Location-based recommendation services (LBRS) are widely used by people to find new places of interest. However, the prevalence of LBRS poses a severe threat to users’ privacy, because LBRS queries contain sensitive information such as users’ preferences and location. Many Location Privacy Protection Mechanisms (LPPMs) have been proposed to mitigate the threat by obfuscating actual location in the query with a noise-based privacy-preserving technique. However, disguised location information can potentially harm the user experience with LBRS. In this work, we evaluate the impact of the noise-based privacy-preserving technique on user-perceived utility measured as nDCG (normalized Discounted Cumulative Gain) ranks. We empirically evaluate user-perceived utility under different noise levels to explore the trade-off between privacy and utility. A variety of factors, including service density and mechanism employed by service providers, are found to impact the utility loss, including but not limited to different service providers, different service types, and different sorts of areas (e.g., urban v.s. rural).

Managed DNS (MDNS) services today excel at providing a simple and cost-effective way to outsource domain management and ensure rapid lookup times for geo-distributed users. The intense focus on optimizing lookup performance coupled with DNS’ inherent expectations of weak consistency has had unfortunate side effects: updates are inexplicably slow and MDNS providers pay scant attention to consistency correctness. We conduct an empirical measurement-driven study of 8 top-tier managed DNS providers and find that inter-nameserver update propagation delays commonly take tens of seconds with little improvement over the last several years. Client-perceived inconsistency is rampant with roughly a third of end-users being vulnerable to TTL abuse by local DNS resolvers. Furthermore, we find that 6 of the 8 MDNS providers violate monotonic read consistency under frequent updates and at least one large MDNS provider appears to violate even eventual consistency.

Last-mile geo-localization plays an essential role in many location-based services, such as fraud detection and targeted advertising. In this study, we point out that round trip time (RTT) latency shows an extremely weak correlation with physical distance estimation in China's Internet, since a path between a vantage point and a destination can often be circuitous and inflated by queuing and processing delays. To sidestep the latency measurement, we perform a three-tier hop count based IP geo-localization mapping for China's Internet, on the assumption that each provincial router only serves a limited area. The mapping approach begins at the first tier using a single vantage point to fetch large-scale traceroute paths from the server to landmarks and target IPs. At the second tier, we try to find the last common routers along the traceroute paths of targets and landmarks and aggregate their hop count distances. At the third tier, we estimate the physical distances from hop count distances and provincial router radii, and geo-localize the targets to the nearest landmarks. Through large-scale experiments, we show that our approach is both cost-efficient and reliable, and can achieve last-ten-kilometer IP geo-localization for approximately 65% of the total 48874 pingable target IP addresses with a single ping server, and our hop count based approach completely outperforms the RTT based method.

Production networks are transitioning from the use of physical middleboxes to virtual network functions (VNFs), which makes it easy to construct highly-customized service chains of VNFs dynamically using software. Wide-area service chains are increasingly important given the emergence of heterogeneous execution platforms consisting of customer premise equipment (CPE), small edge cloud sites, and large centralized cloud data centers, since only part of the service chain can be deployed at the CPE and even the closest edge site may not always be able to process all the customers' traffic. Switchboard is a middleware for realizing and managing such an ecosystem of diverse VNFs and cloud platforms. It exploits principles from service-oriented architectures to treat VNFs as independent services, and provides a traffic routing platform shared by all VNFs. Moreover, Switchboard's global controller optimizes wide-area routes based on a holistic view of customer traffic as well as the resources available at VNFs and the underlying network. Switchboard globally optimized routes achieve up to 57% higher throughput and 49% lower latency than a distributed load balancing approach in a wide-area testbed. Its routing platform supports line-rate traffic with millions of concurrent flows.

Location-based social networks (LBSNs) feature friend discovery by location proximity that has attracted hundreds of millions of users world-wide. While leading LBSN providers claim the well-protection of their users' location privacy, for the first time we show through real world attacks that these claims do not hold. In our identified attacks, a malicious individual with the capability of no more than a regular LBSN user can easily break most LBSNs by manipulating location information fed to LBSN client apps and running them as location oracles. We further develop an automated user location tracking system and test it on leading LBSNs including Wechat, Skout, and Momo. We demonstrate its effectiveness and efficiency via a 3 week real-world experiment on 30 volunteers and show that we could geo-locate any target with high accuracy and readily recover his/her top 5 locations. Finally, we also develop a framework that explores a grid reference system and location classifications to mitigate the attacks. Our result serves as a critical security reminder of the current LBSNs pertaining to a vast number of users.

This paper presents a quantitative methodology and results comparing different approaches for {\it location-independent} communication. Our approach is empirical and is based on real Internet topologies, routing tables from real routers, and a measured workload of the mobility of devices and content across network addresses today. We measure the extent of network mobility exhibited by mobile devices with a home-brewn Android app deployed on hundreds of smartphones, and measure the network mobility of Internet content from distributed vantage points. We combine this measured data with our quantitative methodology to analyze the different cost-benefit tradeoffs struck by location-independent network architectures with respect to routing update cost, path stretch, and forwarding table size. We find that more than 20% of users change over 10 IP addresses a day, suggesting that mobility is the norm rather than the exception, so intrinsic and efficient network support for mobility is critical. We also find that with purely name-based routing approaches, each event involving the mobility of a device or popular content may result in an update at up to 14% of Internet routers; but, the fraction of impacted routers is much smaller for the long tail of unpopular content. These results suggest that recent proposals for pure name-based networking are suitable for highly aggregateable content that does not move frequently but may need to be augmented with addressing-assisted approaches to handle device mobility.

Malicious and selfish behaviors represent a serious threat against routing in delay/disruption tolerant networks (DTNs). Due to the unique network characteristics, designing a misbehavior detection scheme in DTN is regarded as a great challenge. In this paper, we propose iTrust, a probabilistic misbehavior detection scheme, for secure DTN routing toward efficient trust establishment. The basic idea of iTrust is introducing a periodically available Trusted Authority (TA) to judge the node's behavior based on the collected routing evidences and probabilistically checking. We model iTrust as the inspection game and use game theoretical analysis to demonstrate that, by setting an appropriate investigation probability, TA could ensure the security of DTN routing at a reduced cost. To further improve the efficiency of the proposed scheme, we correlate detection probability with a node's reputation, which allows a dynamic detection probability determined by the trust of the users. The extensive analysis and simulation results demonstrate the effectiveness and efficiency of the proposed scheme.

Cognitive Radio Network (CRN) is regarded as a promising way to address the increasing demand for wireless channel resources. It solves the channel resource shortage problem by allowing a Secondary User (SU) to access the channel of a Primary User (PU) when the channel is not occupied by the PU. The latest FCC's rule in May 2012 enforces database-driven CRNs, in which an SU queries a database to obtain spectrum availability information by submitting a location based query. However, one concern about database-driven CRNs is that the queries sent by SUs will inevitably leak the location information. In this study, we identify a new kind of attack against location privacy of database-drive CRNs. Instead of directly learning the SUs' locations from their queries, our discovered attacks can infer an SU's location through his used channels. We propose Spectrum Utilization based Location Inferring Algorithm that enables the attacker to geo-locate an SU. To thwart location privacy leaking from query process, we propose a novel Private Spectrum Availability Information Retrieval scheme that utilizes a blind factor to hide the location of the SU. To defend against the discovered attack, we propose a novel prediction based Private Channel Utilization protocol that reduces the possibilities of location privacy leaking by choosing the most stable channels. We implement our discovered attack and proposed scheme on the data extracted from Google Earth Coverage Maps released by FCC. Experiment results show that the proposed protocols can significantly improve the location privacy.

Collaborative spectrum sensing has been recognized as a promising approach to improve the sensing performance via exploiting the spatial diversity of the secondary users. In this study, a new selfishness issue is identified, that selfish users sense no spectrum in collaborative sensing. For easier presentation, it's denoted as entropy selfishness. This selfish behavior is difficult to distinguish, making existing detection based incentive schemes fail to work. To thwart entropy selfishness in distributed collaborative sensing, we propose YouSense, a One-Time Pad (OTP) based incentive design that could naturally isolate entropy selfish users from the honest users without selfish node detection. The basic idea of YouSense is to construct a trapdoor onetime pad for each sensing report by combining the original report and a random key. Such a one-time pad based encryption could prevent entropy selfish users from accessing the original sensing report while enabling the honest users to recover the report. Different from traditional cryptography based OTP which requires the key delivery, YouSense allows an honest user to recover the pad (or key) by exploiting a unique characteristic of collaborative sensing that different secondary users share some common observations on the same radio spectrum. We further extend YouSense to improve the recovery successful rate by reducing the cardinality of set of the possible pads. By extensive USRP based experiments, we show that YouSense can successfully thwart entropy selfishness with low system overhead.

The Database-driven Cognitive Radio Network is regarded as a promising way for a better utilization of radio channels without introducing the interference to the primary user. However, it is also facing a series of security threats. In this study, we identify a new kind of location privacy related attack which could geo-locate a secondary user from the spectrum he used. We propose a Spectrum Utilization based Location Inference Algorithm, which is based on the intersection of the possible location sets revealed by each channel access or channel transition event under the presence of the primary user. We implement our algorithm on the data extracted from Google Earth Coverage Maps released by FCC. Our experiement results show that, $80\%$ SUs could be located to 10 cells based on 25 or less channels.

Mobile social networks are expected to substantially enrich interaction with ubiquitous computing environments by integrating social context information into local interactions. However, in mobile social networks, the mobile users may face the risk of leaking their personal information and their location privacy. In this study, we first model the secure friend discovery process as a generalized privacy-preserving interest/profile matching problem. Then, we identify a new security threat arising from existing secure friend discovery protocols, coined as runaway attack, which is expected to introduce serious fairness issue. To address this new threat, we introduce a novel blind vector transformation technique, which could hide the correlation between the original vector and the transformed result. Based on it, we propose our fairness-aware privacy preserving interest/profile matching protocol, which enables one party to match its interest with the profile of another, without revealing its real interest and profile and vice versa. The detailed security analysis as well as real-world implementations demonstrate the effectiveness and the efficiency of the proposed protocol.

Collaborative spectrum sensing has been recognized as a promising way to ameliorate the sensing performance in cognitive radio networks. Unfortunately, it also introduces some system overhead to users, and as a result some selfish secondary users might be unwilling to contribute to collaborative spectrum sensing. In this paper, we propose a new selfishness model in cluster-based collaborative spectrum sensing, which is referred to Overclaim Selfishness (OS). An OS group may gain benefit by sharing nominally equal but actually much less sensing reports than it declares. To deal with this problem, we propose an Overclaim Selfishness Detection Scheme (OSDS) to detect the potential OS groups. We find that a single secondary user tends to have one special type of sensing reports correlated with his physical location, thus the cluster number estimated by OSDS should be no much less than the number of users the group contains. Further, we adopt an incentive scheme to stimulate rational groups to behave honestly. Finally, a real world experiment is adopted to demonstrate the effectiveness of our proposed scheme OSDS.

Malicious and selfish behaviors represent a serious threat against routing in Delay or Disruption Tolerant Networks (DTNs). Due to the unique network characteristics, designing a misbehavior detection scheme in DTN represents a great challenge. In this paper, we propose PMDS, a probabilistic misbehavior detection scheme, for secure DTN routing. The basic idea of PMDS is introducing a periodically available Trusted Authority (TA), which judges the node's behavior based on the collected routing evidences. We model PMDS as the Inspection Game and use game theoretical analysis to demonstrate that, by setting an appropriate investigation probability, TA could ensure the security of DTN routing at a reduced cost. To further improve the efficiency of the proposed scheme, we correlate detection probability with a node's reputation, which allows a dynamic detection probability determined by a node's reputation. The extensive analysis and simulation results show that the proposed scheme substantiates the effectiveness and efficiency of the proposed scheme.

Collaborative spectrum sensing has been regarded as a promising approach to enable secondary users to detect primary users by exploiting spatial diversity. In this paper, we consider a converse question: could space diversity be exploited by a malicious entity, e.g., an external attacker or an untrusted Fusion Center (FC), to achieve involuntary geolocation of a secondary user by linking his location-dependent sensing report to his physical position. We answer this question by identifying a new security threat in collaborative sensing from testbed implementation, and it is shown that the attackers could geo-locate a secondary user from its sensing report with a successful rate of above 90% even in the presence of data aggregation. We then introduce a novel location privacy definition to quantify the location privacy leaking in collaborative sensing. We propose a Privacy Preserving collaborative Spectrum Sensing (PPSS) scheme, which includes two primitive protocols: Privacy Preserving Sensing Report Aggregation protocol (PPSRA) and Distributed Dummy Report Injection Protocol (DDRI). Specifically, PPSRA scheme utilizes applied cryptographic techniques to allow the FC to obtain the aggregated result from various secondary users without learning each individual's values while DDRI algorithm can provide differential location privacy for secondary users by introducing a novel sensing data randomization technique. We implement and evaluate the PPSS scheme in a real-world testbed. The evaluation results show that PPSS can significantly improve the secondary user's location privacy with a reasonable security overhead in collaborative sensing.

This paper introduces a new security problem in which individuals movement traces (in terms of accurate routes) can be inferred from just a series of mutual contact records and the map of the area in which they roam around. Such contact records may be obtained through the bluetooth communication on mobile phones.