Search

Ransomware is considered as a significant threat for most enterprises since the past few years. In scenarios wherein users can access all files on a shared server, one infected host can lock the access to all shared files. We propose a tool to detect ransomware infection based on file-sharing traffic analysis. The tool monitors the traffic exchanged between the clients and the file servers and using machine learning techniques it searches for patterns in the traffic that betray ransomware actions while reading and overwriting files. The proposal is designed to work for clear text and for encrypted file-sharing protocols. We compare three machine learning models and choose the best for validation. We train and test the detection model using more than 70 ransomware binaries from 26 different strains and more than 2500 hours of not infected traffic from real users. The results reveal that the proposed tool can detect all ransomware binaries, including those not used in training phase (unseen). This paper provides a validation of the algorithm by studying the false positive rate and the amount of information from user files that the ransomware could encrypt before being detected., Comment: 26 pages, 9 figures

This paper describes the Swapped Dragonfly. It is a two-parameter family of diameter three interconnection networks, D3(K,M), which are linearly scalable in M. Although D3(K,M) is a Dragonfly, it differs from standard Dragonflies in many respects. It has a K by M by M coordinate system (c;d; p). The routers (c,d,p) and (c',p,d) are globally connected using a swap of p and d. If L < K and/or N < M, D3(K;M) contains D3(L,N). The coordinate system enables source vector routing on D3(K,M). A source-vector induces KM squared parallel paths on D3(K,M). Because of this, the Swapped Dragonfly can support conflict-free parallelism over local ports, global ports, routers and source-vectors. In particular, there is an all-to-all algorithm which is not a pairwise exchange algorithm. Keywords: interconnection network, Dragonfly network, swapped network, source-vector routing, all-to-all exchange, Comment: 20 pages 3 figures

Although 5G (Fifth Generation) mobile technology is still in the rollout phase, research and development of 6G (Sixth Generation) wireless have already begun. This paper is an introduction to 6G wireless networks, covering the main drivers for 6G, some of the expected use cases, some of the technical challenges in 6G, example areas that will require research and new technologies, the expected timeline for 6G development and rollout, and a list of some important 6G initiatives world-wide. It was compiled as part of a series of workshops about 6G held by Thinknet 6G and MUENCHNER KREIS in 2021., Comment: 6 pages, 3 figures, document also available in German, document available in a more attractive format, here: www.thinknet-6g.de

Modern vehicles, including autonomous vehicles and connected vehicles, are increasingly connected to the external world, which enables various functionalities and services. However, the improving connectivity also increases the attack surfaces of the Internet of Vehicles (IoV), causing its vulnerabilities to cyber-threats. Due to the lack of authentication and encryption procedures in vehicular networks, Intrusion Detection Systems (IDSs) are essential approaches to protect modern vehicle systems from network attacks. In this paper, a transfer learning and ensemble learning-based IDS is proposed for IoV systems using convolutional neural networks (CNNs) and hyper-parameter optimization techniques. In the experiments, the proposed IDS has demonstrated over 99.25% detection rates and F1-scores on two well-known public benchmark IoV security datasets: the Car-Hacking dataset and the CICIDS2017 dataset. This shows the effectiveness of the proposed IDS for cyber-attack detection in both intra-vehicle and external vehicular networks., Comment: Accepted and to appear in IEEE International Conference on Communications (ICC); Code is available at Github link: https://github.com/Western-OC2-Lab/Intrusion-Detection-System-Using-CNN-and-Transfer-Learning

Event processing is the cornerstone of the dynamic and responsive Internet of Things (IoT). Recent approaches in this area are based on representational state transfer (REST) principles, which allow event processing tasks to be placed at any device that follows the same principles. However, the tasks should be properly distributed among edge devices to ensure fair resources utilization and guarantee seamless execution. This article investigates the use of deep learning to fairly distribute the tasks. An attention-based neural network model is proposed to generate efficient load balancing solutions under different scenarios. The proposed model is based on the Transformer and Pointer Network architectures, and is trained by an advantage actor-critic reinforcement learning algorithm. The model is designed to scale to the number of event processing tasks and the number of edge devices, with no need for hyperparameters re-tuning or even retraining. Extensive experimental results show that the proposed model outperforms conventional heuristics in many key performance indicators. The generic design and the obtained results show that the proposed model can potentially be applied to several other load balancing problem variations, which makes the proposal an attractive option to be used in real-world scenarios due to its scalability and efficiency., Comment: 19 pages, 6 figures

This paper proposes a cascade blockage model for analyzing the vision that a user has of a wireless network. This model, inspired by the classical multiplicative cascade models, has a radial structure meant to analyze blockages seen by the receiver at the origin in different angular sectors. The main novelty is that it is based on the geometry of obstacles and takes the joint blockage phenomenon into account. We show on a couple of simple instances that the Laplace transforms of total interference satisfies a functional equation that can be solved efficiently by an iterative scheme. This is used to analyze the coverage probability of the receiver and the effect of blockage correlation and penetration loss in both dense and sparse blockage environments. Furthermore, this model is used to investigate the effect of blockage correlation on user beamforming techniques. Another functional equation and its associated iterative algorithm are proposed to derive the coverage performance of the best beam selection in this context. In addition, the conditional coverage probability is also derived to evaluate the effect of beam switching. The results not only show that beam selection is quite efficient for multi-beam terminals, but also show how the correlation brought by blockages can be leveraged to accelerate beam sweeping and pairing.

Many common ``consumer'' applications, i.e., applications widely used by non-technical users, are now provided by a very small number of companies, even if that set of companies differ across geographic regions, or rely on a very small number of implementations even if the applications are largely standards-based. While likely only a partial solution, we can draw on earlier regulatory experiences to facilitate competition or at least lessen the impact of the lack thereof., Comment: Interdisciplinary Workshop on (de) Centralization in the Internet (IWCI'21), December 7, 2021

The internet has become a critical communications infrastructure, and access is among the ``assets, systems, and networks, whether physical or virtual, [that] are considered so vital to the United States that their incapacitation or destruction would have a debilitating effect on security, national economic security, national public health or safety, or any combination thereof.'' [CISA] But the internet is more than an issue for the nation as a whole. Internet access affects the security, health, safety, and opportunities in life for individuals and communities, and the economic vitality of businesses everywhere. On the one hand, the COVID-19 pandemic has revealed the success of broadband access in allowing society to function, even during lockdowns. On the other hand, the pandemic has exposed weak, unreliable, or even nonexistent, broadband access and usability in many areas and for many individuals, including especially rural residents and children in many school districts, urban, and rural, as well as a compelling need for universal reach and affordability. It was thus timely that in November 2020, the National Science Foundation (NSF) sponsored a series of workshops to identify new research areas to drive the broadband NSF agenda for the next five years. This request followed similar initiatives during the past twenty years, the most recent in 2016. This Broadband Research Workshop Report of 2021 discusses the research questions and challenges that need to be addressed to provide robust, affordable, and meaningful broadband access to every resident of the United States.

We study age-agnostic scheduling in a non-preemptive status update system with two sources sending time-stamped information packets at random instances to a common monitor through a single server. The server is equipped with a waiting room holding the freshest packet from each source called "single-buffer per-source queueing". The server is assumed to be work-conserving and when the waiting room has two waiting packets (one from each source), a probabilistic scheduling policy is applied so as to provide Age of Information (AoI) differentiation for the two sources of interest. Assuming Poisson packet arrivals and exponentially distributed service times, the exact distributions of AoI and also Peak AoI (PAoI) for each source are first obtained. Subsequently, this analytical tool is used to numerically obtain the optimum probabilistic scheduling policy so as to minimize the weighted average AoI/PAoI by means of which differentiation can be achieved between the two sources. In addition, a pair of heuristic age-agnostic schedulers are proposed on the basis of heavy-traffic analysis and comparatively evaluated in a wide variety of scenarios, and guidelines are provided for scheduling and AoI differentiation in status update systems with two sources., Comment: 14 pages, 7 figures, 2 tables

Packet replication and elimination functions are used by time-sensitive networks (as in the context of IEEE TSN and IETF DetNet) to increase the reliability of the network. Packets are replicated onto redundant paths by a replication function. Later the paths merge again and an elimination function removes the duplicates. This redundancy scheme has an effect on the timing behavior of time-sensitive networks and many challenges arise from conducting timing analyses. The replication can induce a burstiness increase along the paths of replicates, as well as packet mis-ordering that could increase the delays in the crossed bridges or routers. The induced packet mis-ordering could also negatively affect the interactions between the redundancy and scheduling mechanisms such as traffic regulators (as with per-flow regulators and interleaved regulators, implemented by TSN asynchronous traffic shaping). Using the network calculus framework, we provide a method of worst-case timing analysis for time-sensitive networks that implement redundancy mechanisms in the general use case, i.e., at end-devices and/or intermediate nodes. We first provide a network calculus toolbox for bounding the burstiness increase and the amount of reordering caused by the elimination function of duplicate packets. We then analyze the interactions with traffic regulators and show that their shaping-for-free property does not hold when placed after a packet elimination function. We provide a bound for the delay penalty when using per-flow regulators and prove that the penalty is not bounded with interleaved regulators. Finally, we use an industrial use-case to show the applicability and the benefits of our findings., Comment: published

Radio Frequency Identification (RFID) systems are among the most widespread computing technologies with technical potential and profitable opportunities in numerous applications worldwide. Further, RFID is the core technology behind the Internet of Things (IoT), which can accomplish the real-time transmission of information between objects without manual operation. However, RFID security has been taken for granted for several years, causing multiple vulnerabilities that can even damage human functionalities. The latest ISO/IEC 18000-63:2015 standard concerning RFID dates to 2015, and much freedom has been given to manufacturers responsible for making their devices secure. The lack of a substantial standard for devices that implement RFID technology creates many vulnerabilities that expose end-users to elevated risk. Hence, this paper gives the reader a clear overview of the technology, and it analyzes 23 well-known RFID attacks such as Reverse Engineering, Buffer Overflow, Eavesdropping, and Malware. Moreover, given the exceptional capabilities and utilities of RFID devices, this paper has focused on security measures and defenses for protecting them, such as Active Jamming, Shielding tag, and Authentication., Comment: 9 pages, 4 figures

The rapid development in the field of System of Chip (SoC) technology, Internet of Things (IoT), cloud computing, and artificial intelligence has brought more possibilities of improving and solving the current problems. With data analytics and the use of machine learning/deep learning, it is made possible to learn the underlying patterns and make decisions based on what was learned from massive data generated from IoT sensors. When combined with cloud computing, the whole pipeline can be automated, and free of manual controls and operations. In this paper, an implementation of an automated data engineering pipeline for anomaly detection of IoT sensor data is studied and proposed. The process involves the use of IoT sensors, Raspberry Pis, Amazon Web Services (AWS) and multiple machine learning techniques with the intent to identify anomalous cases for the smart home security system.

As the number of Internet of Things (IoT) devices and systems have surged, IoT data analytics techniques have been developed to detect malicious cyber-attacks and secure IoT systems; however, concept drift issues often occur in IoT data analytics, as IoT data is often dynamic data streams that change over time, causing model degradation and attack detection failure. This is because traditional data analytics models are static models that cannot adapt to data distribution changes. In this paper, we propose a Performance Weighted Probability Averaging Ensemble (PWPAE) framework for drift adaptive IoT anomaly detection through IoT data stream analytics. Experiments on two public datasets show the effectiveness of our proposed PWPAE method compared against state-of-the-art methods., Comment: Accepted and to appear in IEEE GlobeCom 2021; Code is available at Github link: https://github.com/Western-OC2-Lab/PWPAE-Concept-Drift-Detection-and-Adaptation

We consider the problem of video caching across a set of 5G small-cell base stations (SBS) connected to each other over a high-capacity short-delay back-haul link, and linked to a remote server over a long-delay connection. Even though the problem of minimizing the overall video delivery delay is NP-hard, the Collaborative Caching Algorithm (CCA) that we present can efficiently compute a solution close to the optimal, where the degree of sub-optimality depends on the worst case video-to-cache size ratio. The algorithm is naturally amenable to distributed implementation that requires zero explicit coordination between the SBSs, and runs in $O(N + K \log K)$ time, where $N$ is the number of SBSs (caches) and $K$ the maximum number of videos. We extend CCA to an online setting where the video popularities are not known a priori but are estimated over time through a limited amount of periodic information sharing between SBSs. We demonstrate that our algorithm closely approaches the optimal integral caching solution as the cache size increases. Moreover, via simulations carried out on real video access traces, we show that our algorithm effectively uses the SBS caches to reduce the video delivery delay and conserve the remote server's bandwidth, and that it outperforms two other reference caching methods adapted to our system setting., Comment: 11 pages, 10 figures, WiOpt 2021

The rapidly increasing number of smart devices on the Internet necessitates an efficient inspection system for safeguarding our networks from suspicious activities such as Address Resolution Protocol (ARP) probes. In this research, we analyze sequence data of ARP traffic on LAN based on the numerical count and degree of its packets. Moreover, a dynamic threshold is employed to detect underlying suspicious activities, which are further converted into feature vectors to train an unsupervised autoencoder neural network. Then, we leverage K-means clustering to separate the extracted latent features of suspicious activities from the autoencoder into various patterns. Besides, to evaluate the performance, we collect and adopt a real-world network traffic dataset from five different LANs. At last, we successfully detect suspicious ARP patterns varying in scale, lifespan, and regularity on the LANs., Comment: 5 pages, 7 figures, submitted to 2022 IEEE Consumer Communications & Networking Conference

Content delivery networks (CDNs) provide efficient content distribution over the Internet. CDNs improve the connectivity and efficiency of global communications, but their caching mechanisms may be breached by cyber-attackers. Among the security mechanisms, effective anomaly detection forms an important part of CDN security enhancement. In this work, we propose a multi-perspective unsupervised learning framework for anomaly detection in CDNs. In the proposed framework, a multi-perspective feature engineering approach, an optimized unsupervised anomaly detection model that utilizes an isolation forest and a Gaussian mixture model, and a multi-perspective validation method, are developed to detect abnormal behaviors in CDNs mainly from the client Internet Protocol (IP) and node perspectives, therefore to identify the denial of service (DoS) and cache pollution attack (CPA) patterns. Experimental results are presented based on the analytics of eight days of real-world CDN log data provided by a major CDN operator. Through experiments, the abnormal contents, compromised nodes, malicious IPs, as well as their corresponding attack types, are identified effectively by the proposed framework and validated by multiple cybersecurity experts. This shows the effectiveness of the proposed method when applied to real-world CDN data., Comment: Accepted and to Appear in IEEE Transactions on Network and Service Management

Manufacturer Usage Description (MUD) is an Internet Engineering Task Force (IETF) standard designed to protect IoT devices and networks by creating an out-of-the-box access control list for an IoT device. %The protocol defines a conceptually straightforward method to implement an isolation-based defensive mechanism based on the rules that are introduced by the manufacturer of the device. However, in practice, the access control list of each device is defined in its MUD-File and may contain possibly hundreds of access control rules. As a result, reading and validating these files is a challenge; and determining how multiple IoT devices interact is difficult for the developer and infeasible for the consumer. To address this we introduce the MUD-Visualizer to provide a visualization of any number of MUD-Files. MUD-Visualizer is designed to enable developers to produce correct MUD-Files by providing format correction, integrating them with other MUD-Files, and identifying conflicts through visualization. MUD-Visualizer is scalable and its core task is to merge and illustrate ACEs for multiple devices; both within and beyond the local area network. MUD-Visualizer is made publicly available and can be found on GitHub., Comment: 22 pages, 6 figures, 3 algorithms, To be published in 5th EAI International Conference on Safety and Security in Internet of Things (SaSeIoT)

Several encryption proposals for DNS have been presented since 2016, but their adoption was not comprehensively studied yet. This research measured the current adoption of DoH (DNS over HTTPS), DoT (DNS over TLS), and DoQ (DNS over QUIC) for five months at the beginning of 2021 by three different organizations with global coverage. By comparing the total values, amount of requests per user, and the seasonality of the traffic, it was possible to obtain the current adoption trends. Moreover, we actively scanned the Internet for still-unknown working DoH servers and we compared them with a novel curated list of well-known DoH servers. We conclude that despite growing in 2020, during the first five months of 2021 there was statistically significant evidence that the average amount of Internet traffic for DoH, DoT and DoQ remained stationary. However, we found that the amount of, still unknown and ready to use, DoH servers grew 4 times. These measurements suggest that even though the amount of encrypted DNS is currently not growing, there may probably be more connections soon to those unknown DoH servers for benign and malicious purposes., Comment: 16 pages, 10 figures

Global System for Mobile Communications (GSM) is a cellular network that is popular and has been growing in recent years. It was developed to solve fragmentation issues of the first cellular system, and it addresses digital modulation methods, level of the network structure, and services. It is fundamental for organizations to become learning organizations to keep up with the technology changes for network services to be at a competitive level. A simulation analysis using the NetSim tool in this paper is presented for comparing different cellular network codecs for GSM network performance. These parameters such as throughput, delay, and jitter are analyzed for the quality of service provided by each network codec. Unicast application for the cellular network is modeled for different network scenarios. Depending on the evaluation and simulation, it was discovered that G.711, GSM_FR, and GSM-EFR performed better than the other codecs, and they are considered to be the best codecs for cellular networks. These codecs will be of best use to better the performance of the network in the near future.

The present paper shows a proposal of the characteristics Cloud Risk Assessment Models should have and presents the review of the literature considering those characteristics in order to identify current gaps. This work shows a ranking of Cloud RA models and their degree of compliance with the theoretical reference Cloud Risk Assessment model. The review of literature shows that RA approaches leveraging CSA (Cloud Security Alliance) STAR Registry that have into account organizations security requirements present higher degree of compliance, but they still lack risk economic quantification. The myriad of conceptual models, methodologies and frameworks although based on current NIST SP 800:30, ISO 27001, ISO 27005, ISO 30001, ENISA standards could be enhanced by the use of techno-economic models like UTEM, created by the author, in order to conceive more simplified models for effective Risk Assessment and Mitigation closer to the theoretical reference model for Cloud Risk Assessment, available for all cloud models (IaaS, PaaS, SaaS) and easy to use for all stakeholders., Comment: 12 pages, 5 figures, 2 tables

Modern vehicles, including connected vehicles and autonomous vehicles, nowadays involve many electronic control units connected through intra-vehicle networks to implement various functionalities and perform actions. Modern vehicles are also connected to external networks through vehicle-to-everything technologies, enabling their communications with other vehicles, infrastructures, and smart devices. However, the improving functionality and connectivity of modern vehicles also increase their vulnerabilities to cyber-attacks targeting both intra-vehicle and external networks due to the large attack surfaces. To secure vehicular networks, many researchers have focused on developing intrusion detection systems (IDSs) that capitalize on machine learning methods to detect malicious cyber-attacks. In this paper, the vulnerabilities of intra-vehicle and external networks are discussed, and a multi-tiered hybrid IDS that incorporates a signature-based IDS and an anomaly-based IDS is proposed to detect both known and unknown attacks on vehicular networks. Experimental results illustrate that the proposed system can detect various types of known attacks with 99.99% accuracy on the CAN-intrusion-dataset representing the intra-vehicle network data and 99.88% accuracy on the CICIDS2017 dataset illustrating the external vehicular network data. For the zero-day attack detection, the proposed system achieves high F1-scores of 0.963 and 0.800 on the above two datasets, respectively. The average processing time of each data packet on a vehicle-level machine is less than 0.6 ms, which shows the feasibility of implementing the proposed system in real-time vehicle systems. This emphasizes the effectiveness and efficiency of the proposed IDS., Comment: Accepted and to appear in IEEE Internet of Things Journal; Code is available at Github link: https://github.com/Western-OC2-Lab/Intrusion-Detection-System-Using-Machine-Learning

High-performance computing (HPC) researchers have long envisioned scenarios where application workflows could be improved through the use of programmable processing elements embedded in the network fabric. Recently, vendors have introduced programmable Smart Network Interface Cards (SmartNICs) that enable computations to be offloaded to the edge of the network. There is great interest in both the HPC and high-performance data analytics communities in understanding the roles these devices may play in the data paths of upcoming systems. This paper focuses on characterizing both the networking and computing aspects of NVIDIA's new BlueField-2 SmartNIC when used in an Ethernet environment. For the networking evaluation we conducted multiple transfer experiments between processors located at the host, the SmartNIC, and a remote host. These tests illuminate how much processing headroom is available on the SmartNIC during transfers. For the computing evaluation we used the stress-ng benchmark to compare the BlueField-2 to other servers and place realistic bounds on the types of offload operations that are appropriate for the hardware. Our findings from this work indicate that while the BlueField-2 provides a flexible means of processing data at the network's edge, great care must be taken to not overwhelm the hardware. While the host can easily saturate the network link, the SmartNIC's embedded processors may not have enough computing resources to sustain more than half the expected bandwidth when using kernel-space packet processing. From a computational perspective, encryption operations, memory operations under contention, and on-card IPC operations on the SmartNIC perform significantly better than the general-purpose servers used for comparisons in our experiments. Therefore, applications that mainly focus on these operations may be good candidates for offloading to the SmartNIC., Comment: 13 pages, 8 figures, 4 tables

This paper proposes a new event-based parameter switching method for the control tasks of cybersecurity in the context of preventive and reactive cyber defense dynamics. Our parameter switching method helps avoid excessive control costs as well as guarantees the dynamics to converge as our desired speed. Meanwhile, it can be proved that this approach is Zeno-free. A new estimation method with adaptive time windows is used to bridge the gap between the probability state and the sampling state. With the new estimation method, several practical experiments are given afterwards., Comment: 21 pages, 10 figures, 1 algorithm. may be submitted to SciSec Conference

This paper proposes the characteristics a techno-economic model for 5G should have considering both mobile network operators perspective and end users needs. It also presents a review and classification of models in the literature based on the characteristics of such theoretical techno-economic reference model. The performed analysis identifies current gaps in the techno-economic modeling literature for 5G architectures and shows it can be enhanced using agile techno-economic models like the Universal Techno-Economic Model (UTEM) created and developed by the author to industrialize assessment of different technological solutions, considering all market players perspectives and applicable to decision-making in multiple domains. This model can be used for an effective and agile 5G techno-economic assessment, including not only network deployment perspective but also customers and end users requirements as well as other stakeholders to select the most adequate 5G architectural solution considering both technical and economic feasibility. UTEM model is currently available for all industry stakeholders under specific license of use., Comment: 12 pages, 4 figures, 1 table

Advances in computing have resulted in an emerging need for multi-factor authentication using an amalgamation of cryptographic and physical keys. This letter presents a novel authentication approach using a combination of signal and antenna activation sequences, and most importantly, perturbed antenna array geometries. Possible degrees of freedom in perturbing antenna array geometries affected physical properties and their detection are presented. Channel estimation for the plurality of validly authorized arrays is discussed. Accuracy is investigated as a function of signal-to-noise ratio (SNR) and number of authorized arrays. It is observed that the proposed authentication scheme can provide 1% false authentication rate at 10 dB SNR, while it is achieving less than 1% missed authentication rates., Comment: in IEEE Communications Letters

Secure Device-to-Device (D2D) communication is becoming increasingly important with the ever-growing number of Internet-of-Things (IoT) devices in our daily life. To achieve secure D2D communication, the key agreement between different IoT devices without any prior knowledge is becoming desirable. Although various approaches have been proposed in the literature, they suffer from a number of limitations, such as low key generation rate and short pairing distance. In this paper, we present InaudibleKey, an inaudible acoustic signal-based key generation protocol for mobile devices. Based on acoustic channel reciprocity, InaudibleKey exploits the acoustic channel frequency response of two legitimate devices as a common secret to generating keys. InaudibleKey employs several novel technologies to significantly improve its performance. We conduct extensive experiments to evaluate the proposed system in different real environments. Compared to state-of-the-art works, InaudibleKey improves key generation rate by 3-145 times, extends pairing distance by 3.2-44 times, and reduces information reconciliation counts by 2.5-16 times. Security analysis demonstrates that InaudibleKey is resilient to a number of malicious attacks. We also implement InaudibleKey on modern smartphones and resource-limited IoT devices. Results show that it is energy-efficient and can run on both powerful and resource-limited IoT devices without incurring excessive resource consumption., Comment: 13 pages, 11 figures, IPSN 2021

Similarity caching systems have recently attracted the attention of the scientific community, as they can be profitably used in many application contexts, like multimedia retrieval, advertising, object recognition, recommender systems and online content-match applications. In such systems, a user request for an object $o$, which is not in the cache, can be (partially) satisfied by a similar stored object $o$', at the cost of a loss of user utility. In this paper we make a first step into the novel area of similarity caching networks, where requests can be forwarded along a path of caches to get the best efficiency-accuracy tradeoff. The offline problem of content placement can be easily shown to be NP-hard, while different polynomial algorithms can be devised to approach the optimal solution in discrete cases. As the content space grows large, we propose a continuous problem formulation whose solution exhibits a simple structure in a class of tree topologies. We verify our findings using synthetic and realistic request traces.

Trigger-action programming (TAP) is a popular end-user programming framework that can simplify the Internet of Things (IoT) automation with simple trigger-action rules. However, it also introduces new security and safety threats. A lot of advanced techniques have been proposed to address this problem. Rigorously reasoning about the security of a TAP-based IoT system requires a well-defined model and verification method both against rule semantics and physical-world features, e.g., concurrency, rule latency, extended action, tardy attributes, and connection-based rule interactions, which has been missing until now. By analyzing these features, we find 9 new types of rule interaction vulnerabilities and validate them on two commercial IoT platforms. We then present TAPInspector, a novel system to detect these interaction vulnerabilities in concurrent TAP-based IoT systems. It automatically extracts TAP rules from IoT apps, translates them into a hybrid model by model slicing and state compression, and performs semantic analysis and model checking with various safety and liveness properties. Our experiments corroborate that TAPInspector is practical: it identifies 533 violations related to rule interaction from 1108 real-world market IoT apps and is at least 60000 times faster than the baseline without optimization.

To support faster and more efficient networks, mobile operators and service providers are bringing 5G millimeter wave (mmWave) networks indoors. However, due to their high directionality, mmWave links are extremely vulnerable to blockage by walls and human mobility. To address these challenges, we exploit advances in artificially engineered metamaterials, introducing a wall-mounted smart metasurface, called mmWall, that enables a fast mmWave beam relay through the wall and redirects the beam power to another direction when a human body blocks a line-of-sight path. Moreover, our mmWall supports multiple users and fast beam alignment by generating multi-armed beams. We sketch the design of a real-time system by considering (1) how to design a programmable, metamaterial-based surface that refracts the incoming signal to one or more arbitrary directions, and (2) how to split an incoming mmWave beam into multiple outgoing beams and arbitrarily control the beam energy between these beams. Preliminary results show the mmWall metasurface steers the outgoing beam in a full 360-degrees, with an 89.8% single-beam efficiency and 74.5% double-beam efficiency., Comment: 7 pages, 7 figures, The paper will be published in HotMobile'21

Detecting covert channels among legitimate traffic represents a severe challenge due to the high heterogeneity of networks. Therefore, we propose an effective covert channel detection method, based on the analysis of DNS network data passively extracted from a network monitoring system. The framework is based on a machine learning module and on the extraction of specific anomaly indicators able to describe the problem at hand. The contribution of this paper is two-fold: (i) the machine learning models encompass network profiles tailored to the network users, and not to the single query events, hence allowing for the creation of behavioral profiles and spotting possible deviations from the normal baseline; (ii) models are created in an unsupervised mode, thus allowing for the identification of zero-days attacks and avoiding the requirement of signatures or heuristics for new variants. The proposed solution has been evaluated over a 15-day-long experimental session with the injection of traffic that covers the most relevant exfiltration and tunneling attacks: all the malicious variants were detected, while producing a low false-positive rate during the same period., Comment: This is a pre-print of an article published in the proceedings of 14th International Conference on Malicious and Unwanted Software (MALWARE), 2019

The coexistence of different wireless communication systems such as LTE and Wi-Fi by sharing the unlicensed band is well studied in the literature. In these studies, various methods are proposed to support the coexistence of systems, including listen-before-talk mechanism, joint user association and resource allocation. However, in this study, the coexistence of different waveform structures in the same resource elements are studied under the theory of non-orthogonal multiple access. This study introduces a paradigm-shift on NOMA towards the application-centric waveform coexistence. Throughout the paper, the coexistence of different waveforms is explained with two specific use cases, which are power-balanced NOMA and joint radar-sensing and communication with NOMA. In addition, some of the previous works in the literature regarding non-orthogonal waveform coexistence are reviewed. However, the concept is not limited to these use cases. With the rapid development of wireless technology, next-generation wireless systems are proposed to be flexible and hybrid, having different kinds of capabilities such as sensing, security, intelligence, control, and computing. Therefore, the concept of different waveforms' coexistence to meet these concerns are becoming impressive for researchers., Comment: Submitted to IEEE for possible publication. arXiv admin note: text overlap with arXiv:2007.05753, arXiv:2003.05548

Ransomware is a kind of malware using cryptographic mechanisms to prevent victims from normal use of their computers. As a result, victims lose the access to their files and desktops unless they pay the ransom to the attackers. By the end of 2019, ransomware attack had caused more than 10 billion dollars of financial loss to enterprises and individuals. In this work, we propose Network-Assisted Approach (NAA), which contains effective local detection and network-level detection mechanisms, to help users determine whether a machine has been infected by ransomware. To evaluate its performance, we built 100 containers in Docker to simulate network scenarios. A hybrid ransomware sample which is close to real-world ransomware is deployed on stimulative infected machines. The experiment results show that our network-level detection mechanisms are separately applicable to WAN and LAN environments for ransomware detection., Comment: 15 pages

Machine learning algorithms have been used widely in various applications and areas. To fit a machine learning model into different problems, its hyper-parameters must be tuned. Selecting the best hyper-parameter configuration for machine learning models has a direct impact on the model's performance. It often requires deep knowledge of machine learning algorithms and appropriate hyper-parameter optimization techniques. Although several automatic optimization techniques exist, they have different strengths and drawbacks when applied to different types of problems. In this paper, optimizing the hyper-parameters of common machine learning models is studied. We introduce several state-of-the-art optimization techniques and discuss how to apply them to machine learning algorithms. Many available libraries and frameworks developed for hyper-parameter optimization problems are provided, and some open challenges of hyper-parameter optimization research are also discussed in this paper. Moreover, experiments are conducted on benchmark datasets to compare the performance of different optimization methods and provide practical examples of hyper-parameter optimization. This survey paper will help industrial users, data analysts, and researchers to better develop machine learning models by identifying the proper hyper-parameter configurations effectively., Comment: Published in Neurocomputing (Elsevier's journal, Q1, IF: 5.779). Tutorial code has got 1000+ stars. Github link: https://github.com/LiYangHart/Hyperparameter-Optimization-of-Machine-Learning-Algorithms

The problem of MPI programs execution time prediction on a certain set of computer installations is considered. This problem emerges with orchestration and provisioning a virtual infrastructure in a cloud computing environment over a heterogeneous network of computer installations: supercomputers or clusters of servers (e.g. mini data centers). One of the key criteria for the effectiveness of the cloud computing environment is the time staying by the program inside the environment. This time consists of the waiting time in the queue and the execution time on the selected physical computer installation, to which the computational resource of the virtual infrastructure is dynamically mapped. One of the components of this problem is the estimation of the MPI programs execution time on a certain set of computer installations. This is necessary to determine a proper choice of order and place for program execution. The article proposes two new approaches to the program execution time prediction problem. The first one is based on computer installations grouping based on the Pearson correlation coefficient. The second one is based on vector representations of computer installations and MPI programs, so-called embeddings. The embedding technique is actively used in recommendation systems, such as for goods (Amazon), for articles (Arxiv.org), for videos (YouTube, Netflix). The article shows how the embeddings technique helps to predict the execution time of a MPI program on a certain set of computer installations.

Coexistence between cellular systems and Wi-Fi gained the attention of the research community when LTE License Assisted Access (LAA) entered the unlicensed band. The recent introduction of NR-U as part of 5G introduces new coexistence opportunities because it implements scalable numerology (flexible subcarrier spacing and OFDM symbol lengths), and non-slot based scheduling (mini-slots), which considerably impact channel access. This paper analyzes the impact of NR-U settings on its coexistence with Wi-Fi networks and compares it with LAA operation using simulations and experiments. First, we propose a downlink channel access simulation model, which addresses the problem of the dependency and non-uniformity of transmission attempts of different nodes, as a result of the synchronization mechanism introduced by NR-U. Second, we validate the accuracy of the proposed model using FPGA-based LAA, NR-U, and Wi-Fi prototypes with over-the-air transmissions. Additionally, we show that replacing LAA with NR-U would not only allow to overcome the problem of bandwidth wastage caused by reservation signals but also, in some cases, to preserve fairness in channel access for both scheduled and random-access systems. Finally, we conclude that fair coexistence of the aforementioned systems in unlicensed bands is not guaranteed in general, and novel mechanisms are necessary for improving the sharing of resources between scheduled and contention-based technologies., Comment: 20 double-column single-spaced pages, 10 figures, 3 tables, 39 references, journal submission

This doctoral dissertation shows State of the Art of techno-economic modeling for access network technologies, presents the characteristics a universal techno-economic model should have, and shows a classification and analysis of techno-economic models in the literature based on such characteristics. In order to reduce the gap detected in the literature, the author defines and develops a Universal Techno-Economic Model called UTEM and the corresponding methodology to industrialize techno-economic assessment in multiple domains considering all market players perspectives, also suitable for technological consulting and currently available for all industry stakeholders under specific license of use., Comment: 188 pages, 30 figures, 56 tables, PhD Thesis, delivered in Dec. 2015, defended in Feb. 2016. Confidential chapters 3 and 4 excluded. English Translation. Original in Spanish available at University of the Basque Country official repository: https://addi.ehu.es/handle/10810/24669 *Total Spanish + English versions: 382 pages in arXiv: 2008.07286v3

In this study, a novel transmission scheme is proposed to serve radar-sensing and communication objectives at the same time and allocated bandwidth. The proposed transmitted frame non-orthogonally superimposes two different waveforms, which are frequency modulated continuous-wave (FMCW) for radar-sensing and orthogonal frequency division multiplexing (OFDM) for communication. Also, the receiver scheme that performs channel estimation via radar-sensing functionality without degrading data rate of communication operation is introduced. As numerically evaluated, the proposed system achieves good sensing accuracy even if the signal-to-noise ratio (SNR) is low, and communication performance is only 0.6 dB less at the target bit-error rate (BER) of 1% compared to the assumption of perfect channel state information (CSI) without any pilot overhead over OFDM subcarriers., Comment: Accepted for presentation in VTC 2020 Fall Workshop

Collective communications, namely the patterns allgatherv, reduce_scatter, and allreduce in message-passing systems are optimised based on measurements at the installation time of the library. The algorithms used are set up in an initialisation phase of the communication, similar to the method used in so-called persistent collective communication introduced in the literature. For allgatherv and reduce_scatter the existing algorithms, recursive multiply/divide and cyclic shift (Bruck's algorithm) are applied with a flexible number of communication ports per node. The algorithms for equal message sizes are used with non-equal message sizes together with a heuristic for rank reordering. The two communication patterns are applied in a plasma physics application that uses a specialised matrix-vector multiplication. For the allreduce pattern the cyclic shift algorithm is applied with a prefix operation. The data is gathered and scattered by the cores within the node and the communication algorithms are applied across the nodes. In general our routines outperform the non-persistent counterparts in established MPI libraries by up to one order of magnitude or show equal performance, with a few exceptions of number of nodes and message sizes., Comment: accepted at PASC 2020/2021 conference as a poster

This article shows State of the Art of techno-economic modeling for access network technologies, presents the characteristics a universal techno-economic model should have, and shows a classification and analysis of techno-economic models in the literature based on such characteristics. As a result of his research in this direction, the author created and developed a Universal Techno-Economic Model and the corresponding methodology for techno-economic assessment in multiple domains, currently available for industry stakeholders under specific licence of use., Comment: 12 pages, 1 figure, 4 tables

When training a machine learning model, it is standard procedure for the researcher to have full knowledge of both the data and model. However, this engenders a lack of trust between data owners and data scientists. Data owners are justifiably reluctant to relinquish control of private information to third parties. Privacy-preserving techniques distribute computation in order to ensure that data remains in the control of the owner while learning takes place. However, architectures distributed amongst multiple agents introduce an entirely new set of security and trust complications. These include data poisoning and model theft. This paper outlines a distributed infrastructure which is used to facilitate peer-to-peer trust between distributed agents; collaboratively performing a privacy-preserving workflow. Our outlined prototype sets industry gatekeepers and governance bodies as credential issuers. Before participating in the distributed learning workflow, malicious actors must first negotiate valid credentials. We detail a proof of concept using Hyperledger Aries, Decentralised Identifiers (DIDs) and Verifiable Credentials (VCs) to establish a distributed trust architecture during a privacy-preserving machine learning experiment. Specifically, we utilise secure and authenticated DID communication channels in order to facilitate a federated learning workflow related to mental health care data., Comment: To be published in the proceedings of the 17th International Conference on Trust, Privacy and Security in Digital Business - TrustBus2020

Standardized interfaces are the connecting link of today's distributed systems, facilitating access to data services in the cloud. REST APIs have been prevalent over the last years, despite several issues like over- and underfetching of resources. GraphQL enjoys rapid adoption, resolving these problems by using statically typed queries. However, the redevelopment of services to the new paradigm is costly. Therefore, several approaches for the successive migration from REST to GraphQL have been proposed, many leveraging OpenAPI service descriptions. In this article, we present the findings of our empirical evaluation on the APIs.guru directory and identify several schema translation challenges. These include less expressive schema types in GraphQL, as well as missing meta information about related resources in OpenAPI. To this end, we developed the open source Link Generator, that analyzes OpenAPI documents and automatically adds links to increase translation utility. This fundamentally benefits around 34% of APIs in the APIs.guru directory. Our findings and tool support contribute to the ongoing discussion about the migration of REST APIs to GraphQL, and provide developers with valuable insights into common pitfalls, to reduce friction during API transformation., Comment: WWW2020 Developer Track

Programmable switches have emerged as powerful and flexible alternatives to fixed-function forwarding devices. But because of the unique hardware constraints of network switches, the design and implementation of compilers targeting these devices is tedious and error prone. Despite the important role that compilers play in software development, there is a dearth of tools for testing compilers for programmable network devices. We present Druzhba, a programmable switch simulator used for testing compilers targeting programmable packet-processing substrates. We show that we can model the low-level behavior of a switch's programmable hardware. We further show how our machine model can be used by compiler developers to target Druzhba as a compiler backend. Generated machine code programs are fed into Druzhba and tested using a fuzzing-based approach that allows compiler developers to test the correctness of their compilers. Using a program-synthesis-based compiler as a case study, we demonstrate how Druzhba has been successful in testing compiler-generated machine code for our simulated switch pipeline instruction set., Comment: 7 pages, 4 figures

Federated Learning (FL) is a distributed machine learning paradigm where data is distributed among clients who collaboratively train a model in a computation process coordinated by a central server. By assigning a weight to each client based on the proportion of data instances it possesses, the rate of convergence to an accurate joint model can be greatly accelerated. Some previous works studied FL in a Byzantine setting, in which a fraction of the clients may send arbitrary or even malicious information regarding their model. However, these works either ignore the issue of data unbalancedness altogether or assume that client weights are apriori known to the server, whereas, in practice, it is likely that weights will be reported to the server by the clients themselves and therefore cannot be relied upon. We address this issue for the first time by proposing a practical weight-truncation-based preprocessing method and demonstrating empirically that it is able to strike a good balance between model quality and Byzantine robustness. We also establish analytically that our method can be applied to a randomly selected sample of client weights.

The Internet of Things (IoT) is emerging as a multi-purpose technology with enormous potential for improving the quality of life in several areas. In particular, IoT has been applied in agriculture to make it more sustainable ecologically. For instance, electronic traps have the potential to perform pest control without any pesticide. In this paper, a smart trap with IoT capabilities that uses computer vision to identify the insect of interest is proposed. The solution includes 1) an embedded system with camera, GPS sensor and motor actuators; 2) an IoT middleware as database service provider, and 3) a Web application to present data by a configurable heat map. The demonstration of proposed solution is exposed and the main conclusions are the perception about pest concentration at the plantation and the viability as alternative pest control over traditional control based on pesticides., Comment: 10 pages, 7 figures

Caller ID parodying produces the valid Caller character, in this manner deciding seem to start from another client. This apparently basic assault strategy has been utilized in the developing communication fake and trick calls, bringing about significant financial trouble. Unfortunately, callerID spoofing is easy to implement but yet it is difficult to have protection against it. In addition, there are not effective and defense solutions available right now. In this research it is suggested the CIVE (Callee Inference & VErification), a compelling and viable guard against Caller ID spoofing. This way it is described how it's possible to lunch call spoofing and between line describe how CIVE approach method can help to prevent somehow this kind of attacks. Caller ID Spoofing could cause huge financial and political issues special nowadays, when many things even sometimes authentication and verification are available by phone call, like banks approving transactions or two factor authentications and many other things. We believe critical industries specially banks and payment service providers should be protected against such vulnerabilities with their system and make an approach to prevent it, also it is very important to learn people specially who has special social place like politicians or celebrities to know such kind of attack are already exist. For this paper we implemented a call from white house to show there is no limitation and no matter whom you try to spoof, but destination which is the victim receive the call and that make this attack vector dangerous. And even modern communication and even devices like 4G and smart phones are not able to prevent or even detect this kind of attack. This study is a demonstration of the vulnerabilities available. All experiments were conducted on isolated mock-ups.

This paper introduces a novel non-orthogonal multiple access (NOMA) concept named waveform-domain NOMA, which proposes the coexistence of different waveforms in the same resource element (RE). Regarding the demands of each user equipments (UEs), appropriate waveforms are assigned intelligently and decoded at the receiver side properly. Since the performance gain of power-domain NOMA compared to multi-user multiple-input-multiple-output (MU-MIMO) degrades in the case of successive interference cancellation (SIC) and channel estimation errors, NOMA is not considered as a work-item in 3GPP anymore. The novel waveform-domain NOMA concept provides a remedy for the problems of the power-domain NOMA scheme as well as flexibility in terms of reliability, latency, and energy efficiency. To mitigate SIC errors, low-density parity-check (LDPC) codes aided soft interference cancellation technique is used. As numerically evaluated, the proposed waveform-domain NOMA scheme outperforms the conventional power-domain NOMA in the power-balanced scenario., Comment: 6 pages,6 figures. Accepted for presentation in ICC Workshop 2020, Dublin, Ireland

The proper setting of contention window (CW) values has a significant impact on the efficiency of Wi-Fi networks. Unfortunately, the standard method used by 802.11 networks is not scalable enough to maintain stable throughput for an increasing number of stations, yet it remains the default method of channel access for 802.11ax single-user transmissions. Therefore, we propose a new method of CW control, which leverages deep reinforcement learning (DRL) principles to learn the correct settings under different network conditions. Our method, called centralized contention window optimization with DRL (CCOD), supports two trainable control algorithms: deep Q-network (DQN) and deep deterministic policy gradient (DDPG). We demonstrate through simulations that it offers efficiency close to optimal (even in dynamic topologies) while keeping computational cost low., Comment: 6 pages, 6 figures, published in 2021 IEEE Wireless Communications and Networking Conference (WCNC)

Practical multiple-input-multiple-output (MIMO) systems depend on a predefined set of precoders to provide spatial multiplexing gain. This limitation on the flexibility of the precoders affects the overall performance. Here, we propose a transmission scheme that can reduce the effect of mismatch between users' channels and precoders. The scheme uses the channel knowledge to generate an artificial signal, which realigns the predefined precoder to the actual channel. Moreover, the scheme can provide an additional level of secrecy for the communication link. The performance of the proposed scheme is evaluated using bit-error rate (BER), error vector magnitude (EVM), and secrecy capacity. The results show a significant improvement for the legitimate user, along with a degradation for the eavesdropper., Comment: 4 pages, 5 figures. Accepted for publication in IEEE Communications Letters

Flow reshaping is used in time-sensitive networks (as in the context of IEEE TSN and IETF Detnet) in order to reduce burstiness inside the network and to support the computation of guaranteed latency bounds. This is performed using per-flow regulators (such as the Token Bucket Filter) or interleaved regulators (as with IEEE TSN Asynchronous Traffic Shaping). Both types of regulators are beneficial as they cancel the increase of burstiness due to multiplexing inside the network. It was demonstrated, by using network calculus, that they do not increase the worst-case latency. However, the properties of regulators were established assuming that time is perfect in all network nodes. In reality, nodes use local, imperfect clocks. Time-sensitive networks exist in two flavours: (1) in non-synchronized networks, local clocks run independently at every node and their deviations are not controlled and (2) in synchronized networks, the deviations of local clocks are kept within very small bounds using for example a synchronization protocol (such as PTP) or a satellite based geo-positioning system (such as GPS). We revisit the properties of regulators in both cases. In non-synchronized networks, we show that ignoring the timing inaccuracies can lead to network instability due to unbounded delay in per-flow or interleaved regulators. We propose and analyze two methods (rate and burst cascade, and asynchronous dual arrival-curve method) for avoiding this problem. In synchronized networks, we show that there is no instability with per-flow regulators but, surprisingly, interleaved regulators can lead to instability. To establish these results, we develop a new framework that captures industrial requirements on clocks in both non-synchronized and synchronized networks, and we develop a toolbox that extends network calculus to account for clock imperfections., Comment: ACM SIGMETRICS 2020 Boston, Massachusetts, USA June 8-12, 2020

The identification of cyberattacks which target information and communication systems has been a focus of the research community for years. Network intrusion detection is a complex problem which presents a diverse number of challenges. Many attacks currently remain undetected, while newer ones emerge due to the proliferation of connected devices and the evolution of communication technology. In this survey, we review the methods that have been applied to network data with the purpose of developing an intrusion detector, but contrary to previous reviews in the area, we analyze them from the perspective of the Knowledge Discovery in Databases (KDD) process. As such, we discuss the techniques used for the capture, preparation and transformation of the data, as well as, the data mining and evaluation methods. In addition, we also present the characteristics and motivations behind the use of each of these techniques and propose more adequate and up-to-date taxonomies and definitions for intrusion detectors based on the terminology used in the area of data mining and KDD. Special importance is given to the evaluation procedures followed to assess the different detectors, discussing their applicability in current real networks. Finally, as a result of this literature review, we investigate some open issues which will need to be considered for further research in the area of network security.