In a multi-tenant cloud, a number of Virtual Machines (VMs) are collocated on the same physical machine to optimize performance, power consumption and maximize profit. This, however, increases the risk of a malicious VM performing side-channel attacks and leaking sensitive information from neighboring VMs. As such, this paper develops and analyzes a game-theoretic framework for the VM migration timing problem in which the cloud provider decideswhento migrate a VM to a different physical machine to reduce the risk of being compromised by a collocated malicious VM. The adversary decides the rate at which she launches new VMs to collocate with the victim VMs. Our formulation captures a data leakage model in which the cost incurred by the cloud provider depends on the duration of collocation with malicious VMs. It also captures costs incurred by the adversary in launching new VMs and by the defender in migrating VMs. We establish sufficient conditions for the existence of Nash equilibria for general cost functions, as well as for specific instantiations, and characterize the best response for both players. Furthermore, we extend our model to characterize its impact on the attacker’s payoff when the cloud utilizes intrusion detection systems that detect side-channel attacks. Our theoretical findings are corroborated with extensive numerical results in various settings as well as a proof-of-concept implementation in a realistic cloud setting.

We present a novel game-theoretic framework for the Virtual Machine (VM) migration timing problem. In a multi-tenant cloud, a number of VMs are collocated on the same physical machine. This increases the risk of a malicious VM performing side-channel attacks and leaking sensitive information. To this end, this paper develops and analyzes a game-theoretic framework for the timing problem in which the cloud provider decides when to migrate a VM to a different physical machine to reduce the risk of being compromised by a collocated malicious VM. The adversary decides the rate at which she launches new VMs to collocate with the victim VMs. Our formulation captures a data leakage model in which the cost incurred by the cloud provider depends on the duration of collocation as well as the overhead in migration. We establish sufficient conditions for the existence of Nash equilibria for general cost functions, as well as for specific instantiations, and characterize the best response for both players. Our theoretical findings are corroborated with extensive numerical results in various settings.

Securing Cyber-Physical Systems (CPS) against cyber-attacks is a challenging problem as it requires continuously checking control and measurement signals for errors at runtime. The assignment of check blocks to check those signals must be performed using the available but possibly incomplete or uncertain information and within the delay bounds dictated by the control loop. Moreover, the assignment should remain unpredictable against an adversary who is able to observe/probe the assignment placed and adapt her attack methods accordingly. Due to the large number of potential check blocks that can be assigned, their varying effectiveness in detecting a wide range of cyber-attacks, and the uncertainty on the exact number of signals that need to be checked and protected, finding such strategic assignment is a critical endeavor. This paper presents two-stage stochastic programming models for equipping the CPS control loops with the proper check blocks to secure them. The formulation is based on a game theoretical approach to enable the defender to find an optimal randomized (i.e., mixed strategy) assignment of check blocks while abiding to the control-loop constraints. The models incorporate uncertainty in the number of signals to be checked/protected and capture various degrees of overhead in the operation of the check blocks. We illustrate the superiority of our results, in terms of the value of the stochastic solution, when compared to other assignment strategies. We validate our results through a Simulink-based model for a component in the operation of an autonomous vehicle.

Security and privacy in cloud computing are critical components for various organizations that depend on the cloud in their daily operations. Customers' data and the organizations' proprietary information have been subject to various attacks in the past. In this paper, we develop a set of Moving Target Defense (MTD) strategies that randomize the location of the Virtual Machines (VMs) to harden the cloud against a class of Multi-Armed Bandit (MAB) policy-based attacks. These attack policies capture the behavior of adversaries that seek to explore the allocation of VMs in the cloud and exploit the ones that provide the highest rewards (e.g., access to critical datasets, ability to observe credit card transactions, etc). We assess through simulation experiments the performance of our MTD strategies, showing that they can make MAB policy-based attacks no more effective than random attack policies. Additionally, we show the effects of critical parameters - such as discount factors, the time between randomizing the locations of the VMs and variance in the rewards obtained - on the performance of our defenses. We validate our results through simulations and a real OpenStack system implementation in our lab to assess migration times and down times under different system loads.

In recent years, there have been a number of successful cyber attacks on enterprise networks by malicious actors which have caused severe damage. These networks have Intrusion Detection and Prevention Systems in place to protect them, but they are notorious for producing a high volume of alerts. These alerts must be investigated by cyber analysts to determine whether they are an attack or benign. Unfortunately, there are magnitude more alerts generated than there are cyber analysts to investigate them. This trend is expected to continue into the future creating a need for tools which find optimal assignments of the incoming alerts to analysts in the presence of a strategic adversary. We address this challenge with the four following contributions: (1) a cyber screening game (CSG) model for the cyber network protection domain, (2) an NP-hardness proof for computing the optimal strategy for the defender, (3) an algorithm that finds the optimal allocation of experts to alerts in the CSG, and (4) heuristic improvements for computing allocations in CSGs that accomplishes significant scale-up which we show empirically to closely match the solution quality of the optimal algorithm.

As wireless networks continue to grow rapidly denser with the introduction of various wireless-enabled elements, signal interference coupled with limited radio spectrum availability emerges as a significant hindrance to network performance. In order to retain high network throughput, channels must be strategically assigned to nodes in a way that minimizes signal overlap between neighboring nodes. Current static channel assignment techniques are intolerant of network variations and growth, but flexible dynamic techniques are becoming more feasible with the introduction of software defined networks and network function virtualization. As network maintenance tasks are increasingly handled by software, however, network stability becomes susceptible to malicious behavior. In this paper, we adopt an attacker's prespective and expose stealthy attacks - which we coin “pinball” Attacks - that aim to trigger unnecessary channel switching behavior in a network and increase signal interference between neighboring nodes. We develop a Markov Decision Process (MDP) framework and investigate suboptimal attack policies applied to a number of real-world topologies. We derive attack policies as approximate MDP solutions due to the exponentially large state space. Our results show that pinball attack outperforms other attack policies such as Denial of Service, Random, and other heuristic policies.

The exponential increase in the number and types of mobile devices, along with their ever-growing sets of capabilities, have enabled the development of new architectures that aim to harness such heterogeneity. Transient Clouds (TCs) are examples of mobile clouds which are created on-the-fly by the devices present in an environment to share their physical resources (e.g., CPU, memory, network) and would disappear as the nodes leave the network. They enable a device to go beyond its own physical limitations through utilizing the capabilities offered by nearby devices over an ad-hoc network. In this paper we present a Transient Context-Aware Cloud (TCAC) in which the nodes of the network care more about providing/learning higher level functionalities rather than lower level capabilities. We make the case for such an architecture in scenarios where it is not feasible for all the nodes to compute the context due to privacy, energy, and delay constraints rather than an unreachable network.We present a prototype implementation of our architecture over Android smartphones connected via WiFi along with the performance metrics (power/energy consumption and accuracy)to show the benefits of context awareness in TCs.

Adaptive traffic lights are critical components in Intelligent Transportation Systems (ITS) aiming to minimize the trip times for vehicles as well as reduce their fuel emission rates. With the recent advances in embedded systems and communication technologies, traffic lights receive signals from nearby vehicles to learn about the current load conditions as well as the types of vehicles on various lanes. This information is used by the traffic lights to adjust the traffic cycles appropriately to optimize efficiency. In this paper, we study the impact of selective jamming attacks in which a subset of the signals from the vehicles to the traffic light are jammed. This causes the traffic light to adapt its cycle to incorrect load estimates, leading to an increase in the trip times for vehicles and higher fuel emission rates. We focus on stealthy types of attacks that take the cost of the attack in consideration when mounting attacks. In particular, the attacker aims to maximize the marginal utility of the jamming attack. We evaluate the effect of our exposed attacks using SUMO simulations under various types of scenarios and for different metrics of damage and cost.

Mobile devices are evolving into powerful systems due to recent advances in their communication, storage and computation technologies. They are poised to play a key role in providing a rich collaborative computing platform for various applications. This paper proposes "Transient Clouds" - a collaborative computing platform that allows nearby devices to form an ad-hoc network and provide various capabilities as cloud services. Transient Clouds utilize the collective capabilities of the devices present, along with their social and context awareness that cannot be provided efficiently by the traditional clouds. We present a modified algorithm of the Hungarian method for assigning tasks to devices in order to achieve various goals (e.g., load balancing, collocating executions, etc.). We evaluate the performance of our proposed algorithms through simulation and provide a real implementation on the Android platform using the Wi-Fi Direct framework. We envision Transient Clouds to be utilized in temporal scenarios in which the cloud is created on-the-fly by the devices present in an environment and would disappear as the devices leave the network.

Systems employing mobile devices (e.g., sensors, smart phones, robots) are emerging with growing capabilities in performing a wide variety of tasks. Due to their abundance and wide deployments, they are posed to play a dominant role in providing a rich mobile computing platform for various jobs, especially for new ones that are created on-the-fly. Realizing this platform is challenging since it is hard to predict the exact equipment present in an environment, what types of information need to be communicated to the devices to execute their tasks, and how to reprogram these devices. This work proposes a new on-demand collaborative computing framework that maps a new job as a set of tasks onto the mobile devices for execution. The mapping is done in a manner that takes into account the capabilities of the devices, the dependency between the tasks, the adjacency of the devices, and the requirements of the requested new job. Our proposed framework is implemented as a test-bed in our Mobile Cyber-Physical Systems lab with MICAz sensors and iRobot Create robots.

With the escalation of attacks that target mobile devices there is an increasing need for efficient monitoring tools. Due to computation, storage, and power constraints of the devices, these monitoring tools may overload the entire system causing severe performance degradation for the running applications. Moreover, they can be pushed by resource-intensive applications and may not perform an adequate monitoring job. To that end, in this project we develop adaptive monitoring tools that are capable of monitoring a wide range of information while efficiently utilizing the available resources on the mobile device. We apply control theoretic techniques to design monitoring functionalities, such as process, integrity and network monitors, that utilize the underlying resources efficiently. This is achieved through controllers that dynamically select the duty cycles of the monitors. Our models and results are validated on the Android platform through emulation and real implementation on the Nexus 7 tablet.

Recent advances in wireless technologies have enabled many new applications in Intelligent Transportation Systems (ITS) such as collision avoidance, cooperative driving, congestion avoidance, and traffic optimization. Due to the vulnerable nature of wireless communication against interference and intentional jamming, ITS face new challenges to ensure the reliability and the safety of the overall system. In this paper, we expose a class of stealthy attacks -- Stuck in Traffic (SiT) attacks -- that aim to cause congestion by exploiting how drivers make decisions based on smart traffic signs. An attacker mounting a SiT attack solves a Markov Decision Process problem to find optimal/suboptimal attack policies in which he/she interferes with a well-chosen subset of signals that are based on the state of the system. We apply approximate policy iteration algorithms to derive potent attack policies. We evaluate their performance on a number of systems and compare them to other attack policies including random, myopic and DoS attack policies. The generated policies, albeit suboptimal, are shown to significantly outperform other attack policies as they maximize the expected cumulative reward from the standpoint of the attacker.

The proliferation of mobile devices, coupled by the increase in their capabilities, have enabled the establishment of a rich mobile computing platform for various applications. In this paper we propose a probabilistic code distribution model that enables a mobile device to execute code segments through the help of nearby mobile devices in a secure and resilient manner. The model relies on randomization and replication techniques against unhelpful devices that do not execute their assigned code segments and malicious ones that try to reveal the overall application. We derive bounds to ensure the success of our scheme with a very high probability. Simulation and implementation experiments using MICAz sensors are conducted to validate our model and study the performance of our scheme.

Path splicing is a proposed routing architecture for the Internet in which end-hosts (and intermediate routers) are empowered to change the paths their traffic uses by modifying a number of bits in the packet headers. These bits allow intermediate routers to choose alternate paths from the shortest one. To that end, this paper exposes SKWeak (Selective K Weakest links) attacks that exploit the adaptive behavior of end-hosts, through attacking the K weakest links. We show that SKWeak attack can significantly increase the network overhead due to the use of non-optimal paths. Our results show a multiplicative factor of SKWeak attacks that are close to 700. We propose defense mechanisms that aim to limit the dynamics induced by preventing excessive splicing from end-hosts. Our assessment is conducted on the Sprint topology with synthetic traffic matrices.

In prefix hijacking, an Autonomous System (AS) advertises routes for prefixes that are owned by another AS, and ends up hijacking traffic that is intended to the owner. While misconfigurations and/or misunderstandings of policies are the likely reasons behind the majority of those incidents, malicious incidents have also been reported. Recent works have focused on malicious scenarios that aim to maximize the amount of hijacked traffic from all ASes, without considering scenarios where the attacker is aiming to avoid detection. In this paper, we expose a new class of prefix hijacking that is stealthy in nature. The idea is to craft path(s) - of tunable lengths - that deceive only a small subset of ASes. By finely tuning the degree to which ASes are effected, the attacker can handle the hijacked traffic while the victimized AS would not observe a major reduction in its incoming traffic that would raise an alarm. We give upper bounds on the impact of those attacks via simulations on real BGP Internet announcements obtained from Route-Views. We discuss shortcomings in current proposed defense mechanisms against attackers which can falsify traceroute replies. We also present a defense mechanism against stealthy prefix hijacking attacks.

Path splicing is a proposed routing architecture for the Internet in which end-hosts could change the path their traffic uses by changing a number of bits in the packet header. Path splicing improves the reliability of the network against link failures since it ensures that physically connected links can be discovered and used. To that end, this paper studies the performance of path splicing in non-adversarial and adversarial environments. In a non-adversarial setting, we investigate the implications behind giving the end-hosts the power to select routes in the absence/presence of errors in the probing mechanisms they are employing to infer the state of the network. In an adversarial setting, we examine the extent to which attackers can exploit path splicing to mount attacks that cause a series of route changes by end-hosts in searching for better paths. Our results are derived from real traffic matrices obtained from the GEANT network.

This paper proposes HELP://, a simple light-weight protocol that runs over HTTP and is used to disseminate information from a server(s) to its clients during the time of a crisis. HELP runs on an architecture that is a hybrid mix between a pure client/server architecture and a peer-to-peer architecture. Its resemblance to one versus the other is dynamically decided based on load. In particular, under light load, HELP operates in a client/server mode, where all clients are served directly from the server. Under high load, however, HELP picks one client in every n clients to help the server in serving its content. The value of n is chosen dynamically to optimize the performance of HELP and to ensure that clients receive their requested content with a very high probability, even in the presence of uncooperative clients. We assess the performance of HELP through analysis, simulation experiments and real implementation in Linux. We envision HELP to be installed as a plug-in in common browsers.

This paper presents a novel method to implement a covert channel that is based on inducing dynamics to convey a covert message. These dynamics are induced in a manner that emulates the normal operation of a hypothetical virtual channel. As a case study, this paper focuses on a scenario whereby TCP packet losses are induced to change the behavior of the Additive-Increase Multiplicative-Decrease (AIMD) congestion control mechanism of TCP to convey the covert message. From the outside, the TCP connection appears to be a normal connection that is traversing a congested link or a lossy wireless link. However, the sender, through monitoring the packets that get retransmitted, will decode the covert message. Packet losses are induced based on a hashing algorithm with specific hash patterns that are chosen a priori to emulate a specific loss rate. We have assessed the performance of this covert channel through simple analysis, simulation and real Internet experiments. We illustrate the existence of an optimal packet drop rate that maximizes the throughput of the covert channel.

One key adaptation mechanism often deployed in networking and computing systems is dynamic load balancing. The goal from employing dynamic load balancers is to ensure that the offered load would be judiciously distributed across resources to optimize the overall performance. To that end, this paper discovers and studies new instances of Reduction of Quality (RoQ) attacks that target the dynamic operation of load balancers. Our exposition is focused on a number of load balancing policies that are either employed in current commercial products or have been proposed in literature for future deployment. Through queuing theory analysis, numerical solutions, simulations and Internet experiments, we are able to assess the impact of RoQ attacks through the potency metric. We identify the key factors, such as feedback delay and averaging parameters, that expose the trade-offs between resilience and susceptibility to RoQ attacks. These factors could be used to harden load balancers against RoQ attacks. To the best of our knowledge, this work is the first to study adversarial exploits on the dynamic operation of load balancers.

Recent research have exposed new breeds of attacks that are capable of denying service or inflicting significant damage to TCP flows, without sustaining the attack traffic. Such attacks are often referred to as "low-rate" attacks and they stand in sharp contrast against traditional Denial of Service (DoS) attacks that can completely shut off TCP flows by flooding an Internet link. In this paper, we study the impact of these new breeds of attacks and the extent to which defense mechanisms are capable of mitigating the attack's impact. Through adopting a simple discrete-time model with a single TCP flow and a non-oblivious adversary, we were able to expose new variants of these low-rate attacks that could potentially have high attack potency per attack burst. Our analysis is focused towards worst-case scenarios, thus our results should be regarded as upper bounds on the impact of low-rate attacks rather than a real assessment under a specific attack scenario.

Current computing systems depend on adaptation mechanisms to ensure that they remain in quiescent operating regions. These regions are often defined using efficiency, fairness, and stability properties. To that end, traditional research works in scalable server architectures and protocols have focused on promoting these properties by proposing even more sophisticated adaptation mechanisms, without the proper attention to security implications. In this paper, we exemplify such security implications by exposing the vulnerabilities of admission control mechanisms that are widely deployed in Internet end systems to reduction of quality (RoQ) attacks. RoQ attacks target the transients of a system's adaptive behavior as opposed to its limited steady-state capacity. We show that a well orchestrated RoQ attack on an end-system admission control policy could introduce significant inefficiencies that could potentially deprive an Internet end-system from much of its capacity, or significantly reduce its service quality, while evading detection by consuming an unsuspicious, small fraction of that system's hijacked capacity. We develop a control theoretic model for assessing the impact of RoQ attacks on an end-system's admission controller. We quantify the damage inflicted by an attacker through deriving appropriate metrics. We validate our findings through real Internet experiments performed in our lab.

With the increased use of Virtual Machines (VMs) as vehicles that isolate applications running on the same host, it is necessary to devise techniques that enable multiple VMs to share underlying resources both fairly and efficiently. To that end, one common approach is to deploy complex resource management techniques in the hosting infrastructure. Alternately, in this paper, we advocate the use of self-adaptation in the VMs themselves based on feedback about resource usage and availability. Consequently, we define Friendly VM (FVM) to be a virtual machine that adjusts its demand for system resources, so that they are both efficiently and fairly allocated to competing FVMs. Such properties are ensured using one of many provably convergent control rules, such as Additive-Increase/Multiplicative-Decrease (AIMD). By adopting this distributed application-based approach to resource management, it is not necessary to make assumptions about the underlying resources nor about the requirements of FVMs competing for these resources. To demonstrate the elegance and simplicity of our approach, we present a prototype implementation of our FVM framework in User-Mode Linux (UML)---an implementation that consists of less than 500 lines of code changes to UML. We present an analytic, control-theoretic model of FVM adaptation, which establishes convergence and fairness properties. These properties are also backed up with experimental results using our prototype FVM implementation.

We expose an unorthodox adversarial attack that exploits the transients of a system's adaptive behavior, as opposed to its limited steady-state capacity. We show that a well orchestrated attack could introduce significant inefficiencies that could potentially deprive a network element from much of its capacity, or significantly reduce its service quality, while evading detection by consuming an unsuspicious, small fraction of that element's hijacked capacity. This type of attack stands in sharp contrast to traditional brute-force, sustained high-rate DoS attacks, as well as recently proposed attacks that exploit specific protocol settings such as TCP timeouts. We exemplify what we term as reduction of quality (RoQ) attacks by exposing the vulnerabilities of common adaptation mechanisms. We develop control-theoretic models and associated metrics to quantify these vulnerabilities. We present numerical and simulation results, which we validate with observations from real Internet experiments. Our findings motivate the need for the development of adaptation mechanisms that are resilient to these new forms of attacks.

The best-effort nature of the Internet poses a significant obstacle to the deployment of many applications that require guaranteed bandwidth. We present a novel approach that enables two edge/border routers which we call Internet traffic managers (ITM) - to use an adaptive number of TCP connections to set up a tunnel of desirable bandwidth between them. The number of TCP connections that comprise this tunnel is elastic in the sense that it increases/decreases in tandem with competing cross traffic to maintain a target bandwidth. An origin ITM would then schedule incoming packets from an application requiring guaranteed bandwidth over that elastic tunnel. Unlike many proposed solutions that aim to deliver soft QoS guarantees, our elastic-tunnel approach does not require any support from core routers (as with IntServ and DiffServ); it is scalable in the sense that core routers do not have to maintain per-flow state (as with IntServ); and it is readily deployable within a single ISP or across multiple ISPs. To evaluate our approach, we develop a flow-level control theoretic model to study the transient behavior of established elastic TCP-based tunnels. The model captures the effect of cross-traffic connections on our bandwidth allocation policies. Through extensive simulations, we confirm the effectiveness of our approach in providing soft bandwidth guarantees.