Z-Wave is a proprietary Internet of Things substrate providing distributed home and office automation services. The proprietary nature of Z-Wave devices makes it difficult to determine their security aptitude. While there are a variety of open source tools for analyzing Z-Wave frames, inspecting non-volatile memory, and disassembling firmware, there are no dynamic analysis tools allowing one to inspect the internal state of a Z-Wave transceiver while it is running. In this work, a memory introspection capability is developed for three Z-Wave devices containing a ZW0301, a Z-Wave transceiver system-on-chip. In all three devices, the firmware image is modified to include the memory introspection capability by hooking an existing data exfiltration mechanism used by the device. The memory introspection capability is applied to determine how nonces are generated by Z-Wave devices to prevent replay attacks. Through a combination of static and dynamic analysis, the nonce generating algorithm is found to be based on a nonce round key that updates every secure frame transaction.

This paper introduces a method for unsupervised tokenization of Controller Area Network (CAN) data payloads using bit level transition analysis and a greedy grouping strategy. The primary goal of this proposal is to extract individual time series which have been concatenated together before transmission onto a vehicle's CAN bus. This process is necessary because the documentation for how to properly extract data from a network may not always be available; passenger vehicle CAN configurations are protected as trade secrets. At least one major manufacturer has also been found to deliberately misconfigure their documented extraction methods. Thus, this proposal serves as a critical enabler for robust third-party security auditing and intrusion detection systems which do not rely on manufacturers sharing confidential information.

Smart home devices are relatively inexpensive, readily available, and easily integrated into homes. However, retailers provide smart home devices with little scrutiny in regards to device security or known vulnerabilities. This paper presents a smart home architecture designed with commercially available devices used to investigate Internet of Things data leakage in the wild. Additionally, a pattern-of-life analysis tool was developed to exhibit how an eavesdropper can use traffic from a smart home to classify devices, identify events, track users, and gain physical access to a home. The tool was evaluated through five-days of experimentation in which 17 of 18 devices were classified, 95% of 343 events were identified, and users were tracked with near 100% accuracy. This information, combined with a discovered Bluetooth low energy lock vulnerability, were used to gain unfettered access to the home while the user was away. Furthermore, a mitigation technique was created to introduce spoofed wireless traffic sent on behalf of devices within the home to hinder an eavesdropper’s ability to classify devices, identify events, and track users. During an additional five-day experiment, security devices were concealed, 221 false events were introduced per day, and the user appeared always home. Finally, this paper provides security recommendations to manufacturers and users to help defend against vulnerabilities and create a safer smart home environment.

Z-Wave is a proprietary technology used to integrate sensors and actuators over RF and perform smart home and office automation services. Lacking implementation details, consumers are under-informed on the security aptitude of their installed distributed sensing and actuating systems. While the Physical (PHY) and Medium Access Control (MAC) layers of the protocol have been made public, details regarding the network layer are not available for analysis. Using a real-world Z-Wave network, the frame forwarding and topology management aspects of the Z-Wave routing protocol are reverse engineered. A security analysis is also performed on the network under study to identify source and data integrity vulnerabilities of the routing protocol. It is discovered that the topology and routes may be modified by an outsider through the exploitation of the blind trust inherent to the routing nodes of the network. A Black Hole attack is conducted on a real-world Z-Wave network to demonstrate a well-known routing attack that exploits the exposed vulnerabilities. As a result of the discoveries, several recommendations are made to enhance the security of the routing protocol.

We propose a design to aid experimentation with SDN architectures using legacy network equipment. We implement a portion of the design on an FPGA and evaluate throughput and latency. Results indicate viability for testbed and research environments, especially with proposed additions to further reduce latency in broadcast- and multicast-heavy traffic.

Wireless networks are particularly vulnerable to spoofing and route poisoning attacks due to the contested transmission medium. Recent works investigate physical layer features such as received signal strength or radio frequency fingerprints to localize and identify malicious devices. In this paper we demonstrate a novel and complementary approach to exploiting physical layer differences among wireless devices that is more energy efficient and invariant with respect to the environment. Specifically, we exploit subtle design differences among transceiver hardware types. Transceivers fulfill the physical-layer aspects of wireless networking protocols, yet specific hardware implementations vary among manufacturers and device types. In this paper we demonstrate that precise manipulation of the physical layer header prevents a subset of transceiver types from receiving the manipulated packet. By soliciting acknowledgments from wireless devices using a small number of packets with manipulated preambles and frame lengths, a response pattern identifies the true transceiver class of the device under test. Herein we demonstrate a transceiver taxonomy of six classes with greater than 99 percent accuracy, irrespective of environment. We successfully demonstrate wireless multi-factor authentication, intrusion detection, and transceiver type fingerprinting through preamble manipulation.

The ever-increasing size and complexity of cloud computing, data centers, virtualization, web services, and other forms of distributed computing make automated and effective service management increasingly important. This article treats the service placement problem as a novel generalization of the on-line vector packing problem. This generalization of the service placement problem does not require a priori knowledge of the service resource profiles, allows for resource profiles to change over time, and allows services to be moved once placed on a server. An on-line self-organizing model profiles resource supplies and demands arranging services in a placement based on their resulting quality rating. A policy-driven asymmetric matrix norm quantifies the quality of the placement allowing for administrative preferences regarding service performance versus service inclusion. Service resource usage profiles' variations cause changes in their assigned placement quality; forcing new, better server placements to be found. Because some placements perform better, a proportional integral derivative controller for performance feedback adjusts the services' actual profile according to service's individual response times. This large scale system autonomically organizes placement of services in response to changes in demand and network disruptions. This article presents theorems which demonstrate the theoretical basis for the model. The article includes empirical results from the implementation of this model in a self-organizing testbed of web servers and services.

Large-scale systems are part of a growing trend in distributed computing, and coordinating control of them is an increasing challenge. This paper presents a cooperative agent system that scales to one million or more nodes in which agents form coalit

The ZigBee specification builds upon IEEE 802.15.4 low-rate wireless personal area standards by adding security and mesh networking functionality. ZigBee networks may be secured through 128-bit encryption keys and by MAC address access control lists, yet these credentials are vulnerable to interception and spoofing via free software tools available over the Internet. This work proposes a multi-factor PHY-MAC-NWK security framework for ZigBee that augments bit-level security using radio frequency (RF) PHY features. These features, or RF fingerprints, can be used to differentiate between dissimilar or like-model wireless devices. Previous PHY-based works on mesh network device differentiation predominantly exploited the signal turn-on region, measured in nanoseconds. For an arbitrary benchmark of 90% or better classification accuracy, this work shows that reliable PHY-based ZigBee device discrimination can be achieved at SNR ≥ 8 dB. This is done using the entire transmission preamble, which is less technically challenging to detect and is over 1000 times longer than the signal turn-on region. This work also introduces a statistical, pre-classification feature ranking technique for identifying relevant features that dramatically reduces the number of RF fingerprint features without sacrificing classification performance.

This work defines a heuristic to determine the most optimal configuration for a service oriented infrastructure by effectively and efficiently matching network nodes' resource provisions to services' resource demands. The heuristic is a numerical method that attempts to find the global minima of a configuration quality metric. The efficiency and effectiveness of the heuristic is compared to simulated annealing in a large scale simulation. In the large scale, the heuristic is an order of magnitude better in both effectiveness and efficiency.

In the boundless digital world and global society of the Internet, anonymity and privacy are becoming increasingly important issues. Many anonymous networking protocols have been proposed and numerous empirical investigations over these networks analyzed; however, no known taxonomies exist for consumers to quickly and easily identify which anonymity properties are offered by the disparate wired and wireless anonymous networks. This paper proposes a novel tree-based taxonomy (TBT) which allows the consumer to choose a desired classical or state-of-the-art anonymity protocol depending upon their specific network environment and anonymity requirements. The two key anonymity properties of unidentifiability and unlinkability and various network types are explored. This paper highlights the expanding definition of anonymity and aids consumer and researcher classification of state-of-the-art technological privacy-preserving anonymous networks.

With the aim to preserve privacy over a communications network, a plethora of anonymous protocols have been proposed along with many empirical investigations into specific adversary attacks over those networks. However, no known taxonomies exist that address anonymity in the diverse set of both wired and wireless anonymous communications networks. This paper proposes such a novel cubic taxonomy which explores the three key components of anonymity property, adversary capability, and network type. This taxonomy expands the definition of anonymity and aids in the advancement of state-of-the-art technological privacy-preserving mechanisms in anonymous networks against any adversary.

This paper develops a novel communications protocol for autonomous swarms of unmanned aerial vehicles (UAVs) searching a 2-dimensional grid. The search protocol, the UAV search mission protocol (USMP), combines inter-UAV communication with geographic routing to improve search efficiency in terms of total searches, distance traveled by UAVs, and the minimization of UAV direction changes. By determining where search state updates impact search decisions, messages are geographically routed to improve search efficiency. USMP and the geographic greedy perimeter stateless routing (GPSR) protocol are studied via simulation using OPNET modeler 12.0. Geographic routing degrades performance by at least 20% in total searches and distance traveled, but improves direction changes by 6.7%. Overall, USMP improves performance by as much as 188% compared to scenarios without inter-UAV communication.

Abstract This paper investigates the application of a secure group communication architecture to a swarm of autonomous unmanned aerial vehicles (UAVs). A multicast secure group communication architecture for the low earth orbit (LEO) satellite environment is evaluated to determine if it can be effectively adapted to a swarm of UAVs and provide secure, scalable, and efficient communications. The performance of the proposed security architecture is evaluated with two other commonly used architectures using a discrete event computer simulation developed using MATLAB. Performance is evaluated in terms of the scalability and efficiency of the group key distribution and management scheme when the swarm size, swarm mobility, multicast group join and departure rates are varied. The metrics include the total keys distributed over the simulation period, the average number of times an individual UAV must rekey, the average bandwidth used to rekey the swarm, and the average percentage of battery consumed by a UAV to rekey over the simulation period. The proposed security architecture can successfully be applied to a swarm of autonomous UAVs using current technology. The proposed architecture is more efficient and scalable than the other tested and commonly used architectures. Over all the tested configurations, the proposed architecture distributes 55.2–94.8% fewer keys, rekeys 59.0–94.9% less often per UAV, uses 55.2–87.9% less bandwidth to rekey, and reduces the battery consumption by 16.9–85.4%. Published in 2008 by John Wiley & Sons, Ltd.

This paper investigates how well secure lock scales. Using a Java simulation, secure locks are generated for network sizes up to 5,000 nodes using prime number node identifiers up to 512 bits in length. The resulting message sizes as well as the amount of time and memory consumed in the secure lock generation process are used for comparison. The Java BigInteger class enables secure lock generation on a desktop PC, which requires less than five minutes of time to produce the largest secure locks. The simulation also demonstrates secure locks' ability to exclude untrusted members of the network. It is found that as the number of recipients increases, the secure lock message size increases linearly, while the amount of time and system memory used to create the secure lock increase exponentially.

With the aim to preserve privacy over a communications network, a plethora of anonymous protocols have been proposed along with many empirical investigations into specific adversary attacks over those networks. However, few formal methods have been adequately developed and applied towards anonymous systems with the goal of modeling how an adversary reasons about anonymity. Indeed, many analyses assume a passive, global adversary but fail to provide a rigorous approach to defining and modeling anonymity concepts to ensure information and data assurance as is customary when formally proving other security aspects of a system. Hence, this paper proposes the possibilistic anonymity logical model (PALM) for capturing the knowledge and reasoning ability of an adversary in an anonymous network.

This paper presents the results of experiments to measure subjective G.711 audio quality resulting from wireless transmission over encrypted IEEE 802.11b, IEEE 802.11g, and IEEE 802.11n draft 2.0 wireless local area networks (WLANs). Following ITU-T Recommendation P. 800, forty-two human subjects rate audio recordings taken during 12 network conditions. WLAN encryption is alternated between WPA2 and WPA2 with transport mode 3DES IPsec, and simultaneous call volume is alternated between 6 or 10 simultaneous calls. Results indicate that a previous E-model calculation for 802.11b accurately predicts the subjective Mean Opinion Score (MOS). The upper bound for the decline in MOS due to 3DES IPsec is found to be less than 0.65 (90% CI) for all scenarios examined. Additionally, the subjective data suggest that the combination of G.711 encoding and 802.11 transmission makes toll quality (MOS > 4.0) calls over an encrypted 802.11 WLAN impractical.

Unauthorized reverse-engineering of programs and algorithms is a major problem for the software industry. Reverse-engineers search for security holes in the program to exploit or try to steal competitors' vital algorithms. To discourage reverse-engineering, developers use a variety of static software protections to obfuscate their programs. Metamorphic software protections add another layer of protection to traditional static obfuscation techniques, forcing reverse-engineers to adjust their attacks as the protection changes. Program fragmentation combines two obfuscation techniques, outlining and obfuscated jump tables, into a new, metamorphic protection. Sections of code are removed from the main program flow and placed throughout memory, reducing the program's locality. These fragments move and are called using obfuscated jump tables, making program execution difficult to follow. This research assesses the performance overhead of a program fragmentation engine and provides analysis of its effectiveness against reverse-engineering techniques. Results show that program fragmentation has low overhead and is an effective technique to complicate disassembly of programs using two common disassembler/debugger tools.

A novel client puzzle protocol, the memoryless puzzle protocol (MPP), is proposed and investigated. The goal is to show that MPP is a viable solution for mitigating distributed denial-of-service (DDoS) attacks in an anonymous routing environment. One such environment, Tor, provides anonymity for interactive Internet services. However, Tor relies on the transport layer security (TLS) protocol, making it vulnerable to distributed denial-of-service (DDoS) attacks. Although client puzzles are often proposed as a solution to denial-of-service attacks, this research is the first to explore TLS DDoS attack mitigation in the Tor anonymous routing environment. Using the MPP, the central processing unit (CPU) utilization and user-data latency measures are analyzed under four increasing DDoS attack intensities and four different puzzle probability distribution levels. For results, typical CPU utilization rates of 80-100% drop to below 70% signifying successful mitigation. Furthermore, even if a client only has a 30% chance of receiving a puzzle or the maximum puzzle strength is used, MPP effectively mitigates attacks. Finally, user-data latency decreases approximately 50% under large-scale attacks. Hence, the MPP is a suitable solution for increasing the robustness and reliability of Tor.

The skip graph, an application-layer data structure for routing and indexing, may be used in a sensor network to facilitate queries of the distributed k-dimensional data collected by the nodes, such as their geographic positions. Nodes in a standard skip graph sort keys in layered groups, where group membership is determined by random membership vectors. We propose a skip graph extension that inverts the key and membership vector roles, wherein group membership is based on deterministic z-ordering of k-dimensional data and sorting within groups is based on random keys. This extension retains the structure of a standard skip graph, and can be modified for use in 3D environments such as unmanned aerial vehicle swarms. Our results indicate this extension reduces the number of nodes contacted relative to the query precision, the volume of the multidimensional space, and the skip graph's height. We discuss our extension's performance relative to metrics at the application and network layers for static and mobile 2D networks.

A skip graph is a resilient application-layer routing structure that supports range queries of distributed k-dimensional data. By sorting deterministic keys into groups based on locally computed random membership vectors, nodes in a standard skip graph can optimize range query performance in mobile networks such as unmanned aerial vehicle swarms. We propose a skip graph extension that inverts the key and membership vector roles and bases group membership on deterministic vectors derived from the z-ordering of k-dimensional data and sorting within groups is based on locally computed random keys.

In the drive to create ever smaller transistors, conventional silicon CMOS devices are becoming more difficult to fabricate reliably as process size shrinks. New technologies are being investigated to replace silicon CMOS. While offering greater numbers of devices per unit area, all of these technologies are more difficult to fabricate, and more likely to fail in operation than current technologies. Nanotechnology research has identified the need for fault and defect tolerance at the architectural level so that future devices can be used in large-scale electronics circuits. This paper examines the problem of creating reliable caches using extremely unreliable technologies. We incorporate support logic (i.e., control, datapath, and self-test logic) into the analysis, and propose a novel Content Addressable Memory-based design incorporating "best practice" fault tolerant design techniques. The design requires 15 times the number of devices of a conventional design, but enables the use of device technologies with defect rates higher than 10-6, a three order of magnitude improvement over non-fault tolerant designs

We present a novel cooperative search algorithm for distributed, independent swarm robots. The focus of this paper is three fold: (1) identify fundamental issues associated with searching an area by multiple robots; (2) design a metric to measure the cooperation among multiple robots to complete a search; and (3) propose an effective search algorithm for swarm robots.

In this paper we present a portable fuzzy-logic based intrusion detection system that makes use of behavior profiles and signature matching techniques to detect Hyper Text Transfer Protocol (HTTP) tunnelling activities. The HTTP tunnelling is defined as techniques to use the HTTP protocol to encapsulate illegal and harmful messages within HTTP data. The portable system, whose function is governed by a Motorola 68HC12 microcontroller, is designed to detect both malicious and unauthorized HTTP tunnelling activities: (1) interactive tunnelling sessions, (2) scripted tunnelling sessions, and (3) unauthorized video and audio stream sessions. Preliminary experimental data show the validity of the proposed system.

We develop and analyze an elegant, opportunistic medium access control (MAC) protocol based on the proposed MAC standard for wireless local area networks (WLAN)-IEEE 802.11. Our adaptation of 802.11 is called CATER (code adapts to enhance reliability) and allows communicating stations to reconfigure their transceivers to use a longer pseudonoise (PN) code when retransmissions are unsuccessful over a degraded channel. Results show that our protocol continues to function, permitting up to 14 percent normalized aggregate throughput, at times when IEEE 802.11 fails. In addition, throughput experiences only a small decrease due to protocol overhead during periods when stations experience a good channel and few bit errors.