Power aware routing in Wireless Sensor Networks (WSNs) focuses on the crucial issue of extending the network lifetime of WSNs, which are limited by low capacity batteries. However, most of the previously proposed power aware routing algorithms have an inherent problem, which is the isolation of the sink node due to the quick power exhaustion of nodes that are close to the sink. In this paper, we propose a solution, referred to as HYbrid Multi-hop routiNg (HYMN), which addresses this problem by combining two routing strategies, namely flat multi-hop routing and hierarchical multi-hop routing. The former method aims at minimizing the total power consumption in the network while the latter attempts to decrease the amount of transferred data traffic by utilizing data compression. We present a mathematical analysis on the effect of the hybrid location on the performance of HYMN, and also demonstrate the effectiveness of HYMN through extensive simulations.

While Transmission Control Protocol (TCP) is the most popular transport protocol used in terrestrial networks, its performance is not adequate in wireless networks with long delay, e.g., satellite networks. Though some improvements of TCP and new transport protocols have been proposed, we focus on Variable-structure congestion Control Protocol (VCP) designed for high Bandwidth Delay Product (BDP) networks. In VCP, Explicit Congestion Notification (ECN) is used to generate the feedback signal from routers to sources in order to notify the utilization ratio of a bottleneck link. By adjusting its congestion window according to the network traffic conditions, VCP is able to achieve high link utilization even in high BDP networks. However, VCP requires a long time to fill the link capacity due to its more conservative window control mechanism than the slow start phase in TCP. In addition, throughput is unnecessarily degraded in VCP due to packet losses in wireless environments. In this paper, to address these issues, we propose two extensions of VCP, namely Bandwidth-Independent Start-up Extension (BISE) and Wireless Loss Tolerant Extension (WLTE). BISE can quickly increase its congestion window in the start-up phase. WLTE can maintain high throughput in wireless environments. The performance of the proposed schemes is evaluated through computer simulations. The results demonstrate that the proposed schemes dramatically improve the performance of VCP in the initial phase and also in wireless environments.

Due to their ability to overcome many shortcomings associated with the contemporary client-server paradigm, Peer-to-Peer (P2P) networks have attracted phenomenal interests from researchers in both academia and industry. Interactive and multimedia streaming applications using P2P networks are, however, often prone to long startup delays, which disrupt the smooth playback and undermine users' perceived quality of service. In addition, P2P networks must be able to support a potential number of users while ensuring that the resources are efficiently utilized. In this paper, by addressing these shortcomings in the traditional P2P framework, we envision a novel scheme to effectively provide a Video-on-Demand (VoD) using P2P-based mesh overlay networks. The proposed scheme covers two main phases, namely requesting and scheduling modes. The former aims at dynamically selecting the required contents from the available peers. On the other hand, in the scheduling mode, the incoming requests are scheduled in a priority-based manner for minimizing the startup latency and sustaining the playback rate to an acceptable level. Computer simulations have been conducted to verify the effectiveness of the proposed scheme. The obtained results demonstrate the scalability of our envisioned scheme in addition to its capability to reduce the startup delay and provide a sustainable playback rate.

In IEEE 802.11 Distributed Coordination Function (DCF), the multi-rate Basic Service Set (BSS) suffers from the performance anomaly issue, which brings unfairness in terms of channel occupancy time. To solve the issue, this paper presents a rate control scheme for TCP Friendly Rate Control (TFRC) in IEEE 802.11 DCF mode. The proposed scheme controls the sending rate so that each station can use the wireless channel for equal duration. This is based on the channel occupancy period used by each station in BSS, which is monitored at the Media Access Control (MAC) layer. The performance of the proposed scheme over multi-rate IEEE 802.11 DCF is evaluated and compared with that of normal TFRC through several simulations. The simulation results show that the proposed scheme exhibits fairness in terms of channel occupancy time among the competing stations, which accordingly mitigates the performance anomaly. The proposed scheme improves the aggregated throughput in BSS.

Owing to the diverse geographical distributions of users, multi-layered satellite networks tend to exhibit high variances causing traffic concentrations at particular satellites to increase drastically. This results in high packet drop rates and severe degradation of Quality of Service (QoS). The Explicit Load Balancing (ELB) scheme was developed to address these issues in Low Earth Orbit (LEO) satellite networks by having the satellites, which experience heavy traffic, redirect a portion of the traffic via alternative paths. To cope with network congestion (over a single layer) and for better traffic distribution, multi layer satellites were proposed. In this paper, we propose an efficient traffic distribution scheme for multi-layered satellite networks based on ELB in which we extend the range for exchanging the traffic-load information for achieving further reductions in packet drop rates. We also present an enhanced technique for efficiently computing the detouring ratio. The effectiveness of the envisioned approach is validated via simulations.

The eHealth system is envisioned as a promising approach to improving health care through information technology, where security and privacy are crucial for its success and largescale deployment. In this paper, we propose a strong privacy-preserving Scheme against Global Eavesdropping, named SAGE, for eHealth systems. The proposed SAGE can achieve not only the content oriented privacy but also the contextual privacy against a strong global adversary. Extensive analysis demonstrates the effectiveness and practicability of the proposed scheme.

Abstract In this paper, we propose a signature‐based hierarchical email worm detection (SHEWD) system to detect e‐mail worms in large‐scale networks. The proposed system detects novel worms and instantly generates their signatures. This feature helps to check the spread of any kind of worm—knownorunknown. We envision a two‐layer hierarchical architecture comprising local security managers (LSMs), metropolitan security managers (MSM), and a global security manager (GSM). Local managers collectsuspiciousflows and hand them to metropolitan managers. Metropolitan managers then use cluster analysis to sort worms from the suspicious flows. The sorted worms are used to generate the worm signature which is relayed to the global manager and then to all the collaborating networks. A separate scheme is proposed to automatically select suitable values of the system parameters. This parameter selection procedure takes into account the current network state and thethreat levelof the ongoing attack. The performance of the whole system is investigated using real network traffic with traces of worms. Experimental results demonstrate that the proposed scheme is capable to accurately detect email worms during the early phase of their propagations. Copyright © 2008 John Wiley & Sons, Ltd.

For the management of early stage atherosclerosis, the concept of metabolic syndrome is important. An inexpensive, ultra-mobile ultrasound imaging device is proposed for the accurate diagnosis of the atherosclerosis. A linear probe capable of transmitting and receiving 64 ultrasound beams with the central frequency of 7.5 MHz is made. Echo images are displayed on a 5.7 inch LCD screen. The dimension of the device is 270 times 184 times 62 mm and the total weight including the probe is 1.9kg. For the popularization of the echo images for the patients' education and motivation, ultrasound movie client systems were proposed using a mobile phone or PlayStation Portabletrade. The entire procedure proposed in the paper consists of the development of electronic devices and configuration of this system including to the training of community health nurses to use this device.

Recent advances in solid state and packaging technologies have enabled production of more efficient and reasonably small devices such as micro electro mechanical systems (MEMS). Wireless sensor networks (WSNs) can gather data from sensor nodes and are now at the practical stage of realizations because of the above advances. Conventional researches have mainly focused on extending the lifetime of WSNs because sensor nodes are only equipped with small-capacity batteries. Mobile ubiquitous LAN extension (MULE) is one of the approaches to meet such demand, and it can gather data from isolated nodes. The KAT mobility scheme is one of the mobility schemes on MULE focusing on the efficiency. Therefore, this scheme is expected to prolong the lifetime of the network. However, this scheme cannot ensure that the mobile sinks can gather the data from all of the nodes. In this paper, we focus on the fairness issue of data gathered by the mobile sinks while also considering the efficiency of data gathering. We propose a new mobility scheme based on a new clustering method and the set cover algorithm to ensure that the mobile sinks can gather data from all of the nodes, and simulation results show that fairness of data gathering by the proposed mobility scheme is greatly improved as compared to conventional KAT mobility scheme.

In recent years, information leakage through the Internet has become a new social problem. Many information leakage incidents are caused by illegal applications such as Peer-to-Peer (P2P) file sharing software. To prevent information leakage, early detection and blocking of the traffic exchanged by illegal applications is strongly required. We have proposed a method for application identification based on the transition pattern of payload length of startup phase of the communication. The method can identify applications without using port numbers, which can be easily spoofed. However, the method can identify only applications which the method learned and cannot discriminate unlearned applications. In this paper, we propose a new application identification method by introducing "unknown" category to handle flows of unlearned applications.

Pulsing Denial-of-Service (PDoS) attacks seriously degrade the throughput of TCP flows and consequently pose a grave detrimental effect on network performance. The fact that they generate less traffic than traditional flood-based attacks makes PDoS detection more difficult. Most of the conventional PDoS detection shemes focus on the periodical pattern of the pulse trains. Therefore, attackers can easily escape the detection system by merely controlling the timing of pulse transmission. In this paper, we propose a novel and robust PDoS detection method which capitalizes on the bandwidth usage condition of network traffic in distinguishing the congestion due to normal traffic from that due to PDoS attacks. Simulation experiments have demonstrated the effectiveness of the proposed scheme in detecting PDoS attacks.

In recent years, information leakage through the Internet has become a new social problem. Many information leakage incidents are caused by illegal applications such as peer-to-peer (P2P) file sharing software. To prevent information leakage, early detection and blocking of the traffic exchanged by illegal applications is strongly required. In this paper, we propose a method for application discrimination of monitored traffic based on the transition pattern of payload length during start up phase of the communication. The proposed method does not need port numbers, which can be spoofed easily. Through experiments using real network traffic, we show that the proposed method can quickly and accurately discriminate applications.

The coupling of mobile ad-hoc networks (MANETs) and the Internet is gaining attention by researchers working towards future ubiquitous computing environments. In this work, we focus on the situation that occurs when specialized, sensitive data are sent to the Internet from MANET nodes. These special data types are especially susceptible to security risks such as information leak and data falsification. Therefore, it is necessary for such special data to be forwarded by a secure/trusted gateway which is under control of a trusted network administrator. However, we assume there can be multiple gateways deployed in a MANET, where the cost ineffectiveness makes it difficult for a network administrator to simultaneously manage every gateway. Because of the risk of forwarding special data through an unmaintained gateway, we propose a routing protocol which allows a source node to have all data forwarded to the Internet through a trusted gateway. To achieve desirable performance, we improve upon one of the newest routing protocols, Dynamic MANET On-demand (DYMO). Through simulations, we evaluated our proposal in comparison with the conventional DYMO protocol. The results show that our proposal achieves performance allowing MANET source nodes to choose gateways for specific data.

Data confidentiality is one of the most important concerns in security of ad-hoc networks which have been widely studied in recent years. In this paper, we consider the public-key cryptography which is one of the simplest and viable means to maintain data confidentiality. There are several ways to distribute a public key. Flooding is an intuitive approach to distribute each node’s public key. However, the normal flooding approach is costly, and can cause MAC-level contention in a dense region of nodes. Tree based topology flooding can be appied to mitigate these problems. The construction algorithm should use ideally only local information. In this paper, we propose a completely localized algorithm called the Local Tree-based Reliable Topology (LTRT) algorithm, which achieves both reliability and efficiency. LTRT is a localized version of TRT that has 2-edge connectivity. Each node can distribute its public key to all other nodes in the network by LTRT. Simulation results show the efficiency of LTRT and its superiority over other localized algorithms.

In multi-hop sensor networks, information obtained by the monitoring nodes need to be routed to the sinks. If we assume that the transmitter power level can be adjusted to use the minimum energy required to reach the intended next hop receiver, the energy consumption rate per unit information transmission depends on the choice of the next hop node. In a power-aware routing approach, most proposed algorithms aim at minimizing the total energy consumption or maximizing network lifetime. In this paper, we propose a new routing algorithm with two goals: minimizing the total energy consumption and ensuring fairness of energy consumption between nodes. We formulate this as a nonlinear programming problem and use a sub-gradient algorithm to solve the problem. We also evaluate the proposed algorithm via simulations at the end of this paper.

The transmission of high quality video requires high bandwidth. Ensuring constantly high bandwidth in wireless environments is a challenging task given constraints in the current wireless network resources. Current mobile computers are equipped with multiples wireless interfaces that can be used to improve the video quality by aggregating the bandwidth of these interfaces. Such Bandwidth Aggregation (BAG) approach involves multiple paths in communication and gives rise to a number of issues related to the management of the Service Level Agreement (SLA) and packet reordering. To guarantee an efficient and fair management of SLA, this paper presents a bandwidth aggregation-aware QoS negotiation mechanism that enables users to dynamically negotiate their desired service levels and to reach them through the use of bandwidth aggregation. This operation is performed while ensuring a fair use of the network resources among all competing users. To cope with packet reordering, a new scheduling strategy is presented. The performance evaluation of the proposed bandwidth aggregation-aware QoS negotiation scheme and the proposed scheduling algorithm are conducted via simulations and the results are discussed.

Attacks against encrypted protocols are becoming increasingly popular. They pose a serious challenge to the conventional intrusion detection systems (IDSs) which heavily rely on inspecting the network packet fields and are consequently unable to monitor encrypted sessions. IDSs can be broadly categorized into two types: signature-based and anomaly-based IDSs. The signature-based IDSs rely on previous attack signatures but are often ineffective against new attacks. On the other hand, anomaly-based detection systems depend on detecting the change in the protocol behavior caused by an attack. The latter can be employed to detect novel attacks, and therefore are often preferred over their signature-based counterpart. In this paper, we envision an anomaly-based IDS which can detect attacks against popular encrypted protocols, such as SSH and SSL. The proposed system creates a normal behavior profile and uses non-parametric Cusum algorithm to detect deviation from the normal profile. Upon detecting an anomaly, the proposed mechanism generates an alert, sets a delay to the protocol response, and traces back the attacker. The effectiveness of the proposed detection scheme is verified via simulations.

Satellite communication systems exhibit important and unique features that qualify them to be an integral part of a global ubiquitous information system. Given the universality of the Internet protocol (IP), traffic over satellite network is expected to be all IP. Success of these all-IP satellite systems depends on their abilities to guarantee QoS. QoS provisioning has been a hot topic in terrestrial wired networks. It has been, however, highly overlooked in wireless networks. An efficient QoS provisioning in wireless networks in general, and in satellite networks in particular, can be possible only with the development of new schemes that are able to dynamically (re)negotiate service levels in an adaptive manner to changes in network conditions upon handoff occurrences. This paper surveys major dynamic service level negotiation schemes proposed for terrestrial wireless networks and discusses their limitations when applied to satellite networks. As a solution, a dynamic service level negotiation scheme specifically tailored to satellite networks is portrayed. Comparison of the proposed scheme to other dynamic negotiation approaches, via a qualitative and quantitative analysis, is also presented.

Mobile users are expected to be highly dynamic in next generation mobile networks. Additionally they will be served a wide variety of services with different transmission rates and expect high quality of service (QoS). Since the number of mobile subscribers is rapidly increasing and given the limited resources of any robust network, guarantee of high QoS is possible only by the deployment of network elements that optimally allocate network resources and instantly adapt to network conditions. In attempt to support mobility in IP networks, the hierarchical mobile IPv6 (HMIPv6) has been proposed. An important issue that has been highly overlooked in the design of HMIPv6 consists in its lack of a mechanism that can efficiently control and distribute traffic among multiple mobility anchor points (MAPs). In the absence of such mechanism, some MAPs may get congested while others remain underutilized. In such scenario, mobile users connecting to congested MAPs may experience significant packet drops and excessive queuing delays. This ultimately affects QoS. In this vein, this paper proposes an application-driven mechanism for selection of MAPs. The key idea behind the proposed scheme consists in the reference of access points to the transmission rate of the users' applications to decide which MAP visiting users should be registering with. The decision of MAPs is performed in a way that the load variance of all MAPs, serving the access point in question, is minimized. Issues related to the frequency of binding update messages are also considered in the selection of MAPs. The performance of the proposed scheme is evaluated via computer simulations. In terms of QoS, encouraging results are obtained: better traffic distribution among MAPs and lower handoff delays.

Epidemic worms has become a social problem owing to their potency in paralyzing the Internet, thus affecting our way of life. Recent researches have pointed out that epidemic worms can propagate similar payloads rapidly. It was shown that it is possible to evaluate similarities between these payloads in terms of a 256-dimensional vector based on histograms of the appearance frequencies of 256 character codes. This observation has also been confirmed by our earlier works. However, this method, if applied to flows from only one network, which means a network managed by an independent organization, is prone to a high rate of false positives in cases such as when normal emails are sent through a mailing list. To overcome this problem, we propose a new scheme which checks for any similarity between flows detected at several IDSs in a distributed environment. The proposed scheme is based on the fact that normal payloads propagating from different networks are different, whereas in the case of epidemic worms payloads even propagated through different networks but generated by the same worm exhibit similarity. We have demonstrated the effectiveness of the proposed scheme through extensive experiments using real network traffic that contains worms."

Attacks against encrypted protocols have become increasingly popular and sophisticated. Such attacks are often undetectable by the traditional Intrusion Detection Systems (IDSs). Additionally, the encrypted attack-traffic makes tracing the source of the attack substantially more difficult. In this paper, we address these issues and devise a mechanism to trace back attackers against encrypted protocols. In our efforts to combat attacks against cryptographic protocols, we have integrated a traceback mechanism at the monitoring stubs (MSs), which were introduced in one of our previous works. While we previously focused on strategically placing monitoring stubs to detect attacks against encrypted protocols, in this work we aim at equipping MSs with a traceback feature. In our approach, when a given MS detects an attack, it starts tracing back to the root of the attack. The traceback mechanism relies on monitoring the extracted features at different MSs, i.e., in different points of the target network. At each MS, the monitored features over time provide a pattern which is compared or correlated with the monitored patterns at the neighboring MSs. A high correlation value in the patterns observed by two adjacent MSs indicates that the attack traffic propagated through the network elements covered by these MSs. Based on these correlation values and a prior knowledge of the network topology, the system can then construct a path back to the attacking hosts. The effectiveness of the proposed traceback scheme is verified by simulations.

Users in next generation wireless networks are expected to be highly dynamic while maintaining connectivity through different devices with different processing and communication capabilities. In wireless environments, bandwidth is scarce and channel conditions are time-varying. To guarantee quality of service (QoS) to users roaming between heterogeneous wireless networks, a dynamic QoS negotiation mechanism, which allows users to dynamically negotiate their service-levels with the network, is required. Several protocols for dynamic service level negotiation have been proposed, each focusing on a particular mode. This paper presents an overview of these protocols and discusses their limitations. To alleviate these shortcomings, a dynamic QoS negotiation scheme to allow users to change their service levels in response to changes in both network conditions and their own resource requirements is proposed. In the proposed scheme, upon an intra-domain handoff of a mobile node, the visited access point consults the previously used access point to confirm the legitimacy of the service negotiation request issued by the mobile node. The performance of the proposed scheme has been investigated and compared with other dynamic negotiation approaches. It was demonstrated that the proposed scheme outperforms the state-of-the-art method, in terms of the signaling overhead and data storage, at the expense of a slight increase in the overall negotiation delay.

Flooding-based approaches are incorporated in reactive routing protocols as the fundamental strategy for route discovery. They overtly affect traffic as the frequency of route discovery increases along with the mobility of users in a mobile ad hoc network (MANET). This paper presents a scheme for reducing overall traffic and end-to-end delay in highly MANET networks. Firstly a new routing algorithm is proposed to reduce the frequency of flood requests by elongating the link duration of the selected paths. In order to increase the path duration, non-disjoint paths are also considered. This concept is a novel approach in route discovery as previous reactive routing protocols seek only disjoint paths. Secondly another novel approach is presented to estimate the link expiration time without the need for global positioning system (GPS) devices. To prevent broadcast storms that may be intrigued during the path discovery operation, another scheme is also introduced. The basic concept behind the proposed scheme is to broadcast only specific and well-defined packets, referred to as "best packets" in the paper. The new protocol is simulated with regard to traffic overhead. Although our main aim in this paper is to reduce the net control traffic in a MANET network, there are other benefits arising from the proposed schemes, namely the increase in link duration, reduction in the end-to-end communication delay, less disruption in data flow, and fewer path setups.

Today, with the rapid advance in broadband technology, digital contents delivery applications have been used widely and the streaming technology has made the contents delivery more popular. Nowadays, there is high expectation on Digital Rights Management (DRM). Traitor Tracing is one of the DRM technologies and enables us to observe user's contents streaming and detect illegal contents streaming. However, malicious users can interrupt tracing with illegal processes at user-side computers. To prevent all illegal processes at the user- side, routers should analyze information embedded into packets, which is unrealistic. In this article, we propose a system to detect illegal contents streaming by using only traffic patterns which are constructed from the amount of traffic traversing routers. We also investigate a method to cope with random errors and burst errors which occur frequently in wireless environment and show the satisfactory result which we have obtained in a practical testing environment.

Rapid advances in wireless networking technologies have made it possible to construct a mobile ad hoc network (MANET) which can be applied in infrastructureless situations. However, due to their inherent characteristics, MANETs are vulnerable to various kinds of attacks which aim at disrupting their routing operations. To develop a strong security scheme to protect against these attacks it is necessary to understand the possible form of attacks that may be launched. Recently, researchers have proposed and investigated several possible attacks against MANET. However, there are still unanticipated or sophisticated attacks that have not been well studied. In this paper, we present a collusion attack model against optimized link state routing (OLSR) protocol which is one of the four standard routing protocols for MANETs. After analyzed the attack in detail and demonstrated the feasibility of the attack through simulations, we present a technique to detect the attack by utilizing information of two hops neighbors.

In light of the fast propagation of recent Internet worms, human intervention in securing the Internet during worm outbreaks is of little significance. In order to reduce the damage worms may cause, existing intrusion detection systems (IDSs) need to be adaptive to the security-related requirements of their monitoring networks. This paper presents a Multilevel security based Autonomic Parameter Selector (MAPS) that can be implemented over any existing IDSs. The deployment architecture consists of a number of hierarchically placed local security managers, metropolitan security managers, and a global security manager. These security managers report events to a worm advisory system (WAS). WAS accordingly sets the threat level of the network. Based on this level, MAPS selects the most optimum parameters for the entire IDS to combat against the propagating worm. The MAPS architecture maintains the system performance by constantly evaluating three metrics, namely False Negative Avoidance, False Positive Avoidance, and performance overhead. Extensive experiments, using real network traffic and a recently proposed worm detection system, demonstrate that MAPS is capable of advising an IDS with optimum parameter values to effectively and promptly hinder further propagation of worms.

Due to geographical and/or climatic constraints, the community of future satellite users will exhibit a significant variance in its density over the Globe. This density variance will yield a scenario where some satellite links are congested while others are underutilized. To ensure an intelligent engineering of traffic over satellite networks, this paper proposes a routing protocol that enables neighboring satellites to explicitly exchange information on their congestion status. A "soon-to-be-congested" satellite requests its neighboring satellites to decrease their data forwarding rates. In response, the neighboring satellites search for less congested paths that do not include the satellite in question and communicate a portion of data, primarily destined to the satellite, via the retrieved paths. By so doing, congestion, and the resulting packet drops, can be avoided. A better distribution of traffic among satellites can be guaranteed as well. The proposed scheme is dubbed "Explicit Load Balancing" (ELB) scheme. A set of simulations is conducted to evaluate the performance of the ELB scheme using the Network Simulator. In terms of Quality of Service, encouraging results are obtained: better traffic distribution, higher throughput, and lower packet drops.

This paper describes the architecture of a global sensor network based on a constellation of LEO satellites. The considered sensor network is heterogeneous: two types of sensor nodes are envisioned. One type does the sensing and relays the gathered data to the other type that performs data aggregation and communicates it directly to the satellites. The main challenging tasks in the design of the architecture are explored and adequate solutions are provided. A set of data dissemination techniques is then presented. Following this, a mathematical model is developed to evaluate the energy use of the sensors. Open research issues for the realization of such architecture are finally discussed.

In this paper, we propose the method for reducing out-of-order packets at handover event in LEO satellite networks. In LEO satellite networks, every communicating terminal handovers independently. Therefore, delay between terminals varies drastically within a short period. This drastic delay variation causes out-of-order packets and unnecessary fast retransmission of TCP. To avoid such delay variation, the proposed method makes a satellite to predict and control handover timing of connected user terminals. In the proposed method, two communicating terminals handover in a synchronized manner. By doing this, out-of-order packets at a handover can be reduced and this contributes to avoid occurrence of TCP's false retransmissions.

Internet Worms pose a serious threat to today's Internet. Signature matching is an important approach to detect worms. However, as most signature development processes are manual, they require significant time. They are thus not efficient in reducing the damage worms may cause. In this paper, an efficient signature-based method is proposed for automatic detection of worms over large-scale networks. In the proposed system, detection is performed in a hierarchical manner. Security managers of local networks collect worm-like or suspicious flows and handle these flows to high-hierarchy metropolitan managers. In response, the latter use this information to generate robust signature. The global manager which lies on top of the hierarchy, multicasts the signature to local managers via metropolitan managers. This enables local managers to detect worms that try to penetrate into their networks. The proposed system is evaluated using an off-line real network traffic that contains traces of worms. Experimental results indicate that the proposed system exhibits high detection rates with low false alarm rates.

Over the past few years, a number of private networks have emerged. In these private networks, a server provides its subscribed clients with Internet services, forming a one-to-many network topology. Given the fact that users are located at different distances from the server, usage of the Transmission Control Protocol (TCP) for communication results in drastically unfair bandwidth allocations among the users. In this regard, this paper addresses the fairness and efficiency issues of TCP in such one-to-many IP (Internet Protocol) networks. The efficiency of TCP is controlled by matching the aggregate traffic rate of all TCP connections to the sum of the link capacity and total buffer size. On the other hand, its unfairness issue is mitigated by allocating bandwidth among individual flows in relative proportion with their RTTs. Simulation results elucidate that the proposed method makes better utilization of the network resources, reduces the number of packet drops, and provides a fair service to users.

Low Earth Orbit (LEO) satellite networks are well characterized by frequent and bursty handover occurrences, and these handovers largely affect the cost of mobility management in LEO satellite networks. Although geographical location of a mobile node is useful information to make the mobility management independent from handovers, it is difficult to decide a last-hop satellite of the node based only on geographical location information. This last-hop ambiguity problem needs additional cost to find the real last-hop satellite. To reduce lasthop ambiguity, we propose to exploit orbital information of the satellite connected with a destination node in addition to geographical location information. Simulation results shows that the number of last-hop candidates and hop counts between candidates are reduced by introducing orbital information. Through a mathematical analysis, we evaluate the cost required for mobility management and show the effectiveness of the proposed method.

In the near future, RTP/RTCP-based multimedia streaming will become the norm not only in wired networks but also in mobile environments. Presently when a handoff occurs between heterogeneous networks (with different available bandwidths), a RTP sender cannot stream media at a suitable rate over the new network. Furthermore, RTCP fails to precisely adapt to sudden changes in network resources due to handoff. In order to solve these issues, 1) senders should be aware when mobile nodes are about to perform a handoff; 2) senders should then efficiently probe the available bandwidth in the new network and accordingly adjust their streaming rates. In this paper, we propose a scheme that allows mobile nodes to explicitly notify their handoff timing by using newly-defined RTCP packets. In the proposed scheme, senders probe the available bandwidth in the new network using low-priority RTP dummy packets. The performance of the proposed scheme is evaluated and compared with conventional schemes through extensive simulations. The simulation results show that the proposed scheme achieves appropriate bandwidth utilization immediately after a handoff occurrence and lowers packet losses during the handoff. The proposed scheme exhibits also high TCP-friendliness

Internetworking over vehicle ad-hoc networks (VANETs) is getting increasing attention from all major car manufacturers. The design of effective vehicular communications poses a series of technical challenges. Guaranteeing a stable and reliable routing mechanism over VANETs is an important step towards the realization of effective vehicular communications. In current ad-hoc routing protocols, the control messages in reactive protocols and route update timers in proactive protocols are not used to anticipate link breakage. They solely indicate presence or absence of a route to a given node. Consequently, the route maintenance process at both protocol types is initiated only after a link breakage event takes place. This paper argues the use of information on vehicle headings to predict a possible link breakage event prior to its occurrence. Vehicles are grouped according to their velocity vectors. When a vehicle shifts to a different group and a route, involving the vehicle, is to be broken, the proposed protocol searches for a more stable and "more durable" route that includes vehicles from the same group. The proposed scheme is dubbed velocity-heading based routing protocol (VHRP). Whilst the proposed scheme can be implemented on any existing routing protocol, the paper considers the case of VHRP over destination-sequenced distance vector (DSDV) routing protocol. The performance of the scheme is evaluated through computer simulations. Simulation results indicate that knowledge on the vehicles' heading adds major benefits to routing in terms of reducing the number of link breakage events and increasing the end-to-end throughput

Protection of mobile IP networks from denial-of-service (DoS) attacks, a serious security threat in today's Internet, is a one major step toward making this paradigm a reality. The paper proposes a method to detect DoS attacks, issued from mobile users, in the vicinity of flooding sources and in early stages before they cripple the targeted system. The fundamental challenge in attack detection consists in distinguishing between simple flash events and DoS attacks so as not to deprive innocent users from having legitimate accesses. In the proposed mechanism, this distinction is based on the fact that legitimate TCP flows obey the congestion control protocol, whereas misbehaving sources remain unresponsive. Suspicious flows are sent a test feedback and are required to decrease their sending rates. Legitimacy of such flows is decided based on their responsiveness. The scheme performance is evaluated through a set of simulations and encouraging results are obtained: short detection latency and high detection accuracy

While mobile communication systems provide certainly more flexibility to end-users, they present complex mobility management issues. To tackle mobility management issues, the concept of mobility anchor points (MAPs) was introduced and its use was proposed within the framework of the hierarchical mobile IPv6 (HMIPv6) protocol. However, due to traffic dynamics, the protocol performance remains critically affected by the selection of MAPs. This paper proposes a dynamic and efficient mobility management strategy for the selection of the most appropriate MAP with the lightest traffic load. The MAP selection is based on an estimation of MAP load transition using the exponential moving average (EMA) method. The proposed selection scheme is referred to as dynamic and efficient MAP selection (DEMAPS). The scheme performance is evaluated through simulations. Simulation results show that the DEMAPS scheme substantially reduces the number of packet drops, guarantees shorter service delays, makes better utilization of the network resources, avoids redundant transmissions, and maintains a fair and efficient distribution of the network load.

In order to realize the dream of global broadband coverage, the need for satellite communication systems has grown rapidly during the last few years. Several low Earth orbit (LEO), medium Earth orbit (MEO), and geostationary (GEO) satellite constellations have been thus proposed in the recent literature. However, these constellations either require a potential number of satellites or are unable to provide data transmission with high elevation angles. This paper proposes a new satellite constellation composed of quasi geostationary satellites. The main advantage of the constellation is in its ability to provide global coverage with a significantly small number of satellites while, at the same time, maintaining high elevation angles. Since end-terminals can be simultaneously covered by plural satellites in the proposed constellation, a scheme is proposed to select the most appropriate satellite for communication. The selection is based on the geographical location information of end-terminals. The efficiency of the proposed scheme is verified through a set of simulations. Simulation results reveal the good performance of the proposed method in reducing the delay, the delay variation, and ultimately improving the overall quality of service.

Internet worms pose a serious threat to networks. Most current intrusion detection systems (IDSs) take signature matching approach to detect worms. Given the fact that most signatures are developed manually, generating new signatures for each variant of a worm incurs significant overhead. In this paper, we propose a difference-based scheme which differences worm flows and normal flows to generate robust worm signatures. The proposed scheme is based on two observational facts - worm flows contain several invariant portions in their payloads, and core worm codes do not exist in normal flows. It uses samples of worm flows detected by available means to extract common tokens. It then differences the set of these tokens with those of normal flows and generates signature candidates. By using such signatures within enterprises, out of reach of worm writers, the possibility of being tricked by worm writers can be reduced. We evaluate the proposed scheme using real network traffic traces that contains worms. Experiment results show that the proposed scheme exhibits high detection rate with low false positives.

Mobile ad hoc networks (MANET) are usually formed without any major infrastructure. As a result, they are relatively vulnerable to malicious network attacks and therefore the security is a more significant issue than in infrastructure-type wireless networks. In these networks, it is difficult to identify malicious hosts, as the topology of the network changes dynamically. A malicious host can easily interrupt a route for which the malicious host is one of the forming nodes in the communication path. In the literature, there are several proposals to detect such malicious host inside the network. In those methods usually a baseline profile is defined in accordance to static training data and then they are used to verify the identity and the topology of the network, thus avoiding any malicious host to be joined in the network. Since the topology of a MANET is dynamically changing, use of a static profile is not efficient. In this paper, we propose a new intrusion detection scheme based on a learning process, so that the training data can be updated at particular time intervals. The simulation results show the effectiveness of the proposed technique compared to conventional schemes

In mobile environments, the fundamental challenge upon a handoff phenomenon consists in an efficient probing of the availability of the new network resources and an appropriate rate adjustment in the new network cell. This paper proposes the usage of low-priority dummy packets to probe the availability of the new network resources. Indeed, when a mobile node enters a cell overlapping area and is about to change its point-of-attachment to the network, two connections are simultaneously set between the mobile node and the sender: one through the old point-of-attachment and another through the new one. The sender transmits actual data through the old connection. Meanwhile, it sends dummy segments through the new connection to verify the bandwidth availability of the new network. The proposed scheme is dubbed dummy segment based bandwidth probing (DSBP). The performance of the DSBP scheme is evaluated and compared with existing schemes through extensive simulations. The results show that DSBP substantially improves the system efficiency, reduces the number of packet drops, and makes better utilization of the network bandwidth.

As originally specified, TCP did not perform well over satellite network systems, systems known with their rapidly time-varying network topologies. This paper addresses some vexing attributes that impair TCP performance in LEO satellite networks. The paper proposes a scheme that allows satellite systems to automatically adapt to the number of active TCP flows, the free buffer size and the bandwidth-delay product of the network. The proposed scheme controls the efficiency of the system by matching the aggregate traffic rate to the sum of the link capacity and total buffer size. This attribute helps to adjust TCP's aggressiveness and to prevent persistent queues from forming. The system min-max fairness is achieved by allocating bandwidth among individual flows in proportion with their RTTs. Simulation results elucidate that the proposed scheme substantially improves the system fairness, reduces the number of packet drops and makes better utilization of the bottleneck link. The results demonstrate also that the proposed scheme works properly in more complicated environments where connections traverse multiple bottlenecks and the available bandwidth may change over data transmission time.

Transmission control protocol (TCP) is the most widely used transport protocol in today's Internet. Despite the fact that several mechanisms have been presented in recent literature to improve TCP, there remain some vexing attributes that impair TCPs performance. This paper addresses the issue of the efficiency and fairness of TCP in multihops satellite constellations. It mainly focuses on the effect of the change in flows count on TCP behavior. In case of a handover occurrence, a TCP sender may be forced to be sharing a new set of satellites with other users resulting in a change of flows count. This paper argues that the TCP rate of each flow should be dynamically adjusted to the available bandwidth when the number of flows that are competing for a single link, changes over time. An explicit and fair scheme is developed. The scheme matches the aggregate window size of all active TCP flows to the network pipe. At the same time, it provides all the active connections with feedbacks proportional to their round-trip time values so that the system converges to optimal efficiency and fairness. Feedbacks are signaled to TCP sources through the receiver's advertised window field in the TCP header of acknowledgments. Senders should accordingly regulate their sending rates. The proposed scheme is referred to as explicit and fair window adjustment (XFWA). Extensive simulation results show that the XFWA scheme substantially improves the system fairness, reduces the number of packet drops, and makes better utilization of the bottleneck link.

Low earth orbit (LEO) satellite networks are capable of providing wireless connectivity to any part of the world while guaranteeing short propagation delays. There is a huge need for developing Internet protocol (IP) friendly networking technologies that aim to integrate emerging LEO satellite networks with the already existing terrestrial IP networks. LEO satellite networks are well characterized by frequent handover occurrences. These handovers largely affect mobility management in LEO satellite networks. Existing IP mobility management protocols, such as mobile IP, manage the location of mobile nodes on the basis of the network topology. Applying such mechanisms in LEO satellite networks will cause a binding update of mobile nodes upon every handover occurrence. Given the frequent occurrence of handovers in LEO satellite networks, a potentially large number of binding update requests will be generated and ultimately affects the scalability of mobility management. This paper argues a handover-independent mobility management scheme for LEO satellite networks. The proposed scheme purposes to exploit geographical location information to make the mobility management independent from handovers. This handover-independent management method reduces the number of update requests and eventually increases the system scalability. A detailed description of the actual implementation of the scheme is given. Through a mathematical analysis, the paper evaluates the required management cost and accordingly verifies the scalability of the proposed scheme.

This paper presents a precise system for handwritten Chinese and Japanese character recognition. Before extracting directional element feature (DEF) from each character image, transformation based on partial inclination detection (TPID) is used to reduce undesired effects of degraded images. In the recognition process, city block distance with deviation (CBDD) and asymmetric Mahalanobis distance (AMD) are proposed for rough classification and fine classification. With this recognition system, the experimental result of the database ETL9B reaches to 99.42%.

In this paper, we present a heuristic approach to analyze a boundary of network bandwidth allocated to the source(s). This approach can be applied for call admission control (CAC) in ATM networks. Our approach applies two characteristic functions, a time /spl epsi/-quantile function to characterize the source behavior and a function to characterize a maximum amount of network bandwidth served by the multiplexer. These two functions are computed independently and when used simultaneously, it allows us to obtain a new and useful notion of the statistical bandwidth allocation. Moreover, we demonstrate the use of our approach on stochastic and deterministic sources. For the deterministic source, we apply our approach to the source characterized by dual leaky bucket-based traffic descriptor. Its upper bound on bandwidth requirement can be easily obtained for performing a CAC function in real time while providing a significant improvement of network utilization when compared to the peak rate-based bandwidth allocation.

Today, high accuracy of character recognition is attainable using a neural network for problems with a relatively small number of categories. But for large categories, like Chinese characters, it is difficult to reach the neural network convergence because of the "local minima problem" and a large number of calculations. Studies are being done to solve the problem by splitting the neural network into some small modules. The effectiveness of the combination of learning vector quantization (LVQ) and back propagation (BP) has been reported. LVQ is used for rough classification and BP is used for fine recognition. It is difficult to obtain high accuracy for rough classification by LVQ itself. To deal with this problem, we propose hierarchical learning vector quantization (HLVQ). HLVQ divides categories in feature space hierarchically in the learning procedure. The adjacent feature spaces overlap each other near the borders. HLVQ possesses both classification speed and accuracy due to the hierarchical architecture and the overlapping technique. In the experiment using ETL9B, the largest database of handwritten characters in Japan, (includes 3036 categories, 607,200 samples), the effectiveness of HLVQ was verified.

Network configuration information is useful in producing a visual map of the network complete in all details. The visual map is an essential component for network management and operations. It is also possible to generate an inventory report of a network. The inventory report describes the nodes, networks, interfaces, addresses, protocols, speeds, etc. and is a valuable component for network planning and administration. Unfortunately, network management is severely constrained in scope and effectiveness by the lack of any organized pool of network configuration information. We present results of our efforts to develop tools and techniques for automatically and mechanically synthesizing network configuration related information from the Internet. These techniques, we believe, will be instrumental in, generating the pool of network configuration information.

As a fundamental study of multiple image processing, the authors have developed a new technique for the analysis of multispectral remote sensing data. Though the basis of the authors' algorithm is similar to a histogram analysis, they have proposed a novel way of the representation of multidimensional image data, which facilitates a nonexpert to locate and assign different classes present in the data set. The authors' experimentation was done with NOAA satellite image data. The brightness of the received data from channels of different frequency bands are the different dimensions of the multispectral image. By using this method, the authors could successfully classify NOAA satellite data received from the northern part of Japan, and locate the plane areas as an exercise. The authors have quantitatively compared their result with official data. The authors' result was found to be only 1 percent in deviation with the official data.>

The spaceborne synthetic aperture radar (SAR) to be launched on the Japanese Earth Resources Satellite-1 is described. The SAR is operated in the L-band. The mission is mainly dedicated to geological applications. The ground resolution of the processed image is designed as 18 m and the off-nadir angle required to meet geological applications is 35 degrees . The design and performance of the key system parameters are discussed, along with the reasons for choosing such design parameters. The antenna is a thin-flat-foldable configuration that has a 11.9-m by 2.2-m aperture when extended in orbit. The transmitter, receiver, and signal processor are all of the solid-state type to achieve high reliability of operation. They transmit an 1100-W peak (minimum) chirp pulse and receive the return echos and process the echo signals into in-phase and quadrature data streams.>