A country's critical infrastructures are heavily related to the quality of life and safety of the people. As a result, the security protection aspect of critical infrastructure has gained more and more attention nowadays, especially the security of its industrial control system (ICS). To avoid the abnormal condition happening in the critical infrastructure which could put people in great danger, a system that is capable of detecting any abnormal state of the ICS promptly is needed. Fortunately, due to the dramatic growth of the applications of machine learning in recent years, some researchers have already proposed anomaly detection methods with machine learning to provide instant warning and protection for ICS. However, most of the existing anomaly detection research tends to only target one cause that harms the system, such as attacks on the network or physical equipment failures. The ICS will be more comprehensively secured if the anomaly detection system can cover multiple aspects of the ICS. Therefore, we have established a non-normal warning system with the Generative Adversarial Network (GAN) for dam operations in this study, which can detect various types of non-normal operations and notify relevant personnel right away. Note that we use real historical data to make predictions and verify our warning system, and we improve it even more by implementing the visual analysis method, which makes up the indecipherable results often found in unsupervised learning.

Nowadays, network virtualization has been widely investigated in order to prevent Internet ossification, and develop future emerging network applications flexibly. However, prior work by Pignolet et al. shows the possible attacking methodology with which the attackers can disclose the whole cloud topology while deploying virtual networks in cloud named “Topology Disclosure Attack”. In this attack model, the attacker pretends to deploy virtual networks in cloud by issuing the graph requests to service provider. And the service provider responds the requests to the attacker after examining his/her topology resources. With this request/reply model, Pignolet et al. believe this attack eventually infers the targeted topology. However, one vital reason leads this attack to the failure- too many virtual requests from one adversary in a time. This paper tries to provide a new topology disclosure attack model, which multiple attackers launch attacks at the same time with the assistance of proposed Query-Trie and network tomography technique. Hence, in this paper, we propose much more possible attack model in cloud and this topic also encourages the network researchers to develop resistance mechanism against it in the future.

Abstract Nowadays, with the advance of Internet technology, social network is getting popular, which combines the virtual network and the real world. People employ this network to communicate with all social things of their interest, including shopping, making friends, sharing experiences of life, and so on. In social networks, the social data expands rapidly and the malicious users can easily get the social data. With the social information, they could conjecture the relationship among social network data via the systematical analysis tool. Hence, the personal privacy data in social network may be exposed to some unknown risks, and recently, these issues arising in such a network catch much attention. The protection of personal privacy social data becomes an important and urgent research in social networks. One of personal privacy social information is the relations between the individuals and their social groups, namely human relationships. Neighborhood attacks are incident to the exposure of human relationships. Previous studies try to conceal human relationships information with well‐known k‐anonymity protection to resist this attack in social networks. However, those researches do not take care of those attacks in weighted social network, which does not make sense due to the fact that people should have different relationships with different persons. In such weighted social network, the edge denotes the human relationship and the weight denotes the degree of this human relationship in social networks. Our study focuses on the k‐anonymity protection scheme in weighted social networks, and our scheme can achieve k‐anonymity protection under the expected conditions, less virtual edges added and fewer weights changed. Through the analysis with MATLAB tool, we show that our k‐anonymity algorithm can achieve high anonymity protection rate under various k‐anonymity policies. Copyright © 2015 John Wiley & Sons, Ltd.

ABSTRACT Key revocation plays an essential role in ensuring the confidentiality of wireless sensor networks following the compromise of one or more of the network nodes. The distributed key revocation protocol presented by Chanet al. has a rapid reaction time and avoids the single‐point failure problem inherent in centralized schemes. However, the scheme is computationally complex, requires a large storage space, and incurs high communication overheads. Accordingly, this paper proposes a novel distributed, scalable, and cost‐effective key revocation scheme based on Blom'st‐secure property. In the proposed approach, any node identified as having a malicious behavior bytor more sensor nodes is categorized as a compromised node, and its keys are immediately revoked from the entire network. The proposed scheme not only satisfies the rigorous definition of a distributed key revocation protocol but also yields a significant improvement over Chan's revocation scheme in terms of a lower storage space requirement, a reduced communication overhead, and a lower computational cost. Copyright © 2013 John Wiley & Sons, Ltd.

ABSTRACT As the volume of multimedia data exchanged over the Internet continues to grow, the problem of preventing the unauthorized duplication of copyright‐protected images or the dissemination of undesirable material such as pornographic pictures has become increasingly important. The majority of the images circulated over the Internet are coded in the JPEG format. Thus, the present study proposes a novel digital feature retrieval scheme designed to detect unlawful dissemination of pre‐selected JPEG images. In the proposed approach, the packet‐level features of the target JPEG image are collected in advance and are stored in a feature database. Thereafter, the features of all the packets passing through a nominated router are compared on‐the‐fly with those in the feature database in order to detect any transmissions of the target images. The experimental results show that the proposed packet‐level forensic scheme is far more efficient than existing application‐level schemes. As a result, the proposed scheme provides a viable solution for the background monitoring of JPEG streams over large‐scale network environments such as the Internet in order to detect unlawful transmissions and to compile digital evidence of such transmissions for possible future legal proceedings. Copyright © 2012 John Wiley & Sons, Ltd.

The efficiency of RFID applications is severely degraded when multiple tags transmit their IDs simultaneously. As a result, many anticollision algorithms have been proposed for reducing collisions at the reader. However, these algorithms focus only on the tags within communication range of the reader in the previous or current frames. That is, they ignore tags which move out of range of the reader in one frame, but then move back within range several frames later. As a result, the identification performance of the reader is seriously degraded. The present study analyzes the effect of re-entering tags on the performance of three common anticollision algorithms and proposes a new reblocking algorithm (RBA) to alleviate the problem. The lower and upper bounds of the collision probability for re-entering tags are derived using a multinomial coefficients approach. The performance evaluation results show that the proposed algorithm consumes fewer cycles and provides a more robust identification performance than existing blocking algorithms in real-world RFID systems characterized by re-entering tags.

As underwater monitoring technology is well-developed, the underwater sensor network plays an important role for the exploration of the oceans. But there exist possible risks of sensor nodes being captured by adversaries and the transmissions in the underwater communication being illegally accessed. As a result, it is vital to take the security issue into account in such an underwater mobile sensor network. In this paper, our goal is to propose a key distribution scheme adequate for underwater mobile sensor networks. We adopt a mobility model to capture the movement of the sensors floating on the sea. Our key distribution scheme is designed to fit the characteristics of the sensors’ movement, and hence the connection and security can be improved in underwater sensor networks. Our scheme can also reduce redundant keys in the key distribution system. We also propose a secure routing method based on the Focused Beam Routing Protocol to adapt to our proposed iterative key distribution scheme. The simulation results show that our scheme possesses better performance, including better local connectivity, availability of path key, resilience and routing results.

When a wireless mesh network accommodates interactive applications with quality of service requirements, schedule-based protocols are more suitable than contention-based protocols. In this paper, the problem of determining an appropriate schedule assignment for multiple group transmissions within a spatial time division multiple access link scheduling network is referred to as an integrated multiple-group communication and link scheduling problem. A polynomial-time scheduling algorithm, designated as a source-parallel-aware assignment (SPAA), is proposed to increase the spatial utilisation within each time slot in order to enhance the network throughput. Furthermore, an advanced version of SPAA, designated as joint source-parallel-aware assignment with network coding (JSANC), is proposed to reduce the effects of bottleneck paths on the schedule frame length by flexibly applying conventional or opportunistic network coding approaches. Simulation results show that the proposed algorithms achieve a better network throughput than existing flow-based or particular order-based scheduling schemes.

Abstract With the rapid growth of applications in Internet communication, the security for transmitting information on public network has become a fundamental issue. The Internet Protocol Security (IPsec) standard is developed by Internet Engineering Task Force (IETF) to provide the security services at the IP layer. IPSec solutions invariably result in a large‐packet size and a long processing time. Accordingly, this paper proposes new compression architecture, designated as Efficient Secure Pipe (ES_PIPE), to improve both the security and the performance of IPv6 networks. In contrast to traditional IPsec compression schemes, ES_PIPE provides a transport‐layer‐aware compression capability for different types of packets (e.g., TCP or UDP/RTP packets). The experimental results show that the proposed scheme reduces 20–30% transmission time compared to IPsec. Furthermore, ES_PIPE scheme yields about 20% improvement in the efficiency of the encryption and decryption processes. Copyright © 2010 John Wiley & Sons, Ltd.

An efficient fault restoration framework is proposed for accomplishing loopback recovery in optical networks. The pro posed p-cycle-based framework achieves both a minimal spare capacity requirement and a rapid restoration time. In the proposed approach, an algorithm designated as Star-Block is used to simplify the original topology to a 2-connected graph and to partition the graph into multiple blocks, where each block contains a center node and the minimum number of neighboring nodes that collectively form a complete cycle. The simplified graph is then restored to the original topology using conventional graph rules. The Block Selection algorithm is then used to assign the edges be longing to multiple blocks to an appropriate block for fault recovery purposes. Within each block, the working flows are restored in real-time via local p-cycles on the on-cycle and spoke fibers. The performance of the proposed protection framework is evaluated numerically in terms of the spare capacity to working capacity ratio and the length of the restoration path. The framework has a better spare capacity efficiency than existing loopback recovery schemes or the conventional p-cycles approach. In addition, the Star-Block decomposition algorithm shortens the average length of the restoration path and therefore reduces the restoration time. Finally, the protection scheme not only provides a differentiated recovery service for traffic with different QoS requirements in the event of single-link failures within a single block, but also supports multiple-fault restoration for the case in which multiple single-link failures occur simultaneously.

The success of many wireless sensor network (WSN) applications, such as moving target tracking or environment monitoring, is dependent upon achieving ‘k-coverage’ of the sensed area, that is every point in the surveillance area is monitored by at least k sensors. This study presents a novel distributed self-location estimation scheme based on a Voronoi diagram to achieve k-coverage in a WSN with mobile nodes. The simulation results show that the proposed scheme effectively to perform k-coverage within the sensing field and fast convergent to fulfil more than 88% k-coverage ratio following three movements for the minimal required sensor deployment.

Two-layer hierarchy unstructured peer-to-peer (P2P) systems, comprising an upper layer of superpeers and an underlying layer of ordinary peers, are commonly used to improve the performance of large-scale P2P systems. However, the optimal superpeer network design involves several requirements including superpeer degree, network diameter, scalability, load balancing, and flooding performance. A perfect difference graph has desirable properties to satisfy the above design rationale of superpeers overlay network. This paper proposes a two-layer hierarchical unstructured P2P system in which a perfect difference graph (PDG) is used to dynamically construct and maintain the superpeer overlay topology. In addition, the broadcasting performance of the P2P system is enhanced through the use of a PDG-based forwarding algorithm, which ensures that each superpeer receives just one lookup query flooding message. The theoretical results show that the proposed system improves existing superpeer hierarchical unstructured P2P systems in terms of a smaller network diameter, fewer lookup flooding messages, and a reduced average delay, and the experimental results show that the proposed two-layer hierarchy P2P system performs very well in the dynamic network environment.

Peer-to-peer (P2P) content distribution systems based on random linear combination coding schemes outperform traditional block forwarding and source coding systems but have large storage requirements and high computation and communication overheads. To resolve this problem, this paper presents an efficient and scalable P2P content dissemination system based on novel altruistic demand and recoding dissemination mechanisms. In the proposed approach, the shared-content file is segmented and encoded using Reed–Solomon code at a seed. Downstream peers wishing to obtain the file utilize an altruistic demand mechanism to issue demand requests for coded blocks which are useful not only to themselves but also to their neighbors. Upon receiving these requests, the upstream peers utilize a recoding dissemination mechanism to provide the downstream peers with either an existing useful coded block or a new coded block produced using a Lagrange polynomial interpolation method. The two mechanisms rapidly increase the diversity of the coded blocks within the network and therefore provide an effective solution to the missing last block problem. In addition, it is shown that the proposed content distribution system demonstrates a substantial improvement over P2P systems based on random linear combination coding in terms of a lower storage requirement, reduced computation and communication costs, and an improved download efficiency.

Energy consumption is a crucially important issue in battery-driven wireless sensor networks (WSNs). In most sensor networks, the sensors near the data collector (i.e. the sink) become drained more quickly than those elsewhere in the network since they are required to relay all of the data collected in the network to the sink. Therefore more balanced data paths to the sink should be established in order to extend the lifetime of the sensor network. Accordingly, a novel relay deployment scheme for WSNs based on the Voronoi diagram is proposed. The proposed scheme is applicable to both two-dimensional and three-dimensional network topologies and establishes effective routing paths that balance the traffic load within the sensor network and alleviate the burden on the sensors around the sink. Simulation results indicate that the number of relays deployed in the proposed scheme is similar to that deployed in the predetermined location scheme and is significantly less than that deployed in the minimum set cover scheme. Furthermore, the lifetime of the sensor network containing relay nodes deployed using the current scheme is longer than that achieved using either the predetermined location scheme or the minimum set cover scheme.

Recent development in wireless communication networks has enabled the large-scale deployment of low-cost, energy efficient, and multi-purpose wireless sensor networks. A lot of real-world applications have been already deployed and many of them will be based on wireless sensor networks. These applications include geographical monitoring, medical care, manufacturing, transportation, military operations, environmental monitoring, industrial machine monitoring, and surveillance systems. A Wireless Sensor Network is a wireless network which consists of spatially scattered independent devices by the help of sensors to considerately observe the conditions of an environment. A sensor device is typically of small size and consists of the processing subsystem running on the device's CPU, the sensor subsystem, and the communication subsystem. A sensor network is a collection of a number of sensors that utilize wireless transmission in order to establish communication and form an ad-hoc wireless network. Inside such a network the task of each sensor node is dual; the node should: (a) collect data regarding a phenomenon that is being observed (e.g. seismic activity, humidity, fire detection etc.) and (b) assist in routing of data captured by other nodes to a special node, called the sink, which is accessible via the system manager over a backbone network such as the Internet or a satellite link. The typical issues that differentiate a wireless sensor network from the more general case of an adhoc one are attributed to the operating environment of a sensor network and can be summarized as follows: (a) sensor network nodes have fewer capabilities for energy storage, computation, and communication, (b) sensor networks are mostly stationary; however topology changes do occur due to the frequent node failures in a wireless sensor network as opposed to mobility of nodes in ad hoc networks, (c) low-energy consumption may be an even more critical criterion than performance, as in most cases it is impossible to refuel the depleted batteries of sensors. Due to the nature of wireless communication in sensor networks, many security challenges are faced, including eavesdropping, man-in-the-middle, spoofing, and DDoS. The concern for security in a wireless sensor network can be even bigger than that in a conventional ad hoc wireless network, as in many cases, the afore-mentioned computational and energy consumption restrictions pose barriers in the implementation of existing security solutions in a wireless sensor network. Thus, advances in the design and prototype of security mechanisms in wireless sensor network systems for protecting the confidentiality, availability, and integrity are crucial for the success of sensor applications. The aim of this special issue of the Journal of Security and Communication Networks is to highlight some of the most important challenges in the area of security in wireless sensor networks and to present possible solutions. We hope that this issue will be a useful reference for current and future trends in this very active and crucial area of wireless sensor networks. We received 12 papers from all over the world. Each paper was reviewed by at least three qualified reviewers. We have accepted eight papers in this special issue. Papers in this special issue are organized as follows. The first article is entitled “LAID: A Learning Automata-Based Scheme for Intrusion Detection in Wireless Sensor Networks” and is authored by Misra, Abraham, Obaidat, and Krishna. The paper uses learning automata, a machine learning method, to address the problem of detecting intrusion in a wireless sensor network. The second paper, “Chaotic Communication Improves Authentication: Protecting WSNs Against Injection Attacks,” authored by Martinovic, Gollan, and Schmitt, presents the idea of using parameters of the wireless physical layer to form a mechanism, via which, nodes can authenticate themselves to the wireless sensor network. The third paper is “FBT: An Efficient Traceback Scheme in Hierarchical Wireless Sensor Network” and is authored by Cheng, Chen, and Liao. It proposes a traceback method via which the attacking path can be reconstructed in order to identify the attacking source of a DoS/DDoS attack to a hierarchical wireless sensor network. The fourth paper is entitled “An Effective Defensive Node against Jamming Attacks in Sensor Networks” and is authored by Mpitziopoulos and Gavalas. The authors describe the design specifications of a prototype node that effectively defends, via use of a hybrid FHSS-DSSS approach, against the possible jamming attacks a wireless sensor network may encounter. The fifth paper entitled “The Marvin Message Authentication Code and the LetterSoup Authenticated Encryption Scheme” is authored by Simplicio, D'Aquino Barbuda, Barreto, Carvalho, and Margi. The paper presents an authentication function based on a new parallelizable message authentication code and also discusses a related authenticated encryption scheme. The sixth paper is “Confidentiality and Integrity for Data Aggregation in WSN Using Peer Monitoring” and is authored by Di Pietro, Michiardi, and Molva. In this paper the authors present a new data aggregation mechanism in a sensor network that can achieve confidentiality and integrity, and detect bogus data injections. Moreover, it has significant resilience to failures of the network's nodes. The seventh paper is entitled “Privacy-preserving Robust Data Aggregation in Wireless Sensor Networks” and is authored by Conti, Zhang, Roy, Di Pietro, Jajodia, and Mancini. In this paper the authors propose a solution to protecting a node's privacy from issues being raised due to the use of data aggregation in a wireless sensor network. The Special Issue concludes with an article entitled “An Ant Colony Optimization Approach for Reputation and Quality-of-Service-Based Security in Wireless Sensor Networks,” which is authored by Dhurandher, Misra, Obaidat, and Gupta. The authors address the problem of secure routing from the perspective of having nodes abiding to QoS parameters, thus preventing malicious nodes from being part of network routes. The guest editors would like to thank all authors and reviewers for their valuable contributions to this special issue. We would also like to thank Prof. Hsiao-Hwa Chen, Editor-in-Chief of Security and Communication Networks Journal, for hosting this issue. Thanks are also due to all editorial assistants of the journal. We hope that this issue will become a useful reference and fuel for more research efforts in this important and fascinating research area of wireless sensor networking.

In this paper, we study medium access control (MAC) protocols with quality-of-service (QoS) support, that is, topology-independent link activation transmission scheduling, for mobile code-division multiple-access (CDMA) ad hoc networks. QoS provisioning for each communication link is guaranteed without the need to adopt transmission schedules in mobile environments. An interference model, which captures the difference between transmission and interference ranges, is considered. Under this interference model, an approach to guaranteeing conflict-free transmission slots in each frame (QoS provisioning) for each communication link is proposed. Compared with the previously known method, superior performance is obtained. We then present a topology-independent link activation scheduling framework based on the theory of group-divisible (GD) designs. By the mathematical properties of GD designs, the proposed framework guarantees conflict-free transmission slots in each frame for each communication link, without the overhead due to the recomputation of transmission schedules when the network topology changes. With the proposed framework, we study and evaluate one series of GD design constructions. Based on the results derived, topology-independent link activation scheduling algorithms are then presented. The proposed schemes are designed for different objectives: maximizing the minimum system throughput and/or minimizing the schedule frame length. Numerical results show that the proposed algorithms outperform previously known schemes. The average performance of the proposed schemes is also derived.

In this paper, we study topology-independent link activation transmission scheduling protocols for multihop code-division multiple-access (CDMA) packet radio networks. We focus on quality-of-service (QoS) provisioning for each communication link in mobile environments. An interference model for wireless multihop packet radio networks, which is more practical than that adopted in earlier literature, is considered. Under this interference model, an approach to guaranteeing conflict-free transmission slots in each frame for each communication link is proposed. We then present a topology-independent link activation scheduling framework based on the theory of group divisible (GD) designs. The proposed framework guarantees conflict-free transmission slots in each frame for each communication link by mathematical properties of GD designs. With the proposed framework, we study and evaluate one series of GD design construction. We then propose topology-independent link activation scheduling algorithms based on the results derived. The proposed schemes are designed for different objectives: maximizing the minimum system throughput and minimizing the schedule frame length. Analysis results show that the proposed algorithms outperform previously known schemes.

We study topology-transparent link activation transmission scheduling protocols for multihop CDMA ad hoc networks. We focus on quality-of-service (QoS) provisioning for each communication link, particularly when node mobility is considered. An interference model, which is more practical than that adopted in earlier literature, is proposed. Under the presented interference model, two methods are proposed to guarantee conflict-free transmission slots for each communication link in each frame. After that, we present two frameworks for topology-transparent link activation scheduling which are based on resolvable balanced incomplete block (RBIB) designs and group-divisible (GD) designs. respectively. These schemes address and resolve primary and secondary conflicts through the mathematical properties of block designs. The proposed schemes maximize the minimum system throughput and analysis results show that the proposed algorithms can outperform the previously known algorithm.

We propose a novel active queue management mechanism, called flow number estimation (FNE), which is able to achieve network fair bandwidth share and tolerate burst traffic. FNE manages the length of a FIFO queue effectively and guarantees a reasonable queuing delay for every flow. The feature of traffic regulated by FNE is similar to that by the per-flow fair queuing mechanisms. FNE can support a large number of flows using hashing function sorting. However, FNE is much simpler than the per-flow fair queuing mechanisms and it can be easily implemented. Through detailed simulations, FNE is proven to provide fairness.

Core-stateless mechanisms achieve better scalability by reducing the complexity of fair queuing, which usually needs to maintain states, manage buffers, and perform flow scheduling on a per flow basis. However, they require per-packet relabeling in the core routers. We propose a core-stateless fair bandwidth allocation scheme without maintaining per flow state in core routers. Furthermore, it does not need relabeling, which is commonly used in existing core-stateless schemes. Packets are labeled only once in the entrance of the network according to the characteristics of the flow to which the packets belong. No matter TCP or UDP flows can get their fair share rate by the proposed scheme. Moreover, the scheme employs an estimation of number of active flows in the core routers. The estimation can be used to provide fair share rate without maintaining per flow states. The packets belonging to the flows whose rates exceed the estimated fair share rate are dropped. The novel scheme is called core-stateless labeling fairness (CSLF). We present and discuss simulations on the performance under different traffic scenarios.

Abstract In this paper, we evaluate the effectiveness of the current active queue management (AQM) schemes, such as Random Early Detection (RED) and match‐based CHOKe, over traffic with different packet‐size flows and over traffic with mixed adaptive and nonadaptive flows. We find that these schemes allow unfair bandwidth sharing when flows with different packet sizes share a link or when numerous adaptive and nonadaptive flows coexist in a link. In particular, the match‐based schemes present greater unfairness, especially when more nonadaptive flows exist in a shared link. We propose a novel AQM scheme, called Hash Rate Estimation (HRE). The proposed scheme, which works with a FIFO queue, uses per‐active‐flow rate estimation to impose a fair share on each flow. We show that HRE provides better protection than does Fair Random Early Drop (FRED), which uses per‐flow accounting to allocate each flow its fair share by a fixed dropping probability that depends on the flow's buffer use. HRE can support a large number of flows using hash function sorting. In addition, the queue length under HRE is bounded and the characteristics of traffic regulated by HRE are similar to those achieved by the per‐flow fair queuing schemes. © 2002 Wiley Periodicals, Inc.

The focus of this paper is to provide a scheme that a router should treat each packet differently according to its class. We propose a novel scheme that can provide both delay and loss proportional differentiated services. The scheme employs a probabilistic longest queue first (PLQ) mechanism, which reacts effectively to the queue-length fluctuation of each class. The proposed scheme is proven to achieve differentiated services after detailed evaluations. Furthermore, its implementation cost is much less than traditional schemes, such as WTP and PLR.

This paper has two parts: Firstly, we investigate today's ATM network, especially the most load NFS applications. Secondly, we propose a fast simulation based on fractional ARIMA processes and an importance sampling scheme. In our collected data, we have found the traffic characteristics of today's ATM network present both long range dependence (LRD) and short range dependence (SRD) structures. Because of the strong SRD and LRD of the empirical traces, models which can present both LRD and SRD are necessary to simulate the traffic of today's networks. However, traditional Monte Carlo simulations with long range dependent structure make the cost of the computation very large and for CLP (cell loss probability)<10/sup -9/ traditional Monte Carlo simulations are almost impossible to achieve it. The proposed fast ARIMA simulation based on importance sampling efficient to simulate the queuing performance with self-similar inputs which exhibit both SRD and LRD properties.