, continuing our existing work on constructing a mobility-based anomaly detection scheme, we further address a challenging problem - how to adaptively adjust the detection threshold of Intrusion Detection Systems (IDSs) in the context of cellular mobile networks. This is especially critical when we consider the different mobility patterns demonstrated by the mobile users. Utilizing a high order Markov model, we apply a weighted blending scheme to compute the entropy of our Exponentially Weighted Moving Average (EWMA) based mobility trie. This reflection of the uncertainness of the users' normal profile could help us adaptively adjust the detection threshold of our anomaly detection algorithm. Simulation results show that our proposed adaptive mechanisms can further reduce the false positive rate without decreasing the detection rate. Detailed analysis of the simulation results is also provided.

In this paper, we study various security aspects in the IEEE 802.15.3 wireless personal area networks (WPANs) with security analysis. We present these security features in a more natural and concise manner than the overly complicated standard.

Significant security concerns have come to the attention of both service providers and end users in cellular mobile systems. In these systems, misuse-based intrusion detection approaches are not effective since a potential wide variety of mobile users' behaviors are not taken into consideration. In this paper, by exploiting the location history traversed by mobile users, we propose an anomaly detection scheme to identify a group of especially harmful insider attackers - masqueraders. A realistic network model integrating geographic road-level granularities is proposed to effectively utilize users' location information. Based on this model, an Instance-Based Learning (IBL) technique is presented to construct mobile users' movement patterns. Simulation results demonstrate the effectiveness of the proposed scheme in terms of false positive rate and detection rate.

Radio frequency identification (RFID) systems have provided promising solutions to effective identification of a large number of tagged objects. However, RFID systems suffer from unauthorized tag reading and potential eavesdropping, which becomes a challenging issue because of the shared radio medium and limited size and cost considerations in RFID. In this paper, based on a linear congruential generator (LCG), we propose a lightweight block cipher that can meet the security and performance requirement of RFID systems. The trade-off between the security and overhead is discussed. Based on the proposed block cipher, we further propose a secure protocol for RFID that can provide data confidentiality and mutual authentication between the reader and the tag. We also provide performance analysis of our proposed block cipher.

In this paper, we present a detection technique based on Bayes decision rule to identify a group of especially harmful insider attackers - masqueraders. In this technique, we exploit the calling patterns demonstrated by mobile users in mobile cellular networks. Specifically, we formulate the intrusion detection problem as a multi-feature two-class pattern classification problem. Call duration time, call inactivity period and call destination are extracted to form a feature vector to reflect users' calling activities. A nonparametric technique, Parzen window approach with a Gaussian kernel, is used to estimate the smooth class-conditional probability density function. A Bayes decision rule is applied in order to achieve the minimum error rate. Using users' calling activities to demonstrate different behaviors, we carried out simulations to evaluate the proposed scheme in terms of false positive rate and detection rate.

Space communication protocol standards-transport protocol (SCPS-TP) is a set of extensions to transmission control protocol (TCP) aimed at improving TCP performance over space links. Some work has been done on performance evaluation of SCPS-TP based on its methodology, or by testing it as an isolated entity or over satellite that deploys performance enhancing proxies (PEPs). It is needed to have an experimental evaluation of SCPS-TP in coping with heavy noise using the complete SCPS protocol stack, especially by comparing it with state-of-the-art terrestrial TCP. This paper describes an experimental evaluation of SCPS-TP over congestion free, error-prone, high-latency, point-to-point space links, through file transfer experiment by running the actual SCPS protocol stacks via a testbed. The results reveal that SCPS-TP is more tolerant of heavy noise and has significant throughput advantages over TCP. The performance advantage of SCPS-TP in a lossy link is attributed to its novel SNACK scheme and the advantage in asymmetric channel is from the contributions of the channel rate control and acknowledgment reduction mechanisms.

The default acknowledgment (ACK) strategy of TCP easily overruns the constrained ACK channel capacity of the asymmetric network links. There is no effective ACK mechanism to address the asymmetric channel problem for space-Internet. A configurable ACK delay (CAD) mechanism has been developed to delay the ACKs for a configurable period of time to improve the TCP throughput performance over asymmetric space-Internet links. This paper introduces the CAD mechanism and presents a performance evaluation of it in an experimental manner. The experimental results show that the CAD mechanism has significant performance advantages in asymmetric space links with a channel ratio higher than 50/1. The higher the asymmetric channel ratio is, the more advantageous the CAD is over the default ACK strategy.

In this paper, we study a randomized scheduling algorithm, and analyze the problem of maximizing network lifetime under quality of service constraints such as bounded values of detection delay, detection probability, and network coverage intensity in wireless sensor networks. We show that the optimal solutions exist and provide the conditions of the existence of the optimal solutions.

Advanced encryption standard has been proposed and implemented for several years as a new cipher to replace data encryption standard. There are many researches and applications using this new cipher. However, there is a need to provide its performance analysis in scenarios of network applications. In this paper, we provide an overhead analysis of advanced encryption standard and its performance in wireless networks.

In this paper, based on a Linear Congruential Generator (LCG), we propose a new block cipher that is suitable for constructing a lightweight secure protocol for resource-constrained wireless sensor networks. Based on the Plumstead's inference algorithm, we are motivated to embed the generated pseudo-random numbers with sensor data messages in order to provide security. Specifically, the security of our proposed cipher is achieved by adding random noise and random permutations to the original data messages. The analysis of our cipher indicates that it can satisfy the security requirements of wireless sensor networks. We demonstrate that secure protocols based on our proposed cipher satisfy the baseline security requirements: data confidentiality, authenticity, and integrity with low overhead. Performance analysis demonstrates that our proposed block cipher is more lightweight than RC5 in terms of the number of basic operations.

In-network data aggregation in an essential operation to reduce energy consumption in large-scale wireless sensor networks. With data aggregation, however, raw data items are invisible to the base station and thus the authenticity of the aggregated data is hard to guarantee. A compromised sensor node may forge an aggregation value and mislead the base station into trusting a false reading. Due to the stringent constraints of energy supply and computing capability on sensor nodes, it is challenging to detect a compromised sensor node and keep it from cheating. This paper proposes a secure aggregation tree (SAT) to detect and prevent cheating. Our method is essentially different from other existing solutions in that it does not require any cryptographic operations when all sensor nodes work honestly. The detection of cheating is based on the topological constraints in the aggregation tree.

Sensor scheduling plays a critical role for energy efficiency of wireless sensor networks. Traditional methods for sensor scheduling use either sensing coverage or network connectivity, but rarely both. In this paper, we deal with a challenging task: without accurate location information, how do we schedule sensor nodes to save energy and meet both constraints of sensing coverage and network connectivity? Our approach utilizes an integrated method that provides statistical sensing coverage and guaranteed network connectivity. We use random scheduling for sensing coverage and then turn on extra sensor nodes, if necessary, for network connectivity. Our method is totally distributed, is able to dynamically adjust sensing coverage with guaranteed network connectivity, and is resilient to time asynchrony. We present analytical results to disclose the relationship among node density, scheduling parameters, coverage quality, detection probability, and detection delay. Analytical and simulation results demonstrate the effectiveness of our joint scheduling method

There is an urgent need for finding an optimal transmission mechanism in the space-based Internet. This paper presents an experimental analysis of the throughput performance and transmission behavior for the rate-based and window-based congestion control mechanisms in a simulated small-satellite environment using a PC-based test-bed. The experimental analysis revealed that the traffic shaping mechanism of a rate-based transmission is more effective than the bursting flow of a window-based mechanism in error-prone space environment with a long link delay. The window-based transmission mechanisms show performance degradation due to traffic bursts and frequent packet retransmissions caused by their ACK-clocked congestion control. Pure rate-control is preferable to other mechanisms in space when bandwidth reservation is available.

The IEEE 802.15.4 specification defines medium access control (MAC) layer and physical layer for wireless sensor networks. Furthermore, security mechanisms are also defined in the specification. This paper first surveys security services provided in the IEEE 802.15.4 wireless sensor networks. Then, some security enhancements are proposed to prevent same-nonce attack, denial-of-service attack, reply-protection attack, ACK attack, etc.

One of the main challenges in budding intrusion detection systems (IDSs) for mobile ad hoc networks (MANETs) is to integrate the mobility impact and adjust the behavior of IDSs dynamically. In this paper, focusing on the protection of MANET routing protocols, we first demonstrate that nodes' moving speed, a commonly used parameter in tuning IDS performance, is not an effective metric for the performance measurement of IDSs for MANETs. We then propose a new feature - the link change rate, which can not only act as a unified metric in measuring MANET IDS performance, but also be used to facilitate local MANET IDSs to select normal profiles adaptively. We utilize different mobility models to study the performance of our proposed adaptive mechanisms at different mobility levels. Simulation results show that our proposed adaptive mechanisms are effective and less dependent on mobility models. Detailed analysis of simulation results is also provided.

Intrusion detection systems (IDSs) for mobile ad hoc networks (MANETs) are necessary when we deploy MANETs in reality. In this paper, focusing on the protection of MANET routing protocols, we present a new intrusion detection agent model and utilize a Markov chain based anomaly detection algorithm to construct the local detection engine. The details of feature selection, data collection, data preprocess, Markov chain construction, classifier construction and parameter tuning are provided. Based on the routing disruption attack aimed at the dynamic source routing protocol (DSR), we study the performance of the algorithm at different mobility levels. Simulation results show that our algorithm can achieve low false positive ratio, high detection ratio, and small MTFA (mean time to the first alarm), especially when the mobility is low. Detailed analysis of simulation results is also presented.