IEEE 2020; Recent Advances of Image Steganography with Generative
Adversarial NetworksAbstract : In the past few years, the Generative
Adversarial Network (GAN), which proposed in 2014, has achieved great success.
There have been increasing research achievements based on GAN in the field of
computer vision and natural language processing. Image steganography is an
information security technique aiming at hiding secret messages in common
digital images for covert communication. Recently, research on image
steganography has demonstrated great potential by introducing GAN and other
neural network techniques. In this paper, we review the art of steganography
with GANs according to the different strategies in data hiding, which are cover
modification, cover selection, and cover synthesis. We discuss the
characteristics of the three strategies of GAN-based steganography and analyze
their evaluation metrics. Finally, some existing problems of image
steganography with GAN are summarized and discussed. Potential future research
topics are also forecasted.
IEEE 2018 : Anomaly Detection and Attribution in Networks With
Temporally Correlated Traffic
Abstract : Anomaly detection in communication networks is the first step in
the challenging task of securing a network, as anomalies may indicate
suspicious behaviors, attacks, network malfunctions, or failures. In this
paper, we address the problem of not only detecting the anomalous events but
also of attributing the anomaly to the flows causing it. To this end, we
develop a new statistical decision theoretic framework for temporally
correlated traffic in networks viaMarkov chain modeling.We first formulate the
optimal anomaly detection problem via the generalized likelihood ratio test
(GLRT) for our composite model. This results in a combinatorial optimization
problem which is prohibitively expensive. We then develop two low-complexity
anomaly detection algorithms. The first is based on the cross entropy (CE) method,
which detects anomalies as well as attributes anomalies to flows. The second algorithm performs anomaly
detection via GLRT on the aggregated flows transformation—a compact low-dimensional
representation of the raw traffic flows. The two algorithms complement each
other and allow the network operator to first activate the flow aggregation algorithm
in order to quickly detect anomalies in the system. Once an anomaly has been
detected, the operator can further investigate which specific flows are
anomalous by running the CE-based algorithm. We perform extensive performance evaluations and
experiment our algorithms on synthetic and semi-synthetic data, as well as on
real Internet traffic data obtained from the MAWI archive, and finally make
recommendations regarding their usability.
IEEE 2018 : Privacy Preserving IP Traceback
Abstract : Tracing the source and path of traffic flows is an important problem
that is useful in different network security and forensic solutions. Many
solutions have been proposed for IP traceback in the past few decades, based on
logging or marking, or a combination. Yet, there is no ubiquitously deployed traceback
solution in the Internet. While scalability is the challenge facing
logging-based approaches, marking based approaches reveal sensitive information
of ISP networks. In this work, we look into the problem of preserving the
privacy of ISP networks in marking-based traceback solution.To this end, we
propose the first privacy-preserving solution for IP traceback, that does not
reveal the topological information of ISP networks, while still serves
traceback queries. We present both numerical analysis and simulation based studies,
to evaluate the performance of our solution.
IEEE 2018 : ALLYS: All You can Send for Energy Harvesting Networks
Click for more details
IEEE
2017: Vehicular Cloud Data Collection
for Intelligent Transportation Systems
IEEE 2017 Networking
Abstract: The Internet of Things (IoT) envisions to
connect billions of sensors to the Internet, in order to provide new
applications and services for smart cities. IoT will allow the evolution of the
Internet of Vehicles (IoV) from existing Vehicular Ad hoc Networks (VANETs), in
which the delivery of various services will be offered to drivers by
integrating vehicles, sensors, and mobile devices into a global network. To
serve VANET with computational resources, Vehicular Cloud Computing (VCC) is
recently envisioned with the objective of providing traffic solutions to
improve our daily driving. These solutions involve applications and services
for the benefit of Intelligent Transportation Systems (ITS), which represent an
important part of IoV. Data collection is an important aspect in ITS, which can
effectively serve online travel systems with the aid of Vehicular Cloud (VC).
In this paper, we involve the new paradigm of VCC to propose a data collection
model for the benefit of ITS. We show via simulation results that the
participation of low percentage of vehicles in a dynamic VC is sufficient to
provide meaningful data collection
Click for more details
IEEE
2017: Optimizing Cloud-Service Performance: Efficient Resource Provisioning via
Optimal Workload Allocation
IEEE 2017:
Cost Minimization Algorithms for Data Center Management
IEEE
2017: Multi-party secret key agreement over state-dependent wireless broadcast
channels
IEEE 2017: Cost Minimization Algorithms for Data Center Management
Abstract: Due to the increasing usage of cloud computing
applications, it is important to minimize energy cost consumed by a data
center, and simultaneously, to improve quality of service via data center
management. One promising approach is to switch some servers in a data center
to the idle mode for saving energy while to keep a suitable number of servers
in the active mode for providing timely service. In this paper, we design both
online and offline algorithms for this problem. For the offline algorithm, we
formulate data center management as a cost minimization problem by considering
energy cost, delay cost (to measure service quality), and switching cost (to
change servers’s active/idle mode). Then, we analyze certain properties of an
optimal solution which lead to a dynamic programming based algorithm. Moreover,
by revising the solution procedure, we successfully eliminate the recursive
procedure and achieve an optimal offline algorithm with a polynomial
complexity. For the online algorithm, We design it by considering the worst
case scenario for future workload. In simulation, we show this online algorithm
can always provide near-optimal solutions.
IEEE 2016: Modified AODV
Routing Protocol to Improve Security and Performance against Black Hole Attack
IEEE 2016 Networking
Abstract— A Mobile Ad hoc NETwork (MANET) is a collection of autonomous nodes
that have the ability to communicate with each other without having fixed
infrastructure or centralized access point such as a base station. This kind of
networks is very susceptible to adversary's malicious attacks, due to the
dynamic changes of the network topology, trusting the nodes to each other, lack
of fixed substructure for the analysis of nodes behaviors and constrained
resources. One of these attacks is black hole attack. In this attack, malicious
nodes inject fault routing information to the network and lead all data packets
toward themselves, then destroy them all. In this paper, we propose a solution,
which enhances the security of the Ad-hoc On-demand Distance Vector (AODV)
routing protocol to encounter the black hole attacks. Our solution avoids the
black hole and the multiple black hole attacks. The simulation results using
the Network Simulator NS2 shows that our protocol provides better security and
better performance in terms of the packet delivery ratio than the AODV routing
protocol in the presence of one or multiple black hole attacks with marginal
rise in average end-to-end delay and normalized routing overhead.
Abstract : In the past few years, the Generative
Adversarial Network (GAN), which proposed in 2014, has achieved great success.
There have been increasing research achievements based on GAN in the field of
computer vision and natural language processing. Image steganography is an
information security technique aiming at hiding secret messages in common
digital images for covert communication. Recently, research on image
steganography has demonstrated great potential by introducing GAN and other
neural network techniques. In this paper, we review the art of steganography
with GANs according to the different strategies in data hiding, which are cover
modification, cover selection, and cover synthesis. We discuss the
characteristics of the three strategies of GAN-based steganography and analyze
their evaluation metrics. Finally, some existing problems of image
steganography with GAN are summarized and discussed. Potential future research
topics are also forecasted.
IEEE 2018 : Anomaly Detection and Attribution in Networks With
Temporally Correlated Traffic
Abstract : Anomaly detection in communication networks is the first step in
the challenging task of securing a network, as anomalies may indicate
suspicious behaviors, attacks, network malfunctions, or failures. In this
paper, we address the problem of not only detecting the anomalous events but
also of attributing the anomaly to the flows causing it. To this end, we
develop a new statistical decision theoretic framework for temporally
correlated traffic in networks viaMarkov chain modeling.We first formulate the
optimal anomaly detection problem via the generalized likelihood ratio test
(GLRT) for our composite model. This results in a combinatorial optimization
problem which is prohibitively expensive. We then develop two low-complexity
anomaly detection algorithms. The first is based on the cross entropy (CE) method,
which detects anomalies as well as attributes anomalies to flows. The second algorithm performs anomaly
detection via GLRT on the aggregated flows transformation—a compact low-dimensional
representation of the raw traffic flows. The two algorithms complement each
other and allow the network operator to first activate the flow aggregation algorithm
in order to quickly detect anomalies in the system. Once an anomaly has been
detected, the operator can further investigate which specific flows are
anomalous by running the CE-based algorithm. We perform extensive performance evaluations and
experiment our algorithms on synthetic and semi-synthetic data, as well as on
real Internet traffic data obtained from the MAWI archive, and finally make
recommendations regarding their usability.
IEEE 2018 : Privacy Preserving IP Traceback
Abstract : Tracing the source and path of traffic flows is an important problem
that is useful in different network security and forensic solutions. Many
solutions have been proposed for IP traceback in the past few decades, based on
logging or marking, or a combination. Yet, there is no ubiquitously deployed traceback
solution in the Internet. While scalability is the challenge facing
logging-based approaches, marking based approaches reveal sensitive information
of ISP networks. In this work, we look into the problem of preserving the
privacy of ISP networks in marking-based traceback solution.To this end, we
propose the first privacy-preserving solution for IP traceback, that does not
reveal the topological information of ISP networks, while still serves
traceback queries. We present both numerical analysis and simulation based studies,
to evaluate the performance of our solution.
IEEE 2018 : ALLYS: All You can Send for Energy Harvesting Networks
Abstract : The energy harvesting technology enables nodes to gather energy
from a surrounding environment, and store excessive energy for later use. With
the energy harvesting technology, the MAC protocol design paradigm shifts from “how
to reduce energy consumption” to “how to optimize performance with harvested
energy.” Legacy MAC protocols such as Framed Slotted Aloha (FSA) and Dynamic
FSA (DFSA) does not consider energy harvesting and therefore may not work
optimally in a network with energy harvesting nodes. In this paper, we propose a
novel All You can Send (ALLYS) protocol for an energy harvesting network. ALLYS
uses fixed frame size, but the slot transmission probability is adjusted by a
sink node to control the channel access of contending nodes. A sink node
broadcasts not only the frame size but also the transmission probability, so
that a node can transmit more than once in an opportunistic manner fully
utilizing the harvested energy. At the end of a frame, a sink node estimates
the number of nodes accessing the channel and provides an appropriate
transmission probability so as to reduce the collision probability preventing
from the excessive contention among the nodes. We have evaluated the
throughput, delay and energy efficiency of the proposed ALLYS through analysis
and simulations, and it is shown that ALLYS can
greatly improve the throughput, delay and energy efficiency in a wide range of operating
conditions for wireless networks or Internet of Things (IoT).
IEEE 2017: Vehicular Cloud Data Collection for Intelligent Transportation Systems
IEEE 2017 Networking
Abstract: The Internet of Things (IoT) envisions to
connect billions of sensors to the Internet, in order to provide new
applications and services for smart cities. IoT will allow the evolution of the
Internet of Vehicles (IoV) from existing Vehicular Ad hoc Networks (VANETs), in
which the delivery of various services will be offered to drivers by
integrating vehicles, sensors, and mobile devices into a global network. To
serve VANET with computational resources, Vehicular Cloud Computing (VCC) is
recently envisioned with the objective of providing traffic solutions to
improve our daily driving. These solutions involve applications and services
for the benefit of Intelligent Transportation Systems (ITS), which represent an
important part of IoV. Data collection is an important aspect in ITS, which can
effectively serve online travel systems with the aid of Vehicular Cloud (VC).
In this paper, we involve the new paradigm of VCC to propose a data collection
model for the benefit of ITS. We show via simulation results that the
participation of low percentage of vehicles in a dynamic VC is sufficient to
provide meaningful data collection
Click for more details
IEEE 2017: Cost Minimization Algorithms for Data Center Management
IEEE
2017: Optimizing Cloud-Service Performance: Efficient Resource Provisioning via
Optimal Workload Allocation
IEEE 2017 Networking
IEEE 2017:
Cost Minimization Algorithms for Data Center Management
IEEE 2017 Networking
IEEE
2017: Multi-party secret key agreement over state-dependent wireless broadcast
channels
IEEE 2016 Networking
IEEE 2017: Cost Minimization Algorithms for Data Center Management
Abstract: Due to the increasing usage of cloud computing
applications, it is important to minimize energy cost consumed by a data
center, and simultaneously, to improve quality of service via data center
management. One promising approach is to switch some servers in a data center
to the idle mode for saving energy while to keep a suitable number of servers
in the active mode for providing timely service. In this paper, we design both
online and offline algorithms for this problem. For the offline algorithm, we
formulate data center management as a cost minimization problem by considering
energy cost, delay cost (to measure service quality), and switching cost (to
change servers’s active/idle mode). Then, we analyze certain properties of an
optimal solution which lead to a dynamic programming based algorithm. Moreover,
by revising the solution procedure, we successfully eliminate the recursive
procedure and achieve an optimal offline algorithm with a polynomial
complexity. For the online algorithm, We design it by considering the worst
case scenario for future workload. In simulation, we show this online algorithm
can always provide near-optimal solutions.
IEEE 2016 :An Enhanced
Available Bandwidth Estimation Technique for an End-to-End Network Path
IEEE 2016 Networking
Abstract—This paper presents a
unique probing scheme, a rate adjustment algorithm, and a modified excursion
detection algorithm (EDA) for estimating the available bandwidth (ABW) of an
end-to-end network path more accurately and less intrusively. The proposed
algorithm is based on the well known concept of self-induced congestion and it
features a unique probing train structure in which there is a region where
packets are sampled more frequently than in other regions. This high-density
region enables our algorithm to find the turning point more accurately. When
the dynamic ABW is outside of this region, we readjust the lower rate and upper
rate of the packet stream to fit the dynamic ABW into that region. We
appropriately adjust the range between the lower rate and the upper rate using
spread factors, which enables us to keep the number of packets low and we are
thus able to measure the ABW less intrusively. Finally, to detect the ABW from
the one-way queuing delay, we present a modified EDA from PathChirps’ original
EDA to better deal with sudden increase and decrease in queuing delays due to
cross traffic burstiness. For the experiments, an Android OS-based device was
used to measure the ABW over a commercial 4G/LTE mobile network of a Japanese
mobile operator, as well as real testbed measurements were conducted over fixed
and WLAN network. Simulations and experimental results show that our algorithm
can achieve ABW estimations in real time and outperforms other stat-of-the-art
measurement algorithms in terms of accuracy, intrusiveness, and convergence
time.
IEEE 2016 : STAMP:
Enabling Privacy-Preserving Location Proofs for Mobile Users
Abstract—Location-based services
are quickly becoming immensely popular. In addition to services based on users'
current location, many potential services rely on users' location history, or
their spatial-temporal provenance. Malicious users may lie about their
spatial-temporal provenance without a carefully designed security system for
users to prove their past locations. In this paper, we present the Spatial-Temporal
provenance Assurance with Mutual Proofs (STAMP) scheme. STAMP is designed for
ad-hoc mobile users generating location proofs for each other in a distributed
setting. However, it can easily accommodate trusted mobile users and wireless
access points. STAMP ensures the integrity and non-transferability of the
location proofs and protects users' privacy. A semi-trusted Certification
Authority is used to distribute cryptographic keys as well as guard users
against collusion by a light-weight entropy-based trust evaluation approach.
Our prototype implementation on the Android platform shows that STAMP is
low-cost in terms of computational and storage resources. Extensive simulation
experiments show that our entropy-based trust model is able to achieve high
collusion detection accuracy.
IEEE 2016 : FRAppE:
Detecting Malicious Facebook Applications
IEEE 2016 Networking
Abstract—With 20 million installs
a day [1], third-party apps are a major reason for the popularity and
addictiveness of Facebook. Unfortunately, hackers have realized the potential
of using apps for spreading malware and spam. The problem is already significant, as we find that
at least 13% of apps in our dataset are malicious. So far, the research
community has focused on detecting malicious posts and campaigns.In this paper,
we ask the question: given a Facebook application,can we determine if it is
malicious? Our key contribution is in developing FRAppE—Facebook’s Rigorous
Application Evaluator—arguably the first tool focused on detecting malicious
apps on Facebook. To develop FRAppE, we use information gathered by observing
the posting behavior of 111K Facebook apps seen across 2.2 million users on
Facebook. First, we identify a set of features that help us distinguish
malicious apps from benign ones. For example, we find that malicious apps often
share names with other apps, and they typically request fewer permissions than
benign apps. Second, leveraging these distinguishing features, we show that
FRAppE can detect malicious apps with 99.5% accuracy, with no false positives
and a low false negative rate (4.1%). Finally, we explore the ecosystem of
malicious Facebook apps and identify mechanisms that these apps use to
propagate. Interestingly, we find that many apps collude and support each
other; in our dataset, we find 1,584 apps enabling the viral propagation of
3,723 other apps through their posts. Long-term, we see FRAppE as a step
towards creating an independent watchdog for app assessment and ranking, so as
to warn Facebook users before installing apps.
IEEE 2016: Toward Optimum
Crowdsensing Coverage With Guaranteed Performance
IEEE 2016 Networking
IEEE 2016: PRISM:
PRivacy-aware Interest Sharing and Matching in Mobile Social Networks
IEEE 2016 Networking
IEEE 2016: JOKER: A
Novel Opportunistic Routing Protocol
IEEE 2016 Networking
Abstract—The
increase in multimedia services has put energy saving on the top of current
demands for mobile devices. Unfortunately, batteries’ lifetime has not been as
extended as it would be desirable. For that reason, reducing energy consumption
in every task performed by these devices is crucial. In this work, a novel
opportunistic routing protocol, called JOKER, is introduced. This proposal
presents novelties in both the candidate selection and coordination phases,
which permit increasing the performance of the network supporting multimedia
traffic as well as enhancing the nodes’ energy efficiency. JOKER is compared in
different-nature test-benches with BATMAN routing protocol, showing its
superiority in supporting a demanding service such as video-streaming in terms
of QoE, while achieving a power draining reduction in routing tasks.
IEEE
2016 : Software Defined Networking with Pseudonym Systems for Secure Vehicular
Clouds
IEEE 2016 Networking
Abstract: The vehicular cloud is a
promising new paradigm where vehicular networking and mobile cloud computing are
elaborately integrated to enhance the quality of vehicular information
services. Pseudonym is a resource for vehicles to protect their location
privacy, which should be efficiently utilized to secure vehicular clouds.
However, only a few existing architectures of pseudonym systems take
flexibility and efficiency into consideration, thus leading to potential
threats to location privacy. In this paper, we exploit software-defined networking
technology to significantly extend the flexibility and programmability for
pseudonym management in vehicular clouds. We propose a software-defined
pseudonym system where the distributed pseudonym
pools are promptly scheduled and elastically managed in a hierarchical manner.
In order to decrease the system overhead due to the cost of inter-pool
communications, we leverage the two-sided matching theory to formulate and solve
the pseudonym resource scheduling.We conducted extensive simulations based on
the real map of San Francisco. Numerical results indicate that the proposed
software-defined pseudonym system significantly improves the pseudonym resource
utilization, and meanwhile, effectively enhances the vehicles’ location privacy by raising their entropy.
IEEE 2016 : An Enhanced Available Bandwidth
Estimation Technique for an End-to-End Network Path
IEEE 2016 Networking
IEEE 2016 Networking
Abstract: This paper presents a unique
probing scheme, a rate adjustment algorithm, and a modified excursion detection
algorithm (EDA) for estimating the available bandwidth (ABW) of an end-to-end
network path more accurately and less intrusively. The proposed algorithm is
based on the well known concept of self-induced congestion and it features a
unique probing train structure in which there is a region where packets are
sampled more frequently than in other regions. This high-density region enables
our algorithm to find the turning point more accurately. When the dynamic ABW
is outside of this region, we readjust the lower rate and upper rate of the
packet stream to fit the dynamic ABW into that region.We appropriately adjust
the range between the lower rate and the upper rate using spread factors, which
enables us to keep the number of packets low and we are thus able to measure
the ABW less intrusively. Finally, to detect the ABW from the one-way queuing
delay, we present a modified EDA from PathChirps’ original
EDA to better deal with sudden increase and decrease in queuing delays due to
cross traffic burstiness. For the experiments, an Android OS-based device was
used to measure the ABW over a commercial 4G/LTE mobile network of a Japanese
mobile operator, as well as real testbed measurements were conducted over fixed
and WLAN network. Simulations and experimental results show that our algorithm
can achieve ABW estimations in real time and outperforms other stat-of-the-art measurement algorithms
in terms of accuracy, intrusiveness, and convergence time.
IEEE
2016 : Privacy-Preserving Location Sharing Services for Social Networks
IEEE 2016 Networking
Abstract: A common functionality of
many location-based social networking applications is a location sharing
service that allows a group of friends to share their locations. With a
potentially untrusted server, such a location sharing service may threaten the
privacy of users. Existing solutions for Privacy-Preserving Location Sharing
Services (PPLSS) require a trusted third party that has access to the exact
location of all users in the system or rely on expensive algorithms or
protocols in terms of computational or communication overhead. Other solutions
can only provide approximate query answers. To overcome these limitations, we
propose a new encryption notion, called Order-Retrievable Encryption (ORE), for
PPLSS for social networking applications. The distinguishing characteristics of
our PPLSS are that it (1) allows a group of friends to share their exact
locations without the need of any third party or leaking any location information to any
server or users outside the group, (2) achieves low computational and
communication cost by allowing users to receive the exact location of their
friends without requiring any direct communication between users or multiple
rounds of communication between a user and a server, (3) provides efficient
query processing by designing an index structure for our ORE scheme, (4)
supports dynamic location updates, and (5) provides personalized privacy
protection within a group of friends by specifying a maximum
distance where a user is willing to be located by his/her friends. Experimental
results show that the computational and communication cost of our PPLSS is much
better than the state-of-the-art solution.
IEEE 2015 : A Distributed Three-hop Routing Protocol to
Increase the Capacity of Hybrid Wireless Networks
IEEE 2015 Transaction on Networking
Abstract— Hybrid wireless networks combining the advantages of both mobile ad-hoc networks and infrastructure wireless networks have been receiving increased attention due to their ultra-high performance. An efficient data routing protocol is important in such networks for high network capacity and scalability. However, most routing protocols for these networks simply combine the ad-hoc transmission mode with the cellular transmission mode, which inherits the drawbacks of ad-hoc transmission. This paper presents a Distributed Three-hop Routing protocol (DTR) for hybrid wireless networks. To take full advantage of the widespread base stations, DTR divides a message data stream into segments and transmits the segments in a distributed manner. It makes full spatial reuse of a system via its high speed ad-hoc interface and alleviates mobile gateway congestion via its cellular interface. Furthermore, sending segments to a number of base stations simultaneously increases throughput and makes full use of widespread base stations. In addition, DTR significantly reduces overhead due to short path lengths and the elimination of route discovery and maintenance. DTR also has a congestion control algorithm to avoid overloading base stations. Theoretical analysis and simulation results show the superiority of DTR in comparison with other routing protocols in terms of throughput capacity, scalability and mobility resilience. The results also show the effectiveness of the congestion control algorithm in balancing the load between base stations.
Abstract— Hybrid wireless networks combining the advantages of both mobile ad-hoc networks and infrastructure wireless networks have been receiving increased attention due to their ultra-high performance. An efficient data routing protocol is important in such networks for high network capacity and scalability. However, most routing protocols for these networks simply combine the ad-hoc transmission mode with the cellular transmission mode, which inherits the drawbacks of ad-hoc transmission. This paper presents a Distributed Three-hop Routing protocol (DTR) for hybrid wireless networks. To take full advantage of the widespread base stations, DTR divides a message data stream into segments and transmits the segments in a distributed manner. It makes full spatial reuse of a system via its high speed ad-hoc interface and alleviates mobile gateway congestion via its cellular interface. Furthermore, sending segments to a number of base stations simultaneously increases throughput and makes full use of widespread base stations. In addition, DTR significantly reduces overhead due to short path lengths and the elimination of route discovery and maintenance. DTR also has a congestion control algorithm to avoid overloading base stations. Theoretical analysis and simulation results show the superiority of DTR in comparison with other routing protocols in terms of throughput capacity, scalability and mobility resilience. The results also show the effectiveness of the congestion control algorithm in balancing the load between base stations.
IEEE 2015 : Optimum Power Allocation in Sensor Networks for
Active Radar Applications
IEEE 2015 Transaction on Networking
Abstract—We investigate the power allocation problem in distributed sensor networks that are used for target object classification. In the classification process, the absence, the presence, or the type of a target object is observed by the sensor nodes independently. Since these local observations are noisy and thus unreliable, they are fused together as a single reliable observation at a fusion center. The fusion center uses the best linear unbiased estimator in order to accurately estimate the reflection coefficient of target objects. We utilize the average deviation between the estimated and the actual reflection coefficient as a metric for defining the objective function. First, we demonstrate that the corresponding optimization of the power allocation leads to a signomial program which is in general quite hard to solve. Nonetheless, by using the proposed system model, fusion rule and objective function, we are able to optimize the power allocation analytically and can hence present a closed-form solution. Since the power consumption of the entire network may be limited in various aspects, three different cases of power constraints are discussed and compared with each other. In addition, a sensitivity analysis of the optimal power allocation with respect to perfect and imperfect parameter knowledge is worked out.
Abstract—We investigate the power allocation problem in distributed sensor networks that are used for target object classification. In the classification process, the absence, the presence, or the type of a target object is observed by the sensor nodes independently. Since these local observations are noisy and thus unreliable, they are fused together as a single reliable observation at a fusion center. The fusion center uses the best linear unbiased estimator in order to accurately estimate the reflection coefficient of target objects. We utilize the average deviation between the estimated and the actual reflection coefficient as a metric for defining the objective function. First, we demonstrate that the corresponding optimization of the power allocation leads to a signomial program which is in general quite hard to solve. Nonetheless, by using the proposed system model, fusion rule and objective function, we are able to optimize the power allocation analytically and can hence present a closed-form solution. Since the power consumption of the entire network may be limited in various aspects, three different cases of power constraints are discussed and compared with each other. In addition, a sensitivity analysis of the optimal power allocation with respect to perfect and imperfect parameter knowledge is worked out.
IEEE 2015 Transaction on Networking
Abstract—Development of authorization mechanisms for secure
information access by a large community of users in an open environment is an important problem in the ever-growing Internet
world. In this paper we propose a computational dynamic trust model for user authorization, rooted in findings from social
science. Unlike most existing computational trust models, this model distinguishes trusting belief in integrity from that in competence
in different contexts and accounts for subjectivity in the evaluation of a particular trustee by different trusters.
Simulation studies were conducted to compare the performance of the proposed integrity belief model with other trust models from the
literature for different user behavior patterns. Experiments show that the proposed model achieves higher performance than other
models especially in predicting the behavior of unstable users.
IEEE 2015 : Authenticated Key Exchange
Protocols for Parallel Network File Systems
IEEE 2015 Transaction on Networking
Abstract—We study the problem of key establishment for
secure many-to-many communications. The problem is inspired by the
proliferation of large-scale distributed file systems supporting parallel
access to multiple storage devices. Our work focuses on the current Internet standard for such file systems,
i.e., parallel Network File System (pNFS), which makes use of Kerberos to establish
parallel session keys between clients and storage devices. Our review of the
existing Kerberos-based protocol shows that it has a number of limitations: (i)
a metadata server facilitating key exchange between the clients and the storage
devices has heavy workload that restricts the scalability of the protocol; (ii)
the protocol does not provide forward secrecy; (iii) the metadata server
generates itself all the session keys that are used between the clients and
storage devices, and this inherently leads to key escrow. In this paper, we
propose a variety of authenticated key exchange protocols that are designed to
address the above issues. We show that our protocols are capable of reducing up
to approximately 54% of the workload of the metadata server and concurrently
supporting forward secrecy and escrow-freeness. All this requires only a small
fraction of increased computation overhead at the client. that the proposed model achieves higher performance than other
models especially in predicting the behavior of unstable users.
IEEE 2015 : Generating Searchable Public-Key Ciphertexts with
Hidden Structures for Fast Keyword Search
IEEE 2015 Transaction on Networking
Abstract—Existing semantically secure public-key searchable encryption schemes take search time linear with the total number of the ciphertexts. This makes retrieval from large-scale databases prohibitive. To alleviate this problem, this paper proposes Searchable Public-Key Ciphertexts with Hidden Structures (SPCHS) for keyword search as fast as possible without sacrificing semantic security of the encrypted keywords. In SPCHS, all keyword-searchable ciphertexts are structured by hidden relations, and with the search trapdoor corresponding to a keyword, the minimum information of the relations is disclosed to a search algorithm as the guidance to find all matching ciphertexts efficiently. We construct a SPCHS scheme from scratch in which the ciphertexts have a hidden star-like structure. We prove our scheme to be semantically secure in the Random Oracle (RO) model. The search complexity of our scheme is dependent on the actual number of the ciphertexts containing the queried keyword, rather than the number of all ciphertexts. Finally, we present a generic SPCHS construction from anonymous identity-based encryption and collision-free full-identity malleable Identity-Based Key Encapsulation Mechanism (IBKEM) with anonymity. We illustrate two collision-free full-identity malleable IBKEM instances, which are semantically secure and anonymous, respectively, in the RO and standard models. The latter instance enables us to construct an SPCHS scheme with semantic security in the standard model.
Abstract—Existing semantically secure public-key searchable encryption schemes take search time linear with the total number of the ciphertexts. This makes retrieval from large-scale databases prohibitive. To alleviate this problem, this paper proposes Searchable Public-Key Ciphertexts with Hidden Structures (SPCHS) for keyword search as fast as possible without sacrificing semantic security of the encrypted keywords. In SPCHS, all keyword-searchable ciphertexts are structured by hidden relations, and with the search trapdoor corresponding to a keyword, the minimum information of the relations is disclosed to a search algorithm as the guidance to find all matching ciphertexts efficiently. We construct a SPCHS scheme from scratch in which the ciphertexts have a hidden star-like structure. We prove our scheme to be semantically secure in the Random Oracle (RO) model. The search complexity of our scheme is dependent on the actual number of the ciphertexts containing the queried keyword, rather than the number of all ciphertexts. Finally, we present a generic SPCHS construction from anonymous identity-based encryption and collision-free full-identity malleable Identity-Based Key Encapsulation Mechanism (IBKEM) with anonymity. We illustrate two collision-free full-identity malleable IBKEM instances, which are semantically secure and anonymous, respectively, in the RO and standard models. The latter instance enables us to construct an SPCHS scheme with semantic security in the standard model.
IEEE 2015 : Revealing the Trace of
High-Quality JPEG Compression Through Quantization Noise Analysis
IEEE 2015 Transaction on Networking
Abstract—To
identify whether an image has been JPEG
compressed is an important issue in forensic practice. The state-of-the-art methods fail to identify high-quality compressed images,
which are common on the Internet. In this paper, we provide
a novel quantization noise-based solution to reveal the traces of JPEG compression. Based on the analysis of noises in multiple-cycle JPEG compression, we define a quantity called forward quantization noise. We analytically derive that a decompressed JPEG image has a lower variance of forward quantization noise than its uncompressed counterpart. With the
conclusion, we develop a simple yet very effective detection algorithm to identify decompressed JPEG images. We show that our method outperforms the state-of-the-art methods by a large margin especially for high-quality compressed images through extensive experiments on various sources of images. We also demonstrate that the proposed method is robust to small image size and chroma subsampling. The proposed algorithm can be applied in some practical applications, such as Internet image classification and forgery detection.
IEEE 2015 : SmartCrawler: A Two-stage
Crawler for Efficiently Harvesting Deep-Web Interfaces
IEEE 2015 Transaction on Networking
Abstract—As
deep web grows at a very fast pace, there has been increased interest in
techniques that help efficiently locate deep-web
interfaces. However, due to the large volume of web resources and the dynamic
nature of deep web, achieving wide coverage
and high efficiency is a challenging issue. We propose a two-stage framework,
namely SmartCrawler, for efficient harvesting
deep web interfaces. In the first stage, SmartCrawler performs site-based
searching for center pages with the help of search
engines, avoiding visiting a large number of pages. To achieve more accurate
results for a focused crawl, SmartCrawler ranks
websites to prioritize highly relevant ones for a given topic. In the second
stage, SmartCrawler achieves fast in-site searching
by excavating most relevant links with an adaptive link-ranking. To eliminate
bias on visiting some highly relevant links in
hidden web directories, we design a link tree data structure to achieve wider
coverage for a website. Our experimental results
on a set of representative domains show the agility and accuracy of our
proposed crawler framework, which efficiently retrieves
deep-web interfaces from large-scale sites and achieves higher harvest rates
than other crawlers.
IEEE 2015 : Data Collection in
Multi-Application Sharing Wireless Sensor Networks
IEEE 2015 Transaction on Networking
Abstract—Data sharing for data collection among multiple
applications is an efficient way to reduce communication cost for Wireless Sensor Networks (WSNs). This
paper is the first work to introduce the interval data sharing problem which is to investigate how to transmit as less data
as possible over the network, and meanwhile the transmitted data satisfies the requirements of all the applications. Different
from current studies where each application requires a single data sampling
during each task, we study the problem where each
application requires a continuous interval of data sampling in each task. The proposed problem is a nonlinear nonconvex optimization
problem. In order to lower the high complexity for solving a nonlinear nonconvex optimization problem in resource
restricted WSNs, a 2-factor approximation algorithm whose time complexity is
O(n2) and memory complexity is O(n) is provided. A
special instance of this problem is also analyzed. This special instance can be solved with a dynamic programming algorithm
in polynomial time, which gives an optimal result in O(n2) time complexity and O(n) memory complexity. Three online
algorithms are provided to process the continually coming tasks. Both the
theoretical analysis
and simulation results demonstrate the effectiveness of the proposed
algorithms.
IEEE 2015 : Data Collection in
Multi-Application Sharing Wireless Sensor Networks
IEEE 2015 Transaction on Networking
Abstract—Data sharing
for data collection among multiple applications is an efficient way to reduce
communication cost for Wireless Sensor Networks (WSNs). This paper is the
first work to introduce the interval data sharing problem which is to
investigate how to transmit as less data as possible over the network, and
meanwhile the transmitted data satisfies the requirements of all the
applications. Different from current studies where each application requires a
single data sampling during each task, we study the problem where each
application requires a continuous interval of data sampling in each task. The proposed
problem is a nonlinear nonconvex optimization problem. In order to lower the
high complexity for solving a nonlinear nonconvex optimization problem in
resource restricted WSNs, a 2-factor approximation algorithm whose time
complexity is O(n2) and memory complexity is O(n) is provided. A special instance
of this problem is also analyzed. This special instance can be solved with
a dynamic programming algorithm in polynomial time, which gives an optimal
result in O(n2) time complexity and O(n) memory complexity. Three online
algorithms are provided to process the continually coming tasks. Both the
theoretical analysis and simulation results demonstrate the effectiveness
of the proposed algorithms.
IEEE 2015 : Lightweight Secure Scheme
for Detecting Provenance Forgery and Packet Drop Attacks in Wireless Sensor
Networks
IEEE 2015 Transaction on Networking
Abstract— Large-scale sensor networks are deployed in
numerous application domains, and the data they collect are used in
decision-making for critical infrastructures. Data are streamed from multiple
sources through intermediate processing nodes that aggregate information. A
malicious adversary may introduce additional nodes in the network or compromise
existing ones. Therefore, assuring high data trustworthiness is crucial for
correct decision-making. Data provenance represents a key factor in evaluating
the trustworthiness of sensor data. Provenance management for sensor networks
introduces several challenging requirements, such as low energy and bandwidth
consumption, efficient storage and secure transmission. In this paper, we
propose a novel lightweight scheme to securely transmit provenance for sensor
data. The proposed technique relies on inpacket Bloom filters to encode
provenance. We introduce efficient mechanisms for provenance verification and
reconstruction at the base station. In addition, we extend the secure
provenance scheme with functionality to detect packet drop attacks staged by
malicious data forwarding nodes. We evaluate the proposed technique both
analytically and empirically, and the results prove the effectiveness and
efficiency of the lightweight secure provenance scheme in detecting packet
forgery and loss attacks..
IEEE 2015 : Security Optimization of Dynamic Networks with Probabilistic Graph
Modeling and Linear Programming
IEEE 2015 Transaction on Networking
Abstract— Securing the networks of large organizations is
technically challenging due to the complex configurations and
constraints. Managing these networks require rigorous and comprehensive
analysis tools. A network administrator needs to identify vulnerable
configurations, as well as tools for hardening the networks. Such networks
usually have dynamic and fluidic structures, thus one may have incomplete
information about the connectivity and availability of hosts. We describe a
probabilistic graph model and several algorithms for analyzing and
improving the security of large networks. We demonstrate their use in solving several
types of useful network security management problems. Among them is the optimal
placement problem, where the network administrator needs to compute on
which machine(s) to install new security products in order to maximize the
security benefit for the organizational network. In comparison to related
solutions on attack graphs, our probabilistic model provides mechanisms
for expressing uncertainties in network configurations, which is not reported
elsewhere. Our computation utilizes advanced sequential linear
optimization techniques and is scalable to large networks. We have performed
comprehensive experimental validation with real-world network
configuration data of a sizable organization.
IEEE 2015 :Energy and Delay
Constrained Maximum Adaptive Schedule for Wireless Networked Control
Systems
IEEE 2015 Transaction on Networking
Abstract—Communication system
design for Wireless Networked Control Systems (WNCSs) is very challenging
since the strict timing and reliability requirements of control
systems should be met by the wireless communication systems
that introduce non-zero packet error probability and non-zero delay
at all times. Particularly, the scheduling algorithms for WNCSs should be
designed to provide maximum level of adaptivity accommodating packet
losses and changes in network topology while exploiting periodic nature of
the sensor node transmissions. Creating such a schedule has been
previously studied for an Ultra-Wideband (UWB) based WNCS. In this paper,
we extend the joint optimization problem of power control, rate adaptation
and scheduling with the objective of providing maximum
adaptivity for general WNCSs employing continuous rate transmission model
in which Shannon’s channel capacity formulation is used for
the achievable transmission rate. Upon proving the NP-hardness of the
problem, we provide a framework for the design of a heuristic algorithm
for scheduling and propose an optimal polynomial time algorithm for the
power control and rate adaptation problem following the derivation of the
optimality conditions. We demonstrate via extensive simulations that
the proposed algorithms outperform the existing algorithms
with performance close to optimal solution and average runtime admissible for practical WNCSs.
IEEE 2015 : An
Energy-Efficient and Delay-Aware Wireless Computing System for Industrial
Wireless Sensor Networks
IEEE 2015 Transaction on Networking
Abstract—Industrial wireless sensor
networks have attracted much attention as a cornerstone to making the
smart factories real. Utilizing industrial wireless sensor networks as a
base for smart factories makes it possible to optimize the production
line without human resources since it provides industrial Internet
of Things (IoT) service, where various types of data are collected from sensors and mined to control the machines based on the analysis
result. On the other hand, a fog computing node, which executes such
real-time feedback control, should be capable of real-time data
collection, management, and processing. To achieve these requirements, in
this paper, we introduce Wireless Computing System (WCS) as a fog
computing node. Since there are a lot of servers and each
server has 60 GHz antennas to connect to other servers and sensors, WCS
has high collecting and processing capabilities. However, in order to
fulfill a demand for real-time feedback control, WCS needs to satisfy an
acceptable delay for data collection. Additionally, lower power
consumption is required in order to reduce the cost for factory
operation. Therefore, we propose an Energy-Efficient and
Delay-Aware Wireless Computing System (E2DA-WCS). Since there is a trade
off relationship between the power consumption and the delay for data
collection, our proposed system controls the sleep schedule and the number
of links to minimize the power consumption while satisfying an acceptable
delay constraint. Furthermore, the effectiveness of our proposed system is
evaluated through extensive computer simulations.
IEEE 2015 :Distortion-Aware
Concurrent Multipath Transfer for Mobile Video Streaming in Heterogeneous Wireless
Networks
IEEE 2015 Transaction on Networking
Abstract—The massive proliferation
of wireless infrastructures with complementary characteristics prompts the
bandwidth aggregation for Concurrent Multipath Transfer (CMT) over
heterogeneous access networks. Stream Control Transmission Protocol (SCTP)
is the standard transport-layer solution to enable CMT in multihomed
communication environments. However, delivering high-quality streaming
video with the existing CMT solutions still remains problematic due to the
stringent QoS (Quality of Service) requirements and path asymmetry in
heterogeneous wireless networks. In this paper, we advance the state of the art
by introducing video distortion into the decision process of
multipath data transfer. The proposed Distortion-Aware Concurrent Multipath
Transfer (CMT-DA) solution includes three phases: 1) per-path status
estimation and congestion control; 2) quality-optimal video flow rate
allocation; 3) delay and loss controlled data retransmission. The term
‘flow rate allocation’ indicates dynamically picking appropriate access
networks and assigning the transmission rates. We analytically formulate
the data distribution over multiple communication paths to minimize
the end-to-end video distortion and derive the solution based on the
utility maximization theory. The performance of the proposed CMT-DA is evaluated through extensive semi-physical emulations in Exata
involving H.264 video streaming. Experimental results show that CMT-DA
outperforms the reference schemes in terms of video PSNR (Peak Signal-to-Noise
Ratio), goodput, and inter-packet delay.
IEEE 2015 : Cost-Effective
Authentic and Anonymous Data Sharing with Forward Security
IEEE 2015 Transaction on Networking
Abstract—Data sharing has never
been easier with the advances of cloud computing, and an accurate analysis on
the shared data provides an array of benefits to both the society and
individuals. Data sharing with a large number of participants must take into
account several issues, including efficiency, data integrity and privacy
of data owner. Ring signature is a promising candidate to construct an
anonymous and authentic data sharing system. It allows a data owner to
anonymously authenticate his data which can be put into the cloud for
storage or analysis purpose. Yet the costly certificate verification in the
traditional public key infrastructure (PKI) setting becomes a
bottleneck for this solution to be scalable. Identity-based (ID-based) ring
signature, which eliminates the process of certificate verification, can
be used instead. In this paper, we further enhance the security of ID-based
ring signature by providing forward security: If a secret key of any user
has been compromised, all previous generated signatures that include this user
still remain valid. This property is especially important to any large
scale data sharing system, as it is impossible to ask all data owners to
reauthenticate their data even if a secret key of one single user has been
compromised. We provide a concrete and efficient instantiation of our scheme, prove its security and provide an implementation to
show its practicality.
IEEE 2015 :Decentralized
Computation Offloading Game For Mobile Cloud Computing
IEEE 2015 Transaction on Networking
Abstract—Mobile cloud computing is envisioned as a promising approach to
augment computation capabilities of mobile devices for emerging resource-hungry mobile applications. In this paper, we propose a
game theoretic approach for achieving efficient computation offloading for mobile cloud computing. We formulate the decentralized
computation offloading decision making problem among mobile device users as a decentralized computation offloading game. We analyze
the structural property of the game and show that the game always admits a Nash equilibrium. We then design a decentralized
computation offloading mechanism that can achieve a Nash equilibrium of the game and quantify its efficiency ratio over the
centralized optimal solution. Numerical results demonstrate that the proposed mechanism can achieve efficient computation offloading
performance and scale well as the system size increases.
IEEE 2015 :Algorithms for
Enhanced Inter Cell Interference Coordination (eICIC) in LTE HetNets
IEEE 2015 Transaction on Networking
Abstract—The success of LTE
Heterogeneous Networks (Het- Nets) with macro cells and pico cells
critically depends on efficient spectrum sharing between high-power macros
and lowpower picos. Two important challenges in this context are, (i) determining
the amount of radio resources that macro cells should offer to pico cells,
and (ii) determining the association rules that decide which UEs should
associate with picos. In this paper, we develop a novel algorithm to solve
these two coupled problems in a joint manner. Our algorithm has provable guarantee,
and furthermore, it accounts for network topology, traffic load, and
macro-pico interference map. Our solution is standard compliant and can be
implemented using the notion of Almost Blank Subframes (ABS) and Cell
Selection Bias (CSB) proposed by LTE standards. We also show extensive
evaluations using RF plan from a real network and discuss SON based eICIC implementation.
IEEE 2015 :On-Demand Discovery of
Software Service Dependencies in MANETs
IEEE 2015 Transaction on Networking
Abstract—The dependencies among the
components of service oriented software applications hosted in a mobile ad
hoc network (MANET) are difficult to determine due to the
inherent loose coupling of the services and the transient
communication topologies of the network. Yet understanding these
dependencies is critical to making good management decisions, since
dependence data underlie important analyses such as fault localization
and impact analysis. Current methods for discovering
dependencies, developed primarily for fixed networks, assume that
dependencies change only slowly and require relatively long monitoring
periods as well as substantial memory and communication resources, all
of which are impractical in the MANET environment.We describe a new
dynamic dependence discovery method designed specifically for this environment, yielding dynamic snapshots of
dependence relationships discovered through observations of service
interactions. We evaluate the performance of our method in terms
of the accuracy of the discovered dependencies, and draw insights on
the selection of critical parameters under various operational conditions.
Although operated under more stringent conditions, our method is shown to
provide results comparable to or better than existing methods.
IEEE 2015 :The Mason Test: A
Defense Against Sybil Attacks in Wireless Networks Without Trusted Authorities
IEEE 2015 Transaction on Networking
Abstract—Wireless networks are
vulnerable to Sybil attacks, in which a malicious node poses as many identities
in order to gain disproportionate influence. Many defenses based on
spatial variability of wireless channels exist, but depend either on detailed,
multi-tap channel estimation—something not exposed on commodity 802.11
devices—or valid RSSI observations from multiple trusted sources, e.g.,
corporate access points—something not directly available in ad hoc and
delay-tolerant networks with potentially malicious neighbors. We extend
these techniques to be practical for wireless ad hoc networks of commodity
802.11 devices. Specifically, we propose two efficient methods for
separating the valid RSSI observations of behaving nodes from those falsified
by malicious participants. Further, we note that prior signalprint
methods are easily defeated by mobile attackers and develop an appropriate
challenge-response defense. Finally, we present the Mason test, the first
implementation of these techniques for ad hoc and delay-tolerant networks of
commodity 802.11 devices. We illustrate its performance in several
real-world scenarios.
IEEE 2015 :Passive
IP Traceback: Disclosing the Locations of IP Spoofers From Path
Backscatter
IEEE 2015 Transaction on Networking
Abstract—It is long known attackers
may use forged source IP address to conceal their real locations. To
capture the spoofers, a number of IP traceback mechanisms have been
proposed. However, due to the challenges of deployment, there has been not a
widely adopted IP traceback solution, at least at the Internet level. As a
result, the mist on the locations of spoofers has never been dissipated
till now. This paper proposes passive IP traceback (PIT) that bypasses the
deployment difficulties of IP traceback techniques. PIT investigates
Internet Control Message Protocol error messages (named path backscatter)
triggered by spoofing traffic, and tracks the spoofers based on public
available information (e.g., topology). In this way, PIT can find the spoofers without
any deployment requirement. This paper illustrates the causes, collection,
and the statistical results on path backscatter, demonstrates the
processes and effectiveness of PIT, and shows the captured locations of
spoofers through applying PIT on the path backscatter data set.
These results can help further reveal IP spoofing, which has been studied
for long but never well understood. Though PIT cannot work in all the
spoofing attacks, it may be the most useful mechanism to
trace spoofers before an Internet-level traceback system has been deployed
in real.
IEEE 2015 :Wireless
Sensor Networks for Condition Monitoring in the Railway Industry: A Survey
IEEE 2015 Transaction on Networking
Abstract—In recent years, the range
of sensing technologies has expanded rapidly, whereas sensor devices have
become cheaper. This has led to a rapid expansion in condition monitoring
of systems, structures, vehicles, and machinery using sensors.
Key factors are the recent advances in networking technologies
such as wireless communication and mobile ad hoc networking coupled with the technology to integrate devices.Wireless sensor
networks (WSNs) can be used for monitoring the railway
infrastructure such as bridges, rail tracks, track beds, and track
equipment along with vehicle health monitoring such as chassis, bogies,
wheels, and wagons. Condition monitoring reduces human inspection
requirements through automated monitoring, reduces
maintenance through detecting faults before they escalate, and improves
safety and reliability. This is vital for the development, upgrading,
and expansion of railway networks. This paper surveys these
wireless sensors network technology for monitoring in the railway
industry for analyzing systems, structures, vehicles, and
machinery. This paper focuses on practical engineering solutions,
principally, which sensor devices are used and what they are used for; and the identification of sensor configurations and network
topologies. It identifies their respective motivations and distinguishes
their advantages and disadvantages in a comparative review.
IEEE 2015 :Secure
and Distributed Data Discovery and Dissemination in Wireless Sensor
Networks
IEEE 2015 Transaction on Networking
Abstract—A data discovery and
dissemination protocol for wireless sensor networks (WSNs) is responsible
for updating configuration parameters of, and distributing management
commands to, the sensor nodes. All existing data discovery and dissemination
protocols suffer from two drawbacks. First, they are based on the
centralized approach; only the base station can distribute data item. Such
an approach is not suitable for emergent multi-owner-multi-user WSNs.
Second, those protocols were not designed with security in mind and hence
adversaries can easily launch attacks to harm the network. This
paper proposes the first secure and distributed data discovery and
dissemination protocol named DiDrip. It allows the network owners to
authorize multiple network users with different privileges
to simultaneously and directly disseminate data items to the
sensor nodes. Moreover, as demonstrated by our theoretical
analysis, it addresses a number of possible security vulnerabilities
that we have identified. Extensive security analysis show DiDrip is provably
secure. We also implement DiDrip in an experimental network of
resource-limited sensor nodes to show its high efficiency in practice.
IEEE 2015 :User-Defined
Privacy Grid System for Continuous Location-Based Services
IEEE 2015 Transaction on Networking
Abstract—Location-based services (LBS) require users to continuously report
their location to a potentially untrusted server to obtain services based on their location, which can expose them to privacy risks.
Unfortunately, existing privacy-preserving techniques for LBS have several limitations, such as requiring a fully-trusted third party, offering
limited privacy guarantees and incurring high communication overhead. In this paper, we propose a user-defined privacy
grid system called dynamic grid system (DGS); the first holistic system that fulfills four essential requirements for privacy-preserving
snapshot and continuous LBS. (1) The system only requires a semi-trusted third party, responsible for carrying out simple
matching operations correctly. This semi-trusted third party does not have any information about a user’s location. (2) Secure snapshot and
continuous location privacy is guaranteed under our defined adversary models. (3) The communication cost for the user does not depend
on the user’s desired privacy level, it only depends on the number of relevant points of interest in the vicinity of the user. (4)
Although we only focus on range and k-nearest-neighbor queries in this work, our system can be easily extended to support other spatial
queries without changing the algorithms run by the semi-trusted third party and the database server, provided the required search area of
a spatial query can be abstracted into spatial regions. Experimental results show that our DGS is more efficient than the
state-of-the-art privacy-preserving technique for continuous LBS.
IEEE 2015 :Secure
and Distributed Data Discovery and Dissemination in Wireless Sensor
Networks
IEEE
2015 Transactions on Parallel and Distributed Systems
Abstract : A data
discovery and dissemination protocol for wireless sensor networks (WSNs)
is responsible for updating configuration parameters of, and distributing
management commands to, the sensor nodes. All existing data discovery
and dissemination protocols suffer from two drawbacks. First,
they are based on the centralized approach; only the base station can
distribute data item. Such an approach is not suitable for emergent
multi-owner-multi-user WSNs. Second, those protocols were not designed
with security in mind and hence adversaries can easily launch attacks to
harm the network. This paper proposes the first secure and distributed
data discovery and dissemination protocol named DiDrip. It allows the
network owners to authorize multiple network users with different
privileges to simultaneously and directly disseminate data items to the
sensor nodes. Moreover, as demonstrated by our theoretical
analysis, it addresses a number of possible security vulnerabilities
that we have identified. Extensive security analysis show DiDrip
is provably secure. We also implement DiDrip in an
experimental network of resource-limited sensor nodes to show its
high efficiency in practice. infer the name of
each face. Comprehensive experiments demonstrate the effectiveness of our
approach.
IEEE 2015 :The
Mason Test: A Defense Against Sybil Attacks in Wireless Networks Without
Trusted Authorities
IEEE 2015 Transactions on Parallel and Distributed Systems
Abstract : Wireless
networks are vulnerable to Sybil attacks, in which a malicious node poses as
many identities in order to gain disproportionate influence. Many defenses
based on spatial variability of wireless channels exist, but depend either on
detailed, multi-tap channel estimation—something not exposed on commodity
802.11 devices—or valid RSSI observations from multiple trusted
sources, e.g., corporate access points—something not directly available in
ad hoc and delay-tolerant networks with potentially malicious
neighbors. We extend these techniques to be practical for wireless ad hoc
networks of commodity 802.11 devices. Specifically, we propose
two efficient methods for separating the valid RSSI observations of
behaving nodes from those falsified by malicious participants. Further,
we note that prior signalprint methods are easily defeated by mobile
attackers and develop an appropriate challenge-response defense. Finally,
we present the Mason test, the first implementation of these techniques for ad
hoc and delay-tolerant networks of commodity 802.11 devices. We illustrate
its performance in several real-world scenarios..
IEEE 2015 : k Nearest Neighbor Search for
Location-Dependent Sensor Data in MANETs
IEEE 2015 Transactions on Parallel and Distributed Systems
Abstract : K nearest neighbor (kNN) queries, which
retrieve the k nearest sensor data items
associated with a location (location-dependent sensor data) from the
location of the query issuer, are useful for location-based services
(LBSs) in mobile environments. Here, we focus on kNN query processing in
mobile ad hoc networks (MANETs). Key challenges in designing
system protocols for MANETs include low-overhead adaptability
to network topology changes due to node mobility, and
query processing that achieves high accuracy of the query result
without a centralized server. In this paper, we propose the Filling
Area (FA) method to efficiently process kNN
queries in MANETs. The FA method achieves low overhead in query processing
by reducing a search area. In the FA method, data items remain
at nodes near the locations with which the items are associated,
and nodes cache data items whose locations are near their own so that
the query issuer retrieves kNNs
from nearby nodes. Through extensive simulations, we verify that our
proposed approach achieves low overhead and high accuracy of the query
result.
IEEE 2015 :Cost-Effective
Authentic and Anonymous Data Sharing with Forward Security
IEEE 2015 Transactions on Parallel and Distributed Systems
Abstract :Data sharing has never been easier with
the advances of cloud computing, and an accurate analysis on the shared
data provides an array of benefits to both the society and individuals.
Data sharing with a large number of participants must take into
account several issues, including efficiency, data integrity and privacy of
data owner. Ring signature is a promising candidate to construct an
anonymous and authentic data sharing system. It allows a data owner to
anonymously authenticate his data which can be put into the cloud for
storage or analysis purpose. Yet the costly certificate verification in the
traditional public key infrastructure (PKI) setting becomes a bottleneck
for this solution to be scalable. Identity-based (ID-based) ring signature,
which eliminates the process of certificate verification, can be used
instead. In this paper, we further enhance the security of ID-based ring
signature by providing forward security: If a secret key of any user has
been compromised, all previous generated signatures that include this user
still remain valid. This property is especially important to any large
scale data sharing system, as it is impossible to ask all data owners to
reauthenticate their data even if a secret key of one single user has been
compromised. We provide a concrete and efficient instantiation of our
scheme, prove its security and provide an implementation to show its
practicality.
IEEE 2015 :An
Energy-Efficient and Delay-Aware Wireless Computing System
for Industrial Wireless Sensor Networks
IEEE 2015 Transactions on Parallel and Distributed Systems
Abstract
:Industrial
wireless sensor networks have attracted much attention as a cornerstone to
making the smart factories real. Utilizing industrial wireless sensor
networks as a base for smart factories makes it possible to optimize the
production line without human resources since it provides industrial
Internet of Things (IoT) service, where various types of data are
collected from sensors and mined to control the machines based on
the analysis result. On the other hand, a fog computing node,
which executes such real-time feedback control, should be capable of
real-time data collection, management, and processing. To achieve these
requirements, in this paper, we introduce Wireless Computing System (WCS)
as a fog computing node. Since there are a lot of servers and each server
has 60 GHz antennas to connect to other servers and sensors, WCS has high
collecting and processing capabilities. However, in order to fulfill a demand
for real-time feedback control, WCS needs to satisfy an
acceptable delay for data collection. Additionally, lower power
consumption is required in order to reduce the cost for factory
operation. Therefore, we propose an Energy-Efficient and Delay-Aware Wireless
Computing System (E2DA-WCS). Since there is a tradeoff relationship
between the power consumption and the delay for data collection, our
proposed system controls the sleep schedule and the number of links to
minimize the power consumption while satisfying an acceptable delay
constraint. Furthermore, the effectiveness of our proposed system is
evaluated through extensive computer simulations.
IEEE 2014 :
Behavioral Malware Detection in Delay Tolerant Networks
IEEE 2014 : Transactions on Parallel and Distributed Systems
Abstract : The delay-tolerant-network (DTN)
model is becoming a viable communication alternative to the traditional
infrastructural model for modern mobile consumer electronics equipped with
short-range communication technologies such as Bluetooth, NFC, and Wi-Fi
Direct. Proximity malware is a class of malware that exploits
the opportunistic contacts and distributed nature of DTNs for propagation.
Behavioral characterization of malware is an effective
alternative to pattern matching in detecting malware, especially when dealing
with polymorphic or obfuscated malware. In this paper, we first propose a
general behavioral characterization of proximity malware which
based on naive Bayesian model, which has been successfully applied in non-DTN
settings such as filtering email spams and detecting botnets. We identify two
unique challenges for extending Bayesian malware detection to
DTNs ("insufficient evidence versus evidence collection risk" and
"filtering false evidence sequentially and distributed"), and propose
a simple yet effective method, look ahead, to address the challenges.
Furthermore, we propose two extensions to look ahead, dogmatic filtering, and
adaptive look ahead, to address the challenge of "malicious nodes sharing
false evidence." Real mobile network traces are used to verify
the effectiveness of the proposed methods.
IEEE 2014 :A System for
Denial-of-Service Attack Detection Based on Multivariate Correlation Analysis
IEEE 2014 Transactions on Parallel and Distributed Systems
Abstract :Interconnected systems,
such as Web servers, database servers, and cloud computing servers and so on,
are now under threads from network attackers. As one of most common and
aggressive means, denial-of-service (DoS) attacks cause
serious impact on these computing systems. In this paper, we present a
DoS attack detection system that
uses multivariate correlation analysis (MCA) for accurate
network traffic characterization by extracting the
geometrical correlations between network traffic features. Our
MCA-based DoS attack detection system employs the
principle of anomaly based detection in attack recognition.
This makes our solution capable of detecting known and unknown
DoS attacks effectively by learning the patterns of legitimate
network traffic only. Furthermore, a triangle-area-based technique is
proposed to enhance and to speed up the process of MCA. The effectiveness of
our proposed detection system is evaluated using KDD Cup 99 data set,
and the influences of both non-normalized data and normalized data on the
performance of the proposed detection system are examined. The
results show that our system outperforms two other previously
developed state-of-the-art approaches in terms of detection accuracy.
IEEE 2014 :Building
a Scalable System for Stealthy P2P-Botnet Detection
Abstract : Peer-to-peer (P2P)
botnets have recently been adopted by botmasters for their resiliency against
take-down efforts. Besides being harder to take down, modern botnets tend to be
stealthier in the way they perform malicious activities, making
current detection approaches ineffective. In addition, the rapidly
growing volume of network traffic calls for high scalability
of detection systems. In this paper, we propose a novel scalable
botnet detection system capable of
detecting stealthy P2P botnets. Our system first identifies
all hosts that are likely engaged in P2P communications. It then
derives statistical fingerprints to profile P2P traffic and further
distinguish between P2P botnet traffic and
legitimate P2Ptraffic. The parallelized computation with bounded
complexity makes scalability a built-in feature of our system. Extensive
evaluation has demonstrated both high detection accuracy and great
scalability of the proposed system.
IEEE 2014 Transactions on Information Forensics and Security
Abstract : Jammers can severely disrupt the communications
in wireless networks, and jammers' position information allows
the defender to actively eliminate the jamming attacks. Thus, in this paper, we
aim to design a framework that can localize one or
multiple jammers with a high accuracy. Most of existing
jammer-localization schemes utilize indirect measurements (e.g., hearing
ranges) affected by jamming attacks, which makes it difficult
to localize jammers accurately. Instead, we exploit a direct
measurement-the strength of jamming signals (JSS). Estimating JSS is
challenging as jamming signals may be embedded in other signals. As such, we
devise an estimation scheme based on ambient noise floor and validate it with
real-world experiments. To further reduce estimation errors, we define an
evaluation feedback metric to quantify the estimation errors and
formulate jammer localization as a nonlinear optimization problem,
whose global optimal solution is close to jammers' true positions. We
explore several heuristic search algorithms for approaching the global optimal
solution, and our simulation results show that
our error-minimizing-based framework achieves better performance
than the existing schemes. In addition, our error-minimizing framework can
utilize indirect measurements to obtain a better location estimation compared
with prior work.
IEEE 2014 :A
Scalable and Modular Architecture for High-Performance Packet Classification
IEEE 2014 Transactions on Parallel and Distributed Systems
Abstract : Packet classification is
widely used as a core function for various applications in network
infrastructure. With increasing demands in throughput, performing
wire-speed packet classification has become challenging. Also
the performance of
today's packet classification solutions depends on the
characteristics of rule sets. In this work, we propose a
novel modular Bit-Vector (BV) based architecture to
perform high-speed packet classification on Field
Programmable Gate Array (FPGA). We introduce an algorithm named Stride BV and
modularize the BV architecture to achieve better scalability than
traditional BV methods. Further, we incorporate range search in our architecture to
eliminate rule set expansion caused by range-to-prefix conversion. The post
place-and-route results of our implementation on a state-of-the-art FPGA show
that the proposed architecture is able to operate at 100+ Gbps for
minimum size packets while supporting large rule sets up to 28 K
rules using only the on-chip memory resources. Our solution is rule set-feature
independent, i.e. the above performance can be guaranteed for any
rule set regardless the composition of the rules set.
IEEE 2014 :Bandwidth
Distributed Denial of Service: Attacks and Defenses
IEEE 2014 Transactions on Security & Privacy
Abstract :The Internet is vulnerable
to bandwidth distributed denial-of-service (BW-DDoS) attacks,
wherein many hosts send a huge number of packets to cause congestion and
disrupt legitimate traffic. So far, BW-DDoS attacks have employed
relatively crude, inefficient, brute force mechanisms; future attacks might
be significantly more effective and harmful. To meet the increasing threats, we
must deploy more advanced defenses.
IEEE 2014 :E-MACs:
Toward More Secure and More Efficient Constructions of Secure Channels
IEEE 2014 Transactions on Computers
Abstract : In
cryptography, secure channels enable the confidential and
authenticated message exchange between authorized users. A generic approach of
constructing such channels is by combining an encryption primitive
with an authentication primitive (MAC). In this work, we introduce the design
of a new cryptographic primitive to be used in
the construction of secure channels. Instead of using
general purpose MACs, we propose the deployment of special
purpose MACs, named ε-MACs. The main motivation behind this work is the
observation that, since the message must be both encrypted and authenticated,
there might be some redundancy in the computations performed by the two
primitives. Therefore, removing such redundancy can improve the efficiency of
the overall composition. Moreover, computations performed by the encryption
algorithm can be further utilized to improve the security of the authentication
algorithm. In particular, we will show how ε-MACs can be designed to
reduce the amount of computation required by standard MACs based on
universal hash functions, and show how ε-MACs can
be secured against key-recovery attacks..
IEEE 2014 :Secure
Data Retrieval for Decentralized Disruption-Tolerant Military Networks
IEEE 2014 Transactions on Networking
Abstract : Mobile nodes in military environments such as a
battlefield or a hostile region are likely to suffer from
intermittent network connectivity and frequent
partitions. Disruption-tolerant network (DTN) technologies are
becoming successful solutions that allow wireless devices carried by soldiers
to communicate with each other and access the confidential information or
command reliably by exploiting external storage nodes. Some of the most
challenging issues in this scenario are the enforcement of authorization
policies and the policies update for secure data retrieval.
Cipher text-policy attribute-based encryption (CP-ABE) is a promising
cryptographic solution to the access control issues. However, the problem of
applying CP-ABE in decentralized DTNs introduces several security and
privacy challenges with regard to the attribute revocation, key escrow, and
coordination of attributes issued from different authorities. In this paper, we
propose a secure data retrieval scheme using CP-ABE
for decentralized DTNs where multiple key authorities manage their
attributes independently. We demonstrate how to apply the proposed mechanism to
securely and efficiently manage the confidential data distributed in
the disruption-tolerant military network.
IEEE 2014 :Dynamic
Trust Management for Delay Tolerant Networks and Its Application to Secure
Routing.
IEEE 2014 Transactions on Parallel and Distributed Systems
Abstract : Delay tolerant networks (DTNs) are
characterized by high end-to-end latency, frequent disconnection, and
opportunistic communication over unreliable wireless links. In this paper, we
design and validate a dynamic trust management protocol
for secure routing optimization in DTN environments in the presence
of well-behaved, selfish and malicious nodes. We develop a novel model-based
methodology for the analysis of our trust protocol and validate it
via extensive simulation. Moreover, we address
dynamic trust management, i.e., determining and applying the best
operational settings at runtime in response to dynamically
changing network conditions to minimize trust bias
and to maximize the routing application performance. We
perform a comparative analysis of our proposed routing protocol
against Bayesian trust-based and non-trust based (PROPHET and
epidemic) routing protocols. The results demonstrate that our
protocol is able to deal with selfish behaviors and is resilient
against trust-related attacks. Furthermore, our trust-based routing protocol
can effectively trade off message overhead and message delay for a
significant gain in delivery ratio.
Our trust-based routing protocol operating under identified best
settings outperforms Bayesian trust-based routing and PROPHET,
and approaches the ideal performance of epidemic routing in delivery
ratio and message delay without incurring high message or protocol
maintenance overhead.
IEEE 2013 :Window
- based streaming Video - on-Demand Transmission on Bit Torrent-Like
Peer-to-Peer Networks
IEEE 2013 consumer Communications and Networking Conference
Abstract : Peer-to-Peer (P2P) networks are distributed systems where no
central authority rules the behavior of the individual peers. These systems
relay on the voluntary participation of the peers to help each other and reduce
congestion at the data servers. Bit Torrent is a popular file-sharing P2P
application originally designed for non real-time data. Given the inherent
characteristics of these systems, they have been considered to alleviate part
of the traffic in conventional networks, particularly for streaming stored
playback Video-on-Demand services. In this work, a window-based peer selection
strategy for managed P2P networks is proposed. The basic idea is to select the
down loader peers according to their progress in the file download process
relative to the progress of the downloading peers. The aforementioned strategy
is analyzed using both a fluid model and a Continuous Time Markov Chain. Also,
abundance conditions in the system are identified. Index Terms - Streaming
Stored Playback Video-on-Demand, Peer-to-peer Network, Bit Torrent
IEEE 2013 :Redundancy
Management of Multipath Routing for Intrusion Tolerance in Heterogeneous
Wireless SensorNetworks
IEEE 2013: Transactions on Networking
Abstract : In this paper we propose redundancy management of heterogeneous
wireless sensor networks (HWSNs), utilizing multipath routing to answer user
queries in the presence of unreliable and malicious nodes. The key concept
of our redundancy management is to exploit the tradeoff between energy
consumption vs. the gain in reliability, timeliness, and security to maximize
the system useful lifetime. We formulate the tradeoff as an optimization
problem for dynamically determining the best redundancy level to apply to
multipath routing for intrusion tolerance so that the query response success
probability is maximized while prolonging the useful lifetime.
Furthermore, we consider this optimization problem for the case in which
a voting-based distributed intrusion detection algorithm is applied to detect
and evict malicious nodes in a HWSN. We develop a novel probability model to
analyze the best redundancy level in terms of path redundancy and source
redundancy, as well as the best intrusion detection settings in terms of
the number of voters and the intrusion invocation interval under which the
lifetime of a HWSN is maximized. We then apply the analysis results obtained to
the design of a dynamic redundancy management algorithm to identify and apply
the best design parameter settings at run time in response to environment
changes, to maximize the HWSN lifetime
Abstract : Despite the surge in Vehicular Ad Hoc
NETwork (VANET) research, future high-end vehicles are expected to
under-utilize the on-board computation, communication, and storage resources.
Olariu et al. envisioned the next paradigm shift from conventional VANET to
Vehicular Cloud Computing (VCC) by merging VANET with cloud computing. But to
date, in the literature, there is no solid architecture for cloud computing
from VANET standpoint. In this paper, we put forth the taxonomy of VANET based
cloud computing. It is, to the best of our knowledge, the first effort to
define VANET Cloud architecture. Additionally we divide VANET clouds into three
architectural frameworks named Vehicular Clouds (VC), Vehicles using Clouds
(VuC), and Hybrid Vehicular Clouds (HVC). We also outline the unique security
and privacy issues and research challenges in VANET clouds.
IEEE 2013 :NICE - Network Intrusion Detection and Countermeasure Selection in Virtual Network
Systems
IEEE 2013 Transactions on Dependable and Secure Computing
Abstract : Cloud security is one of most important issues that has
attracted a lot of research and development effort in past few years.
Particularly, attackers can explore vulnerabilities of a cloud system and
compromise virtual machines to deploy further large-scale Distributed
Denial-of-Service (DDoS). DDoS attacks usually involve early stage actions such
as multi step exploitation, low-frequency vulnerability scanning, and
compromising identified vulnerable virtual machines as zombies, and finally
DDoS attacks through the compromised zombies. Within the cloud system,
especially the Infrastructure-as-a-Service (IaaS) clouds, the detection of
zombie exploration attacks is extremely difficult. This is because cloud users
may install vulnerable applications on their virtual machines. To prevent
vulnerable virtual machines from being compromised in the cloud, we propose a
multiphase distributed vulnerability detection, measurement, and countermeasure
selection mechanism called NICE, which is built on attack graph-based
analytical models and reconfigurable virtual network-based countermeasures. The
proposed framework leverages Open Flow network programming APIs to build a
monitor and control plane over distributed programmable virtual switches to
significantly improve attack detection and mitigate attack consequences. The
system and security evaluations demonstrate the efficiency and effectiveness of
the proposed solution.
IEEE 2013 :DRINA - A Lightweight and Reliable Routing Approach for In-Network Aggregation in
Wireless Sensor Networks
IEEE 2013 Transactions on Computers
Abstract : Large scale dense Wireless Sensor Networks (WSNs) will be
increasingly deployed in different classes of applications for accurate
monitoring. Due to the high density of nodes in these networks, it is likely
that redundant data will be detected by nearby nodes when sensing an event.
Since energy conservation is a key issue in WSNs, data fusion and aggregation
should be exploited in order to save energy. In this case, redundant data can
be aggregated at intermediate nodes reducing the size and number of exchanged
messages and, thus, decreasing communication costs and energy consumption. In
this work, we propose a novel Data Routing for In-Network Aggregation, called
DRINA, that has some key aspects such as a reduced number of messages for
setting up a routing tree, maximized number of overlapping routes, high
aggregation rate, and reliable data aggregation and transmission. The proposed
DRINA algorithm was extensively compared to two other known solutions: the
Information Fusion-based Role Assignment (InFRA) and Shortest Path Tree (SPT)
algorithms. Our results indicate clearly that the routing tree built by DRINA
provides the best aggregation quality when compared to these other algorithms.
The obtained results show that our proposed solution outperforms these solutions
in different scenarios and in different key aspects required by WSNs
IEEE 2013 :Community-Aware
Opportunistic Routing in Mobile Social Networks
IEEE 2013 Transactions on Computers
Abstract : Mobile social networks (MSNs) are a kind of delay tolerant network
that consists of lots of mobile nodes with social characteristics. Recently,
many social-aware algorithms have been proposed to address routing problems in
MSNs. However, these algorithms tend to forward messages to the nodes with
locally optimal social characteristics, and thus cannot achieve the optimal
performance. In this paper, we propose a distributed optimal Community-Aware
Opportunistic Routing (CAOR) algorithm. Our main contributions are that we propose
a home-aware community model, whereby we turn an MSN into a network that only
includes community homes. We prove that, in the network of community homes, we
still can compute the minimum expected delivery delays of nodes through a
reverse Dijkstra algorithm and achieve the optimal opportunistic routing
performance. Since the number of communities is far less than the number of
nodes in magnitude, the computational cost and maintenance cost of contact
information are greatly reduced. We demonstrate how our algorithm significantly
outperforms the previous ones through extensive simulations, based on a real
MSN trace and a synthetic MSN trace.
IEEE 2013 : ALERT
- An Anonymous Location-Based Efficient Routing Protocol in MANETs
IEEE 2013 Transactions on Mobile Computing
Abstract : Mobile Ad Hoc Networks (MANETs) use
anonymous routing protocols that hide node identities and/or routes from outside
observers in order to provide anonymity protection. However, existing anonymous
routing protocols relying on either hop-by-hop encryption or redundant traffic,
either generate high cost or cannot provide full anonymity protection to data
sources, destinations, and routes. The high cost exacerbates the inherent
resource constraint problem in MANETs especially in multimedia wireless
applications. To offer high anonymity protection at a low cost, we propose an
Anonymous Location-based Efficient Routing pro Tocol (ALERT). ALERT dynamically
partitions the network field into zones and randomly chooses nodes in
zones as intermediate relay nodes, which form a non traceable anonymous route.
In addition, it hides the data initiator/receiver among many initiators/receivers
to strengthen source and destination anonymity protection. Thus, ALERT offers
anonymity protection to sources, destinations, and routes. It also has
strategies to effectively counter intersection and timing attacks. We
theoretically analyze ALERT in terms of anonymity and efficiency. Experimental
results exhibit consistency with the theoretical analysis, and show that ALERT
achieves better route anonymity protection and lower cost compared to other
anonymous routing protocols. Also, ALERT achieves comparable routing efficiency
to the GPSR geographical routing protocol
IEEE 2013 : Towards
a Statistical Framework for Source Anonymity in Sensor Networks
IEEE 2013 Transactions on Mobile Computing
Abstract : In certain applications, the locations of events reported by
a sensor network need to remain anonymous. That is, unauthorized observers must
be unable to detect the origin of such events by analyzing the network traffic.
Known as the source anonymity problem, this problem has emerged as an important
topic in the security of wireless sensor networks, with variety of
techniques based on different adversarial assumptions being proposed. In this
work, we present a new framework for modeling, analyzing and evaluating
anonymity in sensor networks. The novelty of the proposed framework is twofold:
first, it introduces the notion of “interval indistinguishably” and provides a
quantitative measure to model anonymity in wireless sensor networks; second, it
maps source anonymity to the statistical problem of binary hypothesis testing
with nuisance parameters. We then analyze existing solutions for designing
anonymous sensor networks using the proposed model. We show how mapping source
anonymity to binary hypothesis testing with nuisance parameters leads to
converting the problem of exposing private source information into searching
for an appropriate data transformation that removes or minimize the effect of
the nuisance information. By doing so, we transform the problem from analyzing
real-valued sample points to binary codes, which opens the door for coding
theory to be incorporated into the study of anonymous sensor networks. Finally,
we discuss how existing solutions can be modified to improve their anonymity
IEEE 2013 : SinkTrail:
A Proactive Data Reporting Protocol for Wireless Sensor Networks
IEEE 2013 Transactions on Computers
Abstract : In large-scale wireless sensor networks, leveraging data
sinks’ mobility for data gathering has drawn substantial interests in recent
years. Current researches either focus on planning a mobile sink’s moving
trajectory in advance to achieve optimized network performance, or target at
collecting a small portion of sensed data in the network. In many application
scenarios, however, a mobile sink cannot move freely in the deployed area.
Therefore, the per-calculated trajectories may not be applicable. To avoid
constant sink location update traffics when a sink’s future locations cannot be
scheduled in advance, we propose two energy-efficient proactive data reporting
protocols, SinkTrail and SinkTrail-S, for mobile sink based data collection.
The proposed protocols feature low-complexity and reduced control overheads.
Two unique aspects distinguish our approach from previous ones we allow
sufficient flexibility in the movement of mobile sinks to dynamically adapt to
various terrestrial changes; and without requirements of GPS devices or
predefined landmarks, SinkTrail establishes a logical coordinate system for
routing and forwarding data packets, making it suitable for diverse application
scenarios. We systematically analyze the impact of several design factors in
the proposed algorithms. Both theoretical analysis and simulation results
demonstrate that the proposed algorithms reduce control overheads and yield
satisfactory performance in finding shorter routing paths.
IEEE 2013 :On
Quality of Monitoring for Multi-channel Wireless Infrastructure Networks
IEEE 2013 Transactions on Mobile Computing
Abstract : Passive monitoring utilizing distributed wireless sniffers is an
effective technique to monitor activities in wireless infrastruc-ture networks
for fault diagnosis, resource management and critical path analysis. In this
paper, we introduce a quality of monitoring (QoM) metric defined by the
expected number of active users monitored, and investigate the problem of
maximizing QoM by judiciously assigning sniffers to channels based on the
knowledge of user activities in a multi-channel wireless network. Two types of
capture models are considered. The user-centric model assumes frame-level
capturing capability of sniffers such that the activities of different users
can be distinguished while the sniffer-centric model only utilizes the binary
channel information (active or not) at a sniffer. For the user-centric model,
we show that the implied optimization problem is NP-hard, but a constant
approximation ratio can be attained via polynomial complexity algorithms. For
the sniffer-centric model, we devise stochastic inference schemes to transform
the problem into the user-centric domain, where we are able to apply our
polynomial approximation algorithms. The effectiveness of our proposed schemes
and algorithms is further evaluated using both synthetic data as well as
real-world traces from an operational WLAN.
IEEE 2013 :Participatory
Privacy: Enabling Privacy in Participatory
Sensing
IEEE 2013 Transactions on Networking
Abstract :Participatory Sensing is an emerging computing
paradigm that enables the distributed collection of data by self-selected
participants. It allows the increasing number of mobile phone users to share
local knowledge acquired by their sensor-equipped devices, e.g., to monitor
temperature, pollution level or consumer pricing information. While research
initiatives and prototypes proliferate, their real-world impact is often bounded
to comprehensive user participation. If users have no incentive, or feel that
their privacy might be endangered, it is likely that they will not participate.
In this article, we focus on privacy protection in Participatory Sensing and
introduce a suitable privacy-enhanced infrastructure. First, we provide a set
of definitions of privacy requirements for both data producers (i.e., users
providing sensed information) and consumers (i.e., applications accessing the
data). Then, we propose an efficient solution designed for mobile phone users,
which incurs very low overhead. Finally, we discuss a number of open problems
and possible research directions.
IEEE 2013 : NICE - Network Intrusion Detection and Countermeasure Selection in Virtual Network
Systems
IEEE 2013 Transactions on Dependable and Secure Computing
Abstract : Cloud security is one of most important issues that has
attracted a lot of research and development effort in past few years.
Particularly, attackers can explore vulnerabilities of a cloud system and
compromise virtual machines to deploy further large-scale Distributed
Denial-of-Service (DDoS). DDoS attacks usually involve early stage actions such
as multistep exploitation, low-frequency vulnerability scanning, and
compromising identified vulnerable virtual machines as zombies, and finally
DDoS attacks through the compromised zombies. Within the cloud system,
especially the Infrastructure-as-a-Service (IaaS) clouds, the detection of
zombie exploration attacks is extremely difficult. This is because cloud users
may install vulnerable applications on their virtual machines. To prevent
vulnerable virtual machines from being compromised in the cloud, we propose a
multiphase distributed vulnerability detection, measurement, and countermeasure
selection mechanism called NICE, which is built on attack graph-based
analytical models and reconfigurable virtual network-based countermeasures. The
proposed framework leverages Open Flow network programming APIs to build a
monitor and control plane over distributed programmable virtual switches to
significantly improve attack detection and mitigate attack consequences. The
system and security evaluations demonstrate the efficiency and effectiveness of
the proposed solution.
IEEE 2013 :Optimal
Multicast Capacity and Delay Tradeoffs in MANETs
IEEE 2013 Transactions on Mobile Computing
Abstract : In
this paper, we give a global perspective of multicast capacity and delay
analysis in Mobile Ad Hoc Networks (MANETs). Specifically, we consider four
node mobility models: two-dimensional i.i.d. mobility, wo-dimensional hybrid
random walk, one-dimensional i.i.d. mobility, and one-dimensional hybrid random
walk. Two mobility time-scales are investigated in this paper: Fast
mobility where node mobility is at the same time-scale as data transmissions;
Slow mobility where node mobility is assumed to occur at a much slower
time-scale than data transmissions. Given a delay constraint D, we first
characterize the optimal multicast capacity for each of the eight types of
mobility models, and then we develop a scheme that can achieve a capacity-delay
tradeoff close to the upper bound up to a logarithmic factor. In addition, we
also study heterogeneous networks with infrastructure support.
IEEE 2013 :Toward
Privacy Preserving and Collusion Resistance in a Location Proof Updating System
IEEE 2013 Transactions on Mobile Computing
Abstract : Today’s
location-sensitive service relies on user’s mobile device to determine the
current location. This allows malicious users to access a restricted resource
or provide bogus alibis by cheating on their locations. To address this issue,
we propose A Privacy-Preserving LocAtion proof Updating System (APPLAUS) in
which colocated Bluetooth enabled mobile devices mutually generate location
proofs and send updates to a location proof server. Periodically changed
pseudonyms are used by the mobile devices to protect source location privacy
from each other, and from the untrusted location proof server. We also develop
user-centric location privacy model in which individual users evaluate their
location privacy levels and decide whether and when to accept the location
proof requests. In order to defend against colluding attacks, we also present
betweenness ranking-based and correlation clustering-based approaches for
outlier detection. APPLAUS can be implemented with existing network
infrastructure, and can be easily deployed in Bluetooth enabled mobile devices
with little computation or power cost. Extensive experimental results show that
APPLAUS can effectively provide location proofs, significantly preserve the
source location privacy, and effectively detect colluding attacks.
IEEE 2013 :A
Lightweight Encryption Scheme for Network-Coded Mobile Ad Hoc Networks
IEEE 2013 Transactions on Parallel and Distributed System
Abstract : Energy
saving is an important issue in Mobile Ad Hoc Networks (MANETs). Recent studies
show that network coding can help reduce the energy consumption in MANETs by
using less transmission. However, apart from transmission cost, there are other
sources of energy consumption, e.g., data encryption/decryption. In this paper,
we study how to leverage network coding to reduce the energy consumed by data
encryption in MANETs. It is interesting that network coding has a nice property
of intrinsic security, based on which encryption can be done quite efficiently.
To this end, we propose P-Coding, a lightweight encryption scheme to provide
confidentiality for network-coded MANETs in an energy-efficient way. The basic
idea of P-Coding is to let the source randomly permutes the symbols of each
packet (which is prefixed with its coding vector), before performing network
coding operations. Without knowing the permutation, eavesdroppers cannot locate
coding vectors for correct decoding, and thus cannot obtain any meaningful
information. We demonstrate that due to its lightweight nature, P-Coding incurs
minimal energy consumption compared to other encryption schemes.
IEEE 2013 :Optimizing
Cloud Resources for Delivering IPTV Services through Virtualization
IEEE 2013 Transactions on Networking
Abstract : Virtualized
cloud-based services can take advantage of statistical multiplexing across
applications to yield significant cost savings to the operator. However,
achieving similar benefits with real-time services can be a challenge. In this
paper, we seek to lower a provider’s costs of real-time IPTV services through a
virtualized IPTV architecture and through intelligent time-shifting of service
delivery. We take advantage of the differences in the deadlines associated with
Live TV versus Video-on-Demand (VoD) to effectively multiplex these services.
We provide a generalized framework for computing the amount of resources needed
to support multiple services, without missing the deadline for any service. We
construct the problem as an optimization formulation that uses a generic cost
function. We consider multiple forms for the cost function (e.g., maximum,
convex and concave functions) to reflect the different pricing options. The
solution to this formulation gives the number of servers needed at different
time instants to support these services. We implement a simple mechanism for
time-shifting scheduled jobs in a simulator and study the reduction in server
load using real traces from an operational IPTV network. Our results show that
we are able to reduce the load by ∼ 24% (compared to a possible ∼ 31%). We also show that there are interesting open problems in
designing mechanisms that allow time-shifting of load in such environments.
IEEE 2013 :Redundancy
Management of Multipath Routing for Intrusion Tolerance in Heterogeneous
Wireless Sensor Networks
IEEE 2013 Transactions on Network and Service Management
Abstract : In this paper we propose redundancy management of heterogeneous
wireless sensor networks (HWSNs), utilizing multipath routing to answer user
queries in the presence of unreliable and malicious nodes. The ke concept of
our redundancy management is to exploit the tradeoff between energy consumption
vs. the gain in reliability, timeliness, and security to maximize the system
useful lifetime. We formulate the tradeoff as an optimization problem for
dynamically determining the best redundancy level to apply to multipath routing
for intrusion tolerance so that the query response success probability is
maximized while prolonging the useful lifetime. Furthermore, we consider
this optimization problem for the case in which a voting-based distributed
intrusion detection algorithm is applied to detect and evict malicious nodes in
a HWSN. We develop a novel probability model to analyze the best redundancy
level in terms of path redundancy and source redundancy, as well as the best
intrusion detection settings in terms of the number of voters and the intrusion
invocation interval under which the lifetime of a HWSN is maximized. We then
apply the analysis results obtained to the design of a dynamic redundancy
management algorithm to identify and apply the best design parameter settings
at runtime in response to environment changes, to maximize the HWSN lifetime.
IEEE 2013 :Community-Aware
Opportunistic Routing in Mobile Social Networks
IEEE 2013 Transactions on Computers
Abstract : Mobile social networks (MSNs) are a kind of delay tolerant network
that consists of lots of mobile nodes with social characteristics. Recently,
many social-aware algorithms have been proposed to address routing problems in
MSNs. However, these algorithms tend to forward messages to the nodes with
locally optimal social characteristics, and thus cannot achieve the optimal
performance. In this paper, we propose a distributed optimal Community-Aware
Opportunistic Routing (CAOR) algorithm. Our main contributions are that we
propose a home-aware community model, whereby we turn an MSN into a network
that only includes community homes. We prove that, in the network of community
homes, we still can compute the minimum expected delivery delays of nodes
through a reverse Dijkstra algorithm and achieve the optimal opportunistic
routing performance. Since the number of communities is far less than the
number of nodes in magnitude, the computational cost and maintenance cost
for contact information are greatly reduced. We demonstrate how our algorithm
significantly out performs the previous ones through extensive simulations,
based on a real MSN trace and a synthetic MSN trace.
IEEE 2013 :EMAP-Expedite Message Authentication Protocol for Vehicular Ad Hoc Networks
IEEE 2013 Transactions on Mobile Computing
Abstract : Vehicular Ad Hoc Networks (VANETs) adopt the Public Key
Infrastructure (PKI) and Certificate Revocation Lists (CRLs) for their
security. In any PKI system, the authentication of a received message is
performed by checking if the certificate of the sender is included in the
current CRL, and verifying the authenticity of the certificate and signature of
the sender. In this paper, we propose an Expedite Message Authentication
Protocol (EMAP) for VANETs, which replaces the time-consuming CRL checking
process by an efficient revocation checking process. The revocation check
process in EMAP uses a keyed Hash Message Authentication Code (HMAC), where the
key used in calculating the HMAC is shared only between non-revoked On-Board
Units (OBUs). In addition, EMAP uses a novel probabilistic key distribution,
which enables non-revoked OBUs to securely share and update a secret key. EMAP
can significantly decrease the message loss ratio due to the message
verification delay compared with the conventional authentication methods
employing CRL. By conducting security analysis and performance evaluation, EMAP
is demonstrated to be secure and efficient. Index
Terms - Vehicular networks, Communication security, Message authentication,
Certificate revocation.
IEEE 2013 : EAACK
- A Secure Intrusion-Detection System for MANETs
IEEE 2013 Transactions on Industrial Electronics
Abstract :The migration to wireless network from wired net-work has been a
global trend in the past few decades. The mobility and scalability brought by
wireless network made it possible in many applications. Among all the
contemporary wireless net-works, Mobile Ad hoc NET work (MANET) is one of the
most important and unique applications. On the contrary to traditional network
architecture, MANET does not require a fixed network infrastructure; every
single node works as both a transmitter and a receiver. Nodes communicate
directly with each other when they are both within the same communication
range. Otherwise, they rely on their neighbors to relay messages. The
self-configuring ability of nodes in MANET made it popular among critical
mission applications like military use or emergency recovery. However, the open
medium and wide distribution of nodes make MANET vulnerable to malicious
attackers. In this case, it is crucial to develop efficient intrusion-detection
mechanisms to protect MANET from attacks. With the improvements of the
technology and cut in hardware costs, we are witnessing a current trend of
expanding MANETs into industrial applications. To adjust to such trend, we
strongly believe that it is vital to address its potential security issues. In
this paper, we propose and implement a new intrusion-detection system named
Enhanced Adaptive ACKnowl-edgment (EAACK) specially designed for MANETs.
Compared to contemporary approaches, EAACK demonstrates higher
mali-cious-behavior-detection rates in certain circumstances while does not
greatly affect the network performances.
IEEE 2013 :Detection
and Localization of Multiple Spoofing Attackers in Wireless Networks
IEEE 2013 Transactions on Parallel and Distributed System
Abstract :Wireless spoofing attacks are easy to
launch and can significantly impact the performance of networks. Although the
identity of a node can be verified through cryptographic authentication,
conventional security approaches are not always desirable because of their
overhead requirements. In this paper, we propose to use spatial information, a
physical property associated with each node, hard to falsify, and not reliant
on cryptography, as the basis for detecting spoofing attacks; determining the number of attackers
when multiple adversaries masquerading as the same node identity; and
localizing multiple adversaries. We propose to use the spatial correlation of
received signal strength (RSS) inherited from wireless nodes to detect the
spoofing attacks. We then formulate the problem of determining the number of
attackers as a multi class detection problem. Cluster-based mechanisms are
developed to determine the number of attackers. When the training data are
available, we explore using the Support Vector Machines (SVM) method to further
improve the accuracy of determining the number of attackers. In addition, we
developed an integrated detection and localization system that can localize the
positions of multiple attackers. We evaluated our techniques through two test
beds using both an 802.11 (WiFi) network and an 802.15.4 (ZigBee) network in
two real office buildings. Our experimental results show that our proposed
methods can achieve over 90 percent Hit Rate and Precision when determining the
number of attackers. Our localization results using a representative set of
algorithms provide strong evidence of high accuracy of localizing multiple
adversaries.
IEEE 2013 :DCIM - Distributed Cache Invalidation Method for Maintaining
Cache Consistency in Wireless Mobile Networks
IEEE 2013 Transactions on Mobile Computing
Abstract :This paper proposes distributed cache
invalidation mechanism (DCIM), a client-based cache consistency scheme that is
implemented on top of a previously proposed architecture for caching data items
in mobile ad hoc networks (MANETs), namely COACS, where special nodes cache the
queries and the addresses of the nodes that store the responses to these
queries. We have also previously proposed a server-based consistency scheme,
named SSUM, whereas in this paper, we introduce DCIM that is totally
client-based. DCIM is a pull-based algorithm that implements adaptive time to
live (TTL), piggybacking, and perfecting, and provides near strong consistency
capabilities. Cached data items are assigned adaptive TTL values that
correspond to their update rates at the data source, where items with expired
TTL values are grouped in validation requests to the data source to refresh
them, whereas unexpired ones but with high request rates are prefetched from
the server. In this paper, DCIM is analyzed to assess the delay and bandwidth
gains (or costs) when compared to polling every time and push-based schemes.
DCIM was also implemented using ns2, and compared against client-based and
server-based schemes to assess its performance experimentally. The consistency
ratio, delay, and overhead traffic are reported versus several variables, where
DCIM showed to be superior when compared to the other systems.
IEEE 2013 :CPU
Scheduling for Power/Energy Management on Multi core Processors Using Cache
Miss and Context Switch Data
IEEE 2013 Transactions on Parallel and Distributed System
Abstract : Power and energy have become increasingly important
concerns in the design and implementation of today’s multi core/many core
chips. In this paper we present two priority-based CPU scheduling algorithms,
Algorithm Cache Miss Priority CPU Scheduler (CM−PCS) and Algorithm Context
Switch Priority CPU Scheduler(CS−PCS), which take advantage of often ignored
dynamic performance data, in order to reduce power consumption by over 20% with
a significant increase in performance. Our algorithms utilize Linux cpu sets
and cores operating at different fixed frequencies. Many other techniques,
including dynamic frequency scaling, can lower a core’s frequency during the
execution of a non-CPU intensive task, thus lowering performance. Our
algorithms match processes to cores better suited to execute those processes in
an effort to lower the average completion time of all processes in an entire
task, thus improving performance. They also consider a process’s cache
miss/cache reference ratio, number of context switches and CPU migrations, and
system load. Finally, our algorithms use dynamic process priorities as
scheduling criteria. We have tested our algorithms using a real AMD Opteron
6134 multi core chip and measured results directly using the “Kill A Watt”
meter, which samples power periodically during execution. Our results show not
only a power (energy/execution time) savings of 39 watts (21.43%) and 38 watts
(20.88%), but also a significant improvement in the performance, performance
per watt, and execution time ·watt (energy) for a task consisting of
twenty-four concurrently executing benchmarks, when compared to the default
Linux scheduler and CPU frequency scaling governor.
IEEE 2013 :Distributed
Cooperative Caching in Social Wireless Networks
IEEE 2013 Transactions on Mobile Computing
Abstract :This paper introduces cooperative caching policies for minimizing
electronic content provisioning cost in Social Wireless Networks (SWNET).
SWNETs are formed by mobile devices, such as data enabled phones, electronic
book readers etc., sharing common interests in electronic content, and
physically gathering together in public places. Electronic object caching in
such SWNETs are shown to be able to reduce the content provisioning cost which
depends heavily on the service and pricing dependence among various
stakeholders including content providers (CP), network service providers, and
End Consumers (EC). Drawing motivation from Amazon’s Kindle electronic book delivery
business, this paper develops practical network, service, and pricing models
which are then used for creating two object caching strategies for minimizing
content provisioning costs in networks with homogenous and heterogeneous object
demands. The paper constructs analytical and simulation models for analyzing
the proposed caching strategies in the presence of selfish users that deviate
from network-wide cost-optimal policies. It also reports results from an
Android phone-based prototype SWNET, validating the presented analytical and
simulation results.
IEEE 2013 :Geo-Community-Based Broadcasting for Data Dissemination
in Mobile Social Networks
IEEE 2013 Transactions on Parallel and Distributed System
Abstract :In this paper, we consider the issue of data broadcasting in
mobile social Networks (MSNets). The objective is to broadcast data from a super
user to other users in the network. There are two main challenges under this
paradigm, namely, how to represent and characterize user mobility in
realistic MSN ets; given the knowledge of regular users’ movements, how to
design an efficient super user route to broadcast data actively. We first
explore several realistic data sets to reveal both geographic and social
regularities of human mobility, and further propose the concepts of
Geo-community and Geo-centrality into MSNet analysis. Then, we employ a
semi-Markov process to model user mobility based on the Geo-community structure
of the network. Correspondingly, the Geo-centrality indicating the “dynamic
user density” of each Geo-community can be derived from the semi-Markov model.
Finally, considering the Geo-centrality information, we provide different route
algorithms to cater to the superuser that wants to either minimize total
duration or maximize dissemination ratio. To the best of our knowledge, this
work is the first to study data broadcasting in a realistic MSNet setting.
Extensive trace-driven simulations show that our approach consistently
outperforms other existing super user route design algorithms in terms of
dissemination ratio and energy efficiency.
No comments:
Post a Comment