Existing acoustic indoor location sensing systems are limited by the need for extensive data collection and model retraining in unseen environments. This paper introduces ZA-SLAM, a novel zero-shot acoustic Simultaneous Localization and Mapping (SLAM) system that can be deployed in unseen environments without model retraining. Our core idea is to train an acoustic encoder that inherits the generalization capabilities of pre-trained Vision-Language Models (VLMs), which show superiority in tasks like zero-shot visual SLAM. To achieve this goal, we perform Acoustic-Visual Feature Alignment to enable the acoustic encoder to generate features aligned with visual features from VLMs. To select high-quality images for effective alignment, we design a Semantic-Guided Image Selection that filters out low-quality collected images caused by factors like abrupt view changes, occlusions, and uninformative views. Furthermore, we address the challenge of false positive loop closures in structurally similar locations with the Learning-Based Trajectory Reachability Matching that validates loop closures leveraging IMU trajectory features. Extensive real-world experiments demonstrate that our system achieves comparable SLAM performance to retraining-based acoustic SLAM, and much improved performance compared to existing zero-shot Wi-Fi and geomagnetic SLAM systems. Our system achieves a mean mapping error of 0.56 m and a localization error of 0.78 m across multiple unseen environments.

The smart grid is a critical infrastructure that must function reliably in a geographically decentralized structure. However, this structure renders the smart grid vulnerable to stealthy cyberattacks, and data silos further limit the sharing of datasets needed to train an effective attack-detection model. Moreover, most existing methods rely on the availability of enormous amounts of labeled data, which is scarce due to the need for domain knowledge. To address these issues, we propose FedCLD, a federated contrastive learning approach for detecting stealthy attacks using unlabeled data. FedCLD leverages Bootstrap Your Own Latent (BYOL), a contrastive learning model, to enhance its ability to learn robust representations from unlabeled data. With the federated learning paradigm, FedCLD enables local centers in different areas to collaboratively train local models without sharing raw datasets. Although the global representation is enhanced, the regional characteristics should be preserved. Therefore, a strategic local update scheme based on the exponential moving average is proposed. Furthermore, we theoretically prove the convergence of FedCLD with this modified update strategy. Experiments are conducted in the industry-level PowerWorld simulator to evaluate the performance of FedCLD.

The development of the Open RAN (O-RAN) framework helps enable network slicing through its virtualization, interoperability, and flexibility. To improve spectral efficiency and better meet users’ dynamic and heterogeneous service demands, O-RAN’s flexibility further presents an opportunity for resource reselling of unused physical resource blocks (PRBs) across users. In this work, we propose a novel game-based user-to-user PRB reselling model in the O-RAN setting, which models the carryover of unmet demand across time slots, along with how users’ internal buffer states relate to any PRBs purchased. We formulate the interplay between the users as a strategic game, with each participant aiming to maximize their own payoffs, and we prove the existence and uniqueness of Nash equilibrium (NE) in the game. We furthermore propose an iterative bidding mechanism that converges to this NE. Extensive simulations show that our best approach reduces data loss by 30.5% and spectrum resource wastage by 50.7% while significantly improving social welfare, compared to its absence.

In this paper, we propose a deep learning (DL)-based task-driven spectrum prediction framework, named DeepSPred. The DeepSPred comprises a feature encoder and a task predictor, where the encoder extracts spectrum usage pattern features, and the predictor configures different networks according to the task requirements to predict future spectrum. Based on the DeepSPred, we first propose a novel 3D spectrum prediction method combining a flow processing strategy with 3D vision Transformer (ViT, i.e., Swin) and a pyramid to serve possible applications such as spectrum monitoring task, named 3D-SwinSTB. 3D-SwinSTB unique3D Patch Merging ViT-to-3D ViT Patch Expandingand pyramid designs help the model accurately learn the potential correlation of the evolution of the spectrogram over time. Then, we propose a novel spectrum occupancy rate (SOR) method by redesigning a predictor consisting exclusively of 3D convolutional and linear layers to serve possible applications such as dynamic spectrum access (DSA) task, named 3D-SwinLinear. Unlike the 3D-SwinSTB output spectrogram, 3D-SwinLinear projects the spectrogram directly as the SOR. Finally, we employ transfer learning (TL) to ensure the applicability of our two methods to diverse spectrum services. The results show that our 3D-SwinSTB outperforms recent benchmarks by more than 5%, while our 3D-SwinLinear achieves a 90% accuracy, with a performance improvement exceeding 10%.

Resource allocation in tactical ad-hoc networks presents unique challenges due to their dynamic and multi-hop nature. Accurate prediction of future network connectivity is essential for effective resource allocation in such environments. In this paper, we introduce the Spatial-Temporal Graph Encoder-Decoder (STGED) framework for Tactical Communication Networks that leverages both spatial and temporal features of network states to learn latent tactical behaviors effectively. STGED hierarchically utilizes graph-based attention mechanism to spatially encode a series of communication network states, leverages a recurrent neural network to temporally encode the evolution of states, and a fully-connected feed-forward network to decode the connectivity in the future state. Through extensive experiments, we demonstrate that STGED consistently outperforms baseline models by large margins across different time-steps input, achieving an accuracy of up to 99.2% for the future state prediction task of tactical communication networks.

Moving target defense (MTD) is a new defensive mechanism developed in power systems to thwart false data injection attacks (FDIAs). However, since the MTD works by perturbing the branch parameters with the distributed flexible ac transmission system (D-FACTS), it might cause additional infrastructure and operation costs and affect the system dynamics. This is a complicated problem because it is closely related to which branches should be perturbed and how much they are changed. In this article, we analyze the essentials of MTD and construct an effective and low-cost MTD. To begin with, we provide a sufficient and necessary condition for MTD to protect a bus from being affected by the intended FDIA. Based on this result, we propose a new metric to quantify the protection level of MTD and an efficient algorithm to minimize the number of required D-FACTS devices for protecting a specific set of buses. To reduce the operation cost, we develop two strategies to make the increasing operation cost zero for activating the MTD. Furthermore, we analyze the impact of MTD on the system dynamics with a special emphasize on small signal stability. Finally, we conduct extensive simulations to validate our findings with the test cases of power systems in MATPOWER.

Industrial robots are prototypical cyber-physical systems widely deployed in (smart) manufacturing, which operate according to the operation code uploaded by the human operator and are monitored in real-time based on their movement data. However, industrial robots suffer from replay attacks, via which attackers can manipulate the robot operation without being observed by the monitoring system. To mitigate this vulnerability, we design a novel intrusion detection system for industrial robots using their power fingerprint, calledPIDS(Power-basedIntrusionDetectionSystem), and deliverPIDSas abump-in-the-wiremodule installed at the powerline of commodity robots. The foundation ofPIDSis the physically-induced dependency between the robot movement and the concomitant power consumption, whichPIDScaptures via joint physical analysis and (cyber) data-driven modeling.PIDSthen fingerprints the robot movements observed by the monitoring system using their expected power consumption, and cross-validates the fingerprints with empirically collected power information — a mismatch thereof flags anomalies of the observed movements (i.e., evidence of replay attack). We have evaluatedPIDSusing three models of robots from different vendors — i.e., ABB IRB120, KUKA KR6 R700, and Universal Robots UR5 robots — with over 2,000 operation cycles. Experimental results show thatPIDSdetects replay attacks at an average rate of 96.5 percent (up to 99.9 percent) and a 0.1s latency.

Data integrity attack (DIA) is one class of threatening cyber attacks against the Internet-of-Things (IoT)-based smart grid. With the assumption that the attacker is capable of obtaining complete or incomplete information of the system topology and branch parameters, it has been widely recognized that the highly synthesized DIA can evade being detected and undermine the smart grid state estimation. However, the branch parameters cannot be easily obtained or inferred by the attacker in practice. They can be changed or disturbed with time. In this article, we complete the class of DIA by designing the zero-parameter-information DIA (ZDIA), which makes it possible for the attacker to execute stealthy data tampering attacks without any information of the branch parameters. Only the topology information about the cut line is required to construct such attack. We prove that, the attacker can arbitrarily modify the state estimate of a one-degree bus, which is connected to the outside only by a single cut line; and modify the state estimates of all buses, with the same arbitrary bias, in a one-degree super-bus, which is a group of buses that is connected to the outside only by a single cut line. Besides, we extend ZDIA to the cases where a bus and super-bus are connected to the outside only by several cut lines. Moreover, we propose two countermeasures to address the topology vulnerability exploited by ZDIA, and present a branch perturbation strategy to defend against general DIAs. Finally, we conduct extensive simulations with the IEEE standard power systems to validate the theoretical results.

Industrial robots have been shown to suffer from replay attacks, via which adversaries not only manipulate the robot operation by downloading malicious code, but also prevent the detection of this manipulation by replaying recorded (and normal) movement data to the monitoring system. To protect industrial robots from replay attacks, we design a novel intrusion detection system using the power fingerprint of robots, called PIDS (Power-based Intrusion Detection System), and deliver PIDS as a bump-in-the-wire module installed at the powerline of commodity robots. The foundation of PIDS is the physically-induced dependency between the robot movement and the concomitant electrical power consumption, which PIDS captures via joint physical analysis and (cyber) data-driven modeling. PIDS then fingerprints the robot movements observed by the monitoring system using their expected power consumption, and cross-validates the fingerprints with empirically collected power information --- a mismatch thereof flags anomalies of the observed movements (i.e., evidence of replay attack). We have evaluated PIDS using three models of robots from different vendors --- i.e., ABB IRB120, KUKA KR6 R700, and Universal Robots UR5 robots --- with over 2, 000 operation cycles. The experimental results show that PIDS detects replay attacks with an average rate of 96.5% (up to 99.9%) and a 0.1s latency.

Due to recent cyber attacks on various cyber-physical systems (CPSes), traditional isolation based security schemes in the critical systems are insufficient to deal with the smart adversaries in CPSes with advanced information and communication technologies (ICTs). In this paper, we develop real-time assessment and mitigation of an attack's impact as a system's built-in mechanisms. We study a general class of attacks, which we call time delay attack, that delays the transmissions of control data packets in the CPS control loops. Based on a joint stability-safety criterion, we propose the attack impact assessment consisting of (i) a machine learning (ML) based safety classification, and (ii) a tandem stability-safety classification that exploits a basic relationship between stability and safety, namely that an unstable system must be unsafe whereas a stable system may not be safe. In this assessment approach, the ML addresses a state explosion problem in the safety classification, whereas the tandem structure reduces false negatives in detecting unsafety arising from imperfect ML. We apply our approach to assess the impact of the attack on power grid automatic generation control, and accordingly develop a two-tiered mitigation that tunes the control gain automatically to restore safety where necessary and shed load only if the tuning is insufficient. We also apply our attack impact assessment approach to a thermal power plant control system consisting of two PID control loops. A mitigation approach by tuning the PID controller is also proposed. Extensive simulations based on a 37-bus system model and a thermal power plant control system are conducted to evaluate the effectiveness of our assessment and mitigation approaches.

Recent studies have exploited moving target defense (MTD) for thwarting false data injection (FDI) attacks against the state estimation (SE) by actively perturbing branch parameters (i.e., impedance or admittance) in power grids. To hide the activation of MTD from attackers, a new strategy named hidden MTD has been proposed by the latest literature. A hidden MTD can increase the defender’s chance to detect FDI attacks and avoid the attacker from inferring new branch parameters. However, by using an MTD-confirming detector like the bad data detection (BDD) checker in SE, we observe that it is still possible for the attacker to detect this hidden MTD when the power flows change with time. To uncover the insight of MTD’s hiddenness, we study the conditions needed for achieving a hidable MTD. We find that the hiddenness of MTD is closely related to the branch perturbations, system topology, and attacker’s knowledge. From the attacker’s perspective, we prove that an MTD can be detected by the attacker only if he/she knows the previous parameters of a set of branches that forms a circle and the measurements corresponding to those branches after MTD. But once the attacker has full knowledge of branch parameters before MTD and has obtained all measurements after MTD, it is proved that we can never achieve a hidable and effective MTD. From the defender’s perspective, since it is impossible to know the attacker’s capability, we cannot determine whether a constructed MTD is hidable or not by purely depending on the MTD design. To address this issue, we propose that, by protecting a basic set of measurements, we always can achieve a hidable and effective MTD regardless of the changes of power flows, the attacker’s knowledge, and the branch perturbations. Furthermore, we validate our findings with the IEEE standard test power systems.

Recent studies have considered thwarting false data injection (FDI) attacks against state estimation in power grids by proactively perturbing branch susceptances. This approach is known as moving target defense (MTD). However, despite of the deployment of MTD, it is still possible for the attacker to launch stealthy FDI attacks generated with former branch susceptances. In this paper, we prove that, an MTD has the capability to thwart all FDI attacks constructed with former branch susceptances only if (i) the number of branches l in the power system is not less than twice that of the system states n (i.e., l ≥ 2n, where n + 1 is the number of buses); (ii) the susceptances of more than n branches, which cover all buses, are perturbed. Moreover, we prove that the state variable of a bus that is only connected by a single branch (no matter it is perturbed or not) can always be modified by the attacker. Nevertheless, in order to reduce the attack opportunities of potential attackers, we first exploit the impact of the susceptance perturbation magnitude on the dimension of the stealthy attack space, in which the attack vector is constructed with former branch susceptances. Then, we propose that, by perturbing an appropriate set of branches, we can minimize the dimension of the stealthy attack space and maximize the number of covered buses. Besides, we consider the increasing operation cost caused by the activation of MTD. Finally, we conduct extensive simulations to illustrate our findings with IEEE standard test power systems.

In this paper, we consider the scenario in which a mobile charger (MC) periodically travels within a sensor network to recharge the sensors wirelessly. We design joint charging and scheduling schemes to maximize the Quality of Monitoring (QoM) for stochastic events, which arrive and depart according to known probability distributions of time. Information is considered captured if it is sensed by at least one sensor. We focus on two closely related research issues, i.e., how to choose the sensors for charging and decide the charging time for each of them, and how to schedule the sensors' activation schedules according to their received energy. We formulate our problem as the maximum QoM CHArging and SchEduling problem (CHASE). We first ignore the MC's travel time and study the resulting relaxed version of the problem, which we call CHASE-R. We show that both CHASE and CHASE-R are NP-hard. For CHASE-R, we prove that it can be formulated as a submodular function maximization problem, which allows two algorithms to achieve 1/6- and 1/(4 + ε)-approximation ratios. Then, for CHASE, we propose approximation algorithms to solve it by extending the CHASE-R results. We conduct simulations to validate our algorithm design.

Many clock synchronization protocols based on message passing, e.g., the Network Time Protocol (NTP), assume symmetric network delays to estimate the one-way packet transmission time as half of the round-trip time. As a result, asymmetric network delays caused by either network congestion or malicious packet delays can cause significant synchronization errors. This article exploits sinusoidal voltage signals of an alternating current (AC) power grid to limit the impact of the asymmetric network delays on these clock synchronization protocols. Our extensive measurements show that the voltage signals at geographically distributed locations in a city are highly synchronized. Leveraging calibrated voltage phases, we develop a new clock synchronization protocol that we call Grid Time Protocol (GTP), which allows direct measurement of one-way packet transmission times between its slave and master nodes, subject to an analytic condition that can be easily verified in practice. The direct measurements render GTP resilient against asymmetric network delays under this condition. A prototype implementation of GTP maintains sub-millisecond synchronization accuracy for two nodes tens of kilometers apart in the presence of malicious packet delays. The result has been demonstrated for both Singapore and Hangzhou, China. Simulations driven by real network delay measurements between Singapore and Hangzhou under both normal and congested network conditions also show the synchronization accuracy improvement by GTP. We believe that GTP is suitable for grid-connected distributed systems that are currently served by NTP but desire higher resilience against unfavorable network dynamics and packet delay attacks.

We study moving-target defense (MTD) that actively perturbs transmission line reactances to thwart stealthy false data injection (FDI) attacks against state estimation in a power grid. Prior work on this topic lacks an analysis of the relationship between MTD's effectiveness (in detecting FDI attacks) and the associated cost of the perturbations (incurred by the grid operator). To address the issue, we present formal design criteria to select MTD reactance perturbations that are truly effective. Based on a key optimal power flow (OPF) formulation, we find that the effective MTD may incur a non-trivial operational cost. We show that MTD's detection capability and the associated cost depend on the separation between the column spaces of measurement matrices before and after the MTD perturbation. We use the metric of smallest principal angles between the subspaces to characterize the separation. We show that different degrees of the separation provide a spectrum of tradeoffs between the MTD's detection capability and its cost. Furthermore, we present closed-form expressions in the case of a two-bus system to illustrate the tradeoffs. While our analysis is primarily based on a direct current (dc) power flow model, we show that the perturbations designed using this model are also effective in detecting FDI attacks against ac power flows. Similarly, the cost-benefit tradeoff still holds under the ac power model. Extensive simulations, using the MATPOWER simulator and benchmark IEEE bus systems, verify and illustrate the proposed design approach that for the first time addresses both key aspects of cost and effectiveness of the MTD.

We address the problem of constructing false data injection (FDI) attacks that can bypass the bad data detector (BDD) of a power grid. The attacker is assumed to have access to only power flow measurement data traces (collected over a limited period of time) and no other prior knowledge about the grid. Existing related algorithms are formulated under the assumption that the attacker has access to measurements collected over a long (asymptotically infinite) time period, which may not be realistic. We show that these approaches do not perform well when the attacker has a limited number of data samples only. We design an enhanced algorithm to construct FDI attack vectors in the face of limited measurements that can nevertheles bypass the BDD with high probability. Furthermore, we characterize an important trade-off between the attack's BDD-bypass probability and its sparsity, which affects the spatial extent of the attack that must be achieved. Extensive simulations using data traces collected from the MATPOWER simulator and benchmark IEEE bus systems validate our findings.

DNS amplification attack is a significant and persistent threat to the Internet. Authoritative name servers (ANSes) of popular domains, especially the DNSSEC-enabled ones, give attractive leverage for attackers in distributed denial-of-service (DDoS) attacks. Particularly, the ANS list of top-level domains (TLD) is publicly accessible, including by would-be attackers, in the form of a root.zone file. In this work, we examine the potential of TLD ANSes to be exploited as unknowing agents in DNS amplification attacks. Specifically, over a period of 12 months that covers two different versions of the root.zone file, we assess the amplification factor (AF) that these servers may provide to attackers when replying to both individual and multiple queries. Also, we measure the degree of actual adoption of the recommended response rate limiting (RRL) countermeasure for the ANSes. Our major findings are that (i) 70% of the distinct ANSes and 47% of the possible DNS queries for the TLDs produce a large AF that exceeds 60, (ii) 10% of the distinct ANSes reflect inbound network traffic and magnify it by a factor that exceeds 50, (iii) the number of most useful ANSes for the attacker, in terms of their role as amplifiers, appears increasing during the monitoring period, and (iv) there still exists a significant number of ANSes that do not implement the RRL or leave it inactive.

We study the impact of signal jamming attacks against the communication based train control (CBTC) systems and develop the countermeasures to limit the attacks' impact. CBTC supports the train operation automation and moving-block signaling, which improves the transport efficiency. We consider an attacker jamming the wireless communication between the trains or the train to wayside access point, which can disable CBTC and the corresponding benefits. In contrast to prior work studying jamming only at the physical or link layer, we study the real impact of such attacks on end users, namely train journey time and passenger congestion. Our analysis employs a detailed model of leaky medium-based communication system (leaky waveguide or leaky feeder/coaxial cable) popularly used in CBTC systems. To counteract the jamming attacks, we develop a mitigation approach based on frequency hopping spread spectrum taking into account domain-specific structure of the leaky-medium CBTC systems. Specifically, compared with existing implementations of FHSS, we apply FHSS not only between the transmitter-receiver pair but also at the track-side repeaters. To demonstrate the feasibility of implementing this technology in CBTC systems, we develop a FHSS repeater prototype using software-defined radios on both leaky-medium and open-air (free-wave) channels. We perform extensive simulations driven by realistic running profiles of trains and real-world passenger data to provide insights into the jamming attack's impact and the effectiveness of the proposed countermeasure.

Modern urban railways extensively use computerized sensing and control technologies to achieve safe, reliable, and well-timed operations. However, the use of these technologies may provide a convenient leverage to cyber-attackers who have bypassed the air gaps and aim at causing safety incidents and service disruptions. In this article, we study False Data Injection (FDI) attacks against railway Traction Power Systems (TPSes). Specifically, we analyze two types of FDI attacks on the train-borne voltage, current, and position sensor measurements—which we call efficiency attack and safety attack— that (i) maximize the system’s total power consumption and (ii) mislead trains’ local voltages to exceed given safety-critical thresholds, respectively. To counteract, we develop a Global Attack Detection (GAD) system that serializes a bad data detector and a novel secondary attack detector designed based on unique TPS characteristics. With intact position data of trains, our detection system can effectively detect FDI attacks on trains’ voltage and current measurements even if the attacker has full and accurate knowledge of the TPS, attack detection, and real-time system state. In particular, the GAD system features an adaptive mechanism that ensures low false-positive and negative rates in detecting the attacks under noisy system measurements. Extensive simulations driven by realistic running profiles of trains verify that a TPS setup is vulnerable to FDI attacks, but these attacks can be detected effectively by the proposed GAD while ensuring a low false-positive rate.

Distributed denial-of-service (DDoS) defense is still a difficult problem though it has been extensively studied. The existing approaches are not capable of detecting various types of DDoS attacks. In particular, new emerging sophisticated DDoS attacks (e.g., Crossfire) constructed by low-rate and short-lived benign traffic are even more challenging to capture. Moreover, it is difficult to enforce realtime defense to throttle these detected attacks since the attack traffic can be concealed in benign traffic. Software defined networking (SDN) opens a new door to address these issues. In this paper, we propose Reinforcing Anti-DDoS Actions in Realtime (RADAR) to detect and throttle DDoS attacks via adaptive correlation analysis built upon unmodified commercial off-the-shelf SDN switches. It is a practical system to defend against a wide range of flooding-based DDoS attacks, e.g., link flooding (including Crossfire), SYN flooding, and UDP-based amplification attacks, while requiring neither modifications in SDN switches/protocols nor extra appliances. It accurately detects attacks by identifying attack features in suspicious flows, and locates attackers (or victims) to throttle the attack traffic by adaptive correlation analysis. We implement RADAR prototype using open source Floodlight controller, and evaluate its performance under various DDoS attacks by real hardware testbed based experiments. We observe that our scheme can successfully detect and effectively defend against various DDoS attacks with acceptable overhead.

The continuous fluctuation of electric network frequency (ENF) presents a fingerprint indicative of time, which we call natural timestamp . This article studies the time accuracy of these natural timestamps obtained from powerline electromagnetic radiation (EMR), which is mainly excited by powerline voltage oscillations at the rate of the ENF. However, since the EMR signal is often weak and noisy, extracting the ENF is challenging, especially on resource-limited sensor platforms. We design an efficient EMR conditioning algorithm and evaluate the time accuracy of EMR natural timestamps on two representative classes of IoT platforms—a high-end single-board computer with a customized EMR antenna and a low-end mote with a normal conductor wire acting as EMR antenna. Extensive measurements at six sites in a city, which are away from each other for up to 24km, show that the high-end and low-end nodes achieve median time errors of about 50ms and 150ms, respectively. To demonstrate the use of the EMR natural timestamps, we discuss three applications: time recovery, runtime clock verification, and secure clock synchronization.

Desynchronized clocks among network nodes in critical infrastructures can degrade system performance and even lead to safety incidents. Clock synchronization protocols based on network message exchanges, though widely used in current network systems, are susceptible to delay attacks against the packet transmission. This vulnerability cannot be solved by conventional security measures, such as encryption, and remains an open problem. This article proposes to use the sine voltage waveform of a utility power grid to synchronize network nodes connected to the same grid. Our experiments demonstrate that minute fluctuations of the voltage’s cycle length encode fine-grained global time information in Singapore’s utility grid. Based on this key result, we develop a clock synchronization approach that achieves good accuracy and is provably secure against packet-delay attacks. Implementation results show that our approach achieves an average synchronization error of 0.1 ms between two network nodes that are deployed in office and residential buildings 10 km apart. When the proposed system is deployed within the same floor of an office building, the error reduces to 10 μs. When there are heavy industrial loads close to one of the two nodes 10 km apart, the system can still maintain subsecond accuracy. Moreover, when the two nodes are deployed within the same building floor with industrial loads nearby, the average synchronization error is 34 μ

Many clock synchronization protocols based on message passing, e.g., the Network Time Protocol (NTP), assume symmetric network delays to estimate the one-way packet transmission time as half of the round-trip time. As a result, asymmetric network delays caused by either %natural one-way network congestion or malicious packet delays can cause significant synchronization errors. This paper exploits sinusoidal voltage signals of an alternating current (ac) power grid to tame the asymmetric network delays for robust and resilient clock synchronization. Our extensive measurements show that the voltage signals at geographically distributed locations in a city are highly synchronized. Leveraging calibrated voltage phases, we develop a new clock synchronization protocol, which we call Grid Time Protocol (GTP), that allows direct measurement of one-way packet transmission times between its slave and master nodes, under an analytic condition that can be easily verified in practice. The direct measurements render GTP resilient against asymmetric network delays under this condition. A prototype implementation of GTP, based on readily available ac/ac transformers and PC-grade sound cards as voltage signal sampling devices, maintains sub-ms synchronization accuracy for two nodes 30 km apart, in the presence of malicious packet delays. We believe that GTP is suitable for grid-connected distributed systems that are currently served by NTP but desire higher resilience against network dynamics and packet delay attacks.

We consider an infrastructure consisting of a network of systems each composed of discrete components that can be reinforced at a certain cost to guard against attacks. The network provides the vital connectivity between systems, and hence plays a critical, asymmetric role in the infrastructure operations. We characterize the system-level correlations using the aggregate failure correlation function that specifies the infrastructure failure probability given the failure of an individual system or network. The survival probabilities of systems and network satisfy first-order differential conditions that capture the component-level correlations. We formulate the problem of ensuring the infrastructure survival as a game between an attacker and a provider, using the sum-form and product-form utility functions, each composed of a survival probability term and a cost term. We derive Nash Equilibrium conditions which provide expressions for individual system survival probabilities, and also the expected capacity specified by the total number of operational components. These expressions differ only in a single term for the sum-form and product-form utilities, despite their significant differences. We apply these results to simplified models of distributed cloud computing infrastructures.

Increasing dynamics of electrical loads presents uncertainty and hence new challenges for power grid controls and optimization. In economic dispatch control (EDC) for minimizing generation cost, demand reporting by customers is a promising approach for managing the uncertainty, but it raises important privacy concerns. Adding random noise to aggregate queries of demand reports can provide differential privacy (DP) for the individual customers. But the noisy query results can adversely impact the EDC's optimality. In this paper, we analyze the privacy cost in demand reporting in terms of how DP-induced noise will increase the total generation cost. Our analysis shows that the noise amounts for different customers are intricately coupled with one another in determining the total cost. In view of the coupling, we apply the principle of Shapley value to attribute fair shares of the total cost to the power grid buses. For efficient sharing of the privacy cost, in a manner scalable to large power systems with many buses, we additionally propose heuristic algorithms to approximate the Shapley value. Trace-driven simulations based on a 5-bus power system model validate our analysis and illustrate the performance of the proposed cost sharing algorithms.

The continuous fluctuation of electric network frequency (ENF) presents a fingerprint indicative of time, which we call natural timestamp. This paper studies the time accuracy of these natural timestamps obtained from powerline electromagnetic radiation (EMR), which is mainly excited by powerline voltage oscillations at the rate of the ENF. However, since the EMR signal is often weak and noisy, extracting the ENF is challenging, especially on resource-limited sensor platforms. We design an efficient EMR conditioning algorithm and evaluate the time accuracy of EMR natural timestamps on two representative classes of IoT platforms - a high-end single-board computer with a customized EMR antenna and a low-end mote with a normal conductor wire acting as EMR antenna. Extensive measurements at five sites in a city, which are away from each other for up to 24 km, show that the high-end and low-end nodes achieve median time errors of about 50 ms and 150 ms, respectively. To demonstrate the use of the EMR natural timestamps, we discuss two applications, namely time recovery and runtime clock verification.

Load shedding can combat the overload of a power grid that may jeopardize the grid’s safety. However, disconnected customers may be excessively inconvenienced or even endangered. With the emergence of demand-response based on cyber-enabled smart meters and appliances, customers may participate in solving the overload by curtailing their demands collaboratively such that no single customers will have to bear a disproportionate burden of reduced usage. However, compliance or commitment to curtailment requests by untrusted users is uncertain, which causes an important safety concern. This article proposes a two-phase load management scheme that (i) gives customers a chance to curtail their demands and correct a grid’s overload when there are no immediate safety concerns but (ii) falls back to load shedding to ensure safety once the grid enters a vulnerable state. Extensive simulations based on a 37-bus electrical grid and traces of real electrical load demonstrate the effectiveness of this scheme. In particular, if customers are, as expected, sufficiently committed to the load curtailment, overloads can be resolved in real time by collaborative and graceful usage degradation among them, thereby avoiding unpleasant load shedding.

This paper studies the impact of false data injection (FDI) attacks on automatic generation control (AGC), a fundamental control system used in all power grids to maintain the grid frequency at a nominal value. Attacks on the sensor measurements for AGC can cause frequency excursion that triggers remedial actions, such as disconnecting customer loads or generators, leading to blackouts, and potentially costly equipment damage. We derive an attack impact model and analyze an optimal attack, consisting of a series of FDIs that minimizes the remaining time until the onset of disruptive remedial actions, leaving the shortest time for the grid to counteract. We show that, based on eavesdropped sensor data and a few feasible-to-obtain system constants, the attacker can learn the attack impact model and achieve the optimal attack in practice. This paper provides essential understanding on the limits of physical impact of the FDIs on power grids, and provides an analysis framework to guide the protection of sensor data links. For countermeasures, we develop efficient algorithms to detect the attack, estimate which sensor data links are under attack, and mitigate attack impact. Our analysis and algorithms are validated by experiments on a physical 16-bus power system test bed and extensive simulations based on a 37-bus power system model.

Fine-grained real-time metering is a fundamental service of wireless energy auditing networks, where metering data is transmitted from embedded wireless power meters to gateways for centralized processing, storage, and forwarding. Due to limited meter capability and wireless bandwidth, the increasing sampling rates and network scales needed to support new energy auditing applications pose significant challenges to metering data fidelity and secrecy . This article exploits the compression and encryption properties of compressive sensing (CS) to design a joint data compression and encryption (JICE) approach that addresses these two challenges simultaneously. Compared with a conventional signal processing pipeline that compresses and encrypts data sequentially, JICE reduces computation and space complexities due to its simple design. It thus leaves more processor time and available buffer space for handling lossy wireless transmissions. Moreover, JICE features an adaptive reconfiguration mechanism that selects the signal representation basis of CS at runtime among several candidate bases to achieve the best fidelity of the recovered data at the gateways. This mechanism enables JICE to adapt to changing power consumption patterns. On a smart plug platform, we implemented JICE and several baseline approaches including downsampling, lossless compression, and the pipeline approach. Extensive testbed experiments show that JICE achieves higher data delivery ratios and lower recovery distortions under a range of realistic settings. In particular, at a meter sampling rate of 8 Hz, JICE increases the number of meters supported by a gateway by 50%, compared with the commonly used pipeline approach, while keeping a signal distortion rate lower than 5%.

Modern urban railways extensively use computerized-sensing and control technologies to achieve safe, reliable, and well-timed operations. However, the use of these technologies may provide a convenient leverage to cyber-attackers who have bypassed the air gaps and aim at causing safety incidents and service disruptions. In this paper, we study false data injection (FDI) attacks against railways' traction power systems (TPSes). Specifically, we analyze two types of FDI attacks on the train-borne voltage, current, and position sensor measurements -- which we call efficiency attack and safety attack -- that (i) maximize the system's total power consumption and (ii) mislead trains' local voltages to exceed given safety-critical thresholds, respectively. To counteract, we develop a global attack detection system that serializes a bad data detector anda novel secondary attack detector designed based on unique TPS characteristics. With intact position data of trains, our detection system can effectively detect the FDI attacks ontrains' voltage and current measurements even if the attacker has full and accurate knowledge of the TPS, attack detection, and real-time system state. Extensive simulations driven by realistic running profiles of trains verify that a TPS setup isvulnerable to the FDI attacks, but these attacks can be detected effectively by the proposed global monitoring.

Much recent work has applied existing fault detectors against attacks in cyber-physical control systems. The results demonstrate effectiveness in detecting simplistic attacks that cause fault-like disruptions. However, they do not address motivated and knowledgeable attackers who craft attacks using knowledge of the system including its method of detecting attacks. In this paper, we analyze the conditions for an attacker to bypass a dissipativity-theoretic fault detector adopted in the prior work. We show that the attacker can use a quadratic programming solver to efficiently compute false data injection attacks to bypass the detector. We show further that, by applying an OR gate to fuse binary detection results from a number of the detectors, with carefully chosen parameters, we can achieve an integrated detector bank that cannot be bypassed by an attacker, if the attacker can tamper with either the sensor or control data of the system. For an n-dimensional linear time-invariant system, the number of needed fault detectors is O(n!). This number can be dramatically reduced to O(n) under a realistic assumption that the system has converged before the attack starts. Simulations for voltage control based on an IEEE 39-bus power system model validate our analysis.

Desynchronized clocks among nodes in industrial Internet of Things (IoT) can degrade system performance and even lead to safety incidents. Clock synchronization protocols based on network message exchanges, though widely used in current industrial systems, are susceptible to delay attacks against the packet transmission. This vulnerability cannot be solved by conventional security measures such as encryption, and remains an open problem. This paper proposes to use the sine voltage waveform of a utility power grid to synchronize "things" connected to the same grid. Our experiments demonstrate that minute fluctuations of the voltage's cycle length encode fine-grained global time information in a city-scale utility grid. Based on this key result, we develop a clock synchronization approach that achieves sub-ms accuracy and is provably secure against packet delay attacks. Implementation results show that our approach achieves an average synchronization error of 0.1 ms between two IoT nodes that are 10 km apart. When the proposed system is deployed within the same floor of a building, the error reduces to 10 us.

Smart meters are integral to demand response in emerging smart grids, by reporting the electricity consumption of users to serve application needs. But reporting real-time usage information for individual households raises privacy concerns. Existing techniques to guarantee differential privacy (DP) of smart meter users either are not fault tolerant or achieve (possibly partial) fault tolerance at high communication overheads. In this paper, we propose a fault-tolerant protocol for smart metering that can handle general communication failures while ensuring DP with significantly improved efficiency and lower errors compared with the state of the art. Our protocol handles fail-stop faults proactively by using a novel design of future ciphertexts, and distributes trust among the smart meters by sharing secret keys among them. We prove the DP properties of our protocol and analyze its advantages in fault tolerance, accuracy, and communication efficiency relative to competing techniques. We illustrate our analysis by simulations driven by real-world traces of electricity consumption.

Privacy protection of time-series data, such as traces of household electricity usage reported by smart meters, is of much practical importance. Solutions are available to improve data privacy by perturbing clear traces to produce noisy versions visible to adversaries, e.g., in battery-based load hiding (BLH) against non-intrusive load monitoring (NILM). A foundational task for research progress in the area is the definition of privacy measures that can truly evaluate the effectiveness of proposed protection methods. It is a difficult problem since resilience against any attack algorithms known to the designer is inconclusive, given that adversaries could discover or indeed already know stronger algorithms for attacks. A more basic measure is information-theoretic in nature, which quantifies the inherent information available for exploitation by an adversary, independent of how the adversary exploits it or indeed any assumed computational limitations of the adversary. In this paper, we analyze information-theoretic measures for privacy protection and apply them to several existing protection methods against NILM. We argue that although these measures abstract away the details of attacks, the kind of information the adversary considers plays a key role in the evaluation, and that a new measure of offline conditional entropy is better suited for evaluating the privacy of perturbed real-world time-series data, compared with other existing measures.

We present an integrated prefetching and caching proxy, termed iPac, for HTTP-based adaptive video streaming services like Netflix and YouTube. The challenge we address is maximizing the byte-hit ratio for proxies through prefetching in the context of the limited bandwidth between proxies and content servers. The problem is NP-hard, and the best approximation ratio that any optimal offline algorithm can achieve is 1-e--1 ≈ 0.63. Considering that offline algorithms cannot be applied to real-time applications with stringent time constraints, we propose a novel 0.5-competitive online prefetching algorithm which, to the best of our knowledge, has the best lower bound so far. We evaluate the performance of iPac by deploying it over the Amazon EC2 cloud accepting user requests from the video clients deployed on the PlanetLab based on a real trace of user requests for YouTube videos. Our experimental results demonstrate that iPac can significantly improve the performance in terms of byte-hit ratio (up to 84%) and video rates (up to 34%), compared with the state-of-the-art approaches. The proposed iPac is compatible with existing HTTP-based adaptive streaming implementations without requiring any modification to existing content servers and video clients.

Fine-grained real-time metering is a fundamental service of wireless energy auditing networks, where metering data is transmitted from embedded power meters to gateways for centralized processing, storage, and forwarding. Due to limited meter capability and wireless bandwidth, the increasing sampling rates and network scales needed to support new energy auditing applications pose significant challenges to metering data fidelity and secrecy. This paper exploits the compression and encryption properties of compressive sensing (CS) to design a joint data compression and encryption (JICE) approach that addresses these two challenges simultaneously. Compared with a conventional signal processing pipeline that compresses and encrypts data sequentially, JICE reduces computation and storage complexities due to its simple design. It thus leaves more processor time and available buffer space for handling lossy wireless transmissions. Moreover, JICE features a machine-learning-based reconfiguration mechanism that adapts its signal representation basis to changing power patterns autonomously. On a smart plug platform, we implemented JICE and several baseline approaches including downsampling, lossless compression, and the pipeline approach. Extensive testbed experiments show that JICE achieves higher data delivery ratios and lower recovery distortions under a range of realistic settings. In particular, JICE increases the number of meters supported by a gateway by 50%, compared with the pipeline approach, while keeping a distortion rate lower than 5%.

Modern information and communication technologies used by electric power grids are subject to cyber-security threats. This article studies the impact of integrity attacks on real-time pricing (RTP), an emerging feature of advanced power grids that can improve system efficiency. Recent studies have shown that RTP creates a closed loop formed by the mutually dependent real-time price signals and price-taking demand. Such a closed loop can be exploited by an adversary whose objective is to destabilize the pricing system. Specifically, small malicious modifications to the price signals can be iteratively amplified by the closed loop, causing highly volatile prices, fluctuating power demand, and increased system operating cost. This article adopts a control-theoretic approach to deriving the fundamental conditions of RTP stability under basic demand, supply, and RTP models that characterize the essential behaviors of consumers, suppliers, and system operators, as well as two broad classes of integrity attacks, namely, the scaling and delay attacks. We show that, under an approximated linear time-invariant formulation, the RTP system is at risk of being destabilized only if the adversary can compromise the price signals advertised to consumers, by either reducing their values in the scaling attack or providing old prices to over half of all consumers in the delay attack. The results provide useful guidelines for system operators to analyze the impact of various attack parameters on system stability so that they may take adequate measures to secure RTP systems.

Smart meters are integral to demand response in emerging smart grids, by reporting the electricity consumption of users to serve application needs. But reporting real-time usage information for individual households raises privacy concerns. Existing techniques to guarantee differential privacy (DP) of smart meter users either are not fault tolerant or achieve (possibly partial) fault tolerance at high communication overheads. In this paper, we propose a fault-tolerant protocol for smart metering that can handle general communication failures while ensuring DP with significantly improved efficiency and lower errors compared with the state of the art. Our protocol handles fail-stop faults proactively by using a novel design of future ciphertexts, and distributes trust among the smart meters by sharing secret keys among them. We prove the DP properties of our protocol and analyze its advantages in fault tolerance, accuracy, and communication efficiency relative to competing techniques. We illustrate our analysis by simulations driven by real-world traces of electricity consumption.

Sensor nodes are inherently unreliable and prone to hardware or software faults. Thus, they may report untrustwor- thy or inconsistent data. Assessing the trustworthiness of sensor data items can allow reliable sensing or monitoring of physical phenomena. A provenance-based trust framework can evaluate the trustworthiness of data items and sensor nodes based on the intuition that two data items with similar data values but with different provenance (i.e., forwarding path) can be considered more trustworthy. Forwarding paths of data items generated from redundantly deployed sensors should consist of trustworthy nodes and remain dissimilar. Unfortunately, operating many sensors with dissimilar paths consumes significant energy. In this paper, we formulate an optimization problem to identify a set of sensor nodes and their corresponding paths toward the base station that achieve a certain trustworthiness threshold, while keeping the energy consumption of the network minimal. We prove the NP-hardness of this problem and propose ERUPT, a simulated annealing solution. Testbed and simulation results show that ERUPT achieves high trustworthiness, while reducing total energy consumption by 32-50% with respect to current approaches.

We consider the problem of event capture by a rechargeable sensor network. We assume that the events of interest follow a renewal process whose event inter-arrival times are drawn from a general probability distribution, and that a stochastic recharge process is used to provide energy for the sensors' operation. Dynamics of the event and recharge processes make the optimal sensor activation problem highly challenging. In this paper we first consider the single-sensor problem. Using dynamic control theory, we consider a full-information model in which, independent of its activation schedule, the sensor will know whether an event has occurred in the last time slot or not. In this case, a simple and optimal greedy policy for the solution is developed. We then further consider a partial-information model where the sensor knows about the occurrence of an event only when it is active. This problem falls into the class of partially observable Markov decision processes (POMDP). Since the POMDP's optimal policy has exponential computational complexity and is intrinsically hard to solve, we propose an efficient heuristic clustering policy and evaluate its performance. Finally, our solutions are extended to handle a network setting in which multiple sensors collaborate to capture the events. We also provide extensive simulation results to evaluate the performance of our solutions.

Modern information and communication technologies used by smart grids are subject to cybersecurity threats. This paper studies the impact of integrity attacks on real-time pricing (RTP), a key feature of smart grids that uses such technologies to improve system efficiency. Recent studies have shown that RTP creates a closed loop formed by the mutually dependent real-time price signals and price-taking demand. Such a closed loop can be exploited by an adversary whose objective is to destabilize the pricing system. Specifically, small malicious modifications to the price signals can be iteratively amplified by the closed loop, causing inefficiency and even severe failures such as blackouts. This paper adopts a control-theoretic approach to deriving the fundamental conditions of RTP stability under two broad classes of integrity attacks, namely, the scaling and delay attacks. We show that the RTP system is at risk of being destabilized only if the adversary can compromise the price signals advertised to smart meters by reducing their values in the scaling attack, or by providing old prices to over half of all consumers in the delay attack. The results provide useful guidelines for system operators to analyze the impact of various attack parameters on system stability, so that they may take adequate measures to secure RTP systems.

A virtual organization (VO) is a group of organizations that have banded together to achieve a common goal. Often a VO could function more effectively if its members were willing to share certain information. However, a typical VO member will not want to share its own information because the member will not benefit directly from the information's reuse, yet will be blamed if the reuse turns out badly.

Though much existing work exploits wireless power charging to enhance sensor network performance such as routing and data aggregation, few efforts focus on issues of stochastic event capture. In this paper, we consider the scenario in which a mobile charger (MC) periodically travels within a sensor network to recharge the sensors wirelessly, to maximize the Quality of Monitoring (QoM) for stochastic events. Towards this goal, two closely related research issues need to be addressed. One is how to choose the sensors for charging and decide the charging time for each of them, the other is how to best schedule the sensors' activation schedules according to their received energy. In this paper, we jointly design the charging scheme and sensor schedules to maximize the QoM. We formulate our problem formally as the maximum QoM charging and scheduling problem (MQCSP). Obtaining an exact solution of MQCSP is challenging. Thus we first ignore the MC's travel time and study the resulting relaxed version of MQCSP, R-MQCSP. We show both MQCSP and R-MQCSP are NP-hard. For R-MQCSP, however, under a special condition, we prove that it can be formulated as a sub modular function maximization problem. This formulation allows a 1/6-approximation algorithm for the general case, and a unified algorithm with a series of approximation factors (up to 1-1/e) for a special case. Then, for MQCSP, we propose approximation algorithms by extending our R-MQCSP results. Finally, we conduct extensive trace-driven simulations to validate our algorithm design. The empirical results corroborate our theoretical analysis.

In this paper we advocate the use of workflow---describing how a system provides its intended functionality---as a pillar of cybersecurity analysis and propose a holistic workflow-oriented assessment framework. While workflow models are currently used in the area of performance and reliability assessment, these approaches are designed neither to assess a system in the presence of an active attacker, nor to assess security aspects such as confidentiality. On the other hand, existing security assessment methods typically focus on modeling the active attacker (e.g., attack graphs), but many rely on restrictive models that are not readily applicable to complex (e.g., cyber-physical or cyber-human) systems.

As a key technology of home area networks in smart grids, fine-grained power usage monitoring may help conserve electricity. Several existing systems achieve this goal by exploiting appliances' power usage signatures identified in labor-intensive in situ training processes. Recent work shows that autonomous power usage monitoring can be achieved by supplementing a smart meter with distributed sensors that detect the working states of appliances. However, sensors must be carefully installed for each appliance, resulting in high installation cost. This paper presents Supero - the first ad hoc sensor system that can monitor appliance power usage without supervised training. By exploiting multisensor fusion and unsupervised machine learning algorithms, Supero can classify the appliance events of interest and autonomously associate measured power usage with the respective appliances. Our extensive evaluation in five real homes shows that Supero can estimate the energy consumption with errors less than 7.5%. Moreover, non-professional users can quickly deploy Supero with considerable flexibility.

Wireless rechargeable sensor networks (WRSNs) have emerged as an alternative to solving the challenges of size and operation time posed by traditional battery-powered systems. In this paper, we study a WRSN built from the industrial wireless identification and sensing platform (WISP) and commercial off-the-shelf RFID readers. The paper-thin WISP tags serve as sensors and can harvest energy from RF signals transmitted by the readers. This kind of WRSNs is highly desirable for indoor sensing and activity recognition and is gaining attention in the research community. One fundamental question in WRSN design is how to deploy readers in a network to ensure that the WISP tags can harvest sufficient energy for continuous operation. We refer to this issue as the energy provisioning problem. Based on a practical wireless recharge model supported by experimental data, we investigate two forms of the problem: point provisioning and path provisioning. Point provisioning uses the least number of readers to ensure that a static tag placed in any position of the network will receive a sufficient recharge rate for sustained operation. Path provisioning exploits the potential mobility of tags (e.g., those carried by human users) to further reduce the number of readers necessary: mobile tags can harvest excess energy in power-rich regions and store it for later use in power-deficient regions. Our analysis shows that our deployment methods, by exploiting the physical characteristics of wireless recharging, can greatly reduce the number of readers compared with those assuming traditional coverage models.

Mobility traces of people and vehicles have been collected and published to assist the design and evaluation of mobile networks, such as large-scale urban sensing networks. Although the published traces are often made anonymous in that the true identities of nodes are replaced by random identifiers, the privacy concern remains. This is because in real life, nodes are open to observations in public spaces, or they may voluntarily or inadvertently disclose partial knowledge of their whereabouts. Thus, snapshots of nodes' location information can be learned by interested third parties, e.g., directly through chance/engineered meetings between the nodes and their observers, or indirectly through casual conversations or other information sources about people. In this paper, we investigate how an adversary, when equipped with a small amount of the snapshot information termed as side information, can infer an extended view of the whereabouts of a victim node appearing in an anonymous trace. Our results quantify the loss of victim nodes' privacy as a function of the nodal mobility, the inference strategies of adversaries, and any noise that may appear in the trace or the side information. Generally, our results indicate that the privacy concern is significant in that a relatively small amount of side information is sufficient for the adversary to infer the true identity (either uniquely or with high probability) of a victim in a set of anonymous traces. For instance, an adversary is able to identify the trace of 30%-50% of the victims when she has collected 10 pieces of side information about a victim.

We consider the problem of event capture by a rechargeable sensor network. We assume that the events of interest follow a renewal process whose event inter-arrival times are drawn from a general probability distribution, and that a stochastic recharge process is used to provide energy for the sensors' operation. Dynamics of the event and recharge processes make the optimal sensor activation problem highly challenging. In this paper we first consider the single-sensor problem. Using dynamic control theory, we consider a full-information model in which, independent of its activation schedule, the sensor will know whether an event has occurred in the last time slot or not. In this case, the problem is framed as a Markov decision process (MDP), and we develop a simple and optimal policy for the solution. We then further consider a partial-information model where the sensor knows about the occurrence of an event only when it is active. This problem falls into the class of partially observable Markov decision processes (POMDP). Since the POMDP's optimal policy has exponential computational complexity and is intrinsically hard to solve, we propose an efficient heuristic clustering policy and evaluate its performance. Finally, our solutions are extended to handle a network setting in which multiple sensors collaborate to capture the events. We provide extensive simulation results to evaluate the performance of our solutions.

In this demonstration, we present a working prototype that uses an Anisotropic Magnetoresistive (AMR) sensor array to estimate the electricity usage on individual branches of an electricity panel. Our design enables the general public to retrofit an electricity panel: one simply needs to attach a compact AMR sensor array onto the panel. Our system can then exploit the inherent power patterns of electric loads to automatically infer the system parameters and estimate the per-branch currents accurately. Even for branches carrying small loads (e.g., a 30W fan), the estimation error of our system is below 10%.

We study data pollution attacks in wireless interflow network coding systems. Although several defenses for these attacks are known for intraflow network coding systems, none of them are applicable to interflow coding systems. We formulate a model for interflow network coding that encompasses all the existing systems, and use it to analyze the impact of pollution attacks. Our analysis shows that the effects of pollution attacks depend not only on the network topology, but also on the location and strategy of the attacker nodes. We propose CodeGuard, a reactive attestation-based defense mechanism that uses efficient bit-level traceback and a novel cross-examination technique to unequivocally identify attacker nodes. We analyze the security of CodeGuard and prove that it is always able to identify and isolate at least one attacker node on every occurrence of a pollution attack. We analyze the overhead of CodeGuard and show that the storage, computation, and communication overhead are practical. We experimentally demonstrate that CodeGuard is able to identify attacker nodes quickly (within 500 ms) and restore system throughput to a high level, even in the presence of many attackers, thus preserving the performance of the underlying network coding system.

We consider the problem of gathering correlated sensor data by a single sink node in a wireless sensor network. We assume that the sensor nodes are energy constrained and design efficient distributed protocols to maximize the network lifetime. Many existing approaches focus on optimizing the routing layer only, but in fact the routing strategy is often coupled with power control in the physical layer and link access in the MAC layer. This paper represents a first effort on network lifetime maximization that jointly considers the three layers. We first assume that link access probabilities are known and consider the joint optimal design of power control and routing. We show that the formulated optimization problem is convex and propose a distributed algorithm, JRPA, for the solution. We also discuss the convergence of JRPA. When the optimal link access probabilities are unknown, as in many practical networks, we generalize the problem formulation to encompass all the three layers of routing, power control, and link-layer random access. In this case, the problem cannot be converted into a convex optimization problem, but there exists a duality gap when the Lagrangian dual method is employed. We propose an efficient heuristic algorithm, JRPRA, to solve the general problem, and show through numerical experiments that it can significantly narrow the gap between the computed and optimal solutions. Moreover, even without a priori knowledge of the best link access probabilities predetermined for JRPA, JRPRA achieves extremely competitive performance with JRPA. Beyond the metric of network lifetime, we also discuss how to solve the problem of correlated data gathering under general utility functions. Numerical results are provided to show the convergence of the algorithms and their advantages over existing solutions.

We consider a high density of sensors randomly placed in a geographical area for event monitoring. The monitoring regions of the sensors may have significant overlap, and a subset of the sensors can be turned off to conserve energy, thereby increasing the lifetime of the monitoring network. Prior work in this area does not consider the event dynamics. In this paper, we show that knowledge about the event dynamics can be exploited for significant energy savings, by putting the sensors on a periodic on/off schedule. We discuss energy-aware optimization of the periodic schedule for the cases of an synchronous and a asynchronous network. To reduce the overhead of global synchronization, we further consider a spectrum of regionally synchronous networks where the size of the synchronization region is specifiable. Under the periodic scheduling, coordinated sleep by the sensors can be applied orthogonally to minimize the redundancy of coverage and further improve the energy efficiency. We consider the interactions between the periodic scheduling and coordinated sleep. We show that the asynchronous network exceeds any regionally synchronous network in the coverage intensity, thereby increasing the effectiveness of the event capture, though the opportunities for coordinated sleep decreases as the synchronization region gets smaller. When the sensor density is high, the asynchronous network with coordinated sleep can achieve extremely good event capture performance while being highly energy efficient.

We present a robust localization algorithm for multiple radiation sources using a network of sensors under random underlying physical processes and measurement errors. The proposed solution uses a hybrid formulation of particle filter and mean-shift techniques to achieve several important features that address major challenges faced by existing localization algorithms. First, our algorithm is able to maintain a constant number of estimation (source) parameters even as the number of radiation sources K increases. In existing algorithms, the number of estimation parameters is proportional to K and thus the algorithm complexity grows exponentially with K. Second, to decide the number of sources K, existing algorithms either require the information to be known in advance or rely on expensive statistical estimations that do not scale well with K. Instead, our algorithm efficiently learns the number of sources from the estimated source parameters. Third, when obstacles are present, our algorithm can exploit the obstacles to achieve better isolation between the source signatures, thereby increasing the localization accuracy in complex deployment environments. In contrast, incompletely specified obstacles will significantly degrade the accuracy of existing algorithms due to their unpredictable effects on the source signatures. We present extensive simulation results to demonstrate that our algorithm has robust performance in complex deployment environments, and its efficiency is scalable to many radiation sources in these environments.

Wireless rechargeable sensor networks (WRSNs) have emerged as an alternative to solving the challenges of size and operation time posed by traditional battery-powered systems. In this paper, we study a WRSN built from the industrial wireless identification and sensing platform (WISP) and commercial off-the-shelf RFID readers. The paper-thin WISP tags serve as sensors and can harvest energy from RF signals transmitted by the readers. This kind of WRSNs is highly desirable for indoor sensing and activity recognition, and is gaining attention in the research community. One fundamental question in WRSN design is how to deploy readers in a network to ensure that the WISP tags can harvest sufficient energy for continuous operation. We refer to this issue as the energy provisioning problem. Based on a practical wireless recharge model supported by experimental data, we investigate two forms of the problem: point provisioning and path provisioning. Point provisioning uses the least number of readers to ensure that a static tag placed in any position of the network will receive a sufficient recharge rate for sustained operation. Path provisioning exploits the potential mobility of tags (e.g., those carried by human users) to further reduce the number of readers necessary: mobile tags can harvest excess energy in power-rich regions and store it for later use in power-deficient regions. Our analysis shows that our deployment methods, by exploiting the physical characteristics of wireless recharging, can greatly reduce the number of readers compared with those assuming traditional coverage models.

A number of networked infrastructure systems rely on both cyber and physical components for their continued operation. We present graph models for a class of such systems, wherein both cyber and physical parts must be made robust, possibly using different methods at different costs. We present methods for ensuring that the system survives, with specified probability PS, cyber and physical degradations due to natural, incidental, or intentional factors. Based on first and second order statistics of the profiles of passive degradations, we present methods to compute the robustness levels needed to ensure PS. Then, we consider the case of intentional compromises, where cost profiles of the provider and compromiser are known to various extents. We present a game-theoretic formulation based on provider and disrupter cost and benefit functions, and their mutual knowledge. We present strategies and performance boundaries of these formulations in ensuring PS under utility functions that are sums of terms corresponding to infrastructure survival and cyber-physical costs.

We propose a steepest descent method to compute optimal control parameters for balancing between multiple performance objectives in stateless stochastic scheduling, wherein the scheduling decision is effected by a simple constant-time coin toss operation only. We apply our method to the scheduling of a mobile sensor's coverage time among a set of points of interest (PoIs). The coverage algorithm is guided by a Markov chain wherein the sensor at PoI i decides to go to the next PoI j with transition probability pij . We use steepest descent to compute the transition probabilities for optimal tradeoff between two performance goals concerning the distributions of per-PoI coverage times and exposure times, respectively. We also discuss how other important goals such as energy efficiency and entropy of the coverage schedule can be addressed. For computational efficiency, we show how to optimally adapt the step size in steepest descent to achieve fast convergence. However, we found that the structure of our problem is complex in that there may exist surprisingly many local optima in the solution space, causing basic steepest descent to get stuck easily at a local optimum. To solve the problem, we show how proper incorporation of noise in the search process can get us out of the local optima with high probability. We provide simulation results to verify the accuracy of our analysis, and show that our method can converge to the globally optimal control parameters under different assigned weights to the performance goals and different initial parameters.

Mobility traces of people and vehicles have been collected and published to assist the design and evaluation of mobilee networks, such as large-scale urban sensing networks. Although the published traces are often made anonymous in that the true identities of nodes are replaced by random identifiers, the privacy concern remains. This is because in real life, nodes are open to observations in public spaces, or they may voluntarily or inadvertently disclose partial knowledge of their whereabouts. Thus, snapshots of nodes' location information can be learned by interested third parties, e.g., directly through chance/engineered meetings between the nodes and their observers, or indirectly through casual conversations or other information sources about people. In this paper, we investigate how an adversary, when equipped with a small amount of the snapshot information termed as side information, can infer an extended view of the whereabouts of a victim node appearing in an anonymous trace. Our results quantify the loss of victim nodes' privacy as a function of the nodal mobility (captured in both real and synthetic traces), the inference strategies of adversaries, and any noise that may appear in the trace or the side information. Generally, our results indicate that the privacy concern is significant in that a relatively small amount of side information is sufficient for the adversary to infer the true identity (either uniquely or with high probability) of a victim in a set of anonymous traces.

We consider service enhancement in a wireless environment in which clients try to obtain service from a set of servers. Each client desires a minimum overall service success probability, which is achieved by establishing multiple independent connections with multiple servers. Given the service success probability of each potential client-server connection, our problem is to assign the connections such that the number of satisfied clients (whose overall service success probability is met) is maximized subject to server capacity constraints. In this paper, we make minor adaptations to the well-known notion of probabilistic network from the machine learning community and use it as our communication model. We then formally define the above optimization problem as the link assignment for successful service problem (LASS). While LASS can be reduced to the maximum matching problem in the deterministic case (where the success probabilities of each edge is 1), we show that in the probabilistic case it is NP-hard (and MaxSNP-hard). An equivalent integer programming formulation for LASS is obtained so that for small input size, the problem may be efficiently solved by the standard IP solver in practice. To tackle large input size, various heuristics are designed. Furthermore, in the special case where the underlying network graph is a tree (which is common in many real-life settings), we show that LASS can be solved in linear time based on a simple greedy algorithm. Experimental evaluations are performed and the results demonstrate the practicality of the algorithms and the heuristics.

We consider the problem of gathering correlated sensor data by a sink node in a wireless sensor network. We design efficient distributed protocols to maximize the network lifetime subject to nodal energy constraints. Many existing approaches address the routing layer only, but the routing often interacts with physical-layer power control and MAC-layer link access. We present a first effort to maximize the network lifetime by jointly considering the three layers. We first solve the joint power control and routing problem, by assuming that the link access probabilities are known. We show that the problem is convex and propose a distributed algorithm, JRPA, as solution. When the link access probabilities are unknown, we then generalize the problem to encompass all three layers of routing, power control, and link random access. The general problem is non-convex; a duality gap exists when the Lagrangian dual method is employed. We propose an efficient heuristic algorithm, JRPRA, to solve the general problem. Numerical results show that JRPRA is highly effective; particularly, even without the best link access probabilities pre-determined for JRPA, JRPRA achieves extremely competitive performance. Our results also show the convergence of the algorithms and their advantages over existing solutions.

Identification of a low-level point radioactive source amidst background radiation is achieved by a network of radiation sensors using a two-step approach. Based on measurements from three or more sensors, a geometric difference triangulation method or an N -sensor localization method is used to estimate the location and strength of the source. Then a sequential probability ratio test based on current measurements and estimated parameters is employed to finally decide: (1) the presence of a source with the estimated parameters, or (2) the absence of the source, or (3) the insufficiency of measurements to make a decision. This method achieves specified levels of false alarm and missed detection probabilities, while ensuring a close-to-minimal number of measurements for reaching a decision. This method minimizes the ghost-source problem of current estimation methods, and achieves a lower false alarm rate compared with current detection methods. This method is tested and demonstrated using: (1) simulations, and (2) a test-bed that utilizes the scaling properties of point radioactive sources to emulate high intensity ones that cannot be easily and safely handled in laboratory experiments.

We analyze the quality of monitoring (QoM) of stochastic events by a periodic sensor which monitors a point of interest (PoI) for q time every p time. We show how the amount of information captured at a PoI is affected by the proportion q/p , the time interval p over which the proportion is achieved, the event type in terms of its stochastic arrival dynamics and staying times and the utility function. The periodic PoI sensor schedule happens in two broad contexts. In the case of static sensors, a sensor monitoring a PoI may be periodically turned off to conserve energy, thereby extending the lifetime of the monitoring until the sensor can be recharged or replaced. In the case of mobile sensors, a sensor may move between the PoIs in a repeating visit schedule. In this case, the PoIs may vary in importance, and the scheduling objective is to distribute the sensor's coverage time in proportion to the importance levels of the PoIs. Based on our QoM analysis, we optimize a class of periodic mobile coverage schedules that can achieve such proportional sharing while maximizing the QoM of the total system.

A mobile sensor is used to cover a number of points of interest (PoIs) where dynamic events appear and disappear according to given random processes. It has been shown in [1] that for Step and Exponential utility functions, the quality of monitoring (QoM), i.e., the fraction of information captured about all events, increases as the speed of the sensor increases. This work, however, does not consider the energy of motion, which is an important constraint for mobile sensor coverage. In this paper, we analyze the expected information captured per unit of energy consumption (IPE) as a function of the event type, the event dynamics, and the speed of the mobile sensor. Our analysis uses a realistic energy model of motion, and it allows the sensor speed to be optimized for information capture. We present simulation results to verify and illustrate the analytical results.

We analyze the ability of a stochastic coverage algorithm to achieve both accurate threat-based coverage and effective information capture. When mobile sensors are used to cover the region over time, the goal of threat-based coverage is to allocate the sensors' coverage time between the subregions in proportion to their threat levels. We show that, in contrast to prior results on mobile coverage for maximizing simple event capture, limiting mobility by strategically pausing the sensor is important for threat-based coverage of physical world monitoring. Besides being energy efficient, pausing has two desirable effects. First, it can improve the accuracy of the threat-based coverage, in particular, the accuracy increases monotonically with a pause time parameter, and a large enough parameter will ensure exact matching of the sensor's coverage profile with the region's threat profile. Second, diverse natural phenomena require a non-negligible sensing time to overcome statistical uncertainties posed by the random nature of the phenomena. Suitable pausing allows a subregion to be observed long enough for reliable results.

We consider a high density of sensors randomly placed in a geographical area for event monitoring. The monitoring regions of the sensors may have significant overlap, and a subset of the sensors can be turned off to conserve energy, thereby increasing the lifetime of the monitoring network. Prior work in this area does not consider the event dynamics. In this paper, we show that knowledge about the event dynamics can be exploited for significant energy savings, by putting the sensors on a periodic on/off schedule. We discuss energy-aware optimization of the periodic schedule for both cases of a synchronous and an asynchronous network. Under the periodic scheduling, coordinated sleep by the sensors can be applied orthogonally to minimize the redundancy of coverage and further improve the energy efficiency. We consider four points in the design space: synchronous periodic scheduling with and without coordinated sleep, and asynchronous periodic scheduling with and without coordinated sleep. We show that the asynchronous network exceeds the synchronous network in the coverage intensity, thereby increasing the effectiveness of the event capture, though it may also reduce the opportunities for coordinated sleep. When the sensor density is high, the asynchronous network with coordinated sleep can achieve extremely good event capture performance while being highly energy-efficient.

The transmission energy required for a wireless communication increases superlinearly with the communication distance. In a mobile wireless network, nodal movement can be exploited to greatly reduce the energy required by postponing communication until the sender moves close to a target receiver, subject to application deadline constraints. In this paper, we characterize the fundamental performance limit, namely the lower bound expected communication distance, achievable by any postponement algorithm within given deadline constraints. Our analytical results concern mainly the random waypoint (RWP) model. Specifically, we develop a tight analytical lower bound of the achievable expected communication distance under the model. In addition, we define a more general map-based movement model, and characterize its lower bound distance by simulations. We also address the practical attainment of distance reduction through movement-predicted communication. Specifically, whereas prior work has experimentally demonstrated the effectiveness a least distance (LD) algorithm, we provide an absolute performance measure of how closely LD can match the theoretical optimum. We show that LD achieves an average reduction in the expected communication distance within 62% to 94% of the optimal, over a realistic range of nodal speeds, for both the RWP and map-based models.

Mobile sensors can be used to effect complete coverage of a surveillance area for a given threat over time, thereby reducing the number of sensors necessary. The surveillance area may have a given threat profile as determined by the kind of threat, and accompanying meteorological, environmental, and human factors. In planning the movement of sensors, areas that are deemed higher threat should receive proportionately higher coverage. We propose a coverage algorithm for mobile sensors to achieve a coverage that will match - over the long term and as quantified by an RMSE metric - a given threat profile. Moreover, the algorithm has the following desirable properties: 1) stochastic, so that it is robust to contingencies and makes it hard for an adversary to anticipate the sensor's movement, 2) efficient, and 3) practical, by avoiding movement over inaccessible areas. Further to matching, we argue that a fairness measure of performance over the shorter time scale is also important. We show that the RMSE and fairness are, in general, antagonistic, and argue for the need of a combined measure of performance, which we call efficacy. We show how a pause time parameter of the coverage algorithm can be used to control the trade-off between the RMSE and fairness, and present an efficient offline algorithm to determine the optimal pause time maximizing the efficacy. Finally, we discuss the effects of multiple sensors, under both independent and coordinated operation. Extensive simulation results - under realistic coverage scenarios - are presented for performance evaluation.

We analyze the quality of monitoring (QoM) of stochastic events by a periodic sensor which monitors a point of interest (PoI) for q time every p time. We show how the amount of information captured at a PoI is affected by the proportion q/p, the time interval p over which the proportion is achieved, the event type, and the stochastic event arrival dynamics and staying times. The periodic PoI sensor schedule happens in two broad contexts. In the case of static sensors, a sensor monitoring a PoI may be periodically turned off to conserve energy, thereby extending the lifetime of the monitoring until the sensor can be recharged or replaced. In the case of mobile sensors, a sensor may move between the PoIs in a repeating visit schedule. In this case, the PoIs may vary in importance, and the scheduling objective is to distribute the sensor's coverage time in proportion to the importance levels of the PoIs. Based on our QoM analysis, we optimize a class of periodic mobile coverage schedules that can achieve such proportional sharing while maximizing the QoM of the total system.

With advances in hardware-assisted full virtualization technologies, system virtualization based on the virtual machine monitor (VMM) has received much recent attention. Using the Xen/IA64 hardware virtual machine implemented on Intel® Virtualization Technology for Itanium® (VT-i), we investigate the design of a virtual software hash translation lookaside buffer (TLB) based on the virtual hash page table (VHPT). Experimental results show that the proposed design can significantly improve the performance of the hardware virtual machine of Xen/IA64. Our contributions are the following. First, we design and implement in the VMM a virtual hash TLB algorithm to optimize the system performance of VT-i guest virtual machines. Second, we quantify experimentally the performance benefits of the hash TLB for VT-i guest virtual machines and analyze the performance impact of the software VHPT walker with the hash TLB algorithm. Lastly, we present experiments to verify, in an SMP virtual machine system environment, the superior scalability of the hash TLB approach.

Identification of a low-level point radiation source amidst background radiation is achieved by a network of radiation sensors using a two-step approach. Based on measurements from three sensors, the geometric difference triangulation method is used to estimate the location and strength of the source. Then a sequential probability ratio test based on current measurements and estimated parameters is employed to finally decide: (1) the presence of a source with the estimated parameters, or (2) the absence of the source, or (3) the insufficiency of measurements to make a decision. This method achieves specified levels of false alarm and missed detection probabilities, while ensuring a close-to-minimal number of measurements for reaching a decision. This method minimizes the ghost-source problem of current estimation methods, and achieves a lower false alarm rate compared with current detection methods. This method is tested and demonstrated using: (1) simulations, and (2) a test-bed that utilizes the scaling properties of point radiation sources to emulate high intensity ones that cannot be easily and safely handled in laboratory experiments.

We present the design, implementation, and experimental evaluation of a wireless sensor network for near real-time structural health monitoring. We use simple custom-built gages to unequivocally detect cracks in critical structural elements. The main data reports have a low data rate and are naturally resilient to loss. We show how a variety of low-cost, off-the-shelf data acquisition/communication devices can be used to support remote monitoring by a control center. The heterogeneous hardware is accommodated by the use of open technology standards, and a software architecture that is portable, modular, and highly configurable. We present an experimental evaluation of our structural assessment network, using a full-scale three-story reinforced concrete building, subjected to lateral forces emulating forces induced by earthquakes. Our results show that a set of 12 strategically positioned sensors on the three floors achieved a zero false-alarm rate, in the sense that each reported breakage can be traced to cracks exceeding the specified total width, and a 100% detection rate for cracks that are covered by a sensor.

The localization of a radioactive source can be solved in closed-form using 4 ideal sensors and the Apollonius circle in a noise- and error-free environment. When measurement errors and noise such as background radiation are considered, a larger number of sensors is needed to produce accurate results, particularly for extremely low source intensities. In this paper, we present an efficient fusion algorithm that can exploit measurements from n sensors to improve the localization accuracy, and show how the accuracy scales with n. We report testbed results for a 0.911 μCi source to illustrate the effectiveness of our algorithm, in particular performance comparisons with state-of-the-art fusion algorithms based on Mean of Estimates (MoE) and Maximum Likelihood Estimation (MLE). We show that ITP is more accurate than MoE, whereas the choice between ITP and MLE is generally a tradeoff between accuracy and run time efficiency. Higher-intensity radioactive sources are not safe for actual experiments. In this case, we present simulation results based on a validated simulation model. We show that a low-intensity 400 μCi source, similar to the radioactivity of a concealed dirty bomb, can be localized to within 32.5 m using a sensor density of about 1 per 1100 m 2 in a surveillance area.

Defending against denial-of-service (DoS) in a mobile ad hoc network (MANET) is challenging because the network topology is dynamic and nodes are selfish. In this paper, we propose a DoS mitigation technique that uses digital signatures to verify legitimate packets, and drop packets that do not pass the verification. Since nodes are selfish, they may not perform the verification so that they can avoid paying the overhead. A bad packet that escapes verification along the whole network path will bring a penalty to all its forwarders. A network game can be formulated in which nodes along a network path, in optimizing their own benefits, are encouraged to act collectively to filter out bad packets. Analytical results show that Nash equilibrium can be attained for players in the proposed game, in which significant benefits can be provided to forwarders such that many of the bad packets will be eliminated by verification.

No abstract available.

In this paper, we develop concepts of network coverage by a set of mobile wireless sensors for given AOIs, possibly under given deadline constraints. We present analytical results to characterize various basic statistical properties of AOI coverage, when sensors move according to the random waypoint model -either by design or when carried by mobile hosts engaging in random movement -within a closed network area with boundaries.

The transmission energy required for a wireless communication increases superlinearly with the communication distance. In a mobile wireless network, nodal movement can be exploited to greatly reduce the energy required by postponing communication until the sender moves close to a target receiver, subject to application deadline constraints. In this paper, we characterize the fundamental performance limit, namely the lower bound expected communication distance, achievable by any postponement algorithm within given deadline constraints. We consider a realistic map based stochastic movement model, of which the well known random waypoint model is a special case. For the random waypoint model, we develop a tight analytical lower bound of the achievable expected communication distance. For the general map-based model, we characterize the lower bound distance experimentally. We also address the practical attainment of distance reduction (and hence, energy savings) through movement predicted communication. Specifically, whereas prior work has presented a least distance (LD) postponement algorithm and established its effectiveness experimentally, we provide an absolute performance measure of how closely LD can match the theoretical optimum. We show that LD achieves an average reduction in the expected communication distance within 62% to 94% of the optimal, over a realistic range of nodal speeds, for both the map based and random waypoint models. Moreover, the algorithm's absolute performance increases as the nodal speed or the allowable postponement delay increases.

We study the problem of a mobile target (the mouse) trying to evade detection by one or more mobile sensors (we call such a sensor a cat) in a closed network area. We view our problem as a game between two players: the mouse, and the collection of cats forming a single (meta-)player. The game ends when the mouse falls within the sensing range of one or more cats. A cat tries to determine its optimal strategy to minimize the worst case expected detection time of the mouse. The mouse tries to determine an optimal counter movement strategy to maximize the expected detection time. We divide the problem into two cases based on the relative sensing capabilities of the cats and the mouse. When the mouse has a larger sensing range than the cats, we show how the mouse can determine its optimal movement strategy based on local observations of the cats' movements. When the mouse has a sensing range smaller than or equal to the cats', we develop a dynamic programming solution for the mouse's optimal strategy, assuming high level information about the cats' movement model. We discuss how the cats' chosen movement model will affect its presence matrix in the network, and hence its payoff in the game. Extensive experimental results verify and illustrate the analytical results, and evaluate the game's payoffs as a function of several important system parameters.

Public-access networks need to handle persistent congestion and overload caused by high bandwidth aggregates that may occur during times of flooding-based DDoS attacks or flash crowds. The often unpredictable nature of these two activities can severely degrade server performance. Legitimate user requests also suffer considerably when traffic from many different sources aggregates inside the network and causes congestion. This paper studies a family of algorithms that "proactively" protect a server from overload by installing rate throttles in a set of upstream routers. Based on an optimal control setting, we propose algorithms that achieve throttling in a distributed and fair manner by taking important performance metrics into consideration, such as minimizing overall load variations. Using ns-2 simulations, we show that our proposed algorithms 1) are highly adaptive by avoiding unnecessary parameter configuration, 2) provide max-min fairness for any number of throttling routers, 3) respond very quickly to network changes, 4) are extremely robust against extrinsic factors beyond the system control, and 5) are stable under given delay bounds.

Node movement can be exploited to reduce the energy consumption of wireless network communication. The strategy consists in delaying communication until a mobile node moves close to its target peer node within an application- imposed deadline. We evaluate the performance of various heuristics that, based on the movement history of the mobile node, estimate an optimal time (in the sense of least energy use) of communication subject to the delay constraint. We evaluate the impact of the node movement model, length of movement history maintained, allowable delay, single hop versus multiple hop communication, and size of data transfer on the energy consumption. We also present measurement results on an iPAQ pocket PC that quantity energy consumption in executing the prediction algorithms. Our results show that, with relatively simple and, hence, efficient prediction heuristics, energy savings in communication can significantly outweigh the energy expenses in executing the prediction algorithms. Moreover, it is possible to achieve robust system performance across diverse node movement models.

High-bandwidth traffic aggregates may occur during times of flooding-based distributed denial-of-service attacks or flash crowds. Congestion control of these traffic aggregates is important to avoid congestion collapse of network services. This paper presents a class of feedback-control algorithms that proactively protect a network server from overload by installing rate throttles in a set of upstream routers. A control-theoretical framework is proposed to optimize the control setting such that throttling can be achieved in a distributed and fair manner. We develop control-theoretic algorithms that (1) are highly adaptive by avoiding the configuration of unnecessary control parameters, (2) provide max-min fairness for any number of throttling routers, (3) respond very quickly to network changes, (4) are extremely robust against extrinsic factors beyond the system control, and (5) are stable under given delay bounds.

Energy efficiency in network communication is critical for wirelessly connected small computing devices, which run on limited battery capacity. Under realistic movement scenarios (e.g., a person traveling at airplane, automobile, or biking speed), a mobile sender can track its own movement and postpone communication (subject to application deadline constraints) until it moves close to the communication target. This will save significant energy of sending, which grows superlinearly with the communication distance in, say, the single hop wireless context. However, movement tracking requires the mobile device to be turned on and hence consumes energy. Instead of continuous tracking, the mobile device should sample its movement and be allowed to sleep between the sampling instants (provided that the application also does not have work to do during the sleep). In this paper, we present an adaptive scheduler for determining an effective sampling schedule given changing operating conditions. Our experimental results show that the scheduler can achieve substantial energy savings over a device that is always on. Moreover, the scheduler's adaptivity allows it to outperform fixed sleep periods between tracking, since the "right" sleep period depends on dynamic system conditions and cannot be determined a priori.

Because of limited server and network capacities for streaming applications, multimedia proxies are commonly used to cache multimedia objects such that, by accessing nearby proxies, clients can enjoy a smaller start-up latency and receive a better quality-of-service (QoS) guarantee-for example, reduced packet loss and delay jitters for their requests. However, the use of multimedia proxies increases the risk that multimedia data are exposed to unauthorized access by intruders. In this paper, we present a framework for implementing a secure multimedia proxy system for audio and video streaming applications. The framework employs a notion of asymmetric reversible parametric sequence (ARPS) to provide the following security properties: i) data confidentiality during transmission, ii) end-to-end data confidentiality, iii) data confidentiality against proxy intruders, and iv) data confidentiality against member collusion. Our framework is grounded on a multikey RSA technique such that system resilience against attacks is provably strong given standard computability assumptions. One important feature of our proposed scheme is that clients only need to perform a single decryption operation to recover the original data even though the data packets may have been encrypted by multiple proxies along the delivery path. We also propose the use of a set of encryption configuration parameters (ECP) to trade off proxy encryption throughput against the presentation quality of audio/video obtained by unauthorized parties. Implementation results show that we can simultaneously achieve high encryption throughput and extremely low video quality (in terms of peak signal-to-noise ratio and visual quality of decoded video frames) for unauthorized access.

Our work targets a network architecture and accompanying algorithms for countering distributed denial-of-service (DDoS) attacks directed at an Internet server. The basic mechanism is for a server under stress to install a router throttle at selected upstream routers. The throttle can be the leaky-bucket rate at which a router can forward packets destined for the server. Hence, before aggressive packets can converge to overwhelm the server, participating routers proactively regulate the contributing packet rates to more moderate levels, thus forestalling an impending attack. In allocating the server capacity among the routers, we propose a notion of level-k max-min fairness. We first present a control-theoretic model to evaluate algorithm convergence under a variety of system parameters. In addition, we present packet network simulation results using a realistic global network topology, and various models of good user and attacker distributions and behavior. Using a generator model of web requests parameterized by empirical data, we also evaluate the impact of throttling in protecting user access to a web server. First, for aggressive attackers, the throttle mechanism is highly effective in preferentially dropping attacker traffic over good user traffic. In particular, level-k max-min fairness gives better good-user protection than recursive pushback of max-min fair rate limits proposed in the literature. Second, throttling can regulate the experienced server load to below its design limit - in the presence of user dynamics - so that the server can remain operational during a DDoS attack. Lastly, we present implementation results of our prototype on a Pentium III/866 MHz machine. The results show that router throttling has low deployment overhead in time and memory.

There is currently an urgent need for effective solutions against distributed denial-of-service (DDoS) attacks directed at many well-known Web sites. Because of increased sophistication and severity of these attacks, the system administrator of a victim site needs to quickly and accurately identify the probable attackers and eliminate the attack traffic. Our work is based on a probabilistic marking algorithm in which an attack graph can be constructed by a victim site. We extend the basic concept such that one can quickly and efficiently deduce the intensity of the "local traffic" generated at each router in the attack graph based on the volume of received marked packets at the victim site. Given the intensities of these local traffic rates, we can rank the local traffic and identify the network domains generating most of the attack traffic. We present our trace back and attacker identification algorithms. We also provide a theoretical framework to determine the minimum stable time t/sub min/, which is the minimum time needed to accurately determine the locations of attackers and local traffic rates of participating routers in the attack graph. Extensive experiments are carried out to illustrate that one can accurately determine the minimum stable time t/sub min/ and, at the same time, determine the location of attackers under various threshold parameters, network diameters, attack traffic distributions, on/off patterns, and network traffic conditions.

The current peer-to-peer (P2P) information sharing paradigm does not provide incentive and service differentiation for users. Since there is no motivation to share information or resources, this leads to the "free-riding" and the "tragedy of the commons" problems. We address how one can incorporate incentive into the P2P information sharing paradigm so as to encourage users to share information and resources. Our mechanism (or protocol) provides service differentiation to users with different contribution values and connection types. The mechanism also has some desirable properties: (1) conservation of cumulative contribution and social utility in the P2P community, (2) maximization of social utility if all requesting clients have the same contribution value, and (3) incentive-based resource distribution. The resource distribution algorithm and the contribution update algorithm are computationally efficient and can be easily implemented. Experimental results illustrate the efficiency and fairness of our algorithms.

We consider a distributed approach to detect and to defend against the low-rate TCP attack (A. Kuzmanovic et al., August 2003). The low-rate TCP attack is essentially a periodic short burst which exploits the homogeneity of the minimum retransmission timeout (RTO) of TCP flows and forces all affected TCP flows to back off and enter the retransmission timeout state. This sort of attack is difficult to identify due to a large family of attack patterns. We propose a distributed detection mechanism which uses the dynamic time warping method to robustly and accurately identify the existence of this sort of attack. Once the attack is detected, a fair resource allocation mechanism is used so that (1) the number of affected TCP flows is minimized, and (2) we provide sufficient resource protection for the affected TCP flows. We report experimental results to quantify the robustness and accuracy of the proposed detection mechanism and the efficiency of the defense method.

This paper considers the problem of how to construct and maintain an overlay structured P2P network based on the small world paradigm. Two main attractive properties of a small world network are (1) low average hop distance between any two randomly chosen nodes, and (2) high clustering coefficient of nodes. Having a low average hop distance implies a low latency for object lookup, while having a high clustering coefficient implies the underlying network can effectively provide object lookup even under heavy demands (for example, in a flash crowd scenario). We present a small world overlay protocol (SWOP) for constructing a small world overlay P2P network. We compare the performance of our system with that of other structured P2P networks such as Chord. We show that the SWOP protocol can achieve improved object lookup performance over the existing protocols. We also exploit the high clustering coefficient of a SWOP network to design an object replication algorithm that can effectively handle heavy object lookup traffic. As a result, a SWOP network can quickly and efficiently deliver popular and dynamic objects to a large number of requesting nodes. To the best of our knowledge, ours is the first piece of work that addresses how to handle dynamic flash crowds in a structured P2P network environment.

Traditional peer-to-peer (P2P) networks do not provide service differentiation and incentive for users. Consequently, users can obtain services without themselves contributing any information or service to a P2P community. This leads to the "free-riding" and "tragedy of the commons" problems, in which the majority of information requests are directed towards a small number of P2P nodes willing to share their resources. The objective of this work is to enable service differentiation in a P2P network based on the amount of services each node has provided to its community, thereby encouraging all network nodes to share resources. We first introduce a resource distribution mechanism between all information sharing nodes. The mechanism is driven by a distributed algorithm which has linear time complexity and guarantees Pareto-optimal resource allocation. Besides giving incentive, the mechanism distributes resources in a way that increases the aggregate utility of the whole network. Second, we model the whole resource request and distribution process as a competition game between the competing nodes. We show that this game has a Nash equilibrium and is collusion-proof. To realize the game, we propose a protocol in which all competing nodes interact with the information providing node to reach Nash equilibrium in a dynamic and efficient manner. Experimental results are reported to illustrate that the protocol achieves its service differentiation objective and can induce productive information sharing by rational network nodes. Finally, we show that our protocol can properly adapt to different node arrival and departure events, and to different forms of network congestion.

We consider a Web server that can provide differentiated services to clients with different quality of service (QoS) requirements. The Web server can provide N/spl ges/1 classes of proportional-delay differentiated services (PDDS) to heterogeneous clients. An operator can specify fixed performance spacings between classes, namely, r/sub i,i+1/>1, for i=1,..., N-1. Requests in class i+1 are guaranteed to have an average waiting time which is 1/r/sub i,i+1/ of the average waiting time of class i requests. With PDDS, we can provide consistent performance spacings over a wide range of system loading and this simplifies many pricing issues. In addition, each client can specify a maximum average waiting time requirement to be guaranteed by the PDDS-enabled Web server. We show that, in general, the problem of assigning clients to service classes in order to optimize system efficacy is NP-complete. We propose two efficient admission control algorithms so that a Web server can provide the QoS guarantees and, at the same time, classify each client to its "lowest" admissible class, resulting in lowest usage cost for the admitted client. We also consider how to perform end-point dynamic adaptation such that admitted clients can submit requests at a lower class and further reduce their usage costs without violating their QoS requirements. We propose two dynamic adaptation algorithms: one is server-based and the other is client-based. The client-based adaptation is distributed and is based on a noncooperative game technique. We carry out experiments to illustrate the effectiveness of these algorithms under different utility functions and traffic arrival patterns (e.g., Poisson, MMPP, and Pareto). We report extensive experimental results to illustrate the effectiveness of our proposed algorithms.

Node movement can be exploited to reduce the energy consumption of wireless network communication. The strategy consists in delaying communication until a mobile node moves close to its target peer node, within an application-imposed deadline. We evaluate the performance of various heuristics that, based on the movement history of the mobile node, estimate an optimal time (in the sense of least energy use) of communication subject to the delay constraint. We evaluate the impact of node movement model, length of movement history maintained, allowable delay, single hop versus multiple hop communication, and size of data transfer on the energy consumption. We also present measurement results on an iPAQ pocket PC that quantify energy consumption in executing the prediction algorithms. Our results show that, with relatively simple and hence efficient prediction heuristics, energy savings in communication can significantly outweigh the energy expenses in executing the prediction algorithms.

One of the principal concerns of wireless computing is the limited battery life of mobile devices. To address the concern, application-aware adaptation has emerged as one of the effective strategies for controlling energy usage. But for adaptation to be effective, we must be able to predict the energy requirement of running applications, in an application-specific manner. This paper reports a set of experiments performed to understand the energy usage pattern of handheld devices while decoding and displaying MPEG compressed video in software. Experiments are designed to bring forth parameters that can be used to predict the energy requirement for MPEG playback. Based on our experimental results, we find that it is possible to construct simple polynomial models of energy usage with good least square fit (R value of 0.92 and higher). These models can be used to predict application energy requirement under various combinations of controllable video parameters.

We consider several distributed collaborative key agreement protocols for dynamic peer groups. This problem has several important characteristics which make it different from traditional secure group communication. They are (1) the distributed nature in which there is no centralized key server, (2) collaborative nature in which the group key is contributory; i.e., each group member will collaboratively contribute its part to the global group key, and (3) the dynamic nature in which existing members can leave the group while new members may join. Instead of performing individual rekey operations, i.e., recomputing the group key after every join or leave request, we consider an interval-based approach of rekeying. In particular, we consider three distributed algorithms for updating the group key: (1) the rebuild algorithm, (2) the batch algorithm, and (3) the queue-batch algorithm. Performance of these distributed algorithms under different settings, such as different join and leave probabilities, is analyzed. We show that these three distributed algorithms significantly outperform the individual rekey algorithm, and that the queue-batch algorithm performs the best among the three distributed algorithms. Moreover the queue-batch algorithm has the intrinsic property of balancing the computation/communication workload such that the dynamic peer group can quickly begin secure group communication. This provides a fundamental understanding about establishing a collaborative group key for a distributed dynamic peer group.

Because of limited server and network capacities in multimedia streaming, proxies are commonly used to cache multimedia objects such that, by accessing nearby proxies, clients can enjoy smaller start-up latencies and reduced packet loss and delay jitters for their requests. However, the use of video proxies increases the risk that multimedia data are exposed to unauthorized access by intruders. In this paper, we present a framework for implementing a secure video proxy or, more generally, a secure proxy architecture. The framework employs a notion of asymmetric reversible parametric sequences to provide the following security properties: (1) data confidentiality during transmission, (2) end-to-end data confidentiality, (3) data confidentiality against proxy intruders, and (4) data confidentiality against member collusion. Our framework is grounded on a multi-key RSA technique such that system resilience against attacks is provably strong given standard computability assumptions. We also propose the use of a set of encryption configuration parameters to trade off proxy encryption throughput against the viewing quality of video by unauthorized parties. Implementation results on a Pentium III/800 MHz machine show that our techniques can simultaneously achieve high encryption throughput and extremely low video quality (in terms of both PSNR and the visual quality of decoded frames) during unauthorized viewing.

We consider a web server that can provide differentiated services to clients with different QoS requirements. The web server can provide N > 1 classes of service. Rather than using a strict priority policy , which may lead to request starvation, the web server provides a proportional-delay differentiated service (PDDS) to heterogeneous clients. An operator for the web server can specify "fixed" performance spacings between classes, namely, ri,i+1 > 1, for i = 1,…,N - 1. Requests in class i + 1 are guaranteed to have an average waiting time which is 1/ri,i+1 of the average waiting time of class i requests. With PDDS, we can provide consistent performance spacings over a wide range of system loadings. In addition, each client can specify a maximum average waiting time requirement to be guaranteed by the web server. We propose two efficient admission control algorithms so that a web server can provide the QoS guarantees and, at the same time, classify each client to its "lowest" admissible class, resulting in lowest usage cost for the client. We also consider how to perform end-point dynamic adaptation such that clients can submit requests at lower class and further reduce their usage cost, without violating their QoS requirements. We propose two dynamic adaptation algorithms: one is server-based and the other is client-based. The client-based adaptation is based on a non-cooperative game technique. We report diverse experimental results to illustrate the effectiveness of these algorithms.

Future routers will not only forward data packets but also provide value-added services, such as security, accounting, caching, and resource management. These services ran be implemented as general programs, to be invoked by traversing packets embedding router program calls. Software-programmable routers pose new challenges in the design of router operating systems (OS). First, router programs will require access to diverse system resources. The resource demands of a large community of heterogeneous resource consumers must either be coordinated to enable cooperation or arbitrated to resolve competition. Second, it is beneficial to concurrently support multiple virtual machines, each with a guaranteed share of physical resources. This allows services to be customized and to seamlessly evolve. We present the design and implementation of a next generation router OS that can meet the above challenges. We define an orthogonal kernel abstraction of resource allocation, which can schedule various time-shared and space-shared resources with quality of service (QoS) differentiation and guarantees. A scalable and flexible packet classifier enables dynamic resource binding and per-flow processing of received packets. We have prototyped our system on a network of UltraSPARC and Pentium II computers. Currently, QoS-aware schedulers for CPU time, forwarding bandwidth, memory-store capacity, and capacity for secondary data stores have been integrated. We present experimental results on various aspects of resource management in our system.

We propose a new automatic image segmentation method. Color edges in an image are first obtained automatically by combining an improved isotropic edge detector and a fast entropic thresholding technique. After the obtained color edges have provided the major geometric structures in an image, the centroids between these adjacent edge regions are taken as the initial seeds for seeded region growing (SRG). These seeds are then replaced by the centroids of the generated homogeneous image regions by incorporating the required additional pixels step by step. Moreover, the results of color-edge extraction and SRG are integrated to provide homogeneous image regions with accurate and closed boundaries. We also discuss the application of our image segmentation method to automatic face detection. Furthermore, semantic human objects are generated by a seeded region aggregation procedure which takes the detected faces as object seeds.

We examine a proportional-delay model for Internet differentiated services. Under this model, an Internet service provider (ISP) can control the waiting-time "spacings" between different classes of traffic. Specifically, the ISP tries to ensure that the average waiting time of class i traffic relative to that of class i-1 traffic is kept at a constant specified ratio. If the waiting-time ratio of class i-1 to class i is greater than one, the ISP can legitimately charge users of class i traffic a higher tariff rate (compared to the rate for class i-1 traffic), since class i users consistently enjoy better performance than class i-1 users. To realize such proportional-delay differentiated services, we use the time-dependent priority scheduling algorithm. We formally characterize the feasible regions in which given delay ratios can be achieved. Moreover, a set of control parameters for obtaining the desired delay ratios can be determined by an efficient iterative algorithm. We also use an adaptive control algorithm to maintain the correctness of these parameters in response to changing system load. Experiments are carried out to illustrate the short-term, medium-term and long-term relative waiting-time performances for different service classes under Poisson, Pareto, MMPP and mixed traffic workloads. We also carry out experiments to evaluate the achieved end-to-end accumulative waiting times for different classes of traffic which traverse multiple hops under our service model.

We consider a proportional delay model for Internet differentiated services. Under this model, an ISP can control the "spacing" of waiting times between different classes of traffic. Specifically, the ISP tries to ensure that the average waiting time of class i traffic relative to that of class i-1 traffic is consistently a specifiable ratio. If the ratio is less than one, the ISP can legitimately charge users of class i traffic a higher tariff rate (compared to the rate for class i-1 traffic), since class i users consistently enjoy better performance than class i-1 users. We use time-dependent priority scheduling to realize the proportional delay model. We formally characterize the feasible regions in which given delay ratios can be achieved. Moreover a set of scheduling parameters for obtaining the desired delay ratios can be determined by an efficient control algorithm. Experiments are carried out to illustrate the short-term, medium-term and long-term relative waiting time performances for different service classes.

We have been investigating an end system architecture to support networking with quality of service guarantees. For user level protocol code in our architecture to access the network, we have designed a kernel–user interface. The interface targets three areas for improvement: reduced copying, reduced reliance on explicit kernel–user interactions, and provision of rate-based flow control. In this paper, we present the concept of input–output efficient buffers for reduced copying, the concept of fast system calls for low-latency network access, and the concept of kernel threads for flow control. Also included is a concept called direct media streaming which is suitable for applications that require limited user processing of media data. These concepts have been implemented as an extension to SunOS 5.3 (the operating system component of Solaris 2.3). We report some experimental results on the performance of our current system. © 1998 John Wiley & Sons, Inc.

We present an end system architecture designed to support networking with quality of service (QoS) guarantees. The protocol processing component of the architecture, called migrating sockets, has been designed with minimal hidden scheduling which enables accurate determination of the rate requirement of a user application. The end system provides QoS guarantees using: 1) an adaptive rate-controlled scheduler; 2) rate-based flow control on the send side for access to reserved-rate network connections; and 3) a constant overhead active demultiplexing mechanism on the receive side which can be transparently enabled in wide-area TCP/IP internetworking (although it is not restricted to TCP/IP). To achieve efficiency, migrating sockets lets user applications manage network endpoints with minimal system intervention, provides user level protocols read-only access to routing information, and integrates kernel level support previously built for efficient data movement. Migrating sockets is backward compatible with Unix semantics and Berkeley sockets. It has been used to implement Internet protocols such as TCP, UDP, and IP (including IP multicast), and run existing applications such as vic. Migrating sockets has been implemented in Solaris 2.5.1. We discuss our implementation experience, and present performance results of our system running on Sun Sparc and Ultra workstations, as well as Pentium-II desktops.

Migrating Sockets is the protocol processing component of an end system architecture designed for networking with QoS guarantees. The architecture provides: (1) adaptive rate-controlled scheduling of protocol threads in Migrating Sockets, (2) rate-based flow control for reserved rate connections in future integrated services networks, and (3) a constant overhead active demultiplexing mechanism. Migrating Sockets achieves its efficiency by allowing user applications to manage a network endpoint with minimal system intervention, providing user level protocols read-only access to routing information in a "well-known" shared memory region, and integrating efficient kernel level support we previously built. It is backward compatible with Unix semantics and Berkeley sockets, and has been used to implement Internet protocols such as TCP, UDP and IP (including IP multicast). We also show that active demultiplexing supported by Migrating Sockets can be transparently enabled in wide-area TCP/IP internetworking (although it is not restricted to TCP/IP). We have an implementation of Migrating Sockets in Solaris 2.5. We discuss our implementation experience, and present performance results of our system running on the Ultra-1, SPARC 10 and SPARC 20 architectures.

We present a framework for integrated scheduling of continuous media (CM) and other applications. The framework, called ARC scheduling, consists of a rate-controlled on-line CPU scheduler, an admission control interface, a monitoring module, and a rate adaptation interface. ARC scheduling allows threads to reserve CPU time for guaranteed progress. It provides firewall protection between threads such that the progress guarantee to a thread is independent of how other threads actually make scheduling requests. Rate adaptation allows a CM application to adapt its rate to changes in its execution environment. We have implemented the framework as an extension to Solaris 2.3. We present experimental results which show that ARC scheduling is highly effective for integrated scheduling of CM and other applications in a general purpose workstation environment. ARC scheduling is a key component of an end system architecture we have designed and implemented to support networking with quality of service guarantees. In particular, it enables protocol threads to make guaranteed progress.

We present a framework for integrated scheduling of continuous media (CM) and other applications.The framework consists of a rate-controlled on-line CPU scheduler, an admission control interface, a monitoring module and a rate adaptation interface.Rate-controlled scheduling allows processes to reserve CPU time to achieve progress guarantees.It provides firewall protection between processes such that the progress guarantee to a process is independent of how other processes actually make scheduling requests.Rate adaptation allows a CM application to adapt its rate to changes in its execution environment.We have implemented the scheduling framework as an extension to Solaris 2.3.We present experimental results which show that our framework is highly effective in scheduling CM and various other applications in a general purpose workstation environment, KEYWORDS: Continuous media, CPU scheduling, adaptive rate control, rate reservation, QoS guarantee, firewall property

Interframe coding techniques, such as those used in MPEG video, give rise to a sequence of encoded pictures whose sizes (in number of bits) differ by a factor of ten or more. Buffering is needed to reduce fluctuations in the rate at which video packets are sent to a network connection. We design and specify a lossless smoothing algorithm, characterized by three parameters: D (delay bound), X (number of pictures with known sizes), and H (lookahead interval). We prove a theorem which guarantees that, if K/spl ges/1, the algorithm finds a solution that satisfies the delay bound. We present the algorithm's performance from a large number of experiments conducted using MPEG video traces. Lastly, we discuss algorithm implementation.

Interframe compression techniques, such as those used in MPEG video, give rise to a coded bit stream where picture sizes differ by a factor of 10 or more. As a result, buffering is needed to reduce (smooth) rate fluctuations of encoder output from one picture to the next; without smoothing, the performance of networks that carry such video traffic would be adversely affected. Various techniques have been suggested for controlling the output rate of a VBR encoder to alleviate network congestion or prevent buffer overflow. Most of these techniques, however, are lossy, and should be used only as a last resort. In this paper, we design and specify an algorithm for lossless smoothing. The algorithm is characterized by three parameters: D (delay bound), K (number of pictures with known sizes), and H (lookahead interval). We present a theorem which guarantees that, if K ≥ 1, the algorithm finds a solution that satisfies the delay bound. (Although the algorithm and theorem were motivated by MPEG video, they are applicable to the smoothing of compressed video in general). To study performance characteristics of the algorithm, we conducted a large number of experiments using statistics from four MPEG video sequences.