We develop a method to help discover manipulation attacks in protocol implementations. In these attacks, adversaries induce honest nodes to exhibit undesirable behaviors by misrepresenting their intent or network conditions. Our method is based on a novel combination of static analysis with symbolic execution and dynamic analysis with concrete execution. The former finds code paths that are likely vulnerable, and the latter emulates adversarial actions that lead to effective attacks. Our method is precise (i.e., no false positives) and we show that it scales to complex protocol implementations. We apply it to four diverse protocols, including TCP, the 802.11 MAC, ECN, and SCTP, and show that it is able to find all manipulation attacks that have been previously reported for these protocols. We also find a previously unreported attack for SCTP. This attack is a variant of a TCP attack but must be mounted differently in SCTP because of subtle semantic differences between the two protocols.

Virtualization is often used in cloud computing platforms for its several advantages in efficiently managing resources. However, virtualization raises certain additional challenges, and one of them is lack of power metering for virtual machines (VMs). Power management requirements in modern data centers have led to most new servers providing power usage measurement in hardware and alternate solutions exist for older servers using circuit and outlet level measurements. However, VM power cannot be measured purely in hardware. We present a solution for VM power metering, named Joulemeter. We build power models to infer power consumption from resource usage at runtime and identify the challenges that arise when applying such models for VM power metering. We show how existing instrumentation in server hardware and hypervisors can be used to build the required power models on real platforms with low error. Our approach is designed to operate with extremely low runtime overhead while providing practically useful accuracy. We illustrate the use of the proposed metering capability for VM power capping, a technique to reduce power provisioning costs in data centers. Experiments are performed on server traces from several thousand production servers, hosting Microsoft's real-world applications such as Windows Live Messenger. The results show that not only does VM power metering allows virtualized data centers to achieve the same savings that non-virtualized data centers achieved through physical server power capping, but also that it enables further savings in provisioning costs with virtualization.

The most common programming languages and platforms for sensor networks foster a low-level programming style. This design provides fine-grained control over the underlying sensor devices, which is critical given their severe resource constraints. However, this design also makes programs difficult to understand, maintain, and debug. In this paper, we describe an approach to automatically recover the high-level system logic from such low-level programs, along with an instantiation of the approach for nesC programs running on top of the TinyOS operating system. We adapt the technique of symbolic execution from the program analysis community to handle the event-driven nature of TinyOS, providing a generic component for approximating the behavior of a sensor network application or system component. We then employ a form of predicate abstraction on the resulting information to automatically produce a finite state machine representation of the component. We have used our tool, called FSMGen, to automatically produce compact and fairly accurate state machines for several TinyOS applications and protocols. We illustrate how this high-level program representation can be used to aid programmer understanding, error detection, and program validation.

Designing reliable software for sensor networks is challenging because application developers have little visibility into, and understanding of the post-deployment behavior of code executing on resource constrained nodes in remote and ill-reproducible environments. To address this problem, this paper presents HERMES, a lightweight framework and prototype tool that provides fine-grained visibility and control of a sensor node's software at run-time. HERMES's architecture is based on the notion of interposition, which enables it to provide these properties in a minimally intrusive manner, without requiring any modification to software applications being observed and controlled. HERMES provides a general, extensible, and easy-to-use framework for specifying which software components to observe and control as well as when and how this observation and control is done. We have implemented and tested a fully functional prototype of HERMES for the SOS sensor operating system. Our performance evaluation, using real sensor nodes as well as cycle-accurate simulation, shows that HERMES successfully achieves its objective of providing fine-grained and dynamic visibility and control without incurring significant resource overheads. We demonstrate the utility and flexibility of HERMES by using our prototype to design, implement, and evaluate three case-studies: debugging and testing deployed sensor network applications, performing transparent software updates in sensor nodes, and implementing network traffic shaping and resource policing.

It is currently difficult to build practical and reliable programming systems out of distributed and resource-constrained sensor devices. The state of the art in today's sensornet programming is centered around a component-based language called nesC. nesC is a node-level language-a program is written for an individual node in the network-and nesC programs use the services of an operating system called TinyOS. We are pursuing an approach to programming sensor networks that significantly raises the level of abstraction over this practice. The critical change is one of perspective: rather than writing programs from the point of view of an individual node, programmers implement a central program that conceptually has access to the entire network. This approach pushes to the compiler the task of producing node-level programs that implement the desired behavio.

With the advent of miniaturized sensing technology, it has become possible to envision smart structures containing millions of sensors embedded in concrete for autonomously detecting and locating incipient damage. Where are we today in our march towards this vision of autonomous structural health monitoring (SHM) using networked embedded sensing? In this paper, we summarize some of the systems we have developed towards this vision. Wisden is a wireless sensor network that allows continuous monitoring of structures and NetSHM is a programmable system that allows civil engineers to implement and deploy SHM techniques without having to understand the intricacies of wireless sensor networking. We highlight our experiences in developing these systems, and discuss the implications of our experiences on the achievability of the overall vision.

Wireless sensor networks research has, till date, made impressive advances in platforms and software services. Research in the area has moved on to consider an essential piece of sensor network technology---support for programming wireless sensor network applications and systems components at a suitably high level of abstraction. Two broad classes of programming models are currently being investigated by the community. One class focuses on providing higher-level abstractions for specifying a node's local behavior in a distributed computation. Examples of this approach include the recent work on node-local or region-based abstractions. By contrast, a second and less-explored class of research considers programming a sensor network in the large called macroprogramming.