Search

A novel class of extreme link-flooding DDoS (Distributed Denial of Service) attacks is designed to cut off entire geographical areas such as cities and even countries from the Internet by simultaneously targeting a selected set of network links. The Crossfire attack is a target-area link-flooding attack, which is orchestrated in three complex phases. The attack uses a massively distributed large-scale botnet to generate low-rate benign traffic aiming to congest selected network links, so-called target links. The adoption of benign traffic, while simultaneously targeting multiple network links, makes detecting the Crossfire attack a serious challenge. In this paper, we present analytical and emulated results showing hitherto unidentified vulnerabilities in the execution of the attack, such as a correlation between coordination of the botnet traffic and the quality of the attack, and a correlation between the attack distribution and detectability of the attack. Additionally, we identified a warm-up period due to the bot synchronization. For attack detection, we report results of using two supervised machine learning approaches: Support Vector Machine (SVM) and Random Forest (RF) for classification of network traffic to normal and abnormal traffic, i.e, attack traffic. These machine learning models have been trained in various scenarios using the link volume as the main feature set., Comment: arXiv admin note: text overlap with arXiv:1801.00235

We consider the problem of automatically generating networks from data of collaborating researchers. The objective is to apply network analysis on the resulting network layers to reveal supplemental patterns and insights of the research collaborations. In this paper, we describe our data-to-networks method, which automatically generates a set of logical network layers from the relational input data using a linkage threshold. We, then, use a series of network metrics to analyze the impact of the linkage threshold on the individual network layers. Moreover, results from the network analysis also provide beneficial information to improve the network visualization. We demonstrate the feasibility and impact of our approach using real-world collaboration data. We discuss how the produced network layers can reveal insights and patterns to direct the data analytics more intelligently., Comment: International Conference on Optimization and Learning (OLA), 2019

Nowadays, companies such as Amazon, Alibaba, and even pizza chains are pushing forward to use drones, also called UAVs (Unmanned Aerial Vehicles), for service provision, such as package and food delivery. As governments intend to use these immense economic benefits that UAVs have to offer, urban planners are moving forward to incorporate so-called UAV flight zones and UAV highways in their smart city designs. However, the high-speed mobility and behavior dynamics of UAVs need to be monitored to detect and, subsequently, to deal with intruders, rogue drones, and UAVs with a malicious intent. This paper proposes a UAV defense system for the purpose of intercepting and escorting a malicious UAV outside the flight zone. The proposed UAV defense system consists of a defense UAV swarm, which is capable to self-organize its defense formation in the event of intruder detection, and chase the malicious UAV as a networked swarm. Modular design principles have been used for our fully localized approach. We developed an innovative auto-balanced clustering process to realize the intercept- and capture-formation. As it turned out, the resulting networked defense UAV swarm is resilient against communication losses. Finally, a prototype UAV simulator has been implemented. Through extensive simulations, we show the feasibility and performance of our approach., Comment: IEEE Conference on Local Computer Networks (LCN), 2017

Mobile location-based services (LBSs) empowered by mobile crowdsourcing provide users with context-aware intelligent services based on user locations. As smartphones are capable of collecting and disseminating massive user location-embedded sensing information, privacy preservation for mobile users has become a crucial issue. This paper proposes a metric called privacy exposure to quantify the notion of privacy, which is subjective and qualitative in nature, in order to support mobile LBSs to evaluate the effectiveness of privacy-preserving solutions. This metric incorporates activity coverage and activity uniformity to address two primary privacy threats, namely activity hotspot disclosure and activity transition disclosure. In addition, we propose an algorithm to minimize privacy exposure for mobile LBSs. We evaluate the proposed metric and the privacy-preserving sensing algorithm via extensive simulations. Moreover, we have also implemented the algorithm in an Android-based mobile system and conducted real-world experiments. Both our simulations and experimental results demonstrate that (1) the proposed metric can properly quantify the privacy exposure level of human activities in the spatial domain and (2) the proposed algorithm can effectively cloak users' activity hotspots and transitions at both high and low user-mobility levels., Comment: This work was supported in part by A*STAR Singapore under SERC grant 1224104046. This work has been partially funded by the European Union's Horizon 2020 research and innovation programme within the project "Worldwide Interoperability for SEmantics IoT" under grant agreement Number 723156

Crossfire attack is a recently proposed threat designed to disconnect whole geographical areas, such as cities or states, from the Internet. Orchestrated in multiple phases, the attack uses a massively distributed botnet to generate low-rate benign traffic aiming to congest selected network links, so-called target links. The adoption of benign traffic, while simultaneously targeting multiple network links, makes the detection of the Crossfire attack a serious challenge. In this paper, we propose a framework for early detection of Crossfire attack, i.e., detection in the warm-up period of the attack. We propose to monitor traffic at the potential decoy servers and discuss the advantages comparing with other monitoring approaches. Since the low-rate attack traffic is very difficult to distinguish from the background traffic, we investigate several deep learning methods to mine the spatiotemporal features for attack detection. We investigate Autoencoder, Convolutional Neural Network (CNN) and Long Short-Term Memory (LSTM) Network to detect the Crossfire attack during its warm-up period. We report encouraging experiment results., Comment: 5 pages, 5 figures.Presented at Deep Learning Security Workshop 2017, Singapore. Added references for section 2 and section 4. Added new author

We consider the positioning problem of aerial drone systems for efficient three-dimensional (3-D) coverage. Our solution draws from molecular geometry, where forces among electron pairs surrounding a central atom arrange their positions. In this paper, we propose a 3-D clustering algorithm for autonomous positioning (VBCA) of aerial drone networks based on virtual forces. These virtual forces induce interactions among drones and structure the system topology. The advantages of our approach are that (1) virtual forces enable drones to self-organize the positioning process and (2) VBCA can be implemented entirely localized. Extensive simulations show that our virtual forces clustering approach produces scalable 3-D topologies exhibiting near-optimal volume coverage. VBCA triggers efficient topology rearrangement for an altering number of nodes, while providing network connectivity to the central drone. We also draw a comparison of volume coverage achieved by VBCA against existing approaches and find VBCA up to 40\% more efficient.

Autonomous Unmanned Aerial Vehicles (UAVs) have gained popularity due to their many potential application fields. Alongside sophisticated sensors, UAVs can be equipped with communication adaptors aimed for inter-UAV communication. Inter-communication of UAVs to form a UAV swarm raises questions on how to manage its communication structure and mobility. In this paper, we consider therefore the problem of establishing an efficient swarm movement model and a network topology between a collection of UAVs, which are specifically deployed for the scenario of high-quality forest-mapping. The forest environment with its highly heterogeneous distribution of trees and obstacles represents an extreme challenge for a UAV swarm. It requires the swarm to constantly avoid possible collisions with trees, to change autonomously the trajectory, which can lead to disconnection to the swarm, and to reconnect to the swarm after passing the obstacle, while continue collecting environmental data that needs to be fused and assessed efficiently. In this paper, we propose a novel solution to the formation flight problem for UAV swarms. The proposed method provides an adaptive and reliable network structure, which maintains swarm connectivity and communicability. These characteristics are needed to achieve a detailed and accurate description of the environment from the data acquired by the UAV swarm. The main characteristics of our approach are high scalability regarding the number of UAVs in the swarm and the adaptive network topology within the swarm.

Multiple probabilistic packet marking (PPM) schemes for IP traceback have been proposed to deal with Distributed Denial of Service (DDoS) attacks by reconstructing their attack graphs and identifying the attack sources. In this paper, ten PPM-based IP traceback schemes are compared and analyzed in terms of features such as convergence time, performance evaluation, underlying topologies, incremental deployment, re-marking, and upstream graph. Our analysis shows that the considered schemes exhibit a significant discrepancy in performance as well as performance assessment. We concisely demonstrate this by providing a table showing that (a) different metrics are used for many schemes to measure their performance and, (b) most schemes are evaluated on different classes of underlying network topologies. Our results reveal that both the value and arrangement of the PPM-based scheme convergence times vary depending on exactly the underlying network topology. As a result, this paper shows that a side-by-side comparison of the scheme performance a complicated and turns out to be a crucial open problem in this research area.

We deal with the problem of automatically generating social networks by analyzing and assessing smartphone usage and interaction data. We start by assigning weights to the different types of interactions such as messaging, email, phone calls, chat and physical proximity. Next, we propose a ranking algorithm which recognizes the pattern of interaction taking into account the changes in the collected data over time. Both algorithms are based on recent findings from social network research., Comment: IEEE International Conference on Computer Communications (INFOCOM'12) Student Workshop

In the naming game, individuals or agents exchange pairwise local information in order to communicate about objects in their common environment. The goal of the game is to reach a consensus about naming these objects. Originally used to investigate language formation and self-organizing vocabularies, we extend the classical naming game with a globally shared memory accessible by all agents. This shared memory can be interpreted as an external source of knowledge like a book or an Internet site. The extended naming game models an environment similar to one that can be found in the context of social bookmarking and collaborative tagging sites where users tag sites using appropriate labels, but also mimics an important aspect in the field of human-based image labeling. Although the extended naming game is non-deterministic in its word selection, we show that consensus towards a common vocabulary is reached. More importantly, we show the qualitative and quantitative influence of the external source of information, i.e. the shared memory, on the consensus dynamics between the agents., Comment: 6 pages

Ubiquitous computing based on small mobile devices using wireless communication links is becoming very attractive. The computational power and storage capacities provided allow the execution of sophisticated applications. Due to the fact that sharing of information is a central problem for distributed applications, the development of self organizing middleware services providing high level interfaces for information managing is essential. ADS is a directory service for mobile ad-hoc networks dealing with local and nearby information as well as providing access to distant information. The approach discussed throughout this paper is based upon the concept of information markets., Comment: 9 pages, in the 1st International Workshop on Ubiquitous Computing (IWUC-2004) held in conjunction with the 6th International Conference on Enterprise Information Systems (ICEIS 2004)

Leveraging the potential power of even small handheld devices able to communicate wirelessly requires dedicated support. In particular, collaborative applications need sophisticated assistance in terms of querying and exchanging different kinds of data. Using a concrete example from the domain of mobile learning, the general need for information dissemination is motivated. Subsequently, and driven by infrastructural conditions, realization strategies of an appropriate middleware service are discussed., Comment: 8th International Conference on Knowledge-Based Intelligent Information & Engineering Systems (KES2004)

This work aims at optimizing injection networks, which consist in adding a set of long-range links (called bypass links) in mobile multi-hop ad hoc networks so as to improve connectivity and overcome network partitioning. To this end, we rely on small-world network properties, that comprise a high clustering coefficient and a low characteristic path length. We investigate the use of two genetic algorithms (generational and steady-state) to optimize three instances of this topology control problem and present results that show initial evidence of their capacity to solve it., Comment: 1 page, 1 figure

In the field of tutoring systems, investigations have shown that there are many tutoring systems specific to a specific domain that, because of their static architecture, cannot be adapted to other domains. As consequence, often neither methods nor knowledge can be reused. In addition, the knowledge engineer must have programming skills in order to enhance and evaluate the system. One particular challenge is to tackle these problems with the development of a generic tutoring system. AnITA, as a stand-alone application, has been developed and implemented particularly for this purpose. However, in the testing phase, we discovered that this architecture did not fully match the user's intuitive understanding of the use of a learning tool. Therefore, AnITA has been redesigned to exclusively work as a client/server application and renamed to AnITA2. This paper discusses the evolvements made on the AnITA tutoring system, the goal of which is to use generic principles for system re-use in any domain. Two experiments were conducted, and the results are presented in this paper., Comment: Published in: Proceedings of International Conference on Education and Information Systems (EISTA 04), 2004, ISBN 980-6560-11-6

With larger memory capacities and the ability to link into wireless networks, more and more students uses palmtop and handheld computers for learning activities. However, existing software for Web-based learning is not well-suited for such mobile devices, both due to constrained user interfaces as well as communication effort required. A new generation of applications for the learning domain that is explicitly designed to work on these kinds of small mobile devices has to be developed. For this purpose, we introduce CARLA, a cooperative learning system that is designed to act in hybrid wireless networks. As a cooperative environment, CARLA aims at disseminating teaching material, notes, and even components of itself through both fixed and mobile networks to interested nodes. Due to the mobility of nodes, CARLA deals with upcoming problems such as network partitions and synchronization of teaching material, resource dependencies, and time constraints., Comment: Global Congress on Engineering and Technology Education (GCETE 2005)

Topology Control (TC) aims at tuning the topology of highly dynamic networks to provide better control over network resources and to increase the efficiency of communication. Recently, many TC protocols have been proposed. The protocols are designed for preserving connectivity, minimizing energy consumption, maximizing the overall network coverage or network capacity. Each TC protocol makes different assumptions about the network topology, environment detection resources, and control capacities. This circumstance makes it extremely difficult to comprehend the role and purpose of each protocol. To tackle this situation, a taxonomy for TC protocols is presented throughout this paper. Additionally, some TC protocols are classified based upon this taxonomy., Comment: The Sixth International Conference on Networking, ICN 2007

Fixed infrastructured networks naturally support centralized approaches for group management and information provisioning. Contrary to infrastructured networks, in multi-hop ad-hoc networks each node acts as a router as well as sender and receiver. Some applications, however, requires hierarchical arrangements that-for practical reasons-has to be done locally and self-organized. An additional challenge is to deal with mobility that causes permanent network partitioning and re-organizations. Technically, these problems can be tackled by providing additional uplinks to a backbone network, which can be used to access resources in the Internet as well as to inter-link multiple ad-hoc network partitions, creating a hybrid wireless network. In this paper, we present a prototypically implemented hybrid wireless network system optimized for multimedia content distribution. To efficiently manage the ad-hoc communicating devices a weighted clustering algorithm is introduced. The proposed localized algorithm deals with mobility, but does not require geographical information or distances., Comment: 2nd ACM Workshop on Wireless Multimedia Networking and Performance Modeling 2006 (ISBN 1-59593-485)

Ad-hoc networks, a promising trend in wireless technology, fail to work properly in a global setting. In most cases, self-organization and cost-free local communication cannot compensate the need for being connected, gathering urgent information just-in-time. Equipping mobile devices additionally with GSM or UMTS adapters in order to communicate with arbitrary remote devices or even a fixed network infrastructure provides an opportunity. Devices that operate as intermediate nodes between the ad-hoc network and a reliable backbone network are potential injection points. They allow disseminating received information within the local neighborhood. The effectiveness of different devices to serve as injection point differs substantially. For practical reasons the determination of injection points should be done locally, within the ad-hoc network partitions. We analyze different localized algorithms using at most 2-hop neighboring information. Results show that devices selected this way spread information more efficiently through the ad-hoc network. Our results can also be applied in order to support the election process for clusterheads in the field of clustering mechanisms., Comment: The Sixth International Conference on Networking (ICN 2007)

Mobile entities with wireless links are able to form a mobile ad-hoc network. Such an infrastructureless network does not have to be administrated. However, self-organizing principles have to be applied to deal with upcoming problems, e.g. information dissemination. These kinds of problems are not easy to tackle, requiring complex algorithms. Moreover, the usefulness of pure ad-hoc networks is arguably limited. Hence, enthusiasm for mobile ad-hoc networks, which could eliminate the need for any fixed infrastructure, has been damped. The goal is to overcome the limitations of pure ad-hoc networks by augmenting them with instant Internet access, e.g. via integration of UMTS respectively GSM links. However, this raises multiple questions at the technical as well as the organizational level. Motivated by characteristics of small-world networks that describe an efficient network even without central or organized design, this paper proposes to combine mobile ad-hoc networks and infrastructured networks to form hybrid wireless networks. One main objective is to investigate how this approach can reduce the costs of a permanent backbone link and providing in the same way the benefits of useful information from Internet connectivity or service providers. For the purpose of bridging between the different types of networks, an adequate middleware service is the focus of our investigation. This paper shows our first steps forward to this middleware by introducing the Injection Communication paradigm as principal concept., Comment: WSEAS Transactions on Circuits and Systems 2004

In the field of evaluation research, computer scientists live constantly upon dilemmas and conflicting theories. As evaluation is differently perceived and modeled among educational areas, it is not difficult to become trapped in dilemmas, which reflects an epistemological weakness. Additionally, designing and developing a computer-based learning scenario is not an easy task. Advancing further, with end-users probing the system in realistic settings, is even harder. Computer science research in evaluation faces an immense challenge, having to cope with contributions from several conflicting and controversial research fields. We believe that deep changes must be made in our field if we are to advance beyond the CBT (computer-based training) learning model and to build an adequate epistemology for this challenge. The first task is to relocate our field by building upon recent results from philosophy, psychology, social sciences, and engineering. In this article we locate evaluation in respect to communication studies. Evaluation presupposes a definition of goals to be reached, and we suggest that it is, by many means, a silent communication between teacher and student, peers, and institutional entities. If we accept that evaluation can be viewed as set of invisible rules known by nobody, but somehow understood by everybody, we should add anthropological inquiries to our research toolkit. The paper is organized around some elements of the social communication and how they convey new insights to evaluation research for computer and related scientists. We found some technical limitations and offer discussions on how we relate to technology at same time we establish expectancies and perceive others work., Comment: International Conference on Education and Information Systems (EISTA 04), ISBN 980-6560-11-6

Mobile multi-hop ad hoc networks allow establishing local groups of communicating devices in a self-organizing way. However, in a global setting such networks fail to work properly due to network partitioning. Providing that devices are capable of communicating both locally-e.g. using Wi-Fi or Bluetooth-and additionally also with arbitrary remote devices-e.g. using GSM/UMTS links-the objective is to find efficient ways of inter-linking multiple network partitions. Tackling this problem of topology control, we focus on the class of small-world networks that obey two distinguishing characteristics: they have a strong local clustering while still retaining a small average distance between two nodes. This paper reports on results gained investigating the question if small-world properties are indicative for an efficient link management in multiple multi-hop ad hoc network partitions.

Today's computer-based annotation systems implement a wide range of functionalities that often go beyond those available in traditional paper-and-pencil annotations. Conceptually, annotation systems are based on thoroughly investigated psycho-sociological and pedagogical learning theories. They offer a huge diversity of annotation types that can be placed in textual as well as in multimedia format. Additionally, annotations can be published or shared with a group of interested parties via well-organized repositories. Although highly sophisticated annotation systems exist both conceptually as well as technologically, we still observe that their acceptance is somewhat limited. In this paper, we argue that nowadays annotation systems suffer from several fundamental problems that are inherent in the traditional paper-and-pencil annotation paradigm. As a solution, we propose to shift the annotation paradigm for the implementation of annotation system., Comment: The Third International Workshop on E-learning and Mobile Learning on Telecommunications (ELETE 2007)

Clustering techniques create hierarchal network structures, called clusters, on an otherwise flat network. In a dynamic environment-in terms of node mobility as well as in terms of steadily changing device parameters-the clusterhead election process has to be re-invoked according to a suitable update policy. Cluster re-organization causes additional message exchanges and computational complexity and it execution has to be optimized. Our investigations focus on the problem of minimizing clusterhead re-elections by considering stability criteria. These criteria are based on topological characteristics as well as on device parameters. This paper presents a weighted clustering algorithm optimized to avoid needless clusterhead re-elections for stable clusters in mobile ad-hoc networks. The proposed localized algorithm deals with mobility, but does not require geographical, speed or distances information., Comment: The Third International Conference on Wireless and Mobile Communications 2007

Realizing test scenarios through a tutoring system involve questions about architecture and didactic methods in such a system. Observing the fact that traditional tutoring systems normally are domain-static, this paper shows investigations for a generic domain-independent tutoring system for utilizing test scenarios in computer-based and web-based environments. Furthermore, test paradigms are analyzed and it is presented an approach for realizing functionality for applying test paradigms in the presented generic tutoring system architecture by an XML-specified language., Comment: Information and Resource Management (IRMA 2003)

Small-worlds represent efficient communication networks that obey two distinguishing characteristics: a high clustering coefficient together with a small characteristic path length. This paper focuses on an interesting paradox, that removing links in a network can increase the overall clustering coefficient. Reckful Roaming, as introduced in this paper, is a 2-localized algorithm that takes advantage of this paradox in order to selectively remove superfluous links, this way optimizing the clustering coefficient while still retaining a sufficiently small characteristic path length., Comment: To appear in: 1st International Workshop on Localized Algorithms and Protocols for Wireless Sensor Networks (LOCALGOS 2007), 2007, IEEE Compuster Society Press