Search

Unmanned aerial vehicle (UAV) and network function virtualization (NFV) facilitate the deployment of multi-access edge computing (MEC). In the UAV-based MEC (UMEC) network, virtualized network function (VNF) can be implemented as a lightweight container running on UMEC host operating system (OS). However, UMEC network is vulnerable to attack, which can result in resource degradation and even UMEC service disruption. Rejuvenation techniques, such as failover technique and live container migration technique, can mitigate the impact of resource degradation but their effectiveness to improve the resilience of UMEC services should be evaluated. This paper presents a quantitative modeling approach based on semi-Markov process to investigate the resilience of a UMEC service chain consisting of any number of VNFs executed in any number of UMEC hosts in terms of availability and reliability. Unlike existing studies, the semi-Markov model constructed in this paper can capture the time-dependent behaviors between VNFs, between host OSes, and between VNFs and host OSes on the condition that the holding times of the recovery and failure events follow any kind of distribution. We perform the sensitivity analysis to identify potential resilience bottlenecks. The results highlight that migration time is the parameter significantly affecting the resilience, which shed the insight on designing the UMEC service chain with high-grade resilience requirements. In addition, we carry out the numerical experiments to reveal that: (i) the type of failure time distribution has a significant effect on the resilience; and (ii) the resilience increases with decreasing number of VNFs, while the availability increases with increasing number of UMEC hosts and the reliability decreases with increasing number of UMEC hosts, which can provide meaningful guidance for the UAV placement optimization in the UMEC network.

The continuous increase of electric vehicles is being facilitating the large-scale distributed charging-pile deployment. It is crucial to guarantee normal operation of charging piles, resulting in the importance of diagnosing charging-pile faults. The existing fault-diagnosis approaches were based on physical fault data like mechanical log data and sensor data streams. However, there are other types of fault data, which cannot be used for diagnosis by these existing approaches. This paper aims to fill this gap and consider 8 types of fault data for diagnosing, at least including physical installation error fault, charging-pile mechanical fault, charging-pile program fault, user personal fault, signal fault (offline), pile compatibility fault, charging platform fault, and other faults. We aim to find out how to combine existing feature-extraction and machine learning techniques to make the better diagnosis by conducting experiments on realistic dataset. 4 word embedding models are investigated for feature extraction of fault data, including N-gram, GloVe, Word2vec, and BERT. Moreover, we classify the word embedding results using 10 machine learning classifiers, including Random Forest (RF), Support Vector Machine, K-Nearest Neighbor, Multilayer Perceptron, Recurrent Neural Network, AdaBoost, Gradient Boosted Decision Tree, Decision Tree, Extra Tree, and VOTE. Compared with original fault record dataset, we utilize paraphrasing-based data augmentation method to improve the classification accuracy up to 10.40%. Our extensive experiment results reveal that RF classifier combining the GloVe embedding model achieves the best accuracy with acceptable training time. In addition, we discuss the interpretability of RF and GloVe.

Proof-of-Work (PoW) blockchain systems like Bitcoin and Ethereum are vulnerable to selfholding attack. The prior modeling-based works about this attack only considered Bitcoin and assumed that there were at most two honest pools in a perfect network (no natural fork in such networks). However, a blockchain network is imperfect due to block propagation delay, which can lead to forking. Moreover, there may be more than two pools under attack. This paper aims for a quantitative analysis of an imperfect PoW blockchain network system under selfholding attack. We develop a novel stochastic model and derive formulas to evaluate the effect of selfholding attack on miner revenue, system security and system performance. Our work can be used to analyze the scenario where there are any number of pools suffering selfholding attack in both Ethereum and Bitcoin. The model in this paper can capture the behaviors of a more realistic and more general scenario, compared with the existing models. Moreover, our model and formulas can also be applied to evaluate a blockchain system, which uses a similar reward mechanism and is vulnerable to selfholding attack. Our work can help design a more secure blockchain incentive mechanism and an in-pool reward mechanism.

Selfish mining, as a serious threat to blockchain, has been attracting attentions from academic and industry. Stochastic modeling has been explored to quantitatively investigate selfish mining in imperfect blockchain networks. However, prior modeling-based analysis approaches have some of the following issues: (1) only focus on Bitcoin or Ethereum, or (2) ignore extended forks and just consider natural forks, or (3) only compute the mining revenue without assessing the performance and security of the blockchain system when the system suffers from selfish mining. In this paper, we aim to address these issues. We build a Markov chain to make quantitative analysis of selfish mining in imperfect Bitcoin and Ethereum networks with natural and extended forks. Formulas are derived to calculate the mining revenue for the selfish pool (comprising selfish miners) and honest miners, respectively. Moreover, we derive the formulas of performance metrics (namely, transactions per second and stale block ratio) and the formula of security metric (namely, the probability of double-spending success) of the system. These quantitative results can help understand the impact of selfish mining on imperfect blockchain networks and then help the detection of selfish mining.

Vehicle platooning can be applied to cooperative downloading and uploading (CDU) services through the cooperation between lead vehicle and non-lead vehicles. CDU service can be completed cooperatively by containers constructed in vehicles of the vehicle platooning system. Containers in vehicles may suffer from potential attacks which can lead to resource degradation and further cause the decrease in the dependability and security of CDU service. Failover technique can be deployed in an in-vehicle system and then performs protective operation for mitigating the impact of resources degradation and guaranteeing service resilience. This paper aims to quantitatively analyze the availability, reliability and security of CDU service in the vehicle platooning system deploying failover technique. We construct an analytical model to describe the interaction between resources degradation and rejuvenation behaviors of the vehicle platooning system. Then we derive the formulas of availability, Mean Time to Failure (MTTF) for evaluating reliability and Mean Security Capacity to Failure (MSCF) for evaluating security. Simulation and analytical experiments are applied to demonstrate the approximate accuracy of our model and investigate the impact of system parameters on metrics, respectively, which helps service providers make decisions on how to organize vehicles to perform CDU service and how to set system parameter values for maximizing their benefits.

The fantastic growth in cybersecurity attack frequency and sophistication over the years advances the development of Moving Target Defense (MTD) technology. Migration-based dynamic platform technique (DPT), one of MTD techniques, is expected to significantly improve cyberspace security by migrating service across multiple platforms according to the predefined policy. However, the existing random migration policies cause unnecessary cost when the service platform is not under attack, which indicates the necessity of combining DPT with traditional detection-based defense mechanism to make migration decision. In this paper, we propose a Continuous-Time Markov Decision Process (CTMDP)-based dynamic platform defense model against multi-stage attacks, which can determine the optimal service migration timing based on the system reward. To maximize the expected total discounted reward of the system, we utilize the value iteration algorithm to determine the optimal policy which defines what action to be taken in a specific state. Experiments are carried out to demonstrate that our CTMDP-based dynamic platform defense model obtains higher expected total discounted reward than using random migration policies. We also investigate the effects of platform numbers and discount factors on the system reward.

This work proposes Practical Byzantine Fault Tolerance (PBFT) ordering service needed for block formation in permissioned blockchain environments. Contrary to current PBFT implementations that only provide a single point of entry to the ordering service, we allow each ordering node to act as an entry point that proposes and conducts the consensus process of including new record in the distributed ledger. To ensure atomicity of record insertion in distributed ledger, we have developed a bandwidth reservation protocol that uses a modification of CSMA/CA protocol to regulate access to the broadcast medium formed by the P2P network of TCP connections between orderers. We have modeled record insertion service time in a cluster where ordering nodes have random position within Cartesian coordinate system. We have also modeled total request access time to the ledger which includes waiting time in the orderer's queue and record insertion time. These models are used to evaluate system performance under variable request rate ordering service, variable number of nodes and variable physical cluster dimensions. Our results show the interaction between decreased request waiting time in orderer's queue and increased contention among orderers when the number of orderers increases for the given total request arrival rate. This interaction is also investigated for two different physical cluster sizes which affect record insertion time. The interplay of request rate, number of orderers and physical cluster size determines system capacity expressed in total request rate. Our model can be used to make the trade-off between the required system capacity, number of orderers, and physical cluster dimensions under constraints on Byzantine fault rate.

With the growing demand of data processing/storage from Internet of Things (IoT) users and the increasing maturity of Cloud-Edge technologies, it becomes more and more critical to develop an effective and efficient performance evaluation approach in order to enhance the performance of Cloud-Edge services. Analytic modeling is an effective evaluation approach. The existing modeling researches on edge and/or cloud computing either ignored workload heterogeneity or ignored delay constraint of IoT tasks. This paper develops a hierarchical model for capturing the behaviors of Cloud-Edge datacenters, which provides service to tasks with different service priorities and requesting different number of service resources. Formulas for calculating performance measures of interest are also developed. The approximate accuracy of the proposed analytic model is verified through comparing numerical results and discrete-event simulation results.

Ultra-dense networks (UDN) are considered as one of the key technologies for advancing the widespread deployment of 5G networks. To provide continuous and reliable connectivity to user devices and to achieve the integrity and authenticity of communication, UDN needs to address the challenges related to authentication and authorization of information. Existing authentication and key agreement (AKA) schemes are not appropriate for the ultra-dense deployment of access points due to excessive authentication and/or computation overhead. This paper proposes a novel lightweight batch authentication and key agreement (LBAKA) scheme for user-centric UDN scenarios by adopting lightweight batch authentication solution and one-to-one key agreement, and by using mutual authentication to verify the credibility of both sides of the communication. The proposed LBAKA can maintain privacy of identity information under replay, impersonation and man-in-the-middle attacks in user-centric UDNs. In terms of computation and communication overhead, our simulation results show that LBAKA outperforms other similar schemes in user-centric UDNs.

Vehicular cloud computing (VCC) is composed of multiple distributed vehicular clouds (VCs), which are formed on-the-fly by dynamically integrating underutilized vehicular resources including computing power, storage, and so on. Existing proposals for identity-as-a-service (IDaaS) are not suitable for use in VCC due to limited computing resources and storage capacity of onboard vehicle devices. In this paper, we first propose an improved ciphertext-policy attribute-based encryption (CP-ABE) scheme. Utilizing the improved CP-ABE scheme and the permissioned blockchain technology, we propose a lightweight and privacy-preserving IDaaS architecture for VCC named IDaaSoVCC. It realizes lightweight and privacy-preserving access control of vehicles’ personally identifiable information (PII) in a large distributed vehicular cloud system. Security analysis demonstrates the security features of IDaaSoVCC, most notably forward secrecy, confidentiality and identity information privacy. Meanwhile, we verify that IDaaSoVCC is feasible and practical in a large distributed VC system through extensive simulations.

The widespread application of the Hyperledger Fabric platform and the timeliness requirement of transactions on the platform necessitate the effective performance evaluation of transaction processing. The existing evaluation researches on Hyperledger Fabric ignored transaction endorsement failure (due to transaction endorsing duration timeout) and/or ignored block timeout. This paper considers these two timeout constraints and develops a hierarchical model for Hyperledger Fabric v1.4 transaction process from the time when transactions are submitted by clients until the completion of validating/committing transactions as a block. Formulas for calculating performance measures, including platform throughput, transaction rejection probability and mean transaction response delay, are derived. Extensive numerical analysis and simulations are carried out to verify the approximate accuracy of the model and formulas. Moreover, numerical analysis is applied to illustrate the impact of various parameters on performance measures.

As modern vehicles and distributed fog services advance apace, vehicular fog services (VFSs) are being expected to span across multiple geo-distributed datacenters, which inevitably leads to cross-datacenter authentication. Traditional cross-datacenter authentication models are not suitable for the scenario of high-speed moving vehicles accessing VFS, because these models either ignored user privacy or ignored the delay requirement of driving vehicles. This paper proposes a blockchain-assisted lightweight anonymous authentication (BLA) mechanism for distributed VFS, which is provisioned to driving vehicles. BLA can achieve the following advantages: 1) realizing a flexible cross-datacenter authentication, in which a vehicle can decide whether to be reauthenticated or not when it enters a new vehicular fog datacenter; 2) achieving anonymity, and granting vehicle users the responsibility of preserving their privacy; 3) it is lightweight by achieving noninteractivity between vehicles and service managers (SMs), and eliminating the communication between SMs in the authentication process, which significantly reduces the communication delay; and 4) resisting the attack that the database governed by one center is tampered with. BLA achieves these advantages by effectively combining modern cryptographical technology and blockchain technology. These security features are demonstrated by carrying out security analysis. Meanwhile, extensive simulations are conducted to validate the efficiency and practicality of BLA.

Open vSwitch (OVS) is a popular virtual switch implementing OpenFlow, which often works in Linux system. The development of Cloud and Edge datacenters accelerates its popularity, especially with the emergence of 5G mobile networks. Performance analysis of a network system with OVS could help uncovering of performance bottlenecks and improving system performance. Analytic modeling is an effective performance evaluation approach. Existing analytical models of OVS ignored the characteristics of the system where OVS works. Thus, it is hard, if not impossible, to detect performance bottlenecks. This paper proposes a novel analytical model to evaluate the performance of Linux network system with OVS. Different from exiting models, our model can capture key steps, each of which consumes CPU in the packet forwarding process. Our model also enables the computation of a set of performance measures, including packer sojourn time and blocking probability. The approximate accuracy of the proposed model is validated by comparing numerical results with simulation results under various system parameter settings.

Adversarial Malware Example (AME)-based adversarial training can effectively enhance the robustness of Machine Learning (ML)-based malware detectors against AME. AME quality is a key factor to the robustness enhancement. Generative Adversarial Network (GAN) is a kind of AME generation method, but the existing GAN-based AME generation methods have the issues of inadequate optimization, mode collapse and training instability. In this paper, we propose a novel approach (denote as LSGAN-AT) to enhance ML-based malware detector robustness against Adversarial Examples, which includes LSGAN module and AT module. LSGAN module can generate more effective and smoother AME by utilizing brand-new network structures and Least Square (LS) loss to optimize boundary samples. AT module makes adversarial training using AME generated by LSGAN to generate ML-based Robust Malware Detector (RMD). Extensive experiment results validate the better transferability of AME in terms of attacking 6 ML detectors and the RMD transferability in terms of resisting the MalGAN black-box attack. The results also verify the performance of the generated RMD in the recognition rate of AME.

Deep learning (DL) has exhibited its exceptional performance in fields like intrusion detection. Various augmentation methods have been proposed to improve data quality and eventually to enhance the performance of DL models. However, the classic augmentation methods cannot be applied to those DL models which exploit the system-call sequences to detect intrusion. Previously, the seq2seq model has been explored to augment system-call sequences. Following this work, we propose a gated convolutional neural network (GCNN) model to thoroughly extract the potential information of augmented sequences. Also, in order to enhance the model’s robustness, we adopt adversarial training to reduce the impact of adversarial examples on the model. Adversarial examples used in adversarial training are generated by the proposed adversarial sequence generation algorithm. The experimental results on different verified models show that GCNN model can better obtain the potential information of the augmented data and achieve the best performance. Furthermore, GCNN with adversarial training can enhance robustness significantly.

Heterogeneity prevails not only among physical machines but also among workloads in real IaaS Cloud data centers (CDCs). The heterogeneity makes performance modeling of large and complex IaaS CDCs even more challenging. This paper considers the scenario where the number of virtual CPUs requested by each customer job may be different. We propose a hierarchical stochastic modeling approach applicable to IaaS CDC performance analysis under such a heterogeneous workload. Numerical results obtained from the proposed analytic model are verified through discrete-event simulations under various system parameter settings.

With the quick development of the hydrolic engineering in China, the height of the rockfill dams reaches the level of 200– 300 m. High rockfill dams over 200 m behave differently in deformation mode compared to previous lower dams. Due to the particular features of rockfill materials in macroscopic and mesoscopic scales, such as continuity, discrete and crushability, the constitutive models and the deformation mechanisms for rockfills are not yet clear. It is necessary to investigate the mechanical behaviors of rockfill materials from macro- to meso-scale. This paper makes a review on macro- and mesoscopic analysis of rockfill dams and rockfill materials in recent years. The constituitive modeling and the parameter calibration of rockfill dams, the mesoscopic method, deformation mechanisms and the scale effect for rockfill materials are discussed. Besides, the further investigation trends of deformation analysis and control methods in rockfill dams are shown.

Vehicle-to-everything (V2X) has been regarded as an important enabling technology for future intelligent transportation systems (ITS). Safety-critical applications in V2X require authentication of nodes and messages, and also need to preserve the privacy of vehicles. Pseudonymity plays an important role in V2X communication by satisfying both security and privacy requirements. In this paper, we analyze the weaknesses of a recent relevant work named Issue First Activate Later (IFAL), which is the leading European candidate for V2X. We then propose a novel lightweight, secure and privacy-preserving pseudonym changing scheme. Through the security analysis, we show that the proposed scheme achieves the asynchronous key agreement, and realizes both robust forward secrecy and backward secrecy while keeping security functionalities of IFAL. Furthermore, the performance analysis is conducted on Arduino Mega 2560 to illustrate that the proposed scheme is feasible and practical. © 2014 xxxxxxxx. Hosting by Elsevier B.V. All rights reserved.

This paper develops a novel approximate analytical model to evaluate the performance of active virtual machines in IaaS clouds using an M/G/m/m+K queue. The proposed model, combined with the transform-based analytical approach, enables the computation of the probability distribution of the number of jobs in the system and subsequently a set of performance measures, including the mean number of jobs in the system, the mean response time, the probability of immediate service, and the blocking probability. Compared to the existing Markov models of cloud data centers, our approach can reflect the system behavior more accurately even when the service-time distribution has a large coefficient of variation (> 1.5) in a medium-sized IaaS cloud. Numerical results obtained from the proposed analytical model are verified through extensive simulations under various system parameter settings, and compared with the results from existing models.

The increasing shift of various critical services towards Infrastructure-as-a-Service (IaaS) cloud data centers (CDCs) creates a need for analyzing CDCs’ availability, which is affected by various factors including repair policy and system parameters. This paper aims to apply analytical modeling and sensitivity analysis techniques to investigate the impact of these factors on the availability of a large-scale IaaS CDC, which (1) consists of active and two kinds of standby physical machines (PMs), (2) allows PM moving among active and two kinds of standby PM pools, and (3) allows active and two kinds of standby PMs to have different mean repair times. Two repair policies are considered: (P1) all pools share a repair station and (P2) each pool uses its own repair station. We develop monolithic availability models for each repair policy by using Stochastic Reward Nets and also develop the corresponding scalable two-level models in order to overcome the monolithic model’s limitations, caused by the large-scale feature of a CDC and the complicated interactions among CDC components. We also explore how to apply differential sensitivity analysis technique to conduct parametric sensitivity analysis in the case of interacting sub-models. Numerical results of monolithic models and simulation results are used to verify the approximate accuracy of interacting sub-models, which are further applied to examine the sensitivity of the large-scale CDC availability with respect to repair policy and system parameters.

Infrastructure as a Service cloud provides elasticity and scalable virtual machines VMs as computing service to multiple tenants, but the tenants lose the full control of their data. Measuring the integrity of critical files of the VMs and providing the integrity attestation to the tenants on the basis of TCG trusted computing techniques is an effective way to alleviate their anxiety. This paper considers how to measure the integrity of the processes run in guest VMs and files opened in guest VMs. We propose an out-of-the-box integrity measurement approach to measure the integrity of critical files through system call syscall interception without any modification of the guest VMs. Out-of-the-box integrity measurement approach can not only measure the integrity of all files that have been considered by existing approaches but also measure the integrity of the system configuration files, program loaders, and script interpreters, which affect the system behaviors and integrity. The ability of supporting both system and manual measurement policies makes our approach flexible. We implement this approach in Xen hypervisor with little modification of the existing syscall interception method, and this approach can be ported to other virtualization platform easily. Copyright © 2014 John Wiley & Sons, Ltd.

Active queue management (AQM) mechanisms are designed to provide better support for end-to-end congestion control mechanisms of transmission control protocol (TCP) in TCP/IP networks. This paper introduces a stable queue-based adaptive proportional-integral (Q-SAPI) controller for AQM and presents an implementation. The starting points of our approach are the recently developed fluid-flow modeling and control theoretic interpretation of the TCP/AQM dynamics, and the recently developed fixed-gain proportional-integral (PI) controller for AQM. Q-SAPI aims to improve the transient performance of the fixed-gain PI controller while maintaining its steady-state performance over a wide range of uncertainties in round-trip time (RTT) and the number of active TCP flows. The robustness of Q-SAPI is studied in detail, which provides guidelines for selecting control parameters. Through extensive simulations, we demonstrate the ability of Q-SAPI in controlling queue length in both transient and steady states. Q-SAPI achieves this by adapting the controller gains according to the queue length.

Several active queue management (AQM) mechanisms have been proposed in the literature to provide better support for congestion control. However, their performance is examined mainly in best-effort networks. In this paper, we present an empirical study of the effects of AQM mechanisms on the performance of the Assured Forwarding (AF) Service in the non-oversubscribed Differentiated Services networks. The AQM mechanisms to be studied include some existing mechanisms and a new AQM scheme, proposed in this paper. The study is carried out in the cases of the standard traffic conditioner and intelligent traffic conditioners. Extensive simulation results show: (i) when the standard traffic conditioner is employed at the ingress routers, the transient and steady-state behaviors of an AQM scheme in controlling the queue length not only affect the achievement of bandwidth assurance, but also affect the attainment of excessive bandwidth and link throughput; (ii) the behaviors of an AQM affect the ability of an intelligent traffic conditioner in improving bandwidth assurance; (iii) self-tuning AQM schemes perform better than AQMs with fixed-gains in terms of the achievement of bandwidth assurance and link throughput.

The assured forwarding (AF) based service in a differentiated services (DiffServ) network fails to provide bandwidth assurance among competing aggregates under certain conditions, for example, where there exists a large disparity in the round-trip times, packet sizes, or target rates of the aggregates, or there exist non-adaptive aggregates. Several mechanisms have been proposed in order to address the problem of providing bandwidth assurance for aggregates, using only the knowledge gathered at ingress routers. In this paper, we present a control theoretic approach to analyze these mechanisms and explore the reasons when they fail to achieve bandwidth assurance under some circumstances. Then we propose a simple but robust controller for this problem, namely, the variable-structure adaptive CIR threshold (VS-ACT) mechanism. We validate the analysis and demonstrate that VS-ACT outperforms several other mechanisms proposed in the literature over a wide range of network dynamics through extensive simulations.