Mobile networks are prevalent in today's world, being used in a variety of applications ranging from personal use to the work environment and other. Ensuring security for users in a mobile network is therefore increasingly important. Denial-of-service attacks or DoS proved to be the biggest threat to mobile networks in recent years. A lot of work has been done in DoS targeting the infrastructure of the mobile network. User-targeted DoS attacks have been neglected in comparison. The fourth generation of cellular networks 4G LTE is the fastest growing mobile network in terms of subscriber numbers. The security aspect of mobile networks has improved throughout the generations, however, 4G proved to still have vulnerabilities in the signaling plane that allow a malicious attacker to target a specific user. Deploying a rogue base station and forcing the targeted user to connect to it is possible. The attacker could then deny selected services of the targeted user such as voice and SMS services. In this paper, we survey the work done on user-targeted DoS attacks in LTE networks. We analyze the 3GPP LTE standard specifications that allow such attacks. We also test the response of a LTE mobile device to tweaked Attach Accept messages during an Attach Procedure. We furthermore examine the conditions that affect the attack when we have equal priority cells. We finally present a case study of how a targeted user connected to an LTE network provider could be denied SMS and voice services therefore denying 2-factor authentication. We tested the scenarios using open-source implementations of the LTE network stack and widely available Software Defined Radios.

Traffic flowing through a software defined network is vulnerable to disruptions caused by malicious switches. The malicious behaviors are diverse such as dropping traffic, adding traffic or modifying it. A switch could be malicious or otherwise dysfunctional or misconfigured. A lot of work in SDN has addressed the problem by securing the control plane and having it validate network wide properties and policy compliance, e.g., loop-freedom, reachability and resolution of conflicting rules. In this paper, we argue that it is imperative as well to ensure the correctness of traffic forwarding itself. Therefore we define a threat model for the security and correctness of forwarding in an SDN switch. We describe several malicious behaviors that could be encountered at an SDN switch and propose possible solutions to each fault type. The capabilities of the SDN paradigm to detect and deter such attacks are analyzed.

Intrusion Detection Systems (IDSs) are important components in the strategy of defense in depth for network security. Whether an IDS detects intrusions correctly or not depends on the correctness of both its design and the implementation. A survey of the literatures over the last decade reveals various methodologies for the evaluation and testing of network intrusion detection algorithms. However most of these efforts focus on signature based and anomaly based network IDSs. There is another approach of detection known as protocol based detection or protocol anomaly detection. In this paper, we propose an approach for testing the correctness of implementations of protocol based intrusion detection systems. We demonstrate that by adapting protocol conformance testing methodologies we can effectively test the correctness of the implementations.

Conformance test sequences for communication protocols specified by finite state machines (FSM)often use unique input/output (UIO) sequences to detect state transition transfer faults. Since a UIO sequence may not exist for every state of an FSM, in the previous research, we extended UIO sequence to introduce a new concept called narrow input/output(NIO) sequence. The general computation of NIO sequences may lead to state explosion when an FSM is very large. In this paper, we present an approach to find NIO sequences using symbolic model checking.Constructing a Kripke structure and a computation tree logic (CTL) formula for such a purpose is described in detail. We also illustrate the method using a model checker SMV.

We investigate ways in which UIO-based conformance testing can fail to catch faults, including single and multiple faults, faults with extra or missing states, and faults at both the test sequence and subsequence levels. Given a particular error and test method, the error is masked if it is not detected by the test method. Many forms of fault masking are possible, and all test methods we have considered exhibit some forms of masking. Faults captured at the test subsequence level may become masked at the sequence level, and vice versa. Fault masking has been used to argue relative merits of various testing methods. Because of the pervasiveness of masking, we cannot use masking alone to argue that one UIO-based test method is superior to another. Information about the density of masked faults among all faults is needed to evaluate a test method.>

Protocols are large and complex software systems. Complete conformance testing of an implementation against its standard may not be feasible in terms of the resources available. This paper discusses a new approach, the P-method, to the testing of meaningful subsets of communication protocols for an asynchronous model of communication. The approach is based on the probabilistic verification of protocols, which is carried out on the more probable part of the protocol first. The technique can be used for generating probabilistic test sequences for the conformance testing of communication protocols to standards. The proposed method yields meaningful protocol test sequences which test the most probable behaviors of a protocol when the testing of the complete protocol is not feasible. Probabilistic test sequences can be categorized into different classes. The higher the class a probabilistic test sequence is in, the larger the extent of the protocol it covers, and the better is the fault coverage. If the class of a test sequence is high enough, its fault coverage is comparable to the fault coverage of test sequences generated by other methods. Results from a study of the P-method, using alternating bit protocol (ABP) and a subset of NBS TP4 as examples, support the claims above. It can also be shown that if errors are introduced only to the more probable part of the protocol, the fault coverage of P-method is also comparable to other methods.>

The closed-cover technique for verifying progress for two communicating finite-state machines exchanging messages over two lossless, FIFO channels is considered. The authors point out that the definition of a closed cover in M.G. Gouda (ibid., vol.SE-10, no.6, p.846-55, Nov. 1984) may be too restrictive, while that in M.G. Gouda and C.K. Chang (ACM Trans. Prog. Lang., vol.8, no.1, p.154-82, Jan. 1986) is not correct. They then show how a condition of the closed-cover definition can be modified to relax restriction to various degrees. They also discuss the similarities and relationship between the structural partition technique and the closed-cover technique.>