The conventional information leakage metrics assume that an adversary has complete knowledge of t... more The conventional information leakage metrics assume that an adversary has complete knowledge of the distribution of the mechanism used to disclose information correlated with the sensitive attributes of a system. The only uncertainty arises from the specific realizations that are drawn from this distribution. This assumption does not hold in various practical scenarios where an adversary usually lacks complete information about the joint statistics of the private, utility, and the disclosed data. As a result, the typical information leakage metrics fail to measure the leakage appropriately. In this paper, we introduce multiple new versions of the traditional information-theoretic leakage metrics, that aptly represent information leakage for an adversary who lacks complete knowledge of the joint data statistics, and we provide insights into the potential uses of each. We experiment on a real-world dataset to further demonstrate how the introduced leakage metrics compare with the conv...
The processing power of smartphones supports steganographic algorithms that were considered to be... more The processing power of smartphones supports steganographic algorithms that were considered to be too computationally intensive for handheld devices. Several steganography apps are now available on mobile phones to support covert communications using digital photographs. This chapter focuses on two key questions: How effectively can a steganography app be reverse engineered? How can this knowledge help improve the detection of steganographic images and other related files? Two Android steganography apps, PixelKnot and Da Vinci Secret Image, are analyzed. Experiments demonstrate that they are constructed in very different ways and provide different levels of security for hiding messages. The results of detecting steganography files, including images generated by the apps, using three software packages are presented. The results point to an urgent need for further research on reverse engineering steganography apps and detecting images produced by these apps.
Fourth IEEE International Symposium on Network Computing and Applications, 2005
In distributed P2P environments, peers (i.e., users) often have to request the services from some... more In distributed P2P environments, peers (i.e., users) often have to request the services from some unfamiliar peers (i.e., resources) that could be altruistic, selfish, or even malicious. To motivate selfish peers to cooperate and minimize the risk from malicious peers, we propose an adaptive reputation-based trust framework for peer-to-peer applications. In this framework, we define a quantifiable metric trust that is calculated from the user's own view as well as other peers' view (as references) on the reputation of a peer (resource). It can be used to quantify the trustworthiness of peers and provide a measurable and trustable way of resource scheduling/selection and access control for peer-topeer applications. We assume economic resources compete with each other to maximize their profit and design a number of strategies for resources to determine their price. The simulation results show that the framework supports economic resources to achieve long-term high user satisfaction, differentiates malicious nodes from normal ones and encourages the resources to provide high-quality services.
IFIP — The International Federation for Information Processing
Email communications are commonly used by criminal entities to perpetrate illegal activities such... more Email communications are commonly used by criminal entities to perpetrate illegal activities such as fraud and phishing scams as well as for transmitting threats and viruses. Due to the complexity of the task, it is often difficult for investigators to manually analyze email-related evidence. Automated techniques for email analysis can significantly enhance computer crime investigations. This paper proposes a framework for email investigations that incorporates automated techniques for information extraction and linkage discovery. The application of text/data mining and link analysis techniques assists in inferring social networks and in accurately correlating events and activities from email-related evidence.
2012 46th Annual Conference on Information Sciences and Systems (CISS), 2012
Online auction networks often use reputation-based systems to help users assess each other's hone... more Online auction networks often use reputation-based systems to help users assess each other's honesty and integrity. Fraudsters, however, can collude with accomplices to accumulate bogus positive feedback to manipulate the reputation systems. In this paper, we model an online auction network with fraudsters as a random network with hidden communities (fraudsters and associated accomplices), and propose a maximum likelihood framework to detect the fraudsters. We develop an iterative message passing algorithm to heuristically solve the maximum likelihood detection problem. This algorithm identifies fraudsters and accomplices in a distributed fashion and is a scalable solution. The algorithm converges in a finite number of iterations and has very high detection rates according to our simulations.
Security has become one of the major issues for Data Communication over wired and wireless networ... more Security has become one of the major issues for Data Communication over wired and wireless networks. In Wireless Sensor Networks (WSN), the hackers can inject false data via compromised nodes and can able to alter the original files. There are many chances to perform a Denial Of Service (DOS) attack in WSNs. Initially send the Dynamic Key to all the cluster nodes followed by neighboring nodes. Then send the file which will be hidden and is secured by encrypting using Advanced Encryption Standard (AES) algorithm thereby mitigating from the DOS attack and Sybil attack. AES is secure enough to protect classified information up to the top Secret level, which is highest security. In a Sybil attacks, a malicious user obtains multiple fake identities and pretends to be multiple, Distinct nodes in the system. If a compromised is made while file being sent, then the algorithm finds the affected node and informs to the user that DOS attack is done. I.
IEEE INFOCOM 2008 - The 27th Conference on Computer Communications, 2008
Network coding provides the possibility to maximize network throughput and receives various appli... more Network coding provides the possibility to maximize network throughput and receives various applications in traditional computer networks, wireless sensor networks and peer-to-peer systems. However, the applications built on top of network coding are vulnerable to pollution attacks, in which the compromised forwarders can inject polluted or forged messages into networks. Existing schemes addressing pollution attacks either require an extra secure channel or incur high computation overhead. In this paper, we propose an efficient signature-based scheme to detect and filter pollution attacks for the applications adopting linear network coding techniques. Our scheme exploits a novel homomorphic signature function to enable the source to delegate its signing authority to forwarders, that is, the forwarders can generate the signatures for their output messages without contacting the source. This nice property allows the forwarders to verify the received messages, but prohibit them from creating the valid signatures for polluted or forged ones. Our scheme does not need any extra secure channels, and can provide source authentication and batch verification. Experimental results show that it can improve computation efficiency up to ten times compared to some existing one. In addition, we present an alternate lightweight scheme based on a much simpler linear signature function. This alternate scheme provides a tradeoff between computation efficiency and security.
Simulink is widely used for model-driven development (MDD) of cyber-physical systems. Typically, ... more Simulink is widely used for model-driven development (MDD) of cyber-physical systems. Typically, the Simulink-based development starts with Stateflow modeling, followed by simulation, validation, and code generation mapped to physical execution platforms. However, recent trends have raised the demands of rigorous verification on safety-critical applications to prevent intrinsic development faults and improve the system dependability, which is unfortunately challenging. Even though the constructed Stateflow model and the generated code pass the validation of Simulink Design Verifier and Simulink Polyspace, respectively, the system may still fail due to some implicit defects contained in the design model (design defect) and the generated code (implementation defects). In this article, we bridge the Stateflow-based MDD and a well-defined rigorous verification to reduce development faults. First, we develop a self-contained toolkit to translate a Stateflow model into timed automata, whe...
2007 IEEE Internatonal Conference on Mobile Adhoc and Sensor Systems, 2007
After three years of organizing the wireless and sensor network security (WSNS) workshop, it is t... more After three years of organizing the wireless and sensor network security (WSNS) workshop, it is time for some retrospection to the workshop objectives and the visible outcome. This review is focusing on the the quality and performance of the workshop. On the one hand, it represents a good source to recapitulate recent research topics related to security in wireless ad hoc and sensor networks. Additionally, it extrapolates future research directions that seem to be interesting and challenging for forthcoming research activities.
2006 IEEE International Performance Computing and Communications Conference, 2006
Network based attackers often relay attacks through intermediary hosts (i.e., stepping stones) to... more Network based attackers often relay attacks through intermediary hosts (i.e., stepping stones) to evade detection. In addition, attackers make detection more difficult by encrypting attack traffic and introducing delay and chaff 1 perturbations into stepping stone connections. Several approaches have been proposed to detect stepping stone attacks. However, none of them performs effectively when delay and chaff perturbations exist simultaneously. In this paper, we propose and analyze algorithms which represent that attackers cannot always evade detection only by adding limited delay and independent chaff perturbations. We provide the upper bounds on the number of packets needed to confidently detect stepping stone connections from nonstepping stone connections with any given probability of false attribution. We compare our algorithms with previous ones and the experimental results show that our algorithms are more effective in detecting stepping stone attacks in some scenarios.
2004 IEEE International Conference on Mobile Ad-hoc and Sensor Systems (IEEE Cat. No.04EX975)
Several problems are required to be fixed in order to apply geographical routing protocol Greedy ... more Several problems are required to be fixed in order to apply geographical routing protocol Greedy Perimeter Stateless Routing (GPSR) in wireless sensor networks. First, GPSR is designed under the assumption of symmetric links (i.e., bidirectional reachability) which is not realistic for many practical sensor networks. Second, in sensor networks, packet destinations are often marked with locations instead of identifiers like IP address and therefore packets are routed to the home node which is the node geographically closest to the destined location. GPSR is not efficient in identifying the home node when the target location is outside the exterior perimeter of the sensor network. Third, due to the dynamic nature of sensor networks, maintaining data consistency, that is, data retrieved from the home node for a location should be consistent with the data sent to the same location, becomes a challenge when home nodes change. We propose On-demand GPSR (OD-GPSR), a data driven geographical routing protocol customized for sensor networks with solutions to the above three problems. Simulation results show that OD-GPSR performs well in terms of energy efficiency and packet delivery rate at the cost of a little bit more packet delivery delay.
Third IEEE International Symposium on Dependable, Autonomic and Secure Computing (DASC 2007), 2007
Anonymity technologies such as mix networks have gained increasing attention as a way to provide ... more Anonymity technologies such as mix networks have gained increasing attention as a way to provide communication privacy. Mix networks were developed for messagebased applications such as email, but researchers have adapted mix techniques to low-latency, flow-based applications such as anonymous web browsing. In this paper, we systematically address TCP performance issues of flowbased mix networks. We explain why a mix's batching and reordering schemes can dramatically reduce TCP throughput due to out-of-order packet delivery. We developed a theoretical model to analyze such impact and present closed formulae for TCP throughput in mix networks. To improve TCP performance, we examined the approach of increasing TCP's duplicate threshold parameter and derived closed formulae for the performance gains. Our simulation results matched our theoretical analysis well.
Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering, 2009
Currently, multicast services can be implemented at the IP layer or the application layer. While ... more Currently, multicast services can be implemented at the IP layer or the application layer. While IP multicast violates the stateless paradigm of Internet and incurs great difficulties to congestion and flow control, application-layer multicast is lack of scalability due to the unreliability and resource constraints of end-hosts. Moreover, security is a main weakness in Internet-wide group communications. We propose in this paper a novel architecture for secure and scalable multicast in the Internet. In our architecture, a Multicast Agent in each Autonomous System (AS) is responsible for delivering multicast packets at the ASlevel, relaying packets to end-hosts, and generating and updating keys to secure group communications. The proposed membership management protocol enables no-delay to membership updating; the proposed inter-domain routing protocol reduces the worst-case link stress by one magnitude compared to state-of-the-art protocols, and bounds the extra bandwidth cost within one percent compared to traditional IP multicast.
IFIP Advances in Information and Communication Technology, 2012
Peer-to-peer (P2P) file sharing networks are often abused to distribute content that is prohibite... more Peer-to-peer (P2P) file sharing networks are often abused to distribute content that is prohibited by law. Strong evidence of suspicion must be provided to obtain a court order to identify the location of an offender. However, initial evidence collection from a P2P network is a challenge due to the lack of a central point of control and the dynamic nature of the network. This paper describes an initial evidence collection tool for P2P network forensics. The tool performs active and passive monitoring by inserting a modified peer node in a P2P network that records relevant information about nodes that distribute contraband files. It logs data sent by suspicious nodes along with timestamps and unique identification information, which provides a strong, verifiable body of initial evidence.
2010 IEEE 30th International Conference on Distributed Computing Systems, 2010
Internet has become an essential part of the daily life for billions of users worldwide, who are ... more Internet has become an essential part of the daily life for billions of users worldwide, who are using a large variety of network services and applications everyday. However, there have been serious security problems and network failures that are hard to resolve, for example, botnet attacks, polymorphic worm/virus spreading, DDoS, and flash crowds. To address many of these problems, we need to have a network-wide view of the traffic dynamics, and more importantly, be able to detect traffic anomalies in a timely manner. Spatial analysis methods have been proved to be effective in detecting network-wide traffic anomalies that are not detectable at a single monitor. To our knowledge, Principle Component Analysis (PCA) is the best-known spatial detection method for the coordinated low-profile traffic anomalies. However, existing PCA-based solutions have scalability problems in that they require linear running time and space to analyze the traffic measurements within a sliding window, which makes it often infeasible to be deployed for monitoring large-scale high-speed networks. We propose a sketch-based streaming PCA algorithm for the network-wide traffic anomaly detection in a distributed fashion. Our algorithm only requires logarithmic running time and space at both local monitors and Network Operation Centers (NOCs), and can detect both high-profile and coordinated lowprofile traffic anomalies with bounded errors.
2012 IEEE 9th International Conference on Mobile Ad-Hoc and Sensor Systems (MASS 2012), 2012
The cognitive radio (CR) nodes in a cognitive radio network (CRN) do not have license to use spec... more The cognitive radio (CR) nodes in a cognitive radio network (CRN) do not have license to use specific spectrum band. Instead, they use the spectrum bands of the licensed primary users (PU) without interfering with the PU. When the PU becomes active, interfering CRs should leave to another available spectrum band within the PU's tolerable interference delay (TID). Therefore, CRN operates over wide spectrum bands which span many channels. Since each channel is typically licensed to one PU, this requires that channels be sensed separately. This adds monitoring overhead, where the CR should monitor (sense) the channel every TID, which reduces the throughput. For this reason, the node cannot monitor the whole set of channels. Deciding which set of channels to monitor affect other functions in the CRN like routing. Work done on routing in literature assumes that each node maintains a set of available channels which is obtained by sensing. Route setup decision will be made based on the available sets at all nodes. However, there may be some other available channels that the node is not aware of their availability which may enhance the routing quality metric. Also, taking into consideration only the sets of channels available at the CR nodes may preclude finding an end-to-end path. In this paper, we propose a spectrum decision framework that is complementary to the existing routing protocols. This framework is based on two objectives: 1) enhancing the route quality by sensing a few more channels at some nodes. These channels can enhance the quality by: reducing the switching time, requiring shorter sensing time, or expected to be available for longer time; 2) increasing the probability of finding a path by sensing more channels at some nodes in case the routing protocol did not find a path. Simulation results show that the proposed framework can result in enhancement that can be as high as 100% over the routing protocols that build their decisions based on the available channels at each node only.
2013 IEEE Global Communications Conference (GLOBECOM), 2013
Routing in cognitive radio networks (CRNs) necessitates a cross-layering approach. However, accor... more Routing in cognitive radio networks (CRNs) necessitates a cross-layering approach. However, according to [1], CRN routing protocols proposed in literature are partially cross-layer, because the information flow is only from physical layer to network layer, e.g., about channels availabilities. In this work, we introduce a cross-layer routing protocol (CLRP), which considers both the channels that are known to be available at each node, as well as other channels that may be available. The availabilities of the latter channels are considered using a stochastic approach. CLRP computes an end to end path, and feeds the physical layer with information about which channels to sense and which nodes should perform the sensing, such that the expected route quality is enhanced. Simulation results show that CLRP outperforms other cross-layer routing protocols in terms of throughput and stability of the path being setup, and increases the probability of finding an end-to-end path.
Proceedings 22nd International Conference on Distributed Computing Systems
For many Internet applications, the ability to protect the identity of participants in a distribu... more For many Internet applications, the ability to protect the identity of participants in a distributed applications is critical. For such applications, a number of anonymous communication systems have been realized over the recent years. The effectiveness of these systems relies greatly on the way messages are routed among the participants. (We call this the route selection strategy.) In this paper, we describe how to select routes so as to maximize the ability of the anonymous communication systems to protect anonymity. To measure this ability, we define a metric (anonymity degree), and we design and evaluate an optimal route selection strategy that maximizes the anonymity degree of a system. Our analytical and experimental data shows that the anonymity degree may not always monotonically increase as the length of communication paths increase. We also found that variable path-length strategies perform better than fixed-length strategies.
With the phenomenal growth of the Internet, more and more people enjoy and depend on its provided... more With the phenomenal growth of the Internet, more and more people enjoy and depend on its provided services. Unfortunately, the number of network-based attacks is also increasing quickly. Network attackers can very easily hide their identities, and thereby reduce the chance of being captured and punished. Some attacks can even succeed by using only one or a few well-targeted packets. Therefore, it is desirable to design effective and efficient single packet IP traceback systems to attribute attackers. Several single packet IP traceback systems have been designed using Bloom filters. However, the inherent false positives of Bloom filters caused by unavoidable collisions restrain the effectiveness of these systems. To reduce the impact of unavoidable collisions in Bloom filters, we propose a topology-aware single packet IP traceback system, namely TOPO. We utilize router's local topology information, i.e., its immediate predecessor information. Our performance analysis shows that TOPO can reduce the number and scope of unnecessary queries, and significantly decrease false attributions. Furthermore, to improve the practicability of Bloom filter-based IP traceback systems, we design TOPO to allow partial deployment while maintaining its traceback capability. When Bloom filters are used, it is difficult to decide their optimal control parameters a priori. We design a k-adaptive mechanism which can dynamically adjust parameters of Bloom filters to reduce the false positive rate.
The conventional information leakage metrics assume that an adversary has complete knowledge of t... more The conventional information leakage metrics assume that an adversary has complete knowledge of the distribution of the mechanism used to disclose information correlated with the sensitive attributes of a system. The only uncertainty arises from the specific realizations that are drawn from this distribution. This assumption does not hold in various practical scenarios where an adversary usually lacks complete information about the joint statistics of the private, utility, and the disclosed data. As a result, the typical information leakage metrics fail to measure the leakage appropriately. In this paper, we introduce multiple new versions of the traditional information-theoretic leakage metrics, that aptly represent information leakage for an adversary who lacks complete knowledge of the joint data statistics, and we provide insights into the potential uses of each. We experiment on a real-world dataset to further demonstrate how the introduced leakage metrics compare with the conv...
The processing power of smartphones supports steganographic algorithms that were considered to be... more The processing power of smartphones supports steganographic algorithms that were considered to be too computationally intensive for handheld devices. Several steganography apps are now available on mobile phones to support covert communications using digital photographs. This chapter focuses on two key questions: How effectively can a steganography app be reverse engineered? How can this knowledge help improve the detection of steganographic images and other related files? Two Android steganography apps, PixelKnot and Da Vinci Secret Image, are analyzed. Experiments demonstrate that they are constructed in very different ways and provide different levels of security for hiding messages. The results of detecting steganography files, including images generated by the apps, using three software packages are presented. The results point to an urgent need for further research on reverse engineering steganography apps and detecting images produced by these apps.
Fourth IEEE International Symposium on Network Computing and Applications, 2005
In distributed P2P environments, peers (i.e., users) often have to request the services from some... more In distributed P2P environments, peers (i.e., users) often have to request the services from some unfamiliar peers (i.e., resources) that could be altruistic, selfish, or even malicious. To motivate selfish peers to cooperate and minimize the risk from malicious peers, we propose an adaptive reputation-based trust framework for peer-to-peer applications. In this framework, we define a quantifiable metric trust that is calculated from the user's own view as well as other peers' view (as references) on the reputation of a peer (resource). It can be used to quantify the trustworthiness of peers and provide a measurable and trustable way of resource scheduling/selection and access control for peer-topeer applications. We assume economic resources compete with each other to maximize their profit and design a number of strategies for resources to determine their price. The simulation results show that the framework supports economic resources to achieve long-term high user satisfaction, differentiates malicious nodes from normal ones and encourages the resources to provide high-quality services.
IFIP — The International Federation for Information Processing
Email communications are commonly used by criminal entities to perpetrate illegal activities such... more Email communications are commonly used by criminal entities to perpetrate illegal activities such as fraud and phishing scams as well as for transmitting threats and viruses. Due to the complexity of the task, it is often difficult for investigators to manually analyze email-related evidence. Automated techniques for email analysis can significantly enhance computer crime investigations. This paper proposes a framework for email investigations that incorporates automated techniques for information extraction and linkage discovery. The application of text/data mining and link analysis techniques assists in inferring social networks and in accurately correlating events and activities from email-related evidence.
2012 46th Annual Conference on Information Sciences and Systems (CISS), 2012
Online auction networks often use reputation-based systems to help users assess each other's hone... more Online auction networks often use reputation-based systems to help users assess each other's honesty and integrity. Fraudsters, however, can collude with accomplices to accumulate bogus positive feedback to manipulate the reputation systems. In this paper, we model an online auction network with fraudsters as a random network with hidden communities (fraudsters and associated accomplices), and propose a maximum likelihood framework to detect the fraudsters. We develop an iterative message passing algorithm to heuristically solve the maximum likelihood detection problem. This algorithm identifies fraudsters and accomplices in a distributed fashion and is a scalable solution. The algorithm converges in a finite number of iterations and has very high detection rates according to our simulations.
Security has become one of the major issues for Data Communication over wired and wireless networ... more Security has become one of the major issues for Data Communication over wired and wireless networks. In Wireless Sensor Networks (WSN), the hackers can inject false data via compromised nodes and can able to alter the original files. There are many chances to perform a Denial Of Service (DOS) attack in WSNs. Initially send the Dynamic Key to all the cluster nodes followed by neighboring nodes. Then send the file which will be hidden and is secured by encrypting using Advanced Encryption Standard (AES) algorithm thereby mitigating from the DOS attack and Sybil attack. AES is secure enough to protect classified information up to the top Secret level, which is highest security. In a Sybil attacks, a malicious user obtains multiple fake identities and pretends to be multiple, Distinct nodes in the system. If a compromised is made while file being sent, then the algorithm finds the affected node and informs to the user that DOS attack is done. I.
IEEE INFOCOM 2008 - The 27th Conference on Computer Communications, 2008
Network coding provides the possibility to maximize network throughput and receives various appli... more Network coding provides the possibility to maximize network throughput and receives various applications in traditional computer networks, wireless sensor networks and peer-to-peer systems. However, the applications built on top of network coding are vulnerable to pollution attacks, in which the compromised forwarders can inject polluted or forged messages into networks. Existing schemes addressing pollution attacks either require an extra secure channel or incur high computation overhead. In this paper, we propose an efficient signature-based scheme to detect and filter pollution attacks for the applications adopting linear network coding techniques. Our scheme exploits a novel homomorphic signature function to enable the source to delegate its signing authority to forwarders, that is, the forwarders can generate the signatures for their output messages without contacting the source. This nice property allows the forwarders to verify the received messages, but prohibit them from creating the valid signatures for polluted or forged ones. Our scheme does not need any extra secure channels, and can provide source authentication and batch verification. Experimental results show that it can improve computation efficiency up to ten times compared to some existing one. In addition, we present an alternate lightweight scheme based on a much simpler linear signature function. This alternate scheme provides a tradeoff between computation efficiency and security.
Simulink is widely used for model-driven development (MDD) of cyber-physical systems. Typically, ... more Simulink is widely used for model-driven development (MDD) of cyber-physical systems. Typically, the Simulink-based development starts with Stateflow modeling, followed by simulation, validation, and code generation mapped to physical execution platforms. However, recent trends have raised the demands of rigorous verification on safety-critical applications to prevent intrinsic development faults and improve the system dependability, which is unfortunately challenging. Even though the constructed Stateflow model and the generated code pass the validation of Simulink Design Verifier and Simulink Polyspace, respectively, the system may still fail due to some implicit defects contained in the design model (design defect) and the generated code (implementation defects). In this article, we bridge the Stateflow-based MDD and a well-defined rigorous verification to reduce development faults. First, we develop a self-contained toolkit to translate a Stateflow model into timed automata, whe...
2007 IEEE Internatonal Conference on Mobile Adhoc and Sensor Systems, 2007
After three years of organizing the wireless and sensor network security (WSNS) workshop, it is t... more After three years of organizing the wireless and sensor network security (WSNS) workshop, it is time for some retrospection to the workshop objectives and the visible outcome. This review is focusing on the the quality and performance of the workshop. On the one hand, it represents a good source to recapitulate recent research topics related to security in wireless ad hoc and sensor networks. Additionally, it extrapolates future research directions that seem to be interesting and challenging for forthcoming research activities.
2006 IEEE International Performance Computing and Communications Conference, 2006
Network based attackers often relay attacks through intermediary hosts (i.e., stepping stones) to... more Network based attackers often relay attacks through intermediary hosts (i.e., stepping stones) to evade detection. In addition, attackers make detection more difficult by encrypting attack traffic and introducing delay and chaff 1 perturbations into stepping stone connections. Several approaches have been proposed to detect stepping stone attacks. However, none of them performs effectively when delay and chaff perturbations exist simultaneously. In this paper, we propose and analyze algorithms which represent that attackers cannot always evade detection only by adding limited delay and independent chaff perturbations. We provide the upper bounds on the number of packets needed to confidently detect stepping stone connections from nonstepping stone connections with any given probability of false attribution. We compare our algorithms with previous ones and the experimental results show that our algorithms are more effective in detecting stepping stone attacks in some scenarios.
2004 IEEE International Conference on Mobile Ad-hoc and Sensor Systems (IEEE Cat. No.04EX975)
Several problems are required to be fixed in order to apply geographical routing protocol Greedy ... more Several problems are required to be fixed in order to apply geographical routing protocol Greedy Perimeter Stateless Routing (GPSR) in wireless sensor networks. First, GPSR is designed under the assumption of symmetric links (i.e., bidirectional reachability) which is not realistic for many practical sensor networks. Second, in sensor networks, packet destinations are often marked with locations instead of identifiers like IP address and therefore packets are routed to the home node which is the node geographically closest to the destined location. GPSR is not efficient in identifying the home node when the target location is outside the exterior perimeter of the sensor network. Third, due to the dynamic nature of sensor networks, maintaining data consistency, that is, data retrieved from the home node for a location should be consistent with the data sent to the same location, becomes a challenge when home nodes change. We propose On-demand GPSR (OD-GPSR), a data driven geographical routing protocol customized for sensor networks with solutions to the above three problems. Simulation results show that OD-GPSR performs well in terms of energy efficiency and packet delivery rate at the cost of a little bit more packet delivery delay.
Third IEEE International Symposium on Dependable, Autonomic and Secure Computing (DASC 2007), 2007
Anonymity technologies such as mix networks have gained increasing attention as a way to provide ... more Anonymity technologies such as mix networks have gained increasing attention as a way to provide communication privacy. Mix networks were developed for messagebased applications such as email, but researchers have adapted mix techniques to low-latency, flow-based applications such as anonymous web browsing. In this paper, we systematically address TCP performance issues of flowbased mix networks. We explain why a mix's batching and reordering schemes can dramatically reduce TCP throughput due to out-of-order packet delivery. We developed a theoretical model to analyze such impact and present closed formulae for TCP throughput in mix networks. To improve TCP performance, we examined the approach of increasing TCP's duplicate threshold parameter and derived closed formulae for the performance gains. Our simulation results matched our theoretical analysis well.
Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering, 2009
Currently, multicast services can be implemented at the IP layer or the application layer. While ... more Currently, multicast services can be implemented at the IP layer or the application layer. While IP multicast violates the stateless paradigm of Internet and incurs great difficulties to congestion and flow control, application-layer multicast is lack of scalability due to the unreliability and resource constraints of end-hosts. Moreover, security is a main weakness in Internet-wide group communications. We propose in this paper a novel architecture for secure and scalable multicast in the Internet. In our architecture, a Multicast Agent in each Autonomous System (AS) is responsible for delivering multicast packets at the ASlevel, relaying packets to end-hosts, and generating and updating keys to secure group communications. The proposed membership management protocol enables no-delay to membership updating; the proposed inter-domain routing protocol reduces the worst-case link stress by one magnitude compared to state-of-the-art protocols, and bounds the extra bandwidth cost within one percent compared to traditional IP multicast.
IFIP Advances in Information and Communication Technology, 2012
Peer-to-peer (P2P) file sharing networks are often abused to distribute content that is prohibite... more Peer-to-peer (P2P) file sharing networks are often abused to distribute content that is prohibited by law. Strong evidence of suspicion must be provided to obtain a court order to identify the location of an offender. However, initial evidence collection from a P2P network is a challenge due to the lack of a central point of control and the dynamic nature of the network. This paper describes an initial evidence collection tool for P2P network forensics. The tool performs active and passive monitoring by inserting a modified peer node in a P2P network that records relevant information about nodes that distribute contraband files. It logs data sent by suspicious nodes along with timestamps and unique identification information, which provides a strong, verifiable body of initial evidence.
2010 IEEE 30th International Conference on Distributed Computing Systems, 2010
Internet has become an essential part of the daily life for billions of users worldwide, who are ... more Internet has become an essential part of the daily life for billions of users worldwide, who are using a large variety of network services and applications everyday. However, there have been serious security problems and network failures that are hard to resolve, for example, botnet attacks, polymorphic worm/virus spreading, DDoS, and flash crowds. To address many of these problems, we need to have a network-wide view of the traffic dynamics, and more importantly, be able to detect traffic anomalies in a timely manner. Spatial analysis methods have been proved to be effective in detecting network-wide traffic anomalies that are not detectable at a single monitor. To our knowledge, Principle Component Analysis (PCA) is the best-known spatial detection method for the coordinated low-profile traffic anomalies. However, existing PCA-based solutions have scalability problems in that they require linear running time and space to analyze the traffic measurements within a sliding window, which makes it often infeasible to be deployed for monitoring large-scale high-speed networks. We propose a sketch-based streaming PCA algorithm for the network-wide traffic anomaly detection in a distributed fashion. Our algorithm only requires logarithmic running time and space at both local monitors and Network Operation Centers (NOCs), and can detect both high-profile and coordinated lowprofile traffic anomalies with bounded errors.
2012 IEEE 9th International Conference on Mobile Ad-Hoc and Sensor Systems (MASS 2012), 2012
The cognitive radio (CR) nodes in a cognitive radio network (CRN) do not have license to use spec... more The cognitive radio (CR) nodes in a cognitive radio network (CRN) do not have license to use specific spectrum band. Instead, they use the spectrum bands of the licensed primary users (PU) without interfering with the PU. When the PU becomes active, interfering CRs should leave to another available spectrum band within the PU's tolerable interference delay (TID). Therefore, CRN operates over wide spectrum bands which span many channels. Since each channel is typically licensed to one PU, this requires that channels be sensed separately. This adds monitoring overhead, where the CR should monitor (sense) the channel every TID, which reduces the throughput. For this reason, the node cannot monitor the whole set of channels. Deciding which set of channels to monitor affect other functions in the CRN like routing. Work done on routing in literature assumes that each node maintains a set of available channels which is obtained by sensing. Route setup decision will be made based on the available sets at all nodes. However, there may be some other available channels that the node is not aware of their availability which may enhance the routing quality metric. Also, taking into consideration only the sets of channels available at the CR nodes may preclude finding an end-to-end path. In this paper, we propose a spectrum decision framework that is complementary to the existing routing protocols. This framework is based on two objectives: 1) enhancing the route quality by sensing a few more channels at some nodes. These channels can enhance the quality by: reducing the switching time, requiring shorter sensing time, or expected to be available for longer time; 2) increasing the probability of finding a path by sensing more channels at some nodes in case the routing protocol did not find a path. Simulation results show that the proposed framework can result in enhancement that can be as high as 100% over the routing protocols that build their decisions based on the available channels at each node only.
2013 IEEE Global Communications Conference (GLOBECOM), 2013
Routing in cognitive radio networks (CRNs) necessitates a cross-layering approach. However, accor... more Routing in cognitive radio networks (CRNs) necessitates a cross-layering approach. However, according to [1], CRN routing protocols proposed in literature are partially cross-layer, because the information flow is only from physical layer to network layer, e.g., about channels availabilities. In this work, we introduce a cross-layer routing protocol (CLRP), which considers both the channels that are known to be available at each node, as well as other channels that may be available. The availabilities of the latter channels are considered using a stochastic approach. CLRP computes an end to end path, and feeds the physical layer with information about which channels to sense and which nodes should perform the sensing, such that the expected route quality is enhanced. Simulation results show that CLRP outperforms other cross-layer routing protocols in terms of throughput and stability of the path being setup, and increases the probability of finding an end-to-end path.
Proceedings 22nd International Conference on Distributed Computing Systems
For many Internet applications, the ability to protect the identity of participants in a distribu... more For many Internet applications, the ability to protect the identity of participants in a distributed applications is critical. For such applications, a number of anonymous communication systems have been realized over the recent years. The effectiveness of these systems relies greatly on the way messages are routed among the participants. (We call this the route selection strategy.) In this paper, we describe how to select routes so as to maximize the ability of the anonymous communication systems to protect anonymity. To measure this ability, we define a metric (anonymity degree), and we design and evaluate an optimal route selection strategy that maximizes the anonymity degree of a system. Our analytical and experimental data shows that the anonymity degree may not always monotonically increase as the length of communication paths increase. We also found that variable path-length strategies perform better than fixed-length strategies.
With the phenomenal growth of the Internet, more and more people enjoy and depend on its provided... more With the phenomenal growth of the Internet, more and more people enjoy and depend on its provided services. Unfortunately, the number of network-based attacks is also increasing quickly. Network attackers can very easily hide their identities, and thereby reduce the chance of being captured and punished. Some attacks can even succeed by using only one or a few well-targeted packets. Therefore, it is desirable to design effective and efficient single packet IP traceback systems to attribute attackers. Several single packet IP traceback systems have been designed using Bloom filters. However, the inherent false positives of Bloom filters caused by unavoidable collisions restrain the effectiveness of these systems. To reduce the impact of unavoidable collisions in Bloom filters, we propose a topology-aware single packet IP traceback system, namely TOPO. We utilize router's local topology information, i.e., its immediate predecessor information. Our performance analysis shows that TOPO can reduce the number and scope of unnecessary queries, and significantly decrease false attributions. Furthermore, to improve the practicability of Bloom filter-based IP traceback systems, we design TOPO to allow partial deployment while maintaining its traceback capability. When Bloom filters are used, it is difficult to decide their optimal control parameters a priori. We design a k-adaptive mechanism which can dynamically adjust parameters of Bloom filters to reduce the false positive rate.
Uploads
Papers by Yong Guan