Malicious software poses a great risk to critical infrastructure. Researchers have proposed numerous ways to analyze malware behavior in order to understand and respond to this threat. However, only little attention has been paid to the organization of the malware analysis process itself. In this paper we present the Malware Analysis and Storage System (MASS), a novel framework for malware analysis. MASS is designed as a distributed and scalable system and aims to empower cooperation between malware researchers. We will describe the central aspects of the framework and explain the malware analysis process flow. Furthermore, we will present a performance evaluation to demonstrate the suitability of the framework for typical malware analysis tasks.

It is known that the accumulated contact data of all stations of multistatic sonar arrays cannot be handled by traditional VHF links. While other technologies like satellite communication systems could handle the amount of data, these systems are usually too costly in terms of money, weight, or power consumption to be deployed on sonar buoys. Therefore, we installed commercial off-the-shelf WLAN with 4W boosters on a vessel and buoys and measured the achievable communication ranges and data rates during a sea trial. With our experiments we were able to reach ranges of 10km and beyond. Afterwards we derived functions and parameters from our measured data to help predicting the WLAN performance for similar scenarios.

Routing in MANETs still is a challenging task. Especially for proactive protocols where nodes periodically send control messages, a vast amount of the available data rate is used for link detection and the dissemination of topology information. Numerous enhancements to existing routing protocols to reduce the overhead caused by control messages have been proposed. Most of them use complex algorithms or keep track of previous messages. Due to the complexity and sometimes requirements for special hardware or information sources, none of these extensions are widely used. Therefore, we propose two extensions which are simple to implement yet provide significant overhead reduction for typical control messages. The first extension removes unnecessary bytes and redundancy from control messages. The second extension introduces smaller messages sent as replacements when the information did not change since the last message. Both extensions can be used in parallel or individually, providing a good amount of overhead reduction while being simple to implement and integrate.

One of the primary application scenarios for mobile wireless multi-hop networks are disaster areas. However, these pose specific challenges for routing, such as mobility and highly unpredictable links. The main applications for disaster area networks - group-based voice communication and group-oriented, map-based tracking - can be realized using multicast groups. Thus, we decided to implement ODMRP for disaster area deployments. In several disaster area maneuver on-site deployments, we identified the need for extensions, making the protocol more suitable for real-world deployments. In this paper, we propose three extensions to ODMRP: (1) link quality based routing, (2) prioritization of control messages, and (3) overhead reduction mechanisms. In simulations as well as in real-world measurements, we show the benefit of the extensions proposed.

In typical Mobile Ad-Hoc Network (MANET) applications, the network topology changes frequently due to device movement, or link failure. Consequently, a fast response to connectivity changes is one of the most important challenges in MANETs. Most proactive routing protocols detect changes by exchanging control messages. The Neighborhood Discovery Protocol (NHDP) specifies the exchange of these kind of messages. As shown in prior studies, the proposed fixed intervals of NHDP cause unnecessary protocol overhead or late link detection. Our Adaptive HELLO (AH) scheme adapts the interval dynamically with respect to the actual situation and coordinates it between the nodes when necessary. The result is a fast link change detection and an overhead reduction in certain scenarios.

Wireless multi-hop networks meet the requirements of disaster area scenarios by their definition. Recently, different mesh and Wireless Sensor Network (WSN) testbeds were deployed. However, these deployments do not meet the specific characteristics of disaster area scenarios. Developing algorithms and protocols for public safety scenarios and deploying public safety networks is a huge challenge.

Public safety organizations need robust communication networks to transmit different kind of sensor information. These networks must be reliable even when all infrastructure has been destroyed. Wireless multi-hop networks (such as Mobile Ad-Hoc Networks (MANETs), Wireless Sensor Networks (WSNs), and Wireless Mesh Networks (WMNs)) are supposed to meet the requirements of (1) spontaneous deployment, (2) being independent of any kind of existing infrastructure, and (3) robustness in the sense of self-organization and self-healing by their very definition. These networks have been a topic in research for more than a decade now. Recently, real-world tests and deployments provide valuable insights concerning challenges and future research directions. There are different mesh and WSN testbeds (e.g., [4, 9, 10]) enabling the research community to run tests in static real-world networks. However, concerning public safety requirements, there are significant differences: (1) No spontaneous deployment, (2) no or at least no mobility typical for public safety, (3) no typical applications and traffic for public safety scenarios. Due to these characteristics, developing algorithms and protocols for public safety scenarios and deploying public safety networks is a huge challenge.