Active measurement studies show that the Peer-to-Peer (P2P) file sharing protocol Bit Torrent is highly under attack. Moreover, malicious peers can easily exploit the original seeding algorithm and therefore reduce the efficiency of this protocol. In this paper, we propose a novel seeding algorithm that requests peers to vote for their best sharing peers. Our results show that this incentive mechanism makes Bit Torrent harder to exploit without losing performance. In some situations our algorithm even outperform other seeding algorithms. The peer exchange - that comes as a side effect - reduces the dependency on a centralized tracker and increases the robustness and the efficiency. We studied the effectiveness of our approach in a real testbed comprising 32 peers.

Internet censorship artificially changes the dynamics of resource production and consumption, affecting a range of stakeholders that include end users, service providers, and content providers. We analyze two large-scale censorship events in Pakistan: blocking of pornographic content in 2011 and of YouTube in 2012. Using traffic datasets collected at home and SOHO networks before and after the censorship events, we: a) quantify the demand for blocked content, b) illuminate challenges encountered by service providers in implementing the censorship policies, c) investigate changes in user behavior (e.g., with respect to circumvention) after censorship, and d) assess benefits extracted by competing content providers of blocked content.

The inherent design of anomaly detection systems (ADSs) make them highly susceptible to evasion attacks and hence their wide-spread commercial deployment has not been witnessed. There are two main reasons for this: 1) ADSs incur high false positives; 2) Are highly susceptible to evasion attacks (false negatives). While efforts have been made to minimize false positives, evasion is still an open problem. We argue that ADSs design is inherently flawed since it relies on the ADS's detection logic and feature space which is trivial to estimate. In information security e.g. cryptographic algorithms (such as DES), security is inherently dependent upon the key and not the algorithm, which makes these systems very robust by rendering evasion computationally infeasible. We believe there is a need to redesign the anomaly detection systems similar to cryptographic systems. We propose to randomize the feature space of an ADS such that it acts as a cryptographic key for the ADS and hence this randomized feature space is used by the ADS logic for detection of anomalies. This would make the evasion of the ADS computationally infeasible for the attacker.

poster Share on POSTER: BotFlex: a community-driven tool for botnetdetection Authors: Sheharbano Khattak Independent Researcher, King's Lynn, United Kingdom Independent Researcher, King's Lynn, United KingdomView Profile , Zaafar Ahmed SysNet, National Univ. of Computer & Emerging Sciences., Islamabad, Pakistan SysNet, National Univ. of Computer & Emerging Sciences., Islamabad, PakistanView Profile , Affan Syed SysNet, National Univ. of Computer & Emerging Sciences., Islamabad, Pakistan SysNet, National Univ. of Computer & Emerging Sciences., Islamabad, PakistanView Profile , Syed Ali Khayam PLUMgrid, Inc., Sunnyvale, CA, USA PLUMgrid, Inc., Sunnyvale, CA, USAView Profile Authors Info & Claims CCS '13: Proceedings of the 2013 ACM SIGSAC conference on Computer & communications securityNovember 2013 Pages 1387–1390https://doi.org/10.1145/2508859.2512507Online:04 November 2013Publication History 4citation304DownloadsMetricsTotal Citations4Total Downloads304Last 12 Months5Last 6 weeks0 Get Citation AlertsNew Citation Alert added!This alert has been successfully added and will be sent to:You will be notified whenever a record that you have chosen has been cited.To manage your alert preferences, click on the button below.Manage my AlertsNew Citation Alert!Please log in to your account Save to BinderSave to BinderCreate a New BinderNameCancelCreateExport CitationPublisher SiteGet Access

Real-time network- and host-based Anomaly Detection Systems (ADSs) transform a continuous stream of input data into meaningful and quantifiable anomaly scores. These scores are subsequently compared to a fixed detection threshold and classified as either benign or malicious. We argue that a real-time ADS’ input changes considerably over time and a fixed threshold value cannot guarantee good anomaly detection accuracy for such a time-varying input. In this article, we propose a simple and generic technique to adaptively tune the detection threshold of any ADS that works on threshold method. To this end, we first perform statistical and information-theoretic analysis of network- and host-based ADSs’ anomaly scores to reveal a consistent time correlation structure during benign activity periods. We model the observed correlation structure using Markov chains, which are in turn used in a stochastic target tracking framework to adapt an ADS’ detection threshold in accordance with real-time measurements. We also use statistical techniques to make the proposed algorithm resilient to sporadic changes and evasion attacks. In order to evaluate the proposed approach, we incorporate the proposed adaptive thresholding module into multiple ADSs and evaluate those ADSs over comprehensive and independently collected network and host attack datasets. We show that, while reducing the need of human threshold configuration, the proposed technique provides considerable and consistent accuracy improvements for all evaluated ADSs.

A myriad of studies are reporting an exponential increase in the number and size of worldwide botnets [1, 2, 15, 17, 20, 21]. For instance, it has been reported that the Storm botnet increased by a factor of three during the second quarter of 2008. The reason of such exponential growth is the financial gain that these spam botnets can generate [1, 2, 3]. Absent grounded empirical data, it is challenging to reconcile "revenue estimates" that can range from $2M/day for one spam botnet [4]. Paxson et. al [1] have documented 82,000 and 37,00 monthly orders for seven counterfeit pharmacies and counterfeit software stores, respectively. The spammers running all these spams generally purchase time from a bot master to launch a spam campaign with a single objective to increase their respective profit margins from such spam campaigns.

High data rates and multiple channel profiles of a MIMO system are naturally well-suited to carry video content. However, a video communication scheme to exploit these desirable properties of MIMO systems is widely unexplored. Even the most sophisticated MIMO rate adaptation methods rely on channel BER which shows a monotonic decrease as the channel quality improves. However, video quality, for which PSNR is a better measure than BER, does not show a proportional increase with improved channel quality because of error concealment. In this paper, we present a novel application-aware rate adaptation method which can detect variations in a MIMO channel at a video receiver, quantify the impact of these variations on the received video quality, and adaptively select a transmission profile (consisting of modulation, coding and MIMO mode) to provide unprecedented improvements in video quality. The proposed application-aware MIMO Video Rate Adaptation (MVRA) method relies on a comprehensive model of source- and channel-induced distortions in video quality. Using this model, a MIMO receiver can select an appropriate transmission profile on a per-GOP basis. Trace-driven evaluations over an 802.11n channel show that the proposed MVRA method's PSNR is very close to the PSNR of an optimal RA scheme. Comparison with state-of-the-art MIMO RA methods shows that the proposed MVRA method provides consistently better PSNR, with an average improvement of 19.29% (5.5486 dBs) over the best existing MIMO RA scheme.

In this paper, we propose a Progressive Differential Thresholding (PDT) framework for coordinated network anomaly detection. Under the proposed framework, nodes present on a packet's path progressively encode their opinion (malicious or benign) inside a packet. Subsequent nodes on the path use the encoded opinion as side-information to adapt their anomaly detection thresholds and in turn improve their classification accuracies. Accuracy benefits of PDT are evaluated through experimental evaluations of multiple non-proprietary anomaly detectors on a publicly-available attack dataset. These evaluations indicate that, while being distributed and having negligible complexity and communication overheads, the proposed PDT framework provides considerable and consistent improvements in anomaly detection accuracy. We observe upto 54% improvements in ADS detection accuracy while upto 4 times reduction in the false alarm rates.

In this paper, we study the impact of spatio-temporal variations of a video sequence on wireless MIMO video transmission. In the light of our findings, we propose a cross-layer MIMO video communication architecture for efficient multimedia communication. Existing methods complement Spatial Multiplexing (SM) and Space Time Block Coding (STBC) with enhanced source and channel coding strategies to improve video PSNR at a MIMO receiver. However, these methods ignore the adverse impacts of spatio-temporal content variations on video quality and decoding complexity. We show that the decision to switch between SM and STBC for effective video communication must be based on both channel conditions and motion intensity of a video. We quantify a video's spatio-temporal characteristics using a motion intensity measure, and propose a simple motion-adaptive MIMO video communication technique which can judiciously switch between SM and STBC configurations. Experimental evaluations show that the proposed technique provides significantly better video quality while having very low decoding complexity at the receiver. Based on this technique, we propose a novel cross-layer motion-adaptive architecture for wireless video communication.

This paper reports two attacks on Undercover, a human authentication scheme against passive observers proposed at CHI 2008. The first attack exploits nonuniform human behavior in responding to authentication challenges and the second one is based on information leaked from authentication challenges or responses visible to the attacker. The second attack can be generalized to break two alternative Undercover designs presented at Pervasive 2009. All the attacks exploit design flaws of the Undercover implementations.

Many financial institutions have deployed CAPTCHAs to protect their services (e.g., e-banking) from automated attacks. In addition to CAPTCHAs for login, CAPTCHAs are also used to prevent malicious manipulation of e-banking transactions by automated Man-in-the-Middle (MitM) attackers. Despite serious financial risks, security of e-banking CAPTCHAs is largely unexplored. In this paper, we report the first comprehensive study on e-banking CAPTCHAs deployed around the world. A new set of image processing and pattern recognition techniques is proposed to break all e-banking CAPTCHA schemes that we found over the Internet, including three e-banking CAPTCHA schemes for transaction verification and 41 schemes for login. These broken e-banking CAPTCHA schemes are used by thousands of financial institutions worldwide, which are serving hundreds of millions of e-banking customers. The success rate of our proposed attacks are either equal to or close to 100%. We also discuss possible improvements to these e-banking CAPTCHA schemes and show essential difficulties of designing e-banking CAPTCHAs that are both secure and usable.

Recent studies have shown that standalone anomaly classifiers used by network anomaly detectors are unable to provide acceptable accuracies in real-world deployments. To achieve higher accuracies, Network Anomaly Detection Systems (NADSs) now use multiple classifiers whose outputs are combined to formulate an aggregate anomaly score. Judicious methods of combining these classifiers' outputs are largely unexplored. In this paper, we propose a novel information-theoretic combining method which caters for the individual classifiers' accuracies in a multi-classifier NADS. We first show that existing combining schemes designed for or adapted to the problem of multi-classifier NADS combining do not provide good accuracies because they do not use individual classifiers' detection and false alarm rates in the combining process. Furthermore, we reveal that an accurate multi-classifier NADS, in addition to catering for the mean accuracy rates, must also consider the classifiers' variances during combining. Therefore, we propose a Standard Deviation normalized Entropy of Accuracy (SDnEA) method for classifier combining. Using 9 prominent classifiers operating on two publicly-available traffic datasets, we show that around 3%-10% increase in detection rate and a 40% decrease in false alarm rate over existing combining techniques can be provided by the proposed information-theoretic NADS combining technique.

In ICC2008 and subsequent work, Lei et al. proposed a user authentication system (virtual password system), which is claimed to be secure against identity theft attacks, including phishing, keylogging and shoulder surfing. Their authentication system is a challenge-response protocol based on a randomized linear generation function, which uses a random integer in the responses of each login session to offer security against assorted attacks. In this paper we show that their virtual password system is insecure and vulnerable to multiple attacks. We show that with high probability an attacker can recover an equivalent password with only two (or a few more) observed login sessions. We also give a brief survey of the related work and discuss the main challenges in designing user authentication methods secure against identity theft.

The major contribution of this paper is two-folds: (1) we present our novel variable-length system call representation scheme compared to existing fixed- length sequence schemes, and (2) using this representation, we present our in-execution malware detector that can not only identify zero-day malware without any a priori knowledge but can also detect a malicious process while it is executing. Our representation scheme - a more generalized version of n-gram - can be visualized in a k-dimensional hyperspace in which processes move depending upon their sequence of system calls. The process marks its impact in space by generating hyper-grams that are later used to evaluate an unknown process according to their profile. The proposed technique is evaluated on a real world dataset extracted from a Linux System. The results of our analysis show that our in-execution malware detector with hyper- gram representation achieves low processing overheads and improved detection accuracies as compared to conventional n-grams.

ROC curves have historically been used to evaluate the accuracy of Intrusion Detection Systems (IDSs). In this paper, we argue that a real-time IDS' input changes considerably over time and ROC curves generated using fixed, time-invariant classification thresholds do not characterize the best accuracy that an IDS can achieve. To address this problem, we propose a simple, generic and adaptive technique to achieve good ROC operating points for any given IDS. The proposed technique stochastically predicts the next anomaly score of an IDS and the anomaly classification threshold is then set as a function of the predicted score. We first perform statistical and information-theoretic analyses of network- and host-based IDSs' anomaly scores to reveal a consistent time correlation structure during benign activity periods. We model the observed correlation structure using Markov chains and then use this model to predict and adapt an IDS' classification threshold. The proposed adaptive thresholding module is incorporated into six prominent network- and host-based Anomaly Detection Systems (ADSs). These adaptive ADSs are evaluated on public and labeled attack datasets. We show that, while reducing the need for manual threshold configuration and having very low-complexity, adaptive thresholding enables the ADSs to achieve considerably higher accuracies on the ROC plane.

Covert timing channels exploit varying packet rates between synchronized sending and receiving hosts to transmit hidden information. The overhead in synchronizing covert timing channels and their inherent dependence on network conditions are their main drawbacks. In this paper, we propose a covert channel using multiple active connections that does not depend on the timing differences between consecutive packets. Our proposed approach uses multiple network connections between a pair of communicating hosts to transmit covert data. Hence this covert channel is unaffected by underlying unpredictable network conditions. The concealed data is embedded in the order and sequence of connections to/from which regular (cover) packets of data are sent/received. Our experimental results show that, in addition to higher channel capacity, our proposed channel is undetectable using contemporary timing channel detection approaches.

Bio-inspired ad hoc routing is an active area of research. The designers of these algorithms predominantly evaluate the performance of their protocols with the help of simulation studies. Such studies are mostly scenario and simulator specific and their results cannot be generalized to other scenarios and simulators. Therefore, we argue that mathematical tools should be utilized to develop a consistent, provable and compatible formal framework in order to provide an unbiased evaluation of Bio-inspired ad hoc routing protocols. Motivated by this requirement, in this paper, we develop a probabilistic performance evaluation framework that can be used to model the following key performance metrics of an ad hoc routing algorithm: (1) routing overhead, (2) route optimality, and (3) energy consumption. We utilize this framework to model a well known Bee-inspired routing protocol for ad hoc sensor networks, BeeSensor. We also show that the proposed framework is generic enough and can easily be adapted to even model a classical routing protocol, Ad Hoc on Demand Distance Vector (AODV). The modeled metrics of the two algorithms not only allow unbiased performance comparison but also provide interesting insights into the parameters governing the behavior of these routing protocols.

In this paper, we show that a Bio-inspired classifier's accuracy can be dramatically improved if it operates on intelligent features. We propose a novel set of intelligent features for the well-known problem of malware portscan detection. We compare the performance of three well-known Bio-inspired classifiers operating on the proposed intelligent features: (1) Real Valued Negative Selection (RVNS) based on the adaptive immune system; (2) Dendritic Cell Algorithm (DCA) based on the innate immune system; and (3) Adaptive Neuro Fuzzy Inference System (ANFIS). To empirically evaluate the improvements provided by the intelligent features, we use a network traffic dataset collected on diverse endpoints for a period of 12 months. The endpoints' traffic is infected with well-known malware. For unbiased performance comparison, we also include a machine learning algorithm, Support Vector Machine (SVM), and two state-of-the-art statistical malware detectors, Rate-Limiting (RL) and Maximum-Entropy (ME). To the best of our knowledge, this is the first study in which RVNS and DCA are not only compared with each other but also with several other classifiers on a comprehensive real-world dataset. The experimental results indicate that our proposed features significantly improve the TP rate and FP rate of both RVNS and DCA.

Accurate simulation and analysis of wireless protocols and systems is inherently dependent on an accurate model of the underlying channel. In this paper, we show that residual MAC layer wireless sensor network (WSN) channels cannot be characterized using the commonly-used high-order Markov channel models. Instead, we demonstrate that 2-Tier models, in which a high-level (tier 1) frame-level model excites a lower-level (tier 2) bit-error model, are needed to accurately characterize WSN residual channels. We compare the modeling accuracy of 1-Tier and 2-Tier models using residual bit-error traces collected over an operational 802.15.4 network. We first analyze error traces collected over different setups to investigate the amount of bit-level memory present in wireless sensor network channels. We then validate the accuracy of the proposed models using information divergence measures. We show that 2- Tier models have significantly and consistently better accuracy than 1-Tier models. Finally, we demonstrate that the wrong choice of a channel model can result in grossly inaccurate simulation results. This claim is substantiated by simulating three important metrics: (i) recovery ratio for an abstract Forward Error Correction (FEC) scheme, (ii) frame goodput of an unreliable protocol over a multihop network, and (Hi) number of retransmissions per packet for a reliable protocol.

The 802.15.4 WSN standard provides optional reliability through positive acknowledgments. Since positive-ACKs are not designed for energy efficiency, there is significant room for improvement in the energy usage of reliable 802.15.4. In this paper, we propose a new reliable link layer protocol, referred to as the Selective Retransmission using Virtual Fragmentation (SRVF) protocol. SRVF requires simple modifications to reliable 802.15.4, but provides substantial improvements in energy efficiency. The main premise of the proposed protocol is to localize bit-errors by performing partial checksums on disjoint parts or virtual fragments of a packet. In case of error, only the corrupted virtual fragments are retransmitted. We analytically model reliable 802.15.4 and SRVF as Markov chains operating over an arbitrary-order Markov wireless channel, and show that SRVF provides significant theoretical improvements over reliable 802.15.4. We then use bit-error traces collected over a real sensor network testbed to experimentally evaluate the two reliable protocols. These experimental results show that SRVF has consistently and considerably better energy efficiency than the reliable 802.15.4.

In this paper, we propose an endpoint-based anomaly detection scheme that detects computer worms by comparing the current traffic patterns of each host to the corresponding benign traffic profile of the host. To detect deviations in the traffic patterns, we employ the information-theoretic Kullback-Leibler (K-L) divergence measure which estimates the distance between the distribution of source/destination ports engaged in current communication and that observed in the legitimate host traffic collected earlier. We use a small subset of traces obtained from endpoints in home, university, and office environments to build benign traffic profiles of studied endpoints. Endpoint traces are then infected with both real and simulated worms to examine the performance of our detection mechanism. To perform automated, real-time worm detection, we use Support Vector Machines (SVMs) that are trained using the K-L divergence values. Our results show that the proposed worm detector provides almost 100% detection with negligible false- alarm rates and significantly surpasses the accuracy of existing anomaly detectors.

Internet blackholes have emerged as very effective tools for monitoring changes in the Internet's traffic behavior. Prior studies have shown that traffic observed at a blackhole contains valuable information about emerging malware. While blackhole traffic has been effectively used for attack forensics, a systematic method of leveraging this traffic for online Internet- scale anomaly detection is not available. In this paper, we propose a novel technique to detect malware outbreaks using deviations in a robust statistical model of a blackhole's traffic. First, we introduce a novel and accurate Piecewise Poisson process Model (PPM) of traffic observed at an Internet Motion Sensor (IMS) blackhole which provides a statistical quantification of the intensity or rate of incoming traffic at a blackhole, which can in turn be used to detect malware outbreaks. After establishing the accuracy of the proposed PPM model, we develop a regression model that can characterize variations in the PPM's traffic rates. Once an accurate model of traffic rates is in place, malware outbreaks can be detected using deviations from the model's likely statistical patterns. After removing simple deterministic patterns, we observe that a blackhole's traffic rate residuals have a skewed and heavy-tailed behavior. Consequently, we employ a stable distribution that models variations in traffic rate residuals with very high accuracy. Finally, we propose an online detection mechanism that utilizes deviations from the rate residual distribution of blackhole traffic data to detect malware outbreaks. Experimental results using the IMS data for approximately one year show that the proposed mechanism accurately detects malware outbreaks in a timely manner.

Performance of cross-layer protocols that recommend the relay of corrupted packets to higher layers can be improved significantly by accurately inferring/predicting the bit error rate (BER) in the packets. In practice, higher layers observe the bits only after some hard decision. Hence physical layer link-quality indications, such as the signal strength of each individual bit, are not observable at higher layers. Therefore, it is essential to identify practically observable variables, which can be used for reasonably robust channel state inference/prediction (CSI/CSP). Here, inference specifically refers to estimating the BER in an already received packet, while prediction refers to anticipating the BER in a future packet. In this paper, we note that, in practical 802.11b devices, it is possible to acquire a Signal to Silence Ratio (SSR) indication and measure the background traffic intensity (p) on a per packet basis. This paper, thus presents a measurement-based study that analyzes the utility of SSR andpas side-information for CSI/CSP. In this work, we exploit the method of types to measure the robustness of the observable side-information. Our analysis and simulations based on an extensive set of actual 802.11b traces exhibit the practical utility of the considered observable variables.

Recent wireless measurement studies have revealed the presence of high-order memory in wireless bit-error channels. However, most wireless studies continue to employ the memory-less or 1st order Gilbert bit-error channels to design, analyze and verify wireless protocols and systems. The inaccuracies incurred by ignoring high-order channel memory are largely unexplored. This paper quantifies inaccuracies incurred by ignoring bit-level wireless channel memory in the context of two simple and commonly-used protocol metrics: (i) packet good put of an abstract unreliable protocol and (ii) number of retransmissions per packet for an abstract reliable protocol. We analytically derive expected values of these metrics in terms of the parameters of four models with varying levels of memory. We then train the models using actual 802.11b bit-error traces and use the analytical expressions to estimate the metrics. Comparison of the model-based estimates with actual values of the metrics derived from the traces shows that the memory-less and 1st order models incur significant inaccuracies. The remaining two models that capture high-order memory are very accurate in their estimates of the crucial good put and retransmission metrics.

In this paper, we propose an endpoint-based joint network-host anomaly detection technique to detect self- propagating malicious codes. Our proposed technique is based on the observation that on any endpoint there exists very high correlation between benign network sessions and the keystrokes that trigger these sessions. Specifically, users generally use a few keystrokes to trigger most of the benign network sessions. On the other hand, malicious sessions originating from a compromised endpoint will not have the session-keystroke correlation. We lever-age this observation in a novel information-theoretic framework that characterizes the session-keystroke correlation in terms of their mutual information. Changes in session-keystroke mutual information are used to detect malicious codes in an automated and real-time fashion. To evaluate the proposed anomaly detector, we use actual traffic and keystroke data collected on benign and infected endpoints. We show that the proposed anomaly detector provides almost 100% detection with negligible false-alarm rates and significantly surpasses the accuracy of existing techniques.

Wireless multimedia studies have revealed that forward error correction (FEC) on corrupted packets yields better bandwidth utilization and lower delay than retransmissions. To facilitate FEC-based recovery, corrupted packets should not be dropped so that maximum number of packets is relayed to a wireless receiver's FEC decoder. Previous studies proposed to mitigate wireless packet drops by a partial checksum that ignored payload errors. Such schemes require modifications to both transmitters and receivers, and incur packet-losses due to header errors. In this paper, we introduce a receiver-based scheme which uses the history of active multimedia sessions to detect transmitted values of corrupted packet headers, thereby improving wireless multimedia throughput. Header detection is posed as the decision-theoretic problem of multihypothesis detection of known parameters in noise. Performance of the proposed scheme is evaluated using trace-driven video simulations on an 802.11b local area network. We show that header detection with application layer FEC provides significant throughput and video quality improvements over the conventional UDP/IP/802.11 protocol stack

We propose a novel cross-layer header estimation methodology that can be used by UDP-based wireless multimedia applications to estimate corrupted packet headers, thereby realizing significant throughput improvements. The proposed methodology requires only minor modifications to the protocol stack at the receiver while no modifications are needed to senders or intermediate nodes. We formulate header estimation as a problem of maximum-likelihood estimation of known parameters in noise. We derive likelihood functions for two wireless channel models, namely Markov and multifractal wavelet models. Our trace-driven video simulations at 2, 5.5 and 11 Mbps data rates of an 802.11b LAN demonstrate that significant improvements over normal UDP and UDP Lite can be achieved by employing header estimation with UDP.

Recent wireless multimedia studies have revealed that forward error correction (FEC) on corrupted packets yields better bandwidth utilization and lesser delay than retransmissions. To facilitate FEC decoding at a wireless receiver, it is desirable to relay maximum number of (error-free and corrupted) packets to the receiver's application layer. To that end, most cross-layer multimedia schemes perform partial checksum only on packet headers. However, even with a partial checksum, bursty wireless errors introduce frequent header corruptions, thereby causing considerable packet drops. In this paper, we extend our work in [1], which proposed receiver-based schemes to correct a packet's critical (and corrupted) header fields. This paper: (a) poses header detection as the well-known decision theoretic problem of detecting known parameters in noise, (b) evaluates two detectors using bit-error traces collected over an 802.11b network, (c) provides throughput results for the detectors, and (d) uses video in conjunction with FEC as an example to highlight the efficacy of the proposed schemes. We show that header detection provides significant improvements in throughput and video quality over the conventional UDP/IP protocol stack.

Abstract — High-order full-state Markov (FSM) chains have been employed to model errors and losses in many wireless studies. The complexity of this modeling paradigm is an exponential function of a random process ’ memory-length and hence the viability of FSM chains in resource-constrained wireless environments is severely limited. In this paper, we address an important yet unsettled question: What characteristics of high-order FSM chains should be captured by a low-complexity approximate model? We analytically derive vital guidelines for accurate approximation of an FSM chain of arbitrary memory-length. These guidelines lead to a novel constant-complexity model (CCM), which always comprises of five states irrespective of a process ’ memory-length. Our trace-driven evaluations for 802.11b and GSM channels demonstrate that the 5 state CCM, while providing orders of magnitude reduction in complexity, is comparable to FSM chains and better than linear-complexity models. I.

Delay-sensitivity of real-time applications stipulates resilience against errors and losses in multimedia content. Such resilience is particularly important for bandwidth-constrained and error-prone wireless networks. Recent wireless studies have highlighted that significant improvements in bandwidth utilization and multimedia quality can be achieved if the decision to retain or drop "corrupted" packets is made at the application layer instead of medium access, network or transport layers. Such a strategy, however, necessitates that the maximum number of (good and bad) packets are relayed to the application layer while minimizing any modifications (if any) to the widely-deployed UDP/IP protocol stack. Previous studies have proposed that, while ignoring corruptions in packet payload, only packets with errors in the headers should be dropped. We introduce a receiver-based scheme which uses the history of a multimedia session to correct packet header errors, thereby improving the throughput of real-time applications over wireless local area networks (LANs). The proposed scheme is truly receiver-based and, therefore, does not require any modifications to the source or any intermediate network node. Only minor modifications are required to the protocol stack of the multimedia receiver. Specifically, the proposed scheme generates statistics based on the history of "critical" protocol header fields for active multimedia sessions. These statistics are in turn employed to (a) correct errors in the critical fields and (b) determine if the relevant packets belong to the receiver's session of interest.

In this paper, we analyze the errors observed at the link layer of an 802.11b network. Our analysis at all supported bitrates (i.e., 2, 5.5. and 11 Mbps) establishes that the error patterns are not memoryless, and therefore, they exhibit a certain level of temporal dependencies. Thus, we evaluate the suitability of a two-state Markov model to capture the channel behavior. Non-stationarity of the error patterns renders such a simplistic model inadequate, and hence, we consider higher order models. This formulates a key contribution of this paper, and that is, a hierarchical Markov model, which captures the non-stationarity of the channel while employing real-time application-specific considerations to determine state-transition probabilities.

Inherent vulnerability of the wireless medium renders it more susceptible to errors and losses than classical wired media. In this paper, we evaluate the suitability of protocols and strategies across different layers of the stack to provide real-time services over 802.11b wireless LANs. More specifically, within the context of cross-layer design, we compare the performance of UDP with UDP lite - a proposed framework, which improves bandwidth utilization by delivering partially damaged packets to the realtime application. First, we study the high-level end-to-end throughput improvement achieved by making cross-layer modifications to support a UDP lite framework. We compare the quality of perceived media rendered by UDP (dropped packets only) and UDP lite (dropped and corrupted packets). This formulates one of the key findings of this study, that is, although UDP lite improves the overall high-level throughput by relaying corrupted packets to the real-time application, it fails to provide significant enhancement in perceived media quality. This can, in part, be attributed to the bursty nature of errors and losses that we observed at the application layer regardless of the selected transport protocol. Finally, we compare the error-recovery/concealment overhead required by UDP and UDP lite in order to deliver lossless multimedia. We conclude that the overhead required by UDP lite is considerably lower than UDP, since the received corrupted packets that are delivered by UDP lite (but not by UDP) facilitate error-recovery.

Errors introduced by a wireless medium are more frequent and profound than contemporary wired media. Some of these errors, which are not corrected by the physical layer, result in Medium Access Control (MAC) layer bit errors and packet losses. Design of wireless protocols and applications can benefit substantially from a thorough understanding of these MAC layer impairments. This paper evaluates and proposes Markov-based stochastic chains to model the 802.11b MAC-to-MAC channel behavior for both bit errors and packet losses. We introduce an Entropy Normalized Kullback-Leibler measure to evaluate the performance of existing and new bit error and packet loss models. Based on the proposed measure, and contrary to recent results for mobile networks, we demonstrate that the traditional two-state Markov chain provides a very suitable model for the 802.11b MAC-to-MAC packet loss process. However, this simple model is not adequate for bit errors observed at the MAC layer of wireless local area networks. Consequently, we evaluate three other Markov-based chains for modeling these errors: full-state, hidden, and hierarchical Markov chains. Among these chains, we illustrate that the full-state Markov bit error model, evaluated under a wide range of order values, renders the best performance.