The seven papers in this special issue focus on developments in the area of vehicular networks.

We focus on detecting intrusions in ad hoc networks using the misuse detection technique. We allow for detection modules that periodically fail to detect attacks and also generate false positives. Combining theories of hypothesis testing and approximation algorithms, we develop a framework to counter different threats while minimizing the resource consumption. We obtain computationally simple optimal rules for aggregating and thereby minimizing the errors in the decisions of the nodes executing the intrusion detection software (IDS) modules. But, we show that the selection of the optimal set of nodes for executing the IDS is an NP-hard problem. We describe a polynomial complexity, distributed selection algorithm, "Maximum Unsatisfied Neighbors in Extended Neighborhood" (MUNEN) that attains the best possible approximation ratio. The aggregation rules and MUNEN can be executed by mobile nodes with limited processing power. The overall framework provides a good balance between complexity and performance for attaining robust intrusion detection in ad hoc networks.

In this paper, some challenges for the providing service in a ubiquitous, mobile environment have been described. The first challenge is to provide the performance, the security is the other important challenge where its associations are formed with particular interfaces and the privacy also needed attention in a world that provides ubiquitous services. The design and development of the services brings their own set of challenges. It has to be designed such that they can function effectively in various resources and similarly it development needs careful thought. The other challenges such as novelty, desirability, testing and evaluation are also described in this paper

We consider ad hoc networks with multiple, mobile intruders. We investigate the placement of the intrusion detection modules for misuse-based detection strategy. Our goal is to maximize the detection rate subject to limited availability of communication and computational resources. We mathematically formulate this problem, and show that computing the optimal solution is NP-hard. Thereafter, we propose two approximation algorithms that approximate the optimal solution within a constant factor, and prove that they attain the best possible approximation ratios. The approximation algorithms though require recomputation every time the topology changes. Thereafter, we modify these algorithms to adapt seamlessly to topological changes. We obtain analytical expressions to quantify the resource consumption versus detection rate tradeoffs for different algorithms. Using analysis and simulation, we evaluate these algorithms, and identify the appropriate algorithms for different detection rate and resource consumption tradeoffs.

We focus on detecting intrusions in ad hoc networks using the misuse detection technique. We allow for detection modules that periodically stop functioning due to operational failure or compromise by intruders. Combining theories of stochastic coverage processes and approximation algorithms, we develop a framework to counter failure of detection modules, while minimizing the resource consumption. We show that the selection of the optimal set of nodes for executing the detection modules is an NP-hard problem. We present a distributed polynomial complexity selection algorithm that attains the best possible approximation ratio. We next consider a simple heuristic selection strategy that allows for seamless operation in time varying topologies. We obtain analytical expressions to quantify the tradeoffs between the resource consumption and detection rates attained by these algorithms. Using analysis and simulation, we identify the appropriate algorithms for different failure rates, resource limitation, and required detection rates.

In a wireless sensor network, sensors can be randomly distributed in order to collect data from a site. In many cases the location of the wireless sensor nodes is required in order to map the collected data to a particular location. Various schemes have been proposed earlier to estimate the location of sensor nodes in a sensor network. However most of these schemes assume the absence of a malicious user in the system which might not always be true. This paper presents a secure localization algorithm (SLA) that can be implemented with the capabilities of current sensor nodes without the need for any additional specialized hardware. The scheme is based on the transmission of nonces at different power levels from the anchor nodes. A sensor node receives a certain set of nonces which it will have to transmit back to the sink via the anchor nodes. The location of the sensor node can be estimated securely based on this set of nonces. We have investigated the properties of SLA using simulations

Current wireless networks that are widely deployed for various commercial applications, do not keep track of a mobile user's location. However, location information can enhance security by facilitating tracking of misbehaving users, or though implementation of location based network access. Previous work done on location estimation typically involves methods that use a lookup table comprising the client or access point signal strengths, which are collected manually at short distances throughout the site. This paper proposes a new data collection scheme for building a lookup table using client assistance in an enterprise wireless environment. In this work, a network-bused location estimation scheme is implemented using sniffers, which monitor client signal strength. It is observed that the accuracy of location estimation is improved by averaging the lookup table data collected over time. The client assisted data collection scheme can be used to frequently build lookup tables in an efficient manner and hence improve accuracy in location estimation. Thus, this scheme could be used to implement a location based security policy throughout the enterprise wireless network.

Sensor networks have increasingly become the subject of intense scientific interest over the past few years. In this work, we focus on intrusion detection in sensor networks. The intrusion detection community has been focusing mainly on wired networks. But techniques geared towards wire line networks would not suffice for a sensor environment because of the constraints associated with such networks. In this paper, we consider the arbitrary sized sensor networks and propose algorithms to improve the detection rates by intelligently enabling the intrusion detection functionality on particular sensor nodes. The proposed algorithms, based on the concepts of minimum cut-set and minimum dominating set, allow for a distributed implementation. The performance of the algorithms in identifying intrusions using signature based detection techniques is studied via simulations.

We consider ad hoc networks with multiple, mobile colluding intruders. We investigate the placement of the intrusion detection modules for misuse intrusion detection. Our goal is to maximize the detection performance subject to limitation in the computational resources. We mathematically formulate different detection objectives, and show that computing the optimal solution is NP-hard in each case. Thereafter, we propose a family of algorithms that approximate the optimal solution, and prove that some of these algorithms have guaranteeable approximation ratios. The algorithms that have analytically guaranteeable performance require re-computation every time the topology changes due to mobility. We next modify the computation strategy so as to seamlessly adapt to topological changes due to mobility. Using simulation we evaluate these algorithms, and identify the appropriate algorithms for different detection performance and resource consumption tradeoffs.

There has been a surge of interest in the delivery of personalized information to users (e.g., personalized stocks or travel information), particularly as mobile users with limited terminal device capabilities increasingly desire updated and targeted information in real time. When the number of information recipients is large and there is sufficient commonality in their interests, as is often the case, IP multicast is an efficient way of delivering the information. However, IP multicast services do not consider the structure and semantics of the information in the multicast process. We propose the use of Content-Based Multicast (CBM) where extra content filtering is performed at the interior nodes of the IP multicast tree; this will reduce network bandwidth usage and delivery delay, as well as the computation required at the sources and sinks. We evaluate the situations in which CBM is advantageous. The benefits of CBM depend critically upon how well filters are placed at interior nodes of the IP multicast tree and the costs depend upon those introduced by filters themselves. Further, we consider the benefits of allowing the filters to be mobile so as to respond to user mobility or changes in user interests and the corresponding costs of filter mobility. The criterion that we consider is the total network bandwidth utilization. For this criterion, we develop an optimal filter placement algorithm, as well as a heuristic that executes faster than the optimal algorithm. We evaluate the algorithms by means of simulation experiments. Our results indicate that filters can be effective in substantially reducing bandwidth. We also find filter mobility is worthwhile if there is marked large-scale user mobility. We conclude with suggestions for further work.

In this work, we measure wireless local area network (WLAN) voice performance and capacity. While most WLAN applications today are data centric, the growing popularity of Voice over IP (VoIP) applications and the escalating trend towards convergence with cellular networks will catalyze an increased mix of voice traffic. Since voice applications must compete with each other and with simultaneous data applications for WLAN bandwidth, quantifying voice performance and capacity in the presence of background data traffic is an important issue. We offer a practical investigation into the ability of 802.11b MAC layer to support simultaneous voice and data. We quantify VoIP capacity for standard WLAN networks, indicative of those already in the field, as well as evaluate the practical benefits of implementing backoff control and priority queuing at the access point. Conclusions are drawn based on an extensive set of real-world measurements conducted using off-the-shelf equipment in a commercial testbed.

This paper examines the use of Bluetooth for a collaborative music creation system called codeBLUE where the low cost, low power and small dimensions of Bluetooth technology are critical. Dancers using the codeBLUE system wear clothing incorporating Bluetooth-enabled sensors that measure and transmit information about the dancers' movements to a Bluetooth access point positioned in the demonstration area, which in turn forwards the information to a control system. The system software transforms the simple dance movements into musical modifications in real time, altering the melodic, rhythmic, and dynamic properties of the music stream in terms of MIDI parameters. A configuration console allows the DJ to modify the effects that each type of sensor produces, providing him or her yet another channel of creativity and keeping the codeBLUE experience fresh for participants. The paper describes the architecture, design, and hardware and software implementation of the codeBLUE proof-of-concept prototype. The paper also discusses our evaluation of the technology used for this application. The system has been successfully demonstrated to a live audience.

We investigate the behavior of the various transmission control protocol (TCP) algorithms over wireless links with correlated packet losses. For such a scenario, we show that the performance of NewReno is worse than the performance of Tahoe in many situations and even OldTahoe in a few situations because of the inefficient fast recovery method of NewReno. We also show that random loss leads to significant throughput deterioration when either the product of the square of the bandwidth-delay ratio and the loss probability when in the good state exceeds one, or the product of the bandwidth-delay ratio and the packet success probability when in the bad state is less than two. The performance of Sack is always seen to be the best and the most robust, thereby arguing for the implementation of TCP-Sack over the wireless channel. We also show that, under certain conditions, the performance depends not only on the bandwidth-delay product but also on the nature of timeout, coarse or fine. We have also investigated the effects of reducing the fast retransmit threshold.

Bluetooth is a low-power, low-cost wireless communication system operating in the 2.4 GHz ISM band. Since the 2.4 GHz band is shared among many other wireless systems, Bluetooth is particularly susceptible to harmful interference. We consider such scenarios and provide an algorithm that can increase the throughput in a Bluetooth piconet in the presence of lossy wireless channels. We show, through simulations, that the proposed algorithm provides increased throughputs for a wide range of channel conditions. In addition, the algorithm is simple and easily implementable.

In the Bluetooth system, isochronous applications, such as voice and audio, are carried by synchronous connection oriented (SCO) links. SCO packets are regularly scheduled every two, four, or six time slots and enjoy preemptive priority over data-bearing asynchronous connection-less (ACL) packets. The residual bandwidth available to simultaneous data services is often insufficient for many types of applications, even under perfect channel conditions. We introduce a novel methodology where isochronous audio traffic is carried over ACL links to obtain higher simultaneous data throughputs while strictly adhering to the 64 Kbps isochronous service quality guaranteed by SCO links. Simulation results are presented for a variety of channel conditions verifying that this technique improves both the throughput for data services and the quality of voice services.

Reliance of critical and other commonly used information systems on COTS middleware (CORBA, MOM, Web servers, etc.) has continued to grow tremendously in the past few years. However, COTS middleware is generally too weak to handle intrusions (i.e., information attacks), thus making critical and commonly used information systems highly vulnerable. We evaluate the possible intrusion scenarios associated with today's commercial middleware platforms and discuss the possible impacts. We also describe our approach based on the concepts of fragmentation-redundancy-scattering (FRS) to provide intrusion tolerance to some of these intrusion threats and the utilities provided by the middleware to implement needed functionality. Finally, we set the stage for our current and future work for applying a broad variety of FRS algorithms to a broad spectrum of COTS middleware.

In this paper we evaluate the situations in which CBM is advantageous. The benefits of CBM depend critically upon how well filters are placed at interior nodes of the IP multicast tree, and the costs depend upon those introduced by filters themselves. Further, we consider the benefits of allowing the filters to be mobile so as to respond to user mobility or changes in user interests, and the corresponding costs of filter mobility. We consider two criteria: minimizing total network bandwidth utilization and minimizing mean information delivery delay. For each criterion we develop an optimal filter placement algorithm, as well as a heuristic that executes faster than the optimal algorithm. Finally, we evaluate all the algorithms by means of simulation experiments. Our results indicate that filters can be effective in substantially reducing bandwidth and delay. We also find filter mobility is worthwhile if there is sufficient locality in the interests of users, or there is marked large-scale user mobility. We conclude with suggestions for further work.

In this paper we concentrate on one aspect of information system security, namely that of intrusion tolerance. An intrusion tolerant system is one that continues to function correctly and provide the intended user services in a timely manner even in the face of an information attack. In this paper we concentrate on a technique called fragmentation-redundancy-scattering and investigate as to how agents can be used with this technique to make a system more intrusion tolerant. An algorithm to perform fragmentation and scattering of the file(s) in an optimal manner is also given.

Mobile agent technology has been proposed as an alternative to traditional client-server computing for personalized information retrieval by mobile and wireless users from fixed wired servers. We develop a very simplified analytical model that examines the claimed performance benefits of mobile agents over client-server computing for a mobile information retrieval scenario. Our evaluation of this simple model shows that mobile agents are not necessarily better than client-server calls in terms of average response times; they are only beneficial if the space overhead of the mobile agent code is not too large or if the wireless link connecting the mobile user to the fixed servers of the virtual enterprise is error-prone. We quantify the tradeoffs involved for a variety of scenarios and point out issues for further research.

The problem of fair bandwidth sharing among adaptive (TCP) and non-adaptive (i.e. CBR-UDP) flows at an Internet gateway is considered. An algorithm that drops packet preventively, in an attempt to actively penalize the non-adaptive traffic that attempts to "steal" buffer space, and therefore bandwidth from the adaptive traffic flows, is presented. The algorithm maintains minimal flow state information and is therefore scalable. The performance of the algorithm is compared with other gateway algorithms and it is shown that, in the presence of non-adaptive traffic, it achieves a more balanced bandwidth allocation among the different flows. The behavior of a flow subjected to the given algorithm has also been analysed in detail.

In this paper, we investigate the behavior of the various algorithms of TCP, the internet data transport protocol, over wireless links with correlated packet losses.For such a scenario, we show that the performance of NewReno is worse than the performance of Tahoe in many situations and even OldTahoe in a few situations on account of the inefficient fast recovery method of NewReno.We also show that random loss leads to sign.%csnt throughput deterioration when either the product of the square of the bandwidth-delay ratio and the loss probability when in the good state exceeds 1 or the product of the bandwidth-delay ratio and the packet success probability when in the bad state is less than two.The performance of Sack is always seen to be the best and the most robust thereby arguing for the implementation of TCP SACK over the wireless channel.We also show that under certain conditions the performance depends not only on the bandwidth-delay product but also on the nature of timeout whether coarse or fine.We have also investigated the effects of reducing the fast retransmit threshold. introduction

In this paper we have studied the behavior of the different TCP algorithms on mobiles operating at different speeds. In order to do this we first describe a method of modelling the behavior of the various TCP versions analytically. We show that TCP Sack has the best performance of all the TCP versions in terms of link utilization thereby arguing for the widespread implementation of TCP Sack. We also show that at low speeds Tahoe is a better option compared to New Reno while at high speeds the performance of Sack and New Reno is similar. We then use the analytical model to characterize the loss probability region for high link utilization. From this we also derive approximate conditions on the buffer sizes at various speeds for which the link utilization will be high. Thus we show that at low speeds the performance is sensitive to the buffer size within certain limits. On the other hand at high speeds changing buffer capacity does not lead to much change in the link utilization.