Search

Rate-splitting multiple access (RSMA) is a multiple access technique generalizing conventional techniques, such as, space-division multiple access (SDMA), non-orthogonal multiple access (NOMA), and physical layer multi-casting, which aims to address multi-user interference (MUI) in multiple-input multiple-output (MIMO) systems. In this study, we leverage the interference management capabilities of RSMA to tackle the issue of inter-carrier interference (ICI) in orthogonal frequency division multiplexing (OFDM) waveform. We formulate a problem to find the optimal subcarrier and power allocation for downlink transmission in a two-user system using RSMA and OFDM and propose a weighted minimum mean-square error (WMMSE)-based algorithm to obtain a solution. The sum-rate performance of the proposed OFDM-RSMA scheme is compared with that of conventional orthogonal frequency division multiple access (OFDMA) and OFDM-NOMA by numerical results. It is shown that the proposed OFDM-RSMA outperforms OFDM-NOMA and OFDMA under ICI in diverse propagation channel conditions owing to its flexible structure and robust interference management capabilities., Comment: Submitted to IEEE for possible publication

Network Intrusion Detection Systems (NIDS) have been extensively investigated by monitoring real network traffic and analyzing suspicious activities. However, there are limitations in detecting specific types of attacks with NIDS, such as Advanced Persistent Threats (APT). Additionally, NIDS is restricted in observing complete traffic information due to encrypted traffic or a lack of authority. To address these limitations, a Host-based Intrusion Detection system (HIDS) evaluates resources in the host, including logs, files, and folders, to identify APT attacks that routinely inject malicious files into victimized nodes. In this study, a hybrid network intrusion detection system that combines NIDS and HIDS is proposed to improve intrusion detection performance. The feature flattening technique is applied to flatten two-dimensional host-based features into one-dimensional vectors, which can be directly used by traditional Machine Learning (ML) models. A two-stage collaborative classifier is introduced that deploys two levels of ML algorithms to identify network intrusions. In the first stage, a binary classifier is used to detect benign samples. All detected attack types undergo a multi-class classifier to reduce the complexity of the original problem and improve the overall detection performance. The proposed method is shown to generalize across two well-known datasets, CICIDS 2018 and NDSec-1. Performance of XGBoost, which represents conventional ML, is evaluated. Combining host and network features enhances attack detection performance (macro average F1 score) by 8.1% under the CICIDS 2018 dataset and 3.7% under the NDSec-1 dataset. Meanwhile, the two-stage collaborative classifier improves detection performance for most single classes, especially for DoS-LOIC-UDP and DoS-SlowHTTPTest, with improvements of 30.7% and 84.3%, respectively, when compared with the traditional ML XGBoost., Comment: 20 pages, 11 figures, 4 tables

In applications such as end-to-end encrypted instant messaging, secure email, and device pairing, users need to compare key fingerprints to detect impersonation and adversary-in-the-middle attacks. Key fingerprints are usually computed as truncated hashes of each party's view of the channel keys, encoded as an alphanumeric or numeric string, and compared out-of-band, e.g. manually, to detect any inconsistencies. Previous work has extensively studied the usability of various verification strategies and encoding formats, however, the exact effect of key fingerprint length on the security and usability of key fingerprint verification has not been rigorously investigated. We present a 162-participant study on the effect of numeric key fingerprint length on comparison time and error rate. While the results confirm some widely-held intuitions such as general comparison times and errors increasing significantly with length, a closer look reveals interesting nuances. The significant rise in comparison time only occurs when highly similar fingerprints are compared, and comparison time remains relatively constant otherwise. On errors, our results clearly distinguish between security non-critical errors that remain low irrespective of length and security critical errors that significantly rise, especially at higher fingerprint lengths. A noteworthy implication of this latter result is that Signal/WhatsApp key fingerprints provide a considerably lower level of security than usually assumed., Comment: Accepted to International Conference on Availability, Reliability and Security (ARES 2023)

Today, the audit and diagnosis of the causal relationships between the events in a trigger-action-based event chain (e.g., why is a light turned on in a smart home?) in the Internet of Things (IoT) platforms are untrustworthy and unreliable. The current IoT platforms lack techniques for transparent and tamper-proof ordering of events due to their device-centric logging mechanism. In this paper, we develop a framework that facilitates tamper-proof transparency and event order in an IoT platform by proposing a Blockchain protocol and adopting the vector clock system, both tailored for the resource-constrained heterogeneous IoT devices, respectively. To cope with the unsuited storage (e.g., ledger) and computing power (e.g., proof of work puzzle) requirements of the Blockchain in the commercial off-the-shelf IoT devices, we propose a partial consistent cut protocol and engineer a modular arithmetic-based lightweight proof of work puzzle, respectively. To the best of our knowledge, this is the first Blockchain designed for resource-constrained heterogeneous IoT platforms. Our event ordering protocol based on the vector clock system is also novel for the IoT platforms. We implement our framework using an IoT gateway and 30 IoT devices. We experiment with 10 concurrent trigger-action-based event chains while each chain involves 20 devices, and each device participates in 5 different chains. The results show that our framework may order these events in 2.5 seconds while consuming only 140 mJ of energy per device. The results hence demonstrate the proposed platform as a practical choice for many IoT applications such as smart home, traffic monitoring, and crime investigation., Comment: 12 pages, 13 eps figures

Although 5G (Fifth Generation) mobile technology is still in the rollout phase, research and development of 6G (Sixth Generation) wireless have already begun. This paper is an introduction to 6G wireless networks, covering the main drivers for 6G, some of the expected use cases, some of the technical challenges in 6G, example areas that will require research and new technologies, the expected timeline for 6G development and rollout, and a list of some important 6G initiatives world-wide. It was compiled as part of a series of workshops about 6G held by Thinknet 6G and MUENCHNER KREIS in 2021., 6 pages, 3 figures, document also available in German, document available in a more attractive format, here: www.thinknet-6g.de

Industry 5.0 aims at maximizing the collaboration between humans and machines. Machines are capable of automating repetitive jobs, while humans handle creative tasks. As a critical component of Industrial Internet of Things (IIoT) systems for service delivery, network data stream analytics often encounter concept drift issues due to dynamic IIoT environments, causing performance degradation and automation difficulties. In this paper, we propose a novel Multi-Stage Automated Network Analytics (MSANA) framework for concept drift adaptation in IIoT systems, consisting of dynamic data pre-processing, the proposed Drift-based Dynamic Feature Selection (DD-FS) method, dynamic model learning & selection, and the proposed Window-based Performance Weighted Probability Averaging Ensemble (W-PWPAE) model. It is a complete automated data stream analytics framework that enables automatic, effective, and efficient data analytics for IIoT systems in Industry 5.0. Experimental results on two public IoT datasets demonstrate that the proposed framework outperforms state-of-the-art methods for IIoT data stream analytics., Published in IEEE Transactions on Industrial Informatics (Q1, IF: 11.648); Code is available at Github link: https://github.com/Western-OC2-Lab/MSANA-Online-Data-Stream-Analytics-And-Concept-Drift-Adaptation

We identify new opportunities in video streaming, involving the joint consideration of offline video chunking and online rate adaptation. Due to a video's complexity varying over time, certain parts are more likely to cause performance impairments during playback with a particular rate adaptation algorithm. To address such an issue, we propose Segue, which carefully uses variable-length video segments, and augment specific segments with additional bitrate tracks. The key novelty of our approach is in making such decisions based on the video's time-varying complexity and the expected rate adaptation behavior over time. We propose and implement several methods for such adaptation-aware chunking. Our results show that Segue substantially reduces rebuffering and quality fluctuations, while maintaining video quality delivered; Segue improves QoE by 9% on average, and by 22% in low-bandwidth conditions. Finally, we view our problem framing as a first step in a new thread on algorithmic and design innovation in video streaming, and leave the reader with several interesting open questions.

The Swapped Dragonfly with M routers per group and K global ports per router is denoted D3(K;M) [1]. It has n=KMM routers and is a partially populated Dragonfly. A Swapped Dragonfly with K and M restricted is studied in this paper. There are four cases. matrix product: If K is a perfect square, a matrix product of size n can be performed in squareroot n rounds. all-to-all exchange: If K and M have a common factor s, an all-to-all exchange can be performed in n/s rounds. broadcast: If D3(K,M) is equipped with a synchronized source-vector header it can perform x broadcast in 3x/M rounds. ascend-descend: If K and M are powers of 2 an ascend-descend algorithm can be performed at twice the cost of the algorithm on a Boolean hypercube of size n. In each case the algorithm on the Swapped Dragonfly is free of link conflicts and is compared with algorithms on a hypercube as well as on the fully populated Dragonfly. The results on the Swapped Dragonfly are more applicable than the special cases because D3(K,M) contains emulations of every Swapped Dragonfly with J less than equal to K and/or L less than or equal to M. Keywords: Swapped Interconnection Network, Matrix Product, All-to-all, Universal Exchange, Boolean Hypercube, Ascend-descend algorithm, Broad- cast, Edge-disjoint spanning tree. References [1] R. Draper. The Swapped Dragonfly , ArXiv for Computer Science:2202.01843. 1, Comment: 8 pages

Modern heterogeneous supercomputing systems are comprised of compute blades that offer CPUs and GPUs. On such systems, it is essential to move data efficiently between these different compute engines across a high-speed network. While current generation scientific applications and systems software stacks are GPU-aware, CPU threads are still required to orchestrate data moving communication operations and inter-process synchronization operations. A new GPU stream-aware MPI communication strategy called stream-triggered (ST) communication is explored to allow offloading both computation and communication control paths to the GPU. The proposed ST communication strategy is implemented on HPE Slingshot Interconnects over a new proprietary HPE Slingshot NIC (Slingshot 11) using the supported triggered operations feature. Performance of the proposed new communication strategy is evaluated using a microbenchmark kernel called Faces, based on the nearest-neighbor communication pattern in the CORAL-2 Nekbone benchmark, over a heterogeneous node architecture consisting of AMD CPUs and GPUs., Comment: 11 pages, 12 figures

This paper proposes the characteristics a techno-economic model for 5G should have considering both mobile network operators perspective and end users needs. It also presents a review and classification of models in the literature based on the characteristics of such theoretical techno-economic reference model. The performed analysis identifies current gaps in the techno-economic modeling literature for 5G architectures and shows it can be enhanced using agile techno-economic models like the Universal Techno-Economic Model (UTEM) created and developed by the author to industrialize assessment of different technological solutions, considering all market players perspectives and applicable to decision-making in multiple domains. This model can be used for an effective and agile 5G techno-economic assessment, including not only network deployment perspective but also customers and end users requirements as well as other stakeholders to select the most adequate 5G architectural solution considering both technical and economic feasibility. UTEM model is currently available for all industry stakeholders under specific license of use., Comment: 12 pages, 4 figures, 1 table

Global System for Mobile Communications (GSM) is a cellular network that is popular and has been growing in recent years. It was developed to solve fragmentation issues of the first cellular system, and it addresses digital modulation methods, level of the network structure, and services. It is fundamental for organizations to become learning organizations to keep up with the technology changes for network services to be at a competitive level. A simulation analysisusing the NetSim tool in this paper is presented for comparing different cellular network codecsfor GSM network performance. Theseparameters such as throughput, delay, and jitter are analyzed for the quality of service provided by each network codec. Unicast application for the cellular network is modeled for different network scenarios. Depending on the evaluation and simulation, it was discovered that G.711, GSM_FR, and GSM-EFR performed better than the other codecs, and they are considered to be the best codecs for cellular networks.These codecs will be of best use to better the performance of the network in the near future.

As the number of Internet of Things (IoT) devices and systems have surged, IoT data analytics techniques have been developed to detect malicious cyber-attacks and secure IoT systems; however, concept drift issues often occur in IoT data analytics, as IoT data is often dynamic data streams that change over time, causing model degradation and attack detection failure. This is because traditional data analytics models are static models that cannot adapt to data distribution changes. In this paper, we propose a Performance Weighted Probability Averaging Ensemble (PWPAE) framework for drift adaptive IoT anomaly detection through IoT data stream analytics. Experiments on two public datasets show the effectiveness of our proposed PWPAE method compared against state-of-the-art methods., Comment: Accepted and to appear in IEEE GlobeCom 2021; Code is available at Github link: https://github.com/Western-OC2-Lab/PWPAE-Concept-Drift-Detection-and-Adaptation

Radio Frequency Identification (RFID) systems are among the most widespread computing technologies with technical potential and profitable opportunities in numerous applications worldwide. Further, RFID is the core technology behind the Internet of Things (IoT), which can accomplish the real-time transmission of information between objects without manual operation. However, RFID security has been taken for granted for several years, causing multiple vulnerabilities that can even damage human functionalities. The latest ISO/IEC 18000-63:2015 standard concerning RFID dates to 2015, and much freedom has been given to manufacturers responsible for making their devices secure. The lack of a substantial standard for devices that implement RFID technology creates many vulnerabilities that expose end-users to elevated risk. Hence, this paper gives the reader a clear overview of the technology, and it analyzes 23 well-known RFID attacks such as Reverse Engineering, Buffer Overflow, Eavesdropping, and Malware. Moreover, given the exceptional capabilities and utilities of RFID devices, this paper has focused on security measures and defenses for protecting them, such as Active Jamming, Shielding tag, and Authentication., Comment: 9 pages, 4 figures

This paper proposes a new event-based parameter switching method for the control tasks of cybersecurity in the context of preventive and reactive cyber defense dynamics. Our parameter switching method helps avoid excessive control costs as well as guarantees the dynamics to converge as our desired speed. Meanwhile, it can be proved that this approach is Zeno-free. A new estimation method with adaptive time windows is used to bridge the gap between the probability state and the sampling state. With the new estimation method, several practical experiments are given afterwards., Comment: 21 pages, 10 figures, 1 algorithm. may be submitted to SciSec Conference

Manufacturer Usage Description (MUD) is an Internet Engineering Task Force (IETF) standard designed to protect IoT devices and networks by creating an out-of-the-box access control list for an IoT device. %The protocol defines a conceptually straightforward method to implement an isolation-based defensive mechanism based on the rules that are introduced by the manufacturer of the device. However, in practice, the access control list of each device is defined in its MUD-File and may contain possibly hundreds of access control rules. As a result, reading and validating these files is a challenge; and determining how multiple IoT devices interact is difficult for the developer and infeasible for the consumer. To address this we introduce the MUD-Visualizer to provide a visualization of any number of MUD-Files. MUD-Visualizer is designed to enable developers to produce correct MUD-Files by providing format correction, integrating them with other MUD-Files, and identifying conflicts through visualization. MUD-Visualizer is scalable and its core task is to merge and illustrate ACEs for multiple devices; both within and beyond the local area network. MUD-Visualizer is made publicly available and can be found on GitHub., Comment: 22 pages, 6 figures, 3 algorithms, To be published in 5th EAI International Conference on Safety and Security in Internet of Things (SaSeIoT)

To support faster and more efficient networks, mobile operators and service providers are bringing 5G millimeter wave (mmWave) networks indoors. However, due to their high directionality, mmWave links are extremely vulnerable to blockage by walls and human mobility. To address these challenges, we exploit advances in artificially engineered metamaterials, introducing a wall-mounted smart metasurface, called mmWall, that enables a fast mmWave beam relay through the wall and redirects the beam power to another direction when a human body blocks a line-of-sight path. Moreover, our mmWall supports multiple users and fast beam alignment by generating multi-armed beams. We sketch the design of a real-time system by considering (1) how to design a programmable, metamaterial-based surface that refracts the incoming signal to one or more arbitrary directions, and (2) how to split an incoming mmWave beam into multiple outgoing beams and arbitrarily control the beam energy between these beams. Preliminary results show the mmWall metasurface steers the outgoing beam in a full 360-degrees, with an 89.8% single-beam efficiency and 74.5% double-beam efficiency., Comment: 7 pages, 7 figures, The paper will be published in HotMobile'21

When training a machine learning model, it is standard procedure for the researcher to have full knowledge of both the data and model. However, this engenders a lack of trust between data owners and data scientists. Data owners are justifiably reluctant to relinquish control of private information to third parties. Privacy-preserving techniques distribute computation in order to ensure that data remains in the control of the owner while learning takes place. However, architectures distributed amongst multiple agents introduce an entirely new set of security and trust complications. These include data poisoning and model theft. This paper outlines a distributed infrastructure which is used to facilitate peer-to-peer trust between distributed agents; collaboratively performing a privacy-preserving workflow. Our outlined prototype sets industry gatekeepers and governance bodies as credential issuers. Before participating in the distributed learning workflow, malicious actors must first negotiate valid credentials. We detail a proof of concept using Hyperledger Aries, Decentralised Identifiers (DIDs) and Verifiable Credentials (VCs) to establish a distributed trust architecture during a privacy-preserving machine learning experiment. Specifically, we utilise secure and authenticated DID communication channels in order to facilitate a federated learning workflow related to mental health care data., Comment: To be published in the proceedings of the 17th International Conference on Trust, Privacy and Security in Digital Business - TrustBus2020

Using smartphones for peer-to-peer communication over the Internet is difficult without the aid of centralized services. These centralized services, which usually reside in the cloud, are necessary for brokering communication between peers, and all communication must pass through them. A reason for this is that smartphones lack publicly reachable IP addresses. Also, because people carry their smartphones with them, smartphones will often disconnect from one network and connect to another. Smartphones can also go offline. Additionally, a network of trusted peers (or friends) requires a directory of known peers, authentication mechanisms, and secure communication channels. In this paper, we propose a peer-to-peer middleware that provides these features without the need for centralized services., Comment: ICETE 2018: E-Business and Telecommunications pp 199-218. Part of the Communications in Computer and Information Science book series (CCIS, volume 1118). The final authenticated publication is available online at https://doi.org/10.1007/978-3-030-34866-3_10

Ransomware is a kind of malware using cryptographic mechanisms to prevent victims from normal use of their computers. As a result, victims lose the access to their files and desktops unless they pay the ransom to the attackers. By the end of 2019, ransomware attack had caused more than 10 billion dollars of financial loss to enterprises and individuals. In this work, we propose Network-Assisted Approach (NAA), which contains effective local detection and network-level detection mechanisms, to help users determine whether a machine has been infected by ransomware. To evaluate its performance, we built 100 containers in Docker to simulate network scenarios. A hybrid ransomware sample which is close to real-world ransomware is deployed on stimulative infected machines. The experiment results show that our network-level detection mechanisms are separately applicable to WAN and LAN environments for ransomware detection., Comment: 15 pages

This article shows State of the Art of techno-economic modeling for access network technologies, presents the characteristics a universal techno-economic model should have, and shows a classification and analysis of techno-economic models in the literature based on such characteristics. As a result of his research in this direction, the author created and developed a Universal Techno-Economic Model and the corresponding methodology for techno-economic assessment in multiple domains, currently available for industry stakeholders under specific licence of use., Comment: 12 pages, 1 figure, 4 tables

This doctoral dissertation shows State of the Art of techno-economic modeling for access network technologies, presents the characteristics a universal techno-economic model should have, and shows a classification and analysis of techno-economic models in the literature based on such characteristics. In order to reduce the gap detected in the literature, the author defines and develops a Universal Techno-Economic Model called UTEM and the corresponding methodology to industrialize techno-economic assessment in multiple domains considering all market players perspectives, also suitable for technological consulting and currently available for all industry stakeholders under specific license of use., Comment: 188 pages, 30 figures, 56 tables, PhD Thesis, delivered in Dec. 2015, defended in Feb. 2016. Confidential chapters 3 and 4 excluded. English Translation. Original in Spanish available at University of the Basque Country official repository: https://addi.ehu.es/handle/10810/24669 *Total Spanish + English versions: 382 pages in arXiv: 2008.07286v3

Standardized interfaces are the connecting link of today's distributed systems, facilitating access to data services in the cloud. REST APIs have been prevalent over the last years, despite several issues like over- and underfetching of resources. GraphQL enjoys rapid adoption, resolving these problems by using statically typed queries. However, the redevelopment of services to the new paradigm is costly. Therefore, several approaches for the successive migration from REST to GraphQL have been proposed, many leveraging OpenAPI service descriptions. In this article, we present the findings of our empirical evaluation on the APIs.guru directory and identify several schema translation challenges. These include less expressive schema types in GraphQL, as well as missing meta information about related resources in OpenAPI. To this end, we developed the open source Link Generator, that analyzes OpenAPI documents and automatically adds links to increase translation utility. This fundamentally benefits around 34% of APIs in the APIs.guru directory. Our findings and tool support contribute to the ongoing discussion about the migration of REST APIs to GraphQL, and provide developers with valuable insights into common pitfalls, to reduce friction during API transformation., Comment: WWW2020 Developer Track

Detecting covert channels among legitimate traffic represents a severe challenge due to the high heterogeneity of networks. Therefore, we propose an effective covert channel detection method, based on the analysis of DNS network data passively extracted from a network monitoring system. The framework is based on a machine learning module and on the extraction of specific anomaly indicators able to describe the problem at hand. The contribution of this paper is two-fold: (i) the machine learning models encompass network profiles tailored to the network users, and not to the single query events, hence allowing for the creation of behavioral profiles and spotting possible deviations from the normal baseline; (ii) models are created in an unsupervised mode, thus allowing for the identification of zero-days attacks and avoiding the requirement of signatures or heuristics for new variants. The proposed solution has been evaluated over a 15-day-long experimental session with the injection of traffic that covers the most relevant exfiltration and tunneling attacks: all the malicious variants were detected, while producing a low false-positive rate during the same period., Comment: This is a pre-print of an article published in the proceedings of 14th International Conference on Malicious and Unwanted Software (MALWARE), 2019

The proper setting of contention window (CW) values has a significant impact on the efficiency of Wi-Fi networks. Unfortunately, the standard method used by 802.11 networks is not scalable enough to maintain stable throughput for an increasing number of stations, yet it remains the default method of channel access for 802.11ax single-user transmissions. Therefore, we propose a new method of CW control, which leverages deep reinforcement learning (DRL) principles to learn the correct settings under different network conditions. Our method, called centralized contention window optimization with DRL (CCOD), supports two trainable control algorithms: deep Q-network (DQN) and deep deterministic policy gradient (DDPG). We demonstrate through simulations that it offers efficiency close to optimal (even in dynamic topologies) while keeping computational cost low., Comment: 6 pages, 6 figures, published in 2021 IEEE Wireless Communications and Networking Conference (WCNC)

This article attempts to create a software and hardware complex that can work autonomously and demonstrates the ease of implementation of attacks on denial of service on wireless networks, which in turn emphasizes the need to provide comprehensive protection of wireless networks.

While sharing files in a peer-to-peer (P2P) system significantly increases both the speed of retrieving the contents and the robustness of the system, tracing the access of files is not straightforward, even in the case of private P2P networks. In fact, a participant that has uploaded a file to a P2P network is not necessarily involved in its download. Additionally, due to the nature of the P2P network it is possible for a participant to already have all the fragments of a file, even before requesting it. This work tries to address the problem of tracing file access in a private P2P file sharing network through the use of blockchains to improve quality of service and auditability. To this end, the proposed solution combines three elements: (1) A distributed hash table network that is used to distribute encrypted files with redundancy amongst the partner peers; (2) Shamir's secret sharing scheme to split the secret keys of each file; (3) A blockchain network to distribute and manage the secret shares amongst the partner peers. In fact, the latter makes access to a file undeniable to every node of the network. The solution is relevant for consortia that manage a shared data pool on base of P2P technology with unrestricted access to files but where access to a file has to be recorded due to legal or billing reasons., Comment: 16 pages, 7 figures, 1 listing

Multi-hop wireless networks with autonomous nodes are susceptible to selfish traffic remapping attacks (TRAs). Nodes launching TRAs leverage the underlying channel access function to receive unduly high quality of service (QoS) for packet flows traversing source-to-destination routes. TRAs are easy to execute, impossible to prevent, difficult to detect, and harmful to the QoS of honest nodes. Recognizing the need for providing QoS security, we use a novel network-oriented QoS metric to propose a self-enforcing game-theoretic mitigation approach. By switching between TRA and honest behavior, selfish nodes engage in a noncooperative multistage game in pursuit of high QoS. We analyze feasible node strategies and design a distributed signaling mechanism called DISTRESS, under which, given certain conditions, the game produces a desirable outcome: after an upper-bounded play time, honesty tends to become a selfish node's best-reply behavior, while yielding acceptable QoS to most or all nodes. We verify these findings by Monte Carlo and ns-3 simulations of static and mobile nodes., Comment: 16 pages, 11 figures, 3 tables, journal version of conference paper arXiv:1704.04053

The paper examines quantitative assessment of wireless distribution system security, as well as an assessment of risks from attacks and security violations. Furthermore, it describes typical security breach and formal attack models and five methods for assessing security. The proposed normalized method for assessing the degree of security assurance operates with at least three characteristics, which allows comparatively analyze heterogeneous information systems. The improved calculating formulas have been proposed for two security assessment methods, and the elements of functional-cost analysis have been applied to calculate the degree of security. To check the results of the analysis, the coefficient of concordance was calculated, which gives opportunity to determine the quality of expert assessment. The simultaneous use of several models to describe attacks and the effectiveness of countering them allows us to create a comprehensive approach to countering modern security threats to information networks at the commercial enterprises and critical infrastructure facilities.

This paper presents a study on natural language to sign language translation with human-robot interaction application purposes. By means of the presented methodology, the humanoid robot TEO is expected to represent Spanish sign language automatically by converting text into movements, thanks to the performance of neural networks. Natural language to sign language translation presents several challenges to developers, such as the discordance between the length of input and output data and the use of non-manual markers. Therefore, neural networks and, consequently, sequence-to-sequence models, are selected as a data-driven system to avoid traditional expert system approaches or temporal dependencies limitations that lead to limited or too complex translation systems. To achieve these objectives, it is necessary to find a way to perform human skeleton acquisition in order to collect the signing input data. OpenPose and skeletonRetriever are proposed for this purpose and a 3D sensor specification study is developed to select the best acquisition hardware., Comment: 13 pages, 8 figures, conference

Network operators are looking towards LTE License Assisted Access (LAA) as a means of extending capacity by offloading traffic to unlicensed bands. However, operation in these bands requires abiding to certain coexistence rules in terms of channel access. The description of these rules in existing literature is not always in line with the latest standards. Therefore, in this paper, we clarify the operation of LAA, focusing on channel access and methods of providing Quality of Service (QoS) support. In terms of coexistence, we evaluate the impact of LAA under its various QoS settings on Wi-Fi performance in an experimental testbed. Finally, we describe the upcoming research challenges for LTE-based technologies in unlicensed bands considering the latest developments., Comment: 7 pages, 4 figures, 2 tables

This article discusses the available Software-Defined Radios (SDRs), compatible software, messageformats, and also shows how it is possible to do penetration tests using SDR for Bluetooth Low Energy(BLE) and ZigBee technologies.

Machine-learning based intrusion detection classifiers are able to detect unknown attacks, but at the same time, they may be susceptible to evasion by obfuscation techniques. An adversary intruder which possesses a crucial knowledge about a protection system can easily bypass the detection module. The main objective of our work is to improve the performance capabilities of intrusion detection classifiers against such adversaries. To this end, we firstly propose several obfuscation techniques of remote attacks that are based on the modification of various properties of network connections; then we conduct a set of comprehensive experiments to evaluate the effectiveness of intrusion detection classifiers against obfuscated attacks. We instantiate our approach by means of a tool, based on NetEm and Metasploit, which implements our obfuscation operators on any TCP communication. This allows us to generate modified network traffic for machine learning experiments employing features for assessing network statistics and behavior of TCP connections. We perform the evaluation of five classifiers: Gaussian Naive Bayes, Gaussian Naive Bayes with kernel density estimation, Logistic Regression, Decision Tree, and Support Vector Machines. Our experiments confirm the assumption that it is possible to evade the intrusion detection capability of all classifiers trained without prior knowledge about obfuscated attacks, causing an exacerbation of the TPR ranging from 7.8% to 66.8%. Further, when widening the training knowledge of the classifiers by a subset of obfuscated attacks, we achieve a significant improvement of the TPR by 4.21% - 73.3%, while the FPR is deteriorated only slightly (0.1% - 1.48%). Finally, we test the capability of an obfuscations-aware classifier to detect unknown obfuscated attacks, where we achieve over 90% detection rate on average for most of the obfuscations.

The secure distribution of protected content requires consumer authentication and involves the conventional method of end-to-end encryption. However, in information-centric networking (ICN) the end-to-end encryption makes the content caching ineffective since encrypted content stored in a cache is useless for any consumer except those who know the encryption key. For effective caching of encrypted content in ICN, we propose a novel scheme, called the Secure Distribution of Protected Content (SDPC). SDPC ensures that only authenticated consumers can access the content. The SDPC is a lightweight authentication and key distribution protocol; it allows consumer nodes to verify the originality of the published article by using a symmetric key encryption. The security of the SDPC was proved with BAN logic and Scyther tool verification., Comment: 7 pages, 9 figures, 2018 IEEE 87th Vehicular Technology Conference (VTC Spring)

In wireless networks, stations can improve their received quality of service (QoS) by handling packets of source flows with higher priority. Additionally, in cooperative relay networks, the relays can handle transit flows with lower priority. We use game theory to model a two-hop relay network where each of the two involved stations can commit such selfish QoS manipulation. We design and evaluate a reputation-based incentive scheme called RISC2WIN, whereby a trusted third party (e.g., an access point) can limit selfish behavior and preserve appropriate QoS for both stations., Comment: 7 pages, 4 figures, 12 numbered equations

Nowadays, every organization might be attacked through its network printers. The malicious exploitation of printing protocols is a dangerous and underestimated threat against every printer today, as highlighted by recent published researches. This article presents PIDS (Printers' IDS), an intrusion detection system for detecting attacks on printing protocols. PIDS continuously captures various features and events obtained from traffic produced by printing protocols in order to detect attacks. As part of this research we conducted thousands of automatic and manual printing protocol attacks on various printers and recorded thousands of the printers' benign network sessions. Then we applied various supervised machine learning (ML) algorithms to classify the collected data as normal (benign) or abnormal (malicious). We evaluated several detection algorithms, feature selection methods, and the features needed in order to obtain the best detection results for protocol traffic of printers. Our empirical results suggest that the proposed framework is effective in detecting printing protocol attacks, providing an accuracy of 99.9 with negligible fall-positive rate.

This paper summarizes selected results of the dissertation "Beobachtungsm��glichkeiten im Domain Name System: Angriffe auf die Privatsph��re und Techniken zum Selbstdatenschutz". The dissertation provides new technical insights to answer the questions "Who can monitor us on the Internet?" and "How do we protect ourselves?". It focuses on the Domain Name System (DNS), the address book of the internet. It shows that recursive nameservers have monitoring capabilities that have been neglected so far. In particular, a behavior-based tracking method is introduced, which allows operators to track the activities of users over an extended period of time. On the one hand, this threatens the privacy of Internet users, on the other hand, law enforcement could benefit from this research. Furthermore, new privacy enhancing techniques are proposed, which are more effective and more user-friendly than existing approaches. ----- Dieser Beitrag fasst ausgew��hlte Ergebnisse der Dissertation "Beobachtungsm��glichkeiten im Domain Name System: Angriffe auf die Privatsph��re und Techniken zum Selbstdatenschutz" zusammen. Die Dissertation liefert neue Antworten auf die Fragen "Wer kann uns im Internet ��berwachen?" und "Wie sch��tzen wir uns davor?". Die Arbeit befasst sich mit dem Domain Name System (DNS), dem Adressbuch des Internets. Es wird gezeigt, dass es im DNS bislang vernachl��ssigte ��berwachungsm��glichkeiten gibt. Insbesondere wird ein Verfahren zum verhaltensbasierten Tracking vorgestellt, mit dem die Aktivit��ten von Internetnutzern unbemerkt ��ber l��ngere Zeitr��ume verfolgt werden k��nnen. Einerseits wird dadurch die Privatsph��re vieler Internetnutzer bedroht, andererseits k��nnten daraus neue Werkzeuge f��r die Strafverfolgung entstehen. Weiterhin werden neue Datenschutz-Techniken vorgeschlagen, die sicherer und benutzerfreundlicher sind als die bisherigen Ans��tze., 12 pages, in German

Both enterprise and national firewalls filter network connections. For data forensics and botnet removal applications, it is important to establish the information source. In this paper, we describe a data transport layer which allows a client to transfer encrypted data that provides no discernible information regarding the data source. We use a domain generation algorithm (DGA) to encode AES encrypted data into domain names that current tools are unable to reliably differentiate from valid domain names. The domain names are registered using (free) dynamic DNS services. The data transmission format is not vulnerable to Deep Packet Inspection (DPI)., Comment: 8 pages, 10 figures, conference

These are the Proceedings of the 4th OMNeT++ Community Summit, which was held at the University of Bremen - Germany - on September 7-8, 2017., Comment: Proceedings of the 4th OMNeT++ Community Summit

In the Internet of Things (IoT) devices are exposed to various kinds of attacks when connected to the Internet. An attack detection mechanism that understands the limitations of these severely resource-constrained devices is necessary. This is important since current approaches are either customized for wireless networks or for the conventional Internet with heavy data transmission. Also, the detection mechanism need not always be as sophisticated. Simply signaling that an attack is taking place may be enough in some situations, for example in NIDS using anomaly detection. In graph networks, central nodes are the nodes that bear the most influence in the network. The purpose of this research is to explore experimentally the relationship between the behavior of central nodes and anomaly detection when an attack spreads through a network. As a result, we propose a novel anomaly detection approach using this unique methodology which has been unexplored so far in communication networks. Also, in the experiment, we identify presence of an attack originating and propagating throughout a network of IoT using our methodology., Comment: 5 pages, 4 figures, ICCWS

A new development of smart-home systems is to use mobile apps to control IoT devices across a Home Area Network (HAN). Those systems tend to rely on the Wi-Fi router to authenticate other devices; as verified in our study, IoT vendors tend to trust all devices connected to the HAN. This treatment exposes them to the attack from malicious apps, particularly those running on authorized phones, which the router does not have information to control, as confirmed in our measurement study. Mitigating this threat cannot solely rely on IoT manufacturers, which may need to change the hardware on the devices to support encryption, increasing the cost of the device, or software developers who we need to trust to implement security correctly. In this work, we present a new technique to control the communication between the IoT devices and their apps in a unified, backward-compatible way. Our approach, called Hanguard, does not require any changes to the IoT devices themselves, the IoT apps or the OS of the participating phones. Hanguard achieves a fine-grained, per-app protection through bridging the OS-level situation awareness and the router-level per-flow control: each phone runs a non-system userspace Monitor app to identify the party that attempts to access the protected IoT device and inform the router through a control plane of its access decision; the router enforces the decision on the data plane after verifying whether the phone should be allowed to talk to the device. Hanguard uses a role-based access control (RBAC) schema which leverages type enforcement (TE) and multi-category security (MCS) primitives to define highly flexible access control rules. We implemented our design over both Android and iOS (>95% of mobile OS market share) and a popular router. Our study shows that Hanguard is both efficient and effective in practice.

Cloaking has long been exploited by spammers for the purpose of increasing the exposure of their websites. In other words, cloaking has long served as a major malicious technique in search engine optimization (SEO). Cloaking hides the true nature of a website by delivering blatantly different content to users versus web crawlers. Recently, we have also witnessed a rising trend of employing cloaking in search engine marketing (SEM). However, detecting cloaking is challenging. Existing approaches cannot detect IP cloaking and are not suitable for detecting cloaking in SEM because their search-and-visit method leads to click fraud. In addition, they focus on detecting and measuring cloaking on the server side, but the results are not visible to users to help them avoid frauds. Our work focuses on mitigating IP cloaking and SEM cloaking, and providing client-based real-time cloaking detection services. To achieve these goals, we first propose the Simhash-based Website Model (SWM), a condensed representation of websites, which can model natural page dynamics. Based on SWM, we design and implement Cloaker Catcher, an accurate, efficient and privacy-preserving system, that consists of a server that crawls websites visited by users on demand and a client-side extension that fetches spider views of websites from the server and compares them with user views to detect cloaking. Since Cloaker Catcher checks on the client side for each real user, IP cloaking can be detected whenever it occurs and click fraud in SEM can also be prevented. Using our system, we conducted the first analysis of SEM cloaking and found that the main purpose of SEM cloakers is to provide illicit services.

As today's organizational computer networks are ever evolving and becoming more and more complex, finding potential vulnerabilities and conducting security audits has become a crucial element in securing these networks. The first step in auditing a network is reconnaissance by mapping it to get a comprehensive overview over its structure. The growing complexity, however, makes this task increasingly effortful, even more as mapping (instead of plain scanning), presently, still involves a lot of manual work. Therefore, the concept proposed in this paper automates the scanning and mapping of unknown and non-cooperative computer networks in order to find security weaknesses or verify access controls. It further helps to conduct audits by allowing comparing documented with actual networks and finding unauthorized network devices, as well as evaluating access control methods by conducting delta scans. It uses a novel approach of augmenting data from iteratively chained existing scanning tools with context, using genuine analytics modules to allow assessing a network's topology instead of just generating a list of scanned devices. It further contains a visualization model that provides a clear, lucid topology map and a special graph for comparative analysis. The goal is to provide maximum insight with a minimum of a priori knowledge., Comment: 7 pages, 6 figures

The detection of BGP prefix hijacking attacks has been the focus of research for more than a decade. However, the state-of-the-art techniques fall short of detecting more elaborate types of attack. To study such attacks, we devise a novel formalization of Internet routing, and apply this model to routing anomalies in order to establish a comprehensive attacker model. We use this model to precisely classify attacks and to evaluate their impact and detectability. We analyze the eligibility of attack tactics that suit an attacker’s goals and demonstrate that related work mostly focuses on less impactful kinds of attacks. We further propose, implement, and test the Hijacking Event Analysis Program (HEAP) , a new approach to investigate hijacking alarms. Our approach is designed to seamlessly integrate with the previous work in order to reduce the high rates of false alarms inherent to these techniques. We leverage several unique data sources that can reliably disprove malicious intent. First, we make use of an Internet routing registry to derive business or organizational relationships between the parties involved in an event. Second, we use a topology-based reasoning algorithm to rule out events caused by legitimate operational practice. Finally, we use Internet-wide network scans to identify SSL/TLS-enabled hosts, which helps to identify non-malicious events by comparing public keys prior to and during an event. In our evaluation, we prove the effectiveness of our approach, and show that day-to-day routing anomalies are harmless for the most part. More importantly, we use HEAP to assess the validity of publicly reported alarms. We invite researchers to interface with HEAP in order to crosscheck and narrow down their hijacking alerts.

The analysis techniques of system log messages (syslog messages) have a long history from when the syslog mechanism was invented. Typically, the analysis consists of two parts, one is a message template generation, and the other is finding something interesting using the messages classified by the inferred templates. It is important to generate better templates to achieve better, precise, or convincible analysis results. In this paper, we propose a classification methodology using the length of words of each message. Our method is suitable for online template generation because it does not require two-pass analysis to generate template messages, that is an important factor considering increasing amount of log messages produced by a large number of system components such as cloud infrastructure.

The majority of available wearable devices require communication with Internet servers for data analysis and storage, and rely on a paired smartphone to enable secure communication. However, wearable devices are mostly equipped with WiFi network interfaces, enabling direct communication with the Internet. Secure communication protocols should then run on these wearables itself, yet it is not clear if they can be efficiently supported. In this paper, we show that wearable devices are ready for direct and secure Internet communication by means of experiments with both controlled and Internet servers. We observe that the overall energy consumption and communication delay can be reduced with direct Internet connection via WiFi from wearables compared to using smartphones as relays via Bluetooth. We also show that the additional HTTPS cost caused by TLS handshake and encryption is closely related to number of parallel connections, and has the same relative impact on wearables and smartphones.

Like many routing protocols, the Tor anonymity network has decentralized path selection, in clients locally and independently choose paths. As a result, network resources may be left idle, leaving the system in a suboptimal state. This is referred to as the price of anarchy, where agents acting in their own self interest can make poor decisions when viewed in a global context. In this paper we explore the cost of anarchy in Tor by examining the potential performance increases that can be gained by centrally optimizing circuit and relay selection using global knowledge. In experiments with both offline and online algorithms, we show that centrally coordinated clients can achieve up to 75% higher bandwidth compared to traditional Tor. Drawing on these findings, we design and evaluate a decentralized version of our online algorithm, in which relays locally distribute information enabling clients to make smarter decisions locally and perform downloads 10-60% faster. Finally, we perform a privacy analysis of the decentralized algorithm against a passive and active adversary trying to reduce anonymity of clients and increase their view of the Tor network. We conclude that this decentralized algorithm does not enable new attacks, while providing significantly higher performance.

Security issues related to the cloud computing are relevant to various stakeholders for an informed cloud adoption decision. Apart from data breaches, the cyber security research community is revisiting the attack space for cloud-specific solutions as these issues affect budget, resource management, and service quality. Distributed Denial of Service (DDoS) attack is one such serious attack in the cloud space. In this paper, we present developments related to DDoS attack mitigation solutions in the cloud. In particular, we present a comprehensive survey with a detailed insight into the characterization, prevention, detection, and mitigation mechanisms of these attacks. Additionally, we present a comprehensive solution taxonomy to classify DDoS attack solutions. We also provide a comprehensive discussion on important metrics to evaluate various solutions. This survey concludes that there is a strong requirement of solutions, which are designed keeping utility computing models in mind. Accurate auto-scaling decisions, multi-layer mitigation, and defense using profound resources in the cloud, are some of the key requirements of the desired solutions. In the end, we provide a definite guideline on effective solution building and detailed solution requirements to help the cyber security research community in designing defense mechanisms. To the best of our knowledge, this work is a novel attempt to identify the need of DDoS mitigation solutions involving multi-level information flow and effective resource management during the attack., Comment: Published in Computer Communications, Volume 107, 2017, Eslevier

This report summarizes the results of our evaluation of antennas of contactless and dual interface smartcards and our ideas for user-switchable NFC antennas. We show how to disassemble smartcards with contactless capabilities in order to obtain the bare chip module and the bare antenna wire. We examine the design of various smartcard antennas and present concepts to render the contactless interface unusable. Finally, we present ideas and practical experiments to make the contactless interface switchable by the end-user., Comment: University of Applied Sciences Upper Austria, JR-Center u'smile, Technical report, 29 pages, 27 figures

This is the Proceedings of the 2nd OMNeT++ Community Summit, which was held at IBM Research - Zurich, Switzerland on September 3-4, 2015.

This paper introduces a new scheme of LT codes, named multiple configurations. In multiple configurations LT codes (MC-LT codes), multiple sets of output symbols are simultaneously provided to receivers for recovering the source data. Each receiver, without the need to send information back to the sender, is capable of receiving the output symbols generated by some configuration chosen according to its own decoding phase. Aiming at the broadcasting scenarios without feedback channels, the proposed MC-LT codes are shown to outperform the optimal pure LT codes at the cost of encoding and transmitting units. In this paper, the inspiration of MC-LT codes is presented, how MC-LT codes work is described by giving examples, in which the optimal pure LT codes are outperformed, and a practical design of MC-LT codes, which is analytically proved to have at least the same performance bound as the pure LT codes, is proposed. The results of numerical simulation experiments demonstrate that the proposed practical design of MC-LT codes can deliver better performance than the LT codes in comparison. In summary, this paper creates new potential research directions for LT codes, and MC-LT codes are a promising variant of LT codes, especially for broadcasting scenarios., Comment: 11 pages, 8 figures, 3 tables