In cyber-physical system (CPS) over IEEE 802.11e-based wireless local area networks (WLANs), a misbehaving node can gain significant advantage over other normal nodes in terms of resource sharing by deliberately manipulating its protocol parameters. Due to the random spectrum-access nature of the protocol, it is challenging to detect the misbehaving node accurately and in real-time. Moreover, many existing misbehavior detectors, primarily designed for traditional IEEE 802.11 networks, become inapplicable in IEEE 802.11e networks with heterogeneous network configurations. In this paper, we propose novel real-time and light-weight countermeasures including a hybrid-share misbehavior detector and a packet-dropping-based misbehavior mitigation mechanism for IEEE 802.11e-based CPS. We develop mathematical models for the performance of the proposed detector and mitigation mechanisms. Extensive simulation results show that the proposed mechanisms can achieve a high detection rate and punish a misbehaving node with a high packet dropping rate.

The Enhanced Distributed Channel Access (EDCA) specification in the IEEE 802.11e standard supports heterogeneous backoff parameters and arbitration inter-frame space (AIFS), which makes a selfish node easy to manipulate these parameters and misbehave. In this case, the network-wide fairness cannot be achieved any longer. Many existing misbehavior detectors, primarily designed for legacy IEEE 802.11 networks, become inapplicable in such a heterogeneous network configuration. In this paper, we propose a novel real-time hybrid-share (HS) misbehavior detector for IEEE 802.11e based wireless local area networks (WLANs). The detector keeps updating its state based on every successful transmission and makes detection decisions by comparing its state with a threshold. We develop mathematical analysis of the detector performance in terms of both false positive rate and average detection rate. Numerical results show that the proposed detector can effectively detect both contention window based and AIFS based misbehavior with only a short detection window.

The session initiation protocol (SIP) is widely used for controlling multimedia communication sessions over the Internet Protocol (IP). Effectively detecting a flooding attack to the SIP proxy server is critical to ensure robust multimedia communications over the Internet. The existing flooding detection schemes are inefficient in detecting low-rate flooding from dynamic background traffic, or may even totally fail when flooding is launched in a multi-attribute manner by simultaneously manipulating different types of SIP messages. In this paper, we develop an online detection scheme for SIP flooding attacks, by integrating a novel three-dimensional sketch design with the Hellinger distance (HD) detection technique. In our sketch design, each SIP attribute is associated with a two-dimensional sketch hash table, which summarizes the incoming SIP messages into a probability distribution over the sketch table. The evolution of the probability distribution can then be monitored through HD analysis for flooding attack detection. Our three-dimensional design offers the benefit of high detection accuracy even for low-rate flooding, robust performance under multi-attribute flooding, and the capability of selectively discarding the offending SIP messages to prevent the attacks from bringing damages to the network. Furthermore, we design a scheme to control the distribution of the normal traffic over the sketch. Such a design ensures our detection scheme's effectiveness even under the severe distributed denial of service (DDoS) scenario, where attackers can flood over all the sketch table entries. In this paper, we not only theoretically analyze the performance of the proposed detection techniques, but also resort to extensive computer simulations to thoroughly examine the performance.

The distributed nature of the CSMA/CA-based wireless protocols, for example, the IEEE 802.11 distributed coordinated function (DCF), allows malicious nodes to deliberately manipulate their backoff parameters and, thus, unfairly gain a large share of the network throughput. In this paper, we first design a real-time backoff misbehavior detector, termed as the fair share detector (FS detector), which exploits the nonparametric cumulative sum (CUSUM) test to quickly find a selfish malicious node without any a priori knowledge of the statistics of the selfish misbehavior. While most of the existing schemes for selfish misbehavior detection depend on heuristic parameter configuration and experimental performance evaluation, we develop a Markov chain-based analytical model to systematically study the performance of the FS detector in real-time backoff misbehavior detection. Based on the analytical model, we can quantitatively compute the system configuration parameters for guaranteed performance in terms of average false positive rate, average detection delay, and missed detection ratio under a detection delay constraint. We present thorough simulation results to confirm the accuracy of our theoretical analysis as well as demonstrate the performance of the developed FS detector.

The open and distributed nature of the IEEE 802.11 based wireless networks provides selfish users the opportunity to to gain an unfair share of the network throughput by manipulating the protocol parameters, say, using a smaller contention window. In this paper, we propose an adaptive approach for real-time detection of such selfish misbehavior. An adaptive detector is necessary in practice, as it needs to deal with different misbehaving scenarios where the number of selfish users and the contention windows exploited by each selfish user are different. In this paper, we first design a basic misbehavior detector based on the non-parametric cumulative sum (CUSUM) test. While the basic detector can be modeled with a Markov chain, we further resort to the Markov decision process (MDP) technique to enhance the basic detector to an adaptive design. In particular, we develop a novel reward function based on which the optimal policy of the MDP can be determined. The optimal policy indicates how the adaptive detector should operate at each state. Another important feature of our detector is that it enables an effective iterative method to detect multiple misbehaving nodes. We present thorough simulation results to confirm the accuracy of our analysis, and demonstrate the efficiency of the adaptive detector compared to a static solution.

In this paper, we propose a secure cooperative data downloading framework for paid services in vehicular ad hoc networks (VANETs). In our framework, vehicles download data when they pass by a road side unit (RSU) and then share the data after they travel out of the RSU's coverage. A fundamental issue of cooperative data downloading is how vehicles effectively share data with each other. We develop an application layer data sharing protocol which coordinates the vehicles to relay data for sharing according to their positions. Such coordinated sharing can avoid collisions in the medium access control (MAC) layer and the hidden terminal issue in multi-hop transmissions. A salient feature of the proposed sharing protocol is that it can guarantee the receipt of the requested data file for each applicant vehicle passing a road side unit. Moreover, we also address security and privacy issues in the process of data downloading and sharing, ensuring applicants' exclusive access to the applied data and privacy of the vehicles involved in the application. We carry out NS2 simulations to thoroughly examine the performance of the proposed cooperative downloading protocol implemented over an 802.11p based VANETs.

As voice over IP (VoIP) increasingly gains popularity, traffic anomalies such as the SIP flooding attacks are also emerging and becoming into a major threat to the technology. Thus, detecting and preventing such anomalies is critical to ensure an effective VoIP system. The existing flooding detection schemes are inefficient in detecting low-rate flooding from dynamic background traffic, or may even totally fail when flooding is launched in a multi-attribute manner by simultaneously manipulating different types of SIP messages. In this paper, we develop an online scheme to detect and subsequently prevent the flooding attacks, by integrating a novel three-dimensional sketch design with the Hellinger distance (HD) detection technique. The sketch data structure summarizes the incoming SIP messages into a compact and constant-size data set based on which a separate probability distribution can be established for each SIP attribute. The HD monitors the evolution of the probability distributions and detects flooding attacks when abnormal variations are observed. The three-dimensional design equips our scheme with the advantages of high detection accuracy even for low-rate flooding, robust performance under multi-attribute flooding, and the capability of selectively discarding the offending SIP messages to prevent the attacks. Moreover, we develop an estimation freeze mechanism to protect the detection threshold from being polluted by attacks. Not only do we theoretically analyze the performance of the proposed detection and prevention techniques, but also resort to extensive simulations to thoroughly examine the performance.

In this paper, we propose a security protocol to detect sybil attacks for position based applications in privacy preserved vehicular ad hoc networks (VANETs). Vehicles in our protocol identify sybil attacks locally in a cooperative way by examining the rationality of vehicles' positions to their own neighbors. The attack detection utilizes the characteristics of communication and vehicles' GPS positions which are included in the periodically broadcasted safety related messages. No extra hardware and little communication and computation overhead will be introduced to vehicles. Therefore, our protocol is very light weighted and suitable for real applications. Moreover, a smart attacker scenario in which a malicious vehicle may adjust its communication range to avoid detection and the malicious vehicles' collusion scenario are also considered. Simulation results based on NS2 are presented to demonstrate the performance of the proposed protocol.

Denial of Service (DoS) attacks such as the SIP flooding pose great threats to normal operations of VoIP networks, and can bear various forms to elude detection. In this paper, we address the stealthy SIP flooding attack, where intelligent attackers deliberately increase the flooding rates in a slow pace. As the attack only gradually influences the traffic, it can effectively be disguised from previous SIP flooding detection methods. In order to identify the stealthy attack in its early stage for timely response, we propose a detection scheme based on the signal processing technique wavelet, which is able to quickly expose the changes induced by the attack. In particular, we monitor the percentage of energy corresponding to the detail signal obtained from the wavelet analysis as an indication of the attack. Also, considering the scalability of the proposed scheme, we resort to the sketch technique, which can summarize the traffic observations to a fixed-size hash table to provide raw traffic signals for the wavelet analysis regardless how many users exist in the VoIP network. We validate the performance of the proposed scheme through computer simulation and demonstrate its ability to quickly and accurately detect the attacks.

The distributed nature of the CSMA/CA based wireless protocols, e.g., the IEEE 802.11 distributed coordinated function (DCF), allows malicious nodes to deliberately manipulate their backoff parameters and thus unfairly gain a large share of the network throughput. The non-parametric cumulative sum (CUSUM) test is a promising method for real-time misbehavior detection due to its ability to quickly find abrupt changes in a process without any a priori knowledge of the statistics of the change occurrences. While most of the existing schemes for selfish behavior detection depend on heuristic parameter configuration and experimental performance evaluation, we develop a Markov chain based analytical model to systematically study the CUSUM based scheme for real-time detection of the backoff misbehavior. Based on the analytical model, we can quantitatively compute the system configuration parameters for guaranteed performance in terms of average false positive rate, average detection delay and missed detection ratio under a detection delay constraint. Moreover, we find that the short-term fairness issue of the 802.11 DCF impacts the transition probabilities of the Markov model and thus the detection accuracy. We develop a shuffle scheme to mitigate the short-term fairness impact on the sample series, and investigate the proper shuffle period (in terms of observation windows) that can maintain the randomness in each node's backoff behavior while resolving the short-term fairness issue. We present simulation results to confirm the accuracy of our theoretical analysis as well as demonstrate the performance of the developed real-time detection scheme.

The Session Initiation Protocol (SIP) has been widely used in VoIP for session control and management. As the basic SIP specifications do not require the proxy servers to track the states of established sessions, an extension header field "Session-Expires" has been proposed for SIP to allow the proxy server to hold resources for established sessions just within the specified periods. In this paper, we identify a novel denial of service (DoS) attack utilizing this SIP extension to drain resources of the proxy servers in wireless VoIP. In particular, by deliberately setting a large value of the "Session-Expires'' header and then physically disconnecting from the wireless network, attackers can repeatedly hold resources of the proxy server as long as they want. Also, the low-volume nature of the attack allows it to avoid being detected by existing volume-based intrusion detection systems. As a counter-measure, we propose a robust detection scheme based on the statistical Anderson-Darling test. The key insight that leads to the scheme is the changed statistical property of the header values induced by the attack. We validate the performance through computer simulation. The scheme shows its ability to detect the attack and is even more effective when applied against the distributed denial of service (DDoS) attack.

In this paper, we propose a secure data downloading protocol with privacy preservation in vehicular ad hoc networks (VANETs). In the data downloading application, vehicles send requests, such as where is the nearest gas station, at a road side unit (RSU) and receive the corresponding responses from application servers via current or the following RSUs. It would be easy for eavesdroppers to get vehicles' private information if semi-trust RSUs are compromised because both request and response messages are forwarded by them. Therefore, we develop a protocol which enables vehicles to download data securely from RSUs with their privacy under protection even when one or multiple RSUs are compromised. Our protocol guarantees vehicles exclusive access to their requested data while eavesdroppers can not obtain any private information of the vehicles. Possible attacks and the corresponding solutions as well as privacy evaluation are discussed to demonstrate the performance of the proposed protocol.

The open and distributed nature of the IEEE 802.11 based wireless network makes it easy for selfish nodes to gain unfair share on the networks by manipulating the protocol parameters. In this paper, we address the detection of such selfish behavior. The two main challenges associated with the detection problem are the unknown selfish behavior strategy and real-time detection of the behavior. While the two challenges are correlated for efficient detection, existing solutions can not address both of them well at the same time. In our work, we propose a new observation method monitoring the number of successful transmissions of the tagged node. This enables us to capture the short-term dynamic of the traffic behavior which is crucial for real-time detection. Integrating our the observation method with the CUSUM test, we develop a detection scheme to deal with both the challenges without any modification to the existing protocols. Moreover, we utilize a discrete Markov chain based model to characterize the behavior of the CUSUM test statistic, which enables us to quantitatively analyze the tunable parameters in the scheme for guaranteed detection performance. The performance of the proposed scheme is validated through ns-2 simulation. We show that the scheme is capable of quickly and accurately detecting the selfish behavior without knowledge of the selfish strategy.

The Voice over IP (VoIP) application utilizes the Internet to provide voice service; thus it is susceptible to various security issues common on the IP networks, such as the flooding attack. Moreover, VoIP uses the Session Initiation Protocol (SIP) for session control and management. The transactional nature of SIP makes flooding attack an even severer threat, which can consequentially lead to denial of service (DoS). In this paper, we develop an efficient online SIP flooding detection scheme by integrating the sketch technique with Hellinger distance (HD) based detection. The sketch data structure can summarize the SIP call generating process into a fixed set of data for developing a probability model. The HD technique, combined with on-line traffic estimation, can efficiently identify attacks by monitoring the distance between current traffic distribution and the estimated distribution based on history information. Compared to the original HD detection system, our technique achieves the advantages of higher accuracy, flexibility to deal with multi-attribute attacks and DDoS attacks, and the ability to track the period of attack. Computer simulation results are presented to demonstrate the performance of the proposed technique.

In this paper, we present the creation and characterization of an open source Internet Protocol Multimedia Subsystem (IMS) test bed. We built this test bed with the intention and motivation of doing research related to the performance of its various functional components as they cooperate to provide