This article presents ${\text{DiNATrA}}{\mathcal{X}}$, an innovative methodology for the automated detection of network anomalies in heterogeneous environments (mobile, ethernet) or of different scopes (LAN, MAN, WAN). ${\text{DiNATrA}}{\mathcal{X}}$ is based on three main functional blocks: data collection and pre-processing, analysis by sectors of interest (SOI) and anomaly detection itself. This framework combines temporal modeling (Time Period, Slice & Slot) and digital signatures (DNAs) to identify and quantify variations in network behavior in order to extract any anomalies.Evaluated on two real data sets of completely different natures, namely CANCAN (mobile traffic from French operator Orange) and CTU-13 (botnet traffic), the ${\text{DiNATrA}}{\mathcal{X}}$ methodology demonstrated its effectiveness in detecting major events and the malicious activity of various botnets. These results underline the ability to detect anomalies linked to concrete events, such as outages, crowd movements or attacks, while adapting to the needs of the user attacks, by adapting to the different network topologies, ${\text{DiNATrA}}{\mathcal{X}}$ stands out for its generic, cyclic, fractal, and interpretable aspects, offering a robust reliable alternative to traditional methods based on raw network traffic analysis or statistical approaches.

Network anomaly detection remains an important research topic in the field of cybersecurity. A network anomaly can be defined as an activity or event that does not correspond to an expected or established traffic behavior. This includes traffic due to cybersecurity attacks (intrusions, malware, DDoS, phishing, etc.), technical failures, or operational errors. Distinguishing between normal and abnormal traffic is essential. Normal traffic is usually defined by a statistical baseline or an expected behavior model, while abnormal traffic deviates from this norm. To detect these anomalies, we propose our framework named$\text{DiNATrA}\mathcal{X}$. It is a generic, cyclical, adaptable, and automatable methodology based on the use of different unsupervised machine learning algorithms.$\text{DiNATrA}\mathcal{X}$is organized into 3 functional blocks. The first block aims to collect and pre-process raw network data. The second block allows for the splitting of the network in order to define logical sectors for analysis. For each of these, a digital signature is generated at regular intervals. These signatures constitute our baseline for comparing network flows. Then, for each of these signatures, we calculate its DNA which allows us to automate the comparison of different signatures. This comparison is performed by the third block which calculates the abnormality distance between 2 consecutive DNAs. If a high abnormality distance is detected, it highlights a variation in network activity and therefore an anomaly which may be correlated with a particular event. Our solution allows us to highligt seven real anomalies correlated to real events from two particular sectors.

Blockchains are used to store and transmit digital and secure information. This is made possible by creating a chain of chronologically and cryptographically linked data blocks. An oracle is often used to feed the blockchain to ensure the data inserted are reliable. The nature of data sent to the oracle can vary a lot from one application to another. In the scope of the Internet of Things, data provided by sensors may be corrupted when the sensor is damaged or has been corrupted. In this case, it is important for the oracle to include an efficient tool able to detect these outliers. The Grubbs test is such an efficient tool. This article aims at presenting the impact of the use of the Grubbs test on the performance of the oracle. It shows that not only it allows to significantly increase the quality of the data inserted in the blockchain by identifying outliers, it also keeps the algorithmic complexity of the oracle as low as possible.

A method to improve dynamic service provision is presented, catering to variable future demands while minimizing energy consumption and waiting times, maximizing customer satisfaction. The approach involves dynamic service dispatch reconfiguration at predefined intervals, addressing optimal solutions through iterative single-variable resolution. We propose a pseudo-optimal minimization problem approximating the optimal solution without requiring demand statistics, offering a simple expression. The research establishes effectiveness via a mathematical model and practical implementation using a Google-provided dataset, illustrating real-world applicability.

Various machine learning or clustering techniques are applicable for identifying anomalous activities or particular events in networks by analysing data flows. In this paper we present our networks anomalies detection system which is based on a framework that we named Unsupervised Anomaly Knowledge Flow. Our approach consists of aggregating pre-processed network flows into well-known areas named sectors. For each sector, data describing users activity are aggregated and split into different equal time-periods. After this step, an unsupervised clustering algorithm is employed to extract the digital signatures defining sectors activity. If a specific sector signature for one specific period differs from others, it means that a network anomaly relative to users activity has been detected. A last step is performed to associate highlighted anomalies with their respective events. This framework originality are its generic, cyclic and fractal aspects. Our experiments have been conducted by using a real dataset captured and provided in 2019 by a major French mobile operator. Our proposed knowledge flow is able to detect anomalies related to real crowded events like the Notre-Dame de Paris fire, concerts or soccer matches. For this study, sectors have been computed by using geographic coordinates defining the base transmitting stations, and anomalies are reliant on network activity features.

The goal of this article is to present a hardware and software architecture developed for the evaluation of road anomaly detection algorithms, its different components and the solutions we developed to optimize the use of the bandwidth during communications. It also presents some significant results obtained with the new lightweight road-anomaly detection methods we developed in the scope of this architecture.

Multi-access Edge Computing (MEC) technology has emerged to overcome traditional cloud computing limitations, challenged by the new 5G services with heavy and heterogeneous requirements on both latency and bandwidth. In this work, we tackle the problem of clustering access points in MEC environments, introducing a set of clustering models to be deployed at the pre-provisioning phase. We go through extensive simulations on real-world traffic demands to evaluate the performance of the proposed solutions. In addition, we show how MEC hosts capacity violation can be decreased when integrating access points clustering into the orchestration model, by investigating on solution accuracy when applied on held-out users traffic demands. The obtained results show that our approach outperforms two state-of-the-art algorithms, reducing both memory usage and execution time, by 46% and 50%, respectively, in comparison to a baseline algorithm. It surpasses the two methods in gaining control over MEC hosts capacity usage for different maximum achieved occupancy levels on MEC hosts.

Nowadays, botnet-based attacks are the most preva-lent cyber-threats type. It is therefore essential to detect this kind of malware using efficient bots detection techniques. This paper presents our security anomalies detection system, based on a model that we named Combined Forest. Our approach consists of merging some pre-processed Decision Trees to highlight different kinds of botnet by detecting their intrinsic exchanges. Using a supervised data approach, each tree is built from a labelled dataset. In order to achieve this, we aggregate the IP-flows into Traffic-flows to extract key features and avoid over-fitting. Then, we tested different machine learning algorithms and selected the most suitable one. After that, many experiments have been done to determine the best parameters and design the most accurate, adantative and efficient model.

In this paper we propose an alternative to the security protocols generally developed for VANETs (Vehicular Ad-hoc NETworks), which often rely on asymmetric keys and PKIs (Public Key Infrastructures). Instead, we propose a solution whose architecture is based on Physical Unclonable Functions (PUFs) inside the vehicles. We design a protocol with these PUF functions to securely spread a secret key by means of a Road Side Unit (RSU). This secret key will be used by the vehicles to warn neigboring vehicles of an emergency situation. The key is regularly changed by the RSU but its value evolves slowly over time in a random way. Thus a message using an old (but not too old) key can be accepted as valid. We define the whole protocol where a vehicle first identifies itself to the Road Side Unit for authentication. Then the RSU sends back a key which will be used to send alerts if an emergency situation occurs on the road. The RSU manages the evolution of this key by just randomly changing one bit at each change. Thus an alert can be accepted if the key used to issue an alert is "close" to the last key issued by the RSU. We investigate the advantages of this new scheme and evaluate the implications in terms of exchanges between the vehicles (and their PUFs) and the network connecting the RSUs.

Encryption is a very important way to secure data in storage and communication, and it is a process of encoding messages or information in such a manner that only authorised persons can access it. Different techniques are used to protect confidential image data against illicit access. In image encryption using chaotic systems, most authors use or design algorithms to generate the initial parameters’ values from the secret key. However, as the key size depends on the number of these parameters, the used algorithms show little sensitivity to small changes in the key. To enhance both security and sensitivity in the choice of the initial parameters, this work combines the use of the Grain‐128a stream cipher algorithm with two‐dimensional Zaslavsky chaotic map. Firstly, the Grain‐128a algorithm is applied to generate the required parameters of Zaslavsky's chaotic map from a fixed length 256‐bit secret key. Secondly, the sequences generated by the chaotic map are used to encrypt the image using a bit confusion and diffusion process. The simulation results on greyscale, colour, binary, indexed, and medical images together with the scores obtained in the evaluation of the algorithm show that the proposed method is very sure and effective in encrypting images of any size and any type.

Data Centers (DCs) need to periodically configure their servers in order to meet user demands. Since appropriate proactive management to meet demands reduces the cost, either by improving Quality of Service (QoS) or saving energy, there is a great interest in studying different proactive strategies based on predictions of the energy used to serve CPU and memory requests. The amount of savings that can be achieved depends not only on the selected proactive strategy but also on user-demand statistics and the predictors used. Despite its importance, it is difficult to find theoretical studies that quantify the savings that can be made, due to the problem complexity. A proactive DC management strategy is presented together with its upper bound of energy cost savings obtained with respect to a purely reactive management. Using this method together with records of the recent past, it is possible to quantify the efficiency of different predictors. Both linear and nonlinear predictors are studied, using a Google data set collected over 29 days, to evaluate the benefits that can be obtained with these two predictors.

In this work, we use the energy consumed by one bit of information per meter toward the destination as a local metric to be minimized in channels affected by shadow fading. Given a fixed amount of energy available for transmitting information, the proposed strategy consists in maximizing the amount of information delivered within a given time interval by optimizing both the transmission rate and power.

Data collected from an operational Google data center during 29 days represent a very rich and very useful source of information for understanding the main features of a data center. In this paper, we highlight the strong heterogeneity of jobs. The distribution of job execution duration shows a high disparity, as well as the job waiting time before being scheduled. The resource requests in terms of CPU and memory are also analyzed. The knowledge of all these features is needed to design models of jobs, machines and resource requests that are representative of a real data center.

Effectively transmit real continuous media stream in WMSNs, while ensuring its reliability to deal with various constraints, remains a serious problem, especially for critical and energy-intensive applications. Given the very low number of routing protocols that have approached the experimental phase and still less those who have tackled the issue related to fault tolerance during data transmission. In this paper, we evaluate experimentally on a real testbed the continuous media stream by introducing two fault-tolerant mechanisms implemented in the Geographic Multipath Fault Tolerant (GMFT) routing protocol over the Imote2 platform. We jointly consider sudden failures and those caused by total battery exhaustion during massive data transmission. Experimental results show promising performances, that outperform experimental existing solutions in terms of reliability for continuous media stream with distributed energy consumption which ensures a good load balancing in the network and extends positively its lifetime.

Traces collected from an operational Google data center over 29 days represent a very rich and useful source of information for understanding the main features of a data center. In this paper, we characterize the strong heterogeneity of jobs and the medium heterogeneity of machine configurations. We analyze the off-periods of machines. We study the distribution of jobs per category, per scheduling class, per priority and per number of tasks. The distribution of job execution durations shows a high disparity, as does the job waiting time before being scheduled. The resource requests in terms of CPU and memory are also analyzed. The distribution of these parameter values is very useful to develop accurate models and algorithms for resource allocation in data centers.

Multimedia applications convey large mass of data that requires high transmission rate and intensive treatment, therefore high energy consumption. Transmitting this large media stream while ensuring its reliability and varying QoS requirements with limited available resources are difficult tasks to achieve. In this paper, we present an Energy-efficient routing protocol baptized EGMFT, that improves our previous work on Geographic Multipath Fault Tolerant (GMFT) routing protocol, reinforced by preventive fault-tolerant mechanism, when sensor's energy reaches critical threshold, to effectively manage this precious resource, in order to achieve more balanced energy consumption and load distribution in the network that extends its lifetime. More importantly, to prevents any link breakdown related to battery depletion during real-time data transmission, which affects network connectivity and transmitted stream reliability. Simulations results show significant contribution and indicate that EGMFT is highly advised to guarantee discrete data and continuous media stream reliability even in faulty network.

Location-based routings for Vehicular Ad-hoc Networks (VANETs) use location information in routing decisions. However, location-based routing protocols need location services to query the location information of the communication partner node so that packets could be forwarded properly. In this paper, we propose a proactive flooding-based location service which name is Semi-Flooding Location Service (SFLS). The basic design objective in our proposal is to minimize the number of update packets sent over the whole network. We employed a conditional update technique that manages the number of location updates at the forwarder nodes. This significantly reduces the overhead of location updates. To study the effectiveness of our algorithm, a mathematical model is developed, and some numerical results are provided. Results demonstrated that SFLS achieves its design goals.

The various reasons of failures that affect reliability of sensor nodes in addition to processing and transfer of large multimedia content (image, audio and video) have posed new challenges that are nowadays a real threat for routing protocols in Wireless Multimedia Sensor Networks (WMSNs), which aim to ensure flow delivery while guaranteeing QoS requirements. Moreover, extending network lifetime and maintaining network stability to cope with breaking links and topology changes (failures or sensor mobility), remain unsolved issues, particularly, during data transmission phase. Therefore, in this paper, we jointly consider multipath transmission, load balancing and fault tolerance, to enhance the reliability of transmitted data. We propose a Geographic Multipath routing protocol reinforced by Fault-Tolerant mechanism (GMFT). Theoricals results and those obtained from both simulation study and experiments on a real testbed demonstrate the validity and efficiency of our proposed protocol, and indicate that it is highly advised for multimedia transmission and network stability.

This article describes a stateless authentication protocol designed for sensor networks. A mutual authentication between a sensor and a sink can be useful in many applications such as the monitoring of electricity meters or surveillance and monitoring of industrial plants. The authentication protocol we propose can counter usual attacks on sensor networks. First, as it is based on a PUF function, it is efficient against physical node capture. An attacker can not get into the hardware of the sensor or the sink node to obtain the secret keys of the system even if the node is captured physically. Secondly, this protocol can also counter replay attacks since the authentication uses a time-stamp, and the time interval during which a replay attack could be launched can be controlled and greatly reduced. Thirdly, this protocol is stateless, and so the sink can be authenticated to many co-located sensors using a single authentication message. Moreover, the same message can combine the authentication with the transmission of encrypted or unencrypted data.

Sensor networks are often used to collect data in the environment. Nodes are used to sense the environment and sinks can be used then to collect data from the nodes and transfer them to a backend server for processing, analysis and/or visualization. As sensor nodes can collect critical data (e.g. for medical or military purposes), security is a crucial issue. This article presents a novel mechanism to perform a lightweight mutual authentication between a node and a sink based on simple processor operations and two messages only.

Mobile models aim to mimic human motion. Real traces aim at the same target. However, the latters are specific. They relate to a country or a region or smaller geographical places. Also, they cover at most few months of duration. In cons, Mobility models approach is more general in space and time for taking advantage of Social Theory. Mobile models are used in mobile networks routing protocols for testing purpose. To enhance random and pseudo-random mobility models, user social behavior has been introduced. Global results have already been published which demonstrates the realism of such models versus random and pseudo-random ones. In this paper, more in depth results which demonstrate with surprising deviations how far are random and pseudo-random mobility models from realistic motions, are given. By the way, we assess that taking into account social behaviors borrowed from Social Theory are more general and timeless, i.e. to our sense more realistic than real traces analysis.

One of the challenging problems in mobility modeling on Mobile Ad-hoc NETworks (MANET) is reproducing real motion of mobile nodes. First mobility models were mostly random or with some dependencies (temporal, spatial, geographical,...) but they didn't care about the need of people to socialize with each other. The social behavior of users must not be neglected since it directs the motion of nodes in a network. In this paper we present a new approach in our effort in modeling the mobility on social networks. In this new approach, we add Ant Colony System (ACS) mechanism to our previous social models, after reformulating them mathematically. Then we develop the simulation tools we need and new models, under Opnet Modeler Simulator, and measure their impact on no dense and dense networks with OLSR and AODV AD-HOC Routing Protocols.

Geographic routing protocols have imposed significant challenges for Mobile Ad hoc NETworks (MANETs) to achieve scalability. These routing protocols use location information of mobile nodes in forwarding decisions. However, geographic routing protocols require location management services that handle the location updates sent by nodes and resolve their queries. Most of the location services found in MANET literature resolve the queries as the last stored location which usually makes degradation in the accuracy of the location information due to mobility. In this paper we propose a scalable and energy efficient location service which employs hierarchical geographic clustering structure and considers energy when selecting cluster leaders. Furthermore, our location service is mobility adaptive as it is assisted by mobility prediction model using the well known Kalman Filter. In the proposed protocol, the location servers estimate the locations of the mobile nodes by using the last location information instead of resolving the queries by the last known locations. Through computer simulation, we evaluate the performance of our proposal. Results show an improved performance of our proposal.

Mobile devices are carried by people, which are characterized by their need to socialize. The social character of mobile networks may have an influence in modeling the mobility of their nodes, and consequently in the performance evaluation of the network. In this paper, we introduce social behaviors into existing mobility models so as to mimic real motion of users and evaluate their impact on network performance. An example illustrates the paper by introducing weighted social attraction points into the Manhattan mobility model.

Location-based routing for Mobile Ad hoc Networks (MANETs) use location information in routing decisions. However, location-based routing protocols need location services to query the location information of the communication partner node so that packets could be forwarded properly. In this paper, we propose a proactive flooding-based location service which named Semi-Flooding Location Service (SFLS). The basic design issue in our proposal is to minimize the number of update packets sent over the whole network. We employed a conditional update technique that manages the number of the updates at the forwarder nodes. This way reduces significantly the overhead of location updates. To study the effectiveness of our algorithm, a mathematical model is developed, and some numerical results are generated. Results demonstrated that SFLS achieves its design goals.

After considering the intrinsically erratic behavior of nodes in mobile networks, mobility prediction has been extensively used to improve the quality of services. Many methods have been proposed, inherited from technologies developed for signal processing and self-learning techniques and/or stochastic methods. Among the latter the Extended Kalman Filter (EKF), using the received power as a measurement, is the most used. However, because the measure is not linear with distance, the EKF loses stability under certain circumstances and must be reset. Moreover, it requires the a priori knowledge of disturbances and measurement noise covariance matrices which are difficult to obtain. In this work, from the non-linear model, we derive a stable time-variant first order auto-regressive and moving average model (ARMA), and propose a prediction mechanism based on the well-known Recursive Prediction Error Method (RPEM) to predict the mobile location and then compare it with (EKF). Simulation results show that RPEM has a lower prediction error variance in most cases and similar in others to that obtained with EKF with the additional advantages that it has guaranteed stability and does not require the a priori knowledge of disturbances and measurement noise covariance matrices as in EKF.

Position-based routing is often proposed as a means to achieve scalability in large mobile ad hoc networks. However, such routing protocols are heavily dependent on the existence of scalable location management services. In recent years, many location service protocols have been proposed for ad hoc networks such as the Grid Location Service (GLS), and the Hierarchical Location Service (HLS). In these location services, when a mobile node's location is needed, the previously stored information in the location server is used. Location errors can occur due to infrequent and/or lost updates to location servers, especially when the nodes are highly mobile. A query to a location server fails when a node moves far away from its previous location rendering the previously stored location in the location servers invalid. In this paper we propose a location service called Predictive-Hierarchical Location Service (PHLS) that uses a hierarchy of regions to achieve scalability, and predicts the requested location by utilizing previous location information (location, velocity) to improve the location accuracy. Our simulation results have shown that PHLS outperforms HLS.

Mobility models are used in the network simulation area to reproduce the typical behaviour of nodes. If lots of mobility models have been proposed in the literature, very few are taking into account the social behaviour of users. In this paper, we propose a modelling framework to introduce social behaviours into existing mobility models so as to evaluate their impact on network performance. An example illustrates the paper by introducing social attraction points into the Manhattan mobility model.

RFID systems aim at identifying objects in a wide variety of environments without any contact between tags that hold identities and readers. In order to secure RFID systems as much as possible, most solutions do not only require tags to authenticate themselves to readers, but they also require readers to authenticate themselves to tags to avoid identity theft. Many solutions have tried to cope with this mutual authentication problem. In this article, we present an original lightweight mutual authentication protocol which requires only two messages and does not use complex cryptographic functions.

Radio Frequency Identification (RFID) technology is a method to remotely store and retrieve data using a small microchip called the RFID tag. This makes identification, authentication of objects and people possible without any physical contact between a tag and its reader. As of today, RFID have been applied to a wide range of problems: supply chain management to replace barcode, access control in restricted areas such as laboratories and airports... As a result, billions of tags will be deployed within the next years. However, RFID development is threatened by privacy and security risks. The limited capabilities of RFID tags make privacy and security enforcement a special challenge. This article presents a new method to ensure a mutual authentication between tags and readers using only two messages and without the use of complex cryptography. Our proposition focuses on low-capability tags which cannot use classic cryptographic security methods.

The satellite component of the future Universal Mobile Telecommunications System (UMTS) is anticipated to be partly composed of non-geostationary satellites such as Low-Earth Orbit (LEO) satellites. Those networks are designed to support multimedia traffic with different quality of service (QoS) requirements. This paper deals with the performance evaluation of a new channel resource management technique in Low-Earth Orbit (LEO) satellite systems based on a satellite-fixed cell concept. In cellular and satellite networks the resource capacity is shared among handovers and new calls. Forced termination has a significant impact on the quality of service perceived by the users. This is especially the case for those which have delay constraints (such as video or voice traffic). The guard channel scheme is an access priority that has been proposed in order to reduce the handover failure probability. Its effectiveness has been emphasized in terrestrial cellular networks. In this paper, we propose a dynamic reservation scheme for satellite networks which adapts the number of reserved channels, according to the current number of ongoing calls (voice or video traffic) and on the localization of users. A performance evaluation of the proposed mechanism has been carried out by simulations as regards with the blocking probabilities of each type of users.

Satellite systems will be employed to extend the terrestrial cellular networks and to provide a global coverage, for both mobile and fixed users. In these networks, the resource capacity is shared among handoffs and new calls. Forced termination has a significant impact on the user's quality of service. Several mechanisms such us guard channels or handoff queuing have been proposed in order to reduce handoff failure probability. The guard channel scheme consists in giving a prioritized access to the handoff calls. The penalty is the reduction of the total carried traffic. This paper proposes a dynamic reservation scheme for LEO satellite system, which adapts the number of reserved channel according to the current number of ongoing calls and on the localisation of users in the considered area.