1.
Tayebeh Rajabi, Alvi Ataur Khalil, Mohammad Hossein Manshaei, Mohammad Ashiqur Rahman, Mohammad Dakhilalian, Maurice Ngouen, Murtuza Jadliwala, A. Selcuk Uluagac
Feasibility Analysis for Sybil Attacks in Shard-Based Permissionless Blockchains Journal Article
ACM Distributed Ledger Technologies: Research and Practice Journal, 2023.
Abstract | Links | BibTeX | Tags: Blockchain Security, Network Security, Smart Home Security
@article{Tayabeh2023,
title = {Feasibility Analysis for Sybil Attacks in Shard-Based Permissionless Blockchains},
author = {Tayebeh Rajabi and Alvi Ataur Khalil and Mohammad Hossein Manshaei and Mohammad Ashiqur Rahman and Mohammad Dakhilalian and Maurice Ngouen and Murtuza Jadliwala and A. Selcuk Uluagac},
url = {https://doi.org/10.1145/3618302},
doi = {10.1145/3618302},
year = {2023},
date = {2023-12-01},
urldate = {2023-12-01},
journal = {ACM Distributed Ledger Technologies: Research and Practice Journal},
publisher = {Association for Computing Machinery},
address = {New York, NY, USA},
abstract = {Committee-based permissionless blockchain approaches overcome single leader consensus protocols’ scalability issues by partitioning the outstanding transaction set into shards and selecting multiple committees to process these transactions in parallel. However, by design, shard-based blockchain solutions are vulnerable to Sybil attacks. An adversary with enough computational/hash power can easily manipulate the consensus protocol by generating multiple valid node identifiers/IDs (i.e., multiple Sybil committee members).Despite the straightforward nature of these attacks, they have not been systematically investigated. This article fills this research gap by analyzing Sybil attacks in shard-based consensus of proof-of-work blockchain systems. Specifically, we provide a detailed analysis for Elastico, one of the prominent shard-based blockchain models. We show that the proof-of-work technique used for ID generation in the initial phase of such protocols is vulnerable to Sybil attacks when an adversary (could be a group of colluding nodes) possesses enough hash power. We analytically derive conditions for two different Sybil attacks and perform numerical simulations to validate our theoretical results under various parameters. Further, we utilize the BlockSim simulator to validate our mathematical computation, and results confirm the correctness of the analysis.},
keywords = {Blockchain Security, Network Security, Smart Home Security},
pubstate = {published},
tppubtype = {article}
}
Committee-based permissionless blockchain approaches overcome single leader consensus protocols’ scalability issues by partitioning the outstanding transaction set into shards and selecting multiple committees to process these transactions in parallel. However, by design, shard-based blockchain solutions are vulnerable to Sybil attacks. An adversary with enough computational/hash power can easily manipulate the consensus protocol by generating multiple valid node identifiers/IDs (i.e., multiple Sybil committee members).Despite the straightforward nature of these attacks, they have not been systematically investigated. This article fills this research gap by analyzing Sybil attacks in shard-based consensus of proof-of-work blockchain systems. Specifically, we provide a detailed analysis for Elastico, one of the prominent shard-based blockchain models. We show that the proof-of-work technique used for ID generation in the initial phase of such protocols is vulnerable to Sybil attacks when an adversary (could be a group of colluding nodes) possesses enough hash power. We analytically derive conditions for two different Sybil attacks and perform numerical simulations to validate our theoretical results under various parameters. Further, we utilize the BlockSim simulator to validate our mathematical computation, and results confirm the correctness of the analysis.
2.
Maryna Veksler, David Langus Rodríguez, Ahmet Aris, Kemal Akkaya, A. Selcuk Uluagac
LoFin: LoRa-based UAV Fingerprinting Framework Conference Paper
In the Proceedings of the 41st IEEE Military Communications Conference (MILCOM) , 2022.
Abstract | Links | BibTeX | Tags: Fingerprinting, Network Security, UAV Security
@conference{10017584,
title = {LoFin: LoRa-based UAV Fingerprinting Framework},
author = {Maryna Veksler and David Langus Rodríguez and Ahmet Aris and Kemal Akkaya and A. Selcuk Uluagac},
url = {https://ieeexplore.ieee.org/abstract/document/10017584/},
year = {2022},
date = {2022-01-01},
urldate = {2022-01-01},
booktitle = {In the Proceedings of the 41st IEEE Military Communications Conference (MILCOM)
},
abstract = {The emerging proliferation of unmanned aerial vehicles (UAV) combined with their autonomous capabilities established the solid incorporation of UAVs for military applications. However, seamless deployment of drones into the adversarial environment and on the battlefield requires a robust and secure network stack, protected from adversarial intrusion. As LoRa became a low-cost solution for the long-distance control channel, it solved the challenge of long-range connectivity and prolonged lifespan present in UAV applications. However, the existing implementations lack protection mechanisms against unauthorized access. In this paper, we present LoFin, the first fingerprinting framework used to identify telemetry transceivers that communicate over the LoRa channel. LoFin exploits information leaked due to the differences in hardware structure, which results in processing time variations. Passively collecting},
keywords = {Fingerprinting, Network Security, UAV Security},
pubstate = {published},
tppubtype = {conference}
}
The emerging proliferation of unmanned aerial vehicles (UAV) combined with their autonomous capabilities established the solid incorporation of UAVs for military applications. However, seamless deployment of drones into the adversarial environment and on the battlefield requires a robust and secure network stack, protected from adversarial intrusion. As LoRa became a low-cost solution for the long-distance control channel, it solved the challenge of long-range connectivity and prolonged lifespan present in UAV applications. However, the existing implementations lack protection mechanisms against unauthorized access. In this paper, we present LoFin, the first fingerprinting framework used to identify telemetry transceivers that communicate over the LoRa channel. LoFin exploits information leaked due to the differences in hardware structure, which results in processing time variations. Passively collecting
3.
Ehsan Nowroozi, Yassine Mekdad, Mauro Conti, Simone Milani, Selcuk Uluagac, Berrin Yanikoglu
Real or Virtual: A Video Conferencing Background Manipulation-Detection System Conference Paper
Arxiv, 2022.
Abstract | Links | BibTeX | Tags: Network Security, Web Security
@conference{EhsanRealOrVirtual,
title = {Real or Virtual: A Video Conferencing Background Manipulation-Detection System},
author = {Ehsan Nowroozi and Yassine Mekdad and Mauro Conti and Simone Milani and Selcuk Uluagac and Berrin Yanikoglu},
url = {https://arxiv.org/abs/2204.11853},
year = {2022},
date = {2022-01-01},
urldate = {2022-01-01},
booktitle = {Arxiv},
journal = {arXiv },
abstract = {Recently, the popularity and wide use of the last-generation video conferencing technologies created an exponential growth in its market size. Such technology allows participants in different geographic regions to have a virtual face-to-face meeting. Additionally, it enables users to employ a virtual background to conceal their own environment due to privacy concerns or to reduce distractions, particularly in professional settings. Nevertheless, in scenarios where the users should not hide their actual locations, they may mislead other participants by claiming their virtual background as a real one. Therefore, it is crucial to develop tools and strategies to detect the authenticity of the considered virtual background. In this paper, we present a detection strategy to distinguish between real and virtual video conferencing user backgrounds. We demonstrate that our detector is robust against two attack scenarios. The first scenario considers the case where the detector is unaware about the attacks and inn the second scenario, we make the detector aware of the adversarial attacks, which we refer to Adversarial Multimedia Forensics (i.e, the forensically-edited frames are included in the training set). Given the lack of publicly available dataset of virtual and real backgrounds for video conferencing, we created our own dataset and made them publicly available [1]. Then, we demonstrate the robustness of our detector against different adversarial attacks that the adversary considers. Ultimately, our detector's performance is significant against the CRSPAM1372 [2] features, and post-processing operations such as geometric transformations with different quality.},
keywords = {Network Security, Web Security},
pubstate = {published},
tppubtype = {conference}
}
Recently, the popularity and wide use of the last-generation video conferencing technologies created an exponential growth in its market size. Such technology allows participants in different geographic regions to have a virtual face-to-face meeting. Additionally, it enables users to employ a virtual background to conceal their own environment due to privacy concerns or to reduce distractions, particularly in professional settings. Nevertheless, in scenarios where the users should not hide their actual locations, they may mislead other participants by claiming their virtual background as a real one. Therefore, it is crucial to develop tools and strategies to detect the authenticity of the considered virtual background. In this paper, we present a detection strategy to distinguish between real and virtual video conferencing user backgrounds. We demonstrate that our detector is robust against two attack scenarios. The first scenario considers the case where the detector is unaware about the attacks and inn the second scenario, we make the detector aware of the adversarial attacks, which we refer to Adversarial Multimedia Forensics (i.e, the forensically-edited frames are included in the training set). Given the lack of publicly available dataset of virtual and real backgrounds for video conferencing, we created our own dataset and made them publicly available [1]. Then, we demonstrate the robustness of our detector against different adversarial attacks that the adversary considers. Ultimately, our detector's performance is significant against the CRSPAM1372 [2] features, and post-processing operations such as geometric transformations with different quality.
4.
Akm Iqtidar Newaz, Ahmet Aris, Amit Kumar Sikder, A Selcuk Uluagac
Systematic Threat Analysis of Modern Unified Healthcare Communication Systems Conference Paper
In the Proceedings of the 37th IEEE Global Communications Conference (GLOBECOM), 2022.
Abstract | Links | BibTeX | Tags: Healthcare Security, Network Security
@conference{iqtidarThreatAnalysis,
title = {Systematic Threat Analysis of Modern Unified Healthcare Communication Systems},
author = {Akm Iqtidar Newaz and Ahmet Aris and Amit Kumar Sikder and A Selcuk Uluagac},
url = {https://ieeexplore.ieee.org/abstract/document/10001605/},
year = {2022},
date = {2022-01-01},
urldate = {2022-01-01},
booktitle = {In the Proceedings of the 37th IEEE Global Communications Conference (GLOBECOM)},
abstract = {Recently, smart medical devices have become preva-lent in remote monitoring of patients and the delivery of medication. The ongoing Covid-19 pandemic situation has boosted the upward trend of the popularity of smart medical devices in the healthcare system. Simultaneously, different device manufacturers and technologies compete for a share in a smart medical device's market, which forces the integration of diverse smart medical de-vices into a common healthcare ecosystem. Hence, modern unified healthcare communication systems (UHCSs) combine ISO/IEEE 11073 and Health Level Seven (HL7) communication standards to support smart medical devices' interoperability and their communication with healthcare providers. Despite their advantages in supporting various smart medical devices and communication technologies, these standards do not provide any security and suffer from vulnerabilities},
keywords = {Healthcare Security, Network Security},
pubstate = {published},
tppubtype = {conference}
}
Recently, smart medical devices have become preva-lent in remote monitoring of patients and the delivery of medication. The ongoing Covid-19 pandemic situation has boosted the upward trend of the popularity of smart medical devices in the healthcare system. Simultaneously, different device manufacturers and technologies compete for a share in a smart medical device's market, which forces the integration of diverse smart medical de-vices into a common healthcare ecosystem. Hence, modern unified healthcare communication systems (UHCSs) combine ISO/IEEE 11073 and Health Level Seven (HL7) communication standards to support smart medical devices' interoperability and their communication with healthcare providers. Despite their advantages in supporting various smart medical devices and communication technologies, these standards do not provide any security and suffer from vulnerabilities
5.
Ahmet Kurt, Nico Saputro, Kemal Akkaya, A. Selcuk Uluagac
Distributed Connectivity Maintenance in Swarm of Drones During Post-Disaster Transportation Applications Journal Article
IEEE Transactions on Intelligent Transportation Systems Journal, 2021.
Abstract | Links | BibTeX | Tags: Network Security, UAV Security
@article{9385994,
title = {Distributed Connectivity Maintenance in Swarm of Drones During Post-Disaster Transportation Applications},
author = {Ahmet Kurt and Nico Saputro and Kemal Akkaya and A. Selcuk Uluagac},
url = {https://ieeexplore.ieee.org/abstract/document/9385994/},
year = {2021},
date = {2021-01-01},
urldate = {2021-01-01},
journal = {IEEE Transactions on Intelligent Transportation Systems Journal},
abstract = {Considering post-disaster scenarios for intelligent traffic management and damage assessment where communication infrastructure may not be available, we advocate a swarm-of-drones mesh communication architecture that can sustain in-network connectivity among drones. The connectivity sustenance requirement stems from the fact that drones may move to various locations in response to service requests but they still need to cooperate for data collection and transmissions. To address this need, we propose a fully distributed connectivity maintenance heuristic which enables the swarm to quickly adapt its formation in response to the service requests. To select the moving drone(s) that would bring minimal overhead in terms of time and moving distance, the connected dominating set (CDS) concept from graph theory is utilized. Specifically, a variation of CDS, namely E-CDS, is introduced to address the needs},
keywords = {Network Security, UAV Security},
pubstate = {published},
tppubtype = {article}
}
Considering post-disaster scenarios for intelligent traffic management and damage assessment where communication infrastructure may not be available, we advocate a swarm-of-drones mesh communication architecture that can sustain in-network connectivity among drones. The connectivity sustenance requirement stems from the fact that drones may move to various locations in response to service requests but they still need to cooperate for data collection and transmissions. To address this need, we propose a fully distributed connectivity maintenance heuristic which enables the swarm to quickly adapt its formation in response to the service requests. To select the moving drone(s) that would bring minimal overhead in terms of time and moving distance, the connected dominating set (CDS) concept from graph theory is utilized. Specifically, a variation of CDS, namely E-CDS, is introduced to address the needs
6.
Ahmet Kurt, Enes Erdin, Kemal Akkaya, Selcuk Uluagac, Mumin Cebe
D-LNBot: A Scalable, Cost-Free and Covert Hybrid Botnet on Bitcoin's Lightning Network Journal Article
IEEE Transactions on Dependable and Secure Computing Journal, 2021.
Abstract | Links | BibTeX | Tags: Blockchain Security, Network Security
@article{Kurt2021DLNBotAS,
title = {D-LNBot: A Scalable, Cost-Free and Covert Hybrid Botnet on Bitcoin's Lightning Network},
author = {Ahmet Kurt and Enes Erdin and Kemal Akkaya and Selcuk Uluagac and Mumin Cebe},
url = {https://api.semanticscholar.org/CorpusID:245131355},
year = {2021},
date = {2021-01-01},
urldate = {2021-01-01},
journal = {IEEE Transactions on Dependable and Secure Computing Journal},
abstract = {While various covert botnets were proposed in the past, they still lack complete anonymization for their servers/botmasters or suffer from slow communication between the botmaster and the bots. In this paper, we first propose a new generation hybrid botnet that covertly and efficiently communicates over Bitcoin Lightning Network (LN), called LNBot. Exploiting various anonymity features of LN, we show the feasibility of a scalable two-layer botnet which completely anonymizes the identity of the botmaster. In the first layer, the botmaster anonymously sends the commands to the command and control (C&C) servers through regular LN payments. Specifically, LNBot allows botmaster's commands to be sent in the form of surreptitious multi-hop LN payments, where the commands are either encoded with the payments or attached to the payments to provide covert communications. In the second layer, C&C servers further},
keywords = {Blockchain Security, Network Security},
pubstate = {published},
tppubtype = {article}
}
While various covert botnets were proposed in the past, they still lack complete anonymization for their servers/botmasters or suffer from slow communication between the botmaster and the bots. In this paper, we first propose a new generation hybrid botnet that covertly and efficiently communicates over Bitcoin Lightning Network (LN), called LNBot. Exploiting various anonymity features of LN, we show the feasibility of a scalable two-layer botnet which completely anonymizes the identity of the botmaster. In the first layer, the botmaster anonymously sends the commands to the command and control (C&C) servers through regular LN payments. Specifically, LNBot allows botmaster's commands to be sent in the form of surreptitious multi-hop LN payments, where the commands are either encoded with the payments or attached to the payments to provide covert communications. In the second layer, C&C servers further
7.
Oscar G. Bautista, Nico Saputro, Kemal Akkaya, Selcuk Uluagac
A novel routing metric for IEEE 802.11s-based swarm-of-drones applications Conference Paper
In the Proceedings of the 16th EAI International Conference on Mobile and Ubiquitous Systems, 2020.
Abstract | Links | BibTeX | Tags: Network Security, UAV Security
@conference{10.1145/3360774.3368197,
title = {A novel routing metric for IEEE 802.11s-based swarm-of-drones applications},
author = {Oscar G. Bautista and Nico Saputro and Kemal Akkaya and Selcuk Uluagac},
url = {https://doi.org/10.1145/3360774.3368197},
year = {2020},
date = {2020-01-01},
urldate = {2020-01-01},
booktitle = {In the Proceedings of the 16th EAI International Conference on Mobile and Ubiquitous Systems},
abstract = {With the proliferation of drones in our daily lives, there is an increasing need for handling their numerous challenges. One of such challenge arises when a swarm-of-drones are deployed to accomplish a specific task which requires coordination and communication among the drones. While this swarm-of-drones is essentially a special form of mobile ad hoc networks (MANETs) which has been studied for many years, there are still some unique requirements of drone applications that necessitates re-visiting MANET approaches. These challenges stem from 3–D environments the drones are deployed in, and their specific way of mobility which adds to the wireless link management challenges among the drones. In this paper, we consider an existing routing standard that is used to enable meshing capability among Wi-Fi enabled nodes, namely IEEE 802.11s and adopt its routing capabilities for swarm-of-drones. Specifically, we propose a link quality metric called SrFTime as an improvement to existing Airtime metric which is the 802.11s default routing metric to enable better network throughput for drone applications. This new metric is designed to fit the link characteristics of drones and enable more efficient routes from drones to their gateway. The evaluations in the actual 802.11s standard indicates that our proposed metric outperforms the existing one consistently under various conditions.},
keywords = {Network Security, UAV Security},
pubstate = {published},
tppubtype = {conference}
}
With the proliferation of drones in our daily lives, there is an increasing need for handling their numerous challenges. One of such challenge arises when a swarm-of-drones are deployed to accomplish a specific task which requires coordination and communication among the drones. While this swarm-of-drones is essentially a special form of mobile ad hoc networks (MANETs) which has been studied for many years, there are still some unique requirements of drone applications that necessitates re-visiting MANET approaches. These challenges stem from 3–D environments the drones are deployed in, and their specific way of mobility which adds to the wireless link management challenges among the drones. In this paper, we consider an existing routing standard that is used to enable meshing capability among Wi-Fi enabled nodes, namely IEEE 802.11s and adopt its routing capabilities for swarm-of-drones. Specifically, we propose a link quality metric called SrFTime as an improvement to existing Airtime metric which is the 802.11s default routing metric to enable better network throughput for drone applications. This new metric is designed to fit the link characteristics of drones and enable more efficient routes from drones to their gateway. The evaluations in the actual 802.11s standard indicates that our proposed metric outperforms the existing one consistently under various conditions.
8.
Luis Puche Rondon, Leonardo Babun, Kemal Akkaya, A. Selcuk Uluagac
HDMI-Walk: Attacking HDMI Distribution Networks via Consumer Electronic Control Protocol Conference Paper
In the Proceedings of the 35th Annual Computer Security Applications Conference, 2019.
Abstract | Links | BibTeX | Tags: Enterprise Security, Network Security
@conference{Rondon2019HDMI-walk,
title = {HDMI-Walk: Attacking HDMI Distribution Networks via Consumer Electronic Control Protocol},
author = {Luis Puche Rondon and Leonardo Babun and Kemal Akkaya and A. Selcuk Uluagac},
url = {https://doi.org/10.1145/3359789.3359841},
year = {2019},
date = {2019-01-01},
urldate = {2019-01-01},
booktitle = {In the Proceedings of the 35th Annual Computer Security Applications Conference},
abstract = {The High Definition Multimedia Interface (HDMI) is the backbone and the de-facto standard for Audio/Video interfacing between video-enabled devices. Today, almost tens of billions of HDMI devices exist in the world and are widely used to distribute A/V signals in smart homes, offices, concert halls, and sporting events making HDMI one of the most highly deployed systems in the world. An important component in HDMI is the Consumer Electronics Control (CEC) protocol, which allows for the interaction between devices within an HDMI distribution network. Nonetheless, existing network security mechanisms only protect traditional networking components, leaving CEC outside of their scope. In this work, we identify and tap into CEC protocol vulnerabilities, using them to implement realistic proof-of-work attacks on HDMI distribution networks. We study, how current insecure CEC protocol practices and carelessly implemented HDMI distributions may grant an adversary a novel attack surface for HDMI devices otherwise thought to be unreachable through traditional means. To introduce this novel attack surface, in this paper, we present HDMI-Walk, which opens a realm of remote and local CEC attacks to HDMI devices. Specifically, with HDMI-Walk, an attacker can perform malicious analysis of devices, eavesdropping, Denial of Service attacks, targeted device attacks, and even facilitate other well-known existing attacks through HDMI. With HDMI-Walk, we prove that it is feasible for an attacker to gain arbitrary control of HDMI devices. We demonstrate the implementations of both local and remote attacks with commodity HDMI devices including Smart TVs and Media Players. Our work aims to uncover vulnerabilities in a very well deployed system like HDMI distributions. The consequences of which can largely impact HDMI users as well as other systems which depend on these distributions. Finally, we discuss security mechanisms to provide impactful and comprehensive security evaluation to these real-world systems while guaranteeing deployability and providing minimal overhead, while considering the current limitations of the CEC protocol. To the best of our knowledge, this is the first work solely investigating the security of HDMI device distribution networks.},
keywords = {Enterprise Security, Network Security},
pubstate = {published},
tppubtype = {conference}
}
The High Definition Multimedia Interface (HDMI) is the backbone and the de-facto standard for Audio/Video interfacing between video-enabled devices. Today, almost tens of billions of HDMI devices exist in the world and are widely used to distribute A/V signals in smart homes, offices, concert halls, and sporting events making HDMI one of the most highly deployed systems in the world. An important component in HDMI is the Consumer Electronics Control (CEC) protocol, which allows for the interaction between devices within an HDMI distribution network. Nonetheless, existing network security mechanisms only protect traditional networking components, leaving CEC outside of their scope. In this work, we identify and tap into CEC protocol vulnerabilities, using them to implement realistic proof-of-work attacks on HDMI distribution networks. We study, how current insecure CEC protocol practices and carelessly implemented HDMI distributions may grant an adversary a novel attack surface for HDMI devices otherwise thought to be unreachable through traditional means. To introduce this novel attack surface, in this paper, we present HDMI-Walk, which opens a realm of remote and local CEC attacks to HDMI devices. Specifically, with HDMI-Walk, an attacker can perform malicious analysis of devices, eavesdropping, Denial of Service attacks, targeted device attacks, and even facilitate other well-known existing attacks through HDMI. With HDMI-Walk, we prove that it is feasible for an attacker to gain arbitrary control of HDMI devices. We demonstrate the implementations of both local and remote attacks with commodity HDMI devices including Smart TVs and Media Players. Our work aims to uncover vulnerabilities in a very well deployed system like HDMI distributions. The consequences of which can largely impact HDMI users as well as other systems which depend on these distributions. Finally, we discuss security mechanisms to provide impactful and comprehensive security evaluation to these real-world systems while guaranteeing deployability and providing minimal overhead, while considering the current limitations of the CEC protocol. To the best of our knowledge, this is the first work solely investigating the security of HDMI device distribution networks.
9.
Luis Puche Rondon, Leonardo Babun, Kemal Akkaya, A. Selcuk Uluagac
Attacking HDMI Distribution Networks: Poster Demo/Poster
Proceedings of the 12th Conference on Security and Privacy in Wireless and Mobile Networks, 2019.
Abstract | Links | BibTeX | Tags: Network Security
@Demo/Posters{Rondon2019AttackHDMI,
title = {Attacking HDMI Distribution Networks: Poster},
author = {Luis Puche Rondon and Leonardo Babun and Kemal Akkaya and A. Selcuk Uluagac},
url = {https://doi.org/10.1145/3317549.3326314},
year = {2019},
date = {2019-01-01},
urldate = {2019-01-01},
publisher = {Proceedings of the 12th Conference on Security and Privacy in Wireless and Mobile Networks},
abstract = {The High Definition Multimedia Interface or HDMI is the core and primary standard for Audio/Video communication in various media devices. HDMI allows flexible interaction between devices within HDMI distribution networks. Existing security standards and mechanism only protect traditional networking components. A user may mistakenly believe that a device is secure and an adversary may prove them otherwise. In this ongoing work, we show that by leveraging CEC to an attackers advantage. It is feasible for an attacker to reach devices which were formerly unreachable, and gain arbitrary control of HDMI devices. Specifically, we demonstrate it is possible to execute malicious device analysis, eavesdrop, and perform targeted Denial-of-Service attacks.},
keywords = {Network Security},
pubstate = {published},
tppubtype = {Demo/Posters}
}
The High Definition Multimedia Interface or HDMI is the core and primary standard for Audio/Video communication in various media devices. HDMI allows flexible interaction between devices within HDMI distribution networks. Existing security standards and mechanism only protect traditional networking components. A user may mistakenly believe that a device is secure and an adversary may prove them otherwise. In this ongoing work, we show that by leveraging CEC to an attackers advantage. It is feasible for an attacker to reach devices which were formerly unreachable, and gain arbitrary control of HDMI devices. Specifically, we demonstrate it is possible to execute malicious device analysis, eavesdrop, and perform targeted Denial-of-Service attacks.
10.
Nico Saputro, Kemal Akkaya, Ramazan Algin, Selcuk Uluagac
Drone-Assisted Multi-Purpose Roadside Units for Intelligent Transportation Systems Conference Paper
In the proceedings of the 88th Vehicular Technology Conference (VTC-Fall), 2018.
Abstract | Links | BibTeX | Tags: Network Security, UAV Security
@conference{Saputro2018DroneTranspSystemb,
title = {Drone-Assisted Multi-Purpose Roadside Units for Intelligent Transportation Systems},
author = {Nico Saputro and Kemal Akkaya and Ramazan Algin and Selcuk Uluagac},
url = {https://ieeexplore.ieee.org/abstract/document/8690977/},
year = {2018},
date = {2018-01-01},
urldate = {2018-01-01},
booktitle = {In the proceedings of the 88th Vehicular Technology Conference (VTC-Fall)},
abstract = {As drones are becoming prevalent to be deployed in various civic applications, there is a need to integrate them into efficient and secure communications with the existing infrastructure. In this paper, considering emergency scenarios for intelligent transportation applications, we design a secure hybrid communication infrastructure for mobile road-side units (RSUs) that are based on drones. The architecture tackles interoperability issues when Dedicated Short Range Communications (DSRC), wireless mesh, and LTE need to coexist for coordination. Specifically, we propose a novel tunneling protocol to integrate LTE with IEEE 802.11s mesh network. In addition, we ensure that only legitimate users can connect and control the mobile RSUs by integrating an authentication framework built on top of the recent OAuth 2.0 standard. A detailed communication protocol is proposed within the elements of the architecture from vehicles to control center for emergency operations. The proposed secure architecture is implemented in ns-3 and tested for its performance under heavy multimedia traffic. The results indicate that the proposed hybrid architecture can enable smooth multimedia traffic delivery via the mobile RSU.},
keywords = {Network Security, UAV Security},
pubstate = {published},
tppubtype = {conference}
}
As drones are becoming prevalent to be deployed in various civic applications, there is a need to integrate them into efficient and secure communications with the existing infrastructure. In this paper, considering emergency scenarios for intelligent transportation applications, we design a secure hybrid communication infrastructure for mobile road-side units (RSUs) that are based on drones. The architecture tackles interoperability issues when Dedicated Short Range Communications (DSRC), wireless mesh, and LTE need to coexist for coordination. Specifically, we propose a novel tunneling protocol to integrate LTE with IEEE 802.11s mesh network. In addition, we ensure that only legitimate users can connect and control the mobile RSUs by integrating an authentication framework built on top of the recent OAuth 2.0 standard. A detailed communication protocol is proposed within the elements of the architecture from vehicles to control center for emergency operations. The proposed secure architecture is implemented in ns-3 and tested for its performance under heavy multimedia traffic. The results indicate that the proposed hybrid architecture can enable smooth multimedia traffic delivery via the mobile RSU.
11.
Nico Saputro, Kemal Akkaya, Selcuk Uluagac
Supporting Seamless Connectivity in Drone-assisted Intelligent Transportation Systems Conference Paper
In the Proceedings of the 43rd IEEE Conference on Local Computer Networks Workshops (LCN Workshops), 2018.
Abstract | Links | BibTeX | Tags: Network Security, UAV Security
@conference{Saputro2018DronSeamlessConnb,
title = {Supporting Seamless Connectivity in Drone-assisted Intelligent Transportation Systems},
author = {Nico Saputro and Kemal Akkaya and Selcuk Uluagac},
url = {https://ieeexplore.ieee.org/abstract/document/8628496},
year = {2018},
date = {2018-01-01},
urldate = {2018-01-01},
booktitle = {In the Proceedings of the 43rd IEEE Conference on Local Computer Networks Workshops (LCN Workshops)},
abstract = {Considering emergency scenarios for intelligent transportation applications, we propose a swarm of drones communication architecture that can sustain connectivity to assist the authorities for damage assessments. The connectivity sustenance needs stem from the fact that drones may move to various locations in response to service requests from the authorities but they still need to cooperate for data collection and transmissions. To address this need, we propose a centralized connectivity maintenance heuristic which will enable the swarm to dynamically adapt its formation in response to the service requests while ensuring uninterrupted live assessment reports. To select the moving drone(s), the minimum connected dominating set concept is utilized to come up with three strategies of mixed stretching or moving heuristic for the connectivity restoration. The proposed architecture and heuristics are implemented in ns-3 network simulator and the effectiveness is tested in terms of providing undisturbed services under heavy multimedia traffic. The results indicate that the proposed approaches enable uninterrupted multimedia traffic delivery.},
howpublished = {In the Proceedings of the 43rd IEEE Conference on Local Computer Networks Workshops (LCN Workshops)},
keywords = {Network Security, UAV Security},
pubstate = {published},
tppubtype = {conference}
}
Considering emergency scenarios for intelligent transportation applications, we propose a swarm of drones communication architecture that can sustain connectivity to assist the authorities for damage assessments. The connectivity sustenance needs stem from the fact that drones may move to various locations in response to service requests from the authorities but they still need to cooperate for data collection and transmissions. To address this need, we propose a centralized connectivity maintenance heuristic which will enable the swarm to dynamically adapt its formation in response to the service requests while ensuring uninterrupted live assessment reports. To select the moving drone(s), the minimum connected dominating set concept is utilized to come up with three strategies of mixed stretching or moving heuristic for the connectivity restoration. The proposed architecture and heuristics are implemented in ns-3 network simulator and the effectiveness is tested in terms of providing undisturbed services under heavy multimedia traffic. The results indicate that the proposed approaches enable uninterrupted multimedia traffic delivery.
12.
Amit Kumar Sikder, Abbas Acar, Hidayet Aksu, A. Selcuk Uluagac, Kemal Akkaya, Mauro Conti
IoT-enabled smart lighting systems for smart cities Conference Paper
In the Proceedings of the IEEE 8th Annual Computing and Communication Workshop and Conference (CCWC), 2018.
Abstract | Links | BibTeX | Tags: IoT Security, Network Security
@conference{Sikder2018Smartlightingb,
title = {IoT-enabled smart lighting systems for smart cities},
author = {Amit Kumar Sikder and Abbas Acar and Hidayet Aksu and A. Selcuk Uluagac and Kemal Akkaya and Mauro Conti},
url = {https://ieeexplore.ieee.org/abstract/document/8301744},
year = {2018},
date = {2018-01-01},
urldate = {2018-01-01},
booktitle = {In the Proceedings of the IEEE 8th Annual Computing and Communication Workshop and Conference (CCWC)},
abstract = {Over the past few decades, the rate of urbanization has increased enormously. More enhanced services and applications are needed in urban areas to provide a better lifestyle. Smart city, which is a concept of interconnecting modern digital technologies in the context of a city, is a potential solution to enhance the quality and performance of urban services. With the introduction of Internet-of-Things (IoT) in the smart city, new opportunities have emerged to develop new services and integrate different application domains with each other using Information and Communication Technologies. However, to ensure seamless services in an IoT-enabled smart city environment, all the applications have to be maintained with limited energy resources. One of the core sectors that can be improved significantly by implementing IoT is the lighting system of a city since it consumes more energy than other parts of a city. In a smart city, the lighting system is integrated with advanced sensors and communication channels to obtain a Smart Lighting System (SLS). The goal of an SLS is to obtain an autonomous and more efficient lighting management system. In this paper, we provide an overview of the SLS and review different IoT-enabled communication protocols, which can be used to realize the SLS in the context of a smart city. Moreover, we analyzed different usage scenarios for IoT-enabled indoor and outdoor SLS and provide an analysis of the power consumption. Our results reveal that IoT-enabled smart lighting systems can reduce power consumption up to 33.33% in both indoor and outdoor settings. Finally, we discussed the future research directions in SLS in the smart city.},
keywords = {IoT Security, Network Security},
pubstate = {published},
tppubtype = {conference}
}
Over the past few decades, the rate of urbanization has increased enormously. More enhanced services and applications are needed in urban areas to provide a better lifestyle. Smart city, which is a concept of interconnecting modern digital technologies in the context of a city, is a potential solution to enhance the quality and performance of urban services. With the introduction of Internet-of-Things (IoT) in the smart city, new opportunities have emerged to develop new services and integrate different application domains with each other using Information and Communication Technologies. However, to ensure seamless services in an IoT-enabled smart city environment, all the applications have to be maintained with limited energy resources. One of the core sectors that can be improved significantly by implementing IoT is the lighting system of a city since it consumes more energy than other parts of a city. In a smart city, the lighting system is integrated with advanced sensors and communication channels to obtain a Smart Lighting System (SLS). The goal of an SLS is to obtain an autonomous and more efficient lighting management system. In this paper, we provide an overview of the SLS and review different IoT-enabled communication protocols, which can be used to realize the SLS in the context of a smart city. Moreover, we analyzed different usage scenarios for IoT-enabled indoor and outdoor SLS and provide an analysis of the power consumption. Our results reveal that IoT-enabled smart lighting systems can reduce power consumption up to 33.33% in both indoor and outdoor settings. Finally, we discussed the future research directions in SLS in the smart city.
13.
Kyle Denney, A. Selcuk Uluagac, Hidayet Aksu, Kemal Akkaya
An Android-Based Covert Channel Framework on Wearables Using Status Bar Notifications Journal Article
2018.
Abstract | Links | BibTeX | Tags: Covert channels, Network Security, Wearables
@article{Denney2018AndroidCoverCh,
title = {An Android-Based Covert Channel Framework on Wearables Using Status Bar Notifications},
author = {Kyle Denney and A. Selcuk Uluagac and Hidayet Aksu and Kemal Akkaya},
editor = {Springer International Journal},
url = {https://doi.org/10.1007/978-3-319-97643-3_1},
year = {2018},
date = {2018-01-01},
urldate = {2018-01-01},
booktitle = {Springer International Publishing journal},
abstract = {Covert channels circumvent security measures to steal sensitive data undetectable to an onlooker. Traditionally, covert channels utilize global system resources or settings to send hidden messages. This chapter introduces covert channels and focuses on a novel covert channel on Android-based Internet of Things (IoT) devices. Particularly, we were able to make a covert channel using notifications a user gets from everyday applications. The chapter will also present this covert channel by discussing the framework, evaluating the performance, and demonstrating the functionality and flexibility of the proposed model.},
keywords = {Covert channels, Network Security, Wearables},
pubstate = {published},
tppubtype = {article}
}
Covert channels circumvent security measures to steal sensitive data undetectable to an onlooker. Traditionally, covert channels utilize global system resources or settings to send hidden messages. This chapter introduces covert channels and focuses on a novel covert channel on Android-based Internet of Things (IoT) devices. Particularly, we were able to make a covert channel using notifications a user gets from everyday applications. The chapter will also present this covert channel by discussing the framework, evaluating the performance, and demonstrating the functionality and flexibility of the proposed model.
14.
Anurag Akkiraju, David Gabay, Halim Burak Yesilyurt, Hidayet Aksu, Selcuk Uluagac
Cybergrenade: Automated Exploitation of Local Network Machines via Single Board Computers Conference Paper
In the Proceedings of the IEEE 14th International Conference on Mobile Ad Hoc and Sensor Systems (MASS), 2017.
Abstract | Links | BibTeX | Tags: Network Security
@conference{AnuragCybergrenadeIEEE,
title = {Cybergrenade: Automated Exploitation of Local Network Machines via Single Board Computers},
author = {Anurag Akkiraju and David Gabay and Halim Burak Yesilyurt and Hidayet Aksu and Selcuk Uluagac},
url = {https://ieeexplore.ieee.org/document/8108803},
year = {2017},
date = {2017-01-01},
urldate = {2017-01-01},
booktitle = {In the Proceedings of the IEEE 14th International Conference on Mobile Ad Hoc and Sensor Systems (MASS)},
abstract = {In this paper, we introduce a defensive cybersecurity framework called Cybergrenade automating various penetration testing tools to sequentially exploit machines connected to a single local network, all underneath a single application running on a Single-Board Computer (SBC). This takes advantage of the SBC's unique capabilities in a way that manual exploitation simply cannot match. Currently, while many SBCs are being used in research as exploitation tool-kits, the current state of automation of the processes associated with exploitation leaves much to be desired. While this paper describes the Cybergrenade Framework, it can be used as a guideline for future research automating the exploitation process. Cybergrenade allows tools such as Nmap, OpenVAS, and Metasploit tools to be automatically utilized under one framework. Our experimental evolution revealed that Cybergrenade can perform the automation of various pentesting tools under a single application with ease.},
keywords = {Network Security},
pubstate = {published},
tppubtype = {conference}
}
In this paper, we introduce a defensive cybersecurity framework called Cybergrenade automating various penetration testing tools to sequentially exploit machines connected to a single local network, all underneath a single application running on a Single-Board Computer (SBC). This takes advantage of the SBC's unique capabilities in a way that manual exploitation simply cannot match. Currently, while many SBCs are being used in research as exploitation tool-kits, the current state of automation of the processes associated with exploitation leaves much to be desired. While this paper describes the Cybergrenade Framework, it can be used as a guideline for future research automating the exploitation process. Cybergrenade allows tools such as Nmap, OpenVAS, and Metasploit tools to be automatically utilized under one framework. Our experimental evolution revealed that Cybergrenade can perform the automation of various pentesting tools under a single application with ease.
15.
Abdullah Aydeger, Kemal Akkaya, Mehmet H. Cintuglu, A. Selcuk Uluagac, Osama Mohammed
Software defined networking for resilient communications in Smart Grid active distribution networks Conference Paper
In the Proceedings of the IEEE International Conference on Communications (ICC), 2016.
Abstract | Links | BibTeX | Tags: Network Security, SDN Security
@conference{AydegerSoftwareIEEEICC,
title = {Software defined networking for resilient communications in Smart Grid active distribution networks},
author = {Abdullah Aydeger and Kemal Akkaya and Mehmet H. Cintuglu and A. Selcuk Uluagac and Osama Mohammed},
url = {https://ieeexplore.ieee.org/document/7511049},
year = {2016},
date = {2016-01-01},
urldate = {2016-01-01},
booktitle = {In the Proceedings of the IEEE International Conference on Communications (ICC)},
abstract = {Emerging Software Defined Networking (SDN) technology provides excellent flexibility to large-scale networks in terms of control, management, security, and maintenance. In this paper, we propose an SDN-based communication infrastructure for Smart Grid distribution networks among substations. A Smart Grid communication infrastructure consists of a large number of heterogenous devices that exchange real-time information for monitoring the status of the grid. We then investigate how SDN-enabled Smart Grid infrastructure can provide resilience to active distribution substations with self-recovery. Specifically, by introducing redundant and wireless communication links that can be used during the emergencies, we show that SDN controllers can be effective for restoring the communication while providing a lot of flexibility. Furthermore, to be able to effectively evaluate the performance of the proposed work in terms of various fine-grained network metrics, we developed a Mininet-based testing framework and integrated it with ns-3 network simulator. Finally, we conducted experiments by using actual Smart Grid communication data to assess the recovery performance of the proposed SDN-based system. The results show that SDN is a viable technology for the Smart Grid communications with almost negligible delays in switching to backup wireless links during the times of link failures in reliable fashion.},
keywords = {Network Security, SDN Security},
pubstate = {published},
tppubtype = {conference}
}
Emerging Software Defined Networking (SDN) technology provides excellent flexibility to large-scale networks in terms of control, management, security, and maintenance. In this paper, we propose an SDN-based communication infrastructure for Smart Grid distribution networks among substations. A Smart Grid communication infrastructure consists of a large number of heterogenous devices that exchange real-time information for monitoring the status of the grid. We then investigate how SDN-enabled Smart Grid infrastructure can provide resilience to active distribution substations with self-recovery. Specifically, by introducing redundant and wireless communication links that can be used during the emergencies, we show that SDN controllers can be effective for restoring the communication while providing a lot of flexibility. Furthermore, to be able to effectively evaluate the performance of the proposed work in terms of various fine-grained network metrics, we developed a Mininet-based testing framework and integrated it with ns-3 network simulator. Finally, we conducted experiments by using actual Smart Grid communication data to assess the recovery performance of the proposed SDN-based system. The results show that SDN is a viable technology for the Smart Grid communications with almost negligible delays in switching to backup wireless links during the times of link failures in reliable fashion.
16.
Selcuk Uluagac, Kemal Akkaya, Apurva Mohan, Mehmet H Cintuglu, Tarek Youssef, Osama Mohammed, Daniel Sullivan
Wireless Infrastructure in Industrial Control Systems Journal Article
Cyber-security of SCADA and Other Industrial Control Systems, 2016.
Links | BibTeX | Tags: CPS Security, Network Security
@article{UluagacWirelessSpringer,
title = {Wireless Infrastructure in Industrial Control Systems},
author = {Selcuk Uluagac and Kemal Akkaya and Apurva Mohan and Mehmet H Cintuglu and Tarek Youssef and Osama Mohammed and Daniel Sullivan},
url = {https://csl.fiu.edu/wp-content/uploads/2023/05/wireless_book.pdf},
year = {2016},
date = {2016-01-01},
urldate = {2016-01-01},
journal = {Cyber-security of SCADA and Other Industrial Control Systems},
publisher = {Springer},
keywords = {CPS Security, Network Security},
pubstate = {published},
tppubtype = {article}
}
17.
Spencer Michaels, Kemal Akkaya, A. Selcuk Uluagac
Inducing data loss in Zigbee networks via join/association handshake spoofing Conference Paper
In the Proceedings of the IEEE Conference on Communications and Network Security (CNS), 2016.
Abstract | Links | BibTeX | Tags: IoT Security, Network Security
@conference{MichaelsZigbeeIEEECNS,
title = {Inducing data loss in Zigbee networks via join/association handshake spoofing},
author = {Spencer Michaels and Kemal Akkaya and A. Selcuk Uluagac},
url = {https://ieeexplore.ieee.org/document/7860527},
year = {2016},
date = {2016-01-01},
urldate = {2016-01-01},
booktitle = {In the Proceedings of the IEEE Conference on Communications and Network Security (CNS)},
abstract = {Zigbee is an IEEE 802.15.4-based specification for low-power wireless mesh networks. Being a protocol with several known vulnerabilities, it continues to attract extensive research interest due to its potential applications in the Internet-of-Things (IoT). One of Zigbee's weak points lies in the network coordinator's initial handshake with a joining device, which is unencrypted. Our paper proposes a denial-of-service attack which exploits this fact to convince an end device to send its data to a rogue device on a different channel rather than the actual coordinator. Because the resource limitations of Zigbee devices generally preclude permanent storage, this is likely to result in loss of the transmitted data. We successfully demonstrate our attack and propose a solution that uses challenge-response based authentication to mitigate the attack.},
keywords = {IoT Security, Network Security},
pubstate = {published},
tppubtype = {conference}
}
Zigbee is an IEEE 802.15.4-based specification for low-power wireless mesh networks. Being a protocol with several known vulnerabilities, it continues to attract extensive research interest due to its potential applications in the Internet-of-Things (IoT). One of Zigbee's weak points lies in the network coordinator's initial handshake with a joining device, which is unencrypted. Our paper proposes a denial-of-service attack which exploits this fact to convince an end device to send its data to a rogue device on a different channel rather than the actual coordinator. Because the resource limitations of Zigbee devices generally preclude permanent storage, this is likely to result in loss of the transmitted data. We successfully demonstrate our attack and propose a solution that uses challenge-response based authentication to mitigate the attack.
18.
Troy Nunnally, A Selcuk Uluagac, Raheem Beyah
InterSec: An interaction system for network security applications Conference Paper
In the Proceedings of the IEEE International Conference on Communications (ICC), 2015.
Abstract | Links | BibTeX | Tags: Network Security
@conference{NunnallyInterSecIEEICC,
title = {InterSec: An interaction system for network security applications},
author = {Troy Nunnally and A Selcuk Uluagac and Raheem Beyah},
url = {https://ieeexplore.ieee.org/document/7249464},
year = {2015},
date = {2015-01-01},
urldate = {2015-01-01},
booktitle = {In the Proceedings of the IEEE International Conference on Communications (ICC)},
abstract = {Traditional two-dimensional (2D) and three-dimensional (3D) visualization tools for network security applications often employ a desktop, mouse, and keyboard setup of WIMP (Windows, Icons, Menus, and a Pointer) interfaces, which use a serial set of command inputs (e.g., click, rotate, zoom). However, research has shown that multiple inputs (e.g., Microsoft Kinect [8] and multi-touch monitors) could reduce the selection time of objects, resulting in a quicker response time than its traditional counterparts. In this work, we investigate these alternative user interfaces that are “natural” to the user for multiple inputs that reduce response time as a user navigates within a complex three-dimensional (3D) visualization for network security applications. Specifically, we introduce a visualization tool called InterSec, an interaction system prototype for interacting with 3D network security visualizations. InterSec helps developers build and manage gestures that require the coordination of multiple inputs across multiple interaction technologies. To our knowledge, InterSec is the first tool that proposes a system to reduce number of interactions within 3D visualizations for network security tools. Through our evaluation of live Honeynet data and a user study, the results reveal InterSec's ability to reduce the number of interactions to aid in 3D navigation in comparison to the mouse user interface.},
keywords = {Network Security},
pubstate = {published},
tppubtype = {conference}
}
Traditional two-dimensional (2D) and three-dimensional (3D) visualization tools for network security applications often employ a desktop, mouse, and keyboard setup of WIMP (Windows, Icons, Menus, and a Pointer) interfaces, which use a serial set of command inputs (e.g., click, rotate, zoom). However, research has shown that multiple inputs (e.g., Microsoft Kinect [8] and multi-touch monitors) could reduce the selection time of objects, resulting in a quicker response time than its traditional counterparts. In this work, we investigate these alternative user interfaces that are “natural” to the user for multiple inputs that reduce response time as a user navigates within a complex three-dimensional (3D) visualization for network security applications. Specifically, we introduce a visualization tool called InterSec, an interaction system prototype for interacting with 3D network security visualizations. InterSec helps developers build and manage gestures that require the coordination of multiple inputs across multiple interaction technologies. To our knowledge, InterSec is the first tool that proposes a system to reduce number of interactions within 3D visualizations for network security tools. Through our evaluation of live Honeynet data and a user study, the results reveal InterSec's ability to reduce the number of interactions to aid in 3D navigation in comparison to the mouse user interface.
19.
Christopher Wampler, Selcuk Uluagac, Raheem Beyah
Information leakage in encrypted ip video traffic Conference Paper
In the Proceedings of the IEEE Global Communications Conference (GLOBECOM), 2015.
Abstract | Links | BibTeX | Tags: Network Security
@conference{WamplerInformationGLOBECOM,
title = {Information leakage in encrypted ip video traffic},
author = {Christopher Wampler and Selcuk Uluagac and Raheem Beyah},
url = {https://ieeexplore.ieee.org/document/7417767},
year = {2015},
date = {2015-01-01},
urldate = {2015-01-01},
booktitle = {In the Proceedings of the IEEE Global Communications Conference (GLOBECOM)},
abstract = {Voice chat and conferencing services may be assumed to be private and secure because of strong encryption algorithms applied to the video stream. We show that information leakage is occurring in video over IP traffic, including for encrypted payloads. It is possible to detect motion and scene changes, such as a person standing up or walking past a camera streaming live video. We accomplish this through analysis of network traffic metadata including arrival time between packets, packet sizes, and video stream bandwidth. Event detection through metadata analysis is possible even when common encryption techniques are applied to the video stream such as SSL or AES. We have observed information leakage across multiple codes and cameras. Through measurements of the x264 codec, we establish a basis for detectability of events via packet timing. Our laboratory experiments confirm that this event detection is possible and repeatable with commercial video streaming software.},
keywords = {Network Security},
pubstate = {published},
tppubtype = {conference}
}
Voice chat and conferencing services may be assumed to be private and secure because of strong encryption algorithms applied to the video stream. We show that information leakage is occurring in video over IP traffic, including for encrypted payloads. It is possible to detect motion and scene changes, such as a person standing up or walking past a camera streaming live video. We accomplish this through analysis of network traffic metadata including arrival time between packets, packet sizes, and video stream bandwidth. Event detection through metadata analysis is possible even when common encryption techniques are applied to the video stream such as SSL or AES. We have observed information leakage across multiple codes and cameras. Through measurements of the x264 codec, we establish a basis for detectability of events via packet timing. Our laboratory experiments confirm that this event detection is possible and repeatable with commercial video streaming software.
20.
Kemal Akkaya, A. Selcuk Uluagac, Abdullah Aydeger
Software defined networking for wireless local networks in Smart Grid Conference Paper
In the Proceedings of the 40th IEEE Local Computer Networks Conference Workshops (LCN Workshops), 2015.
Abstract | Links | BibTeX | Tags: Network Security, SDN Security
@conference{AkkayaSofrwareIEEELCN,
title = {Software defined networking for wireless local networks in Smart Grid},
author = {Kemal Akkaya and A. Selcuk Uluagac and Abdullah Aydeger},
url = {https://ieeexplore.ieee.org/document/7365934},
year = {2015},
date = {2015-01-01},
urldate = {2015-01-01},
booktitle = {In the Proceedings of the 40th IEEE Local Computer Networks Conference Workshops (LCN Workshops)},
abstract = {Emerging Software Defined Networking (SDN) technology has provided excellent flexibility to large-scale networks in terms of control, management, security, and maintenance. With SDN, network architectures can be deployed and maintained with ease. New trends in computing (e.g., cloud computing, data centers, and virtualization) can seamlessly be integrated with the SDN architecture. On the other hand, recent years witnessed a tremendous growth in the upgrade and modernization of the critical infrastructure networks, namely the Smart-Grid, in terms of its underlying communication infrastructure. From Supervisory Control and Data Acquisition (SCADA) systems to Advanced Metering Infrastructure (AMI), an increasing number of networking devices are being deployed to connect all the local network components of the Smart Grid together. Such large local networks requires significant effort in terms of network management and security, which is costly in terms of labor and hardware upgrades. SDN would be a perfect candidate technology to alleviate the costs while providing fine-grained control of this critical network infrastructure. Hence, in this paper, we explore the potential utilization of the SDN technology over the Smart Grid communication architecture. Specifically, we introduce three novel SDN deployment scenarios in local networks of Smart Grid. Moreover, we also investigate the pertinent security aspects with each deployment scenario along with possible solutions.},
keywords = {Network Security, SDN Security},
pubstate = {published},
tppubtype = {conference}
}
Emerging Software Defined Networking (SDN) technology has provided excellent flexibility to large-scale networks in terms of control, management, security, and maintenance. With SDN, network architectures can be deployed and maintained with ease. New trends in computing (e.g., cloud computing, data centers, and virtualization) can seamlessly be integrated with the SDN architecture. On the other hand, recent years witnessed a tremendous growth in the upgrade and modernization of the critical infrastructure networks, namely the Smart-Grid, in terms of its underlying communication infrastructure. From Supervisory Control and Data Acquisition (SCADA) systems to Advanced Metering Infrastructure (AMI), an increasing number of networking devices are being deployed to connect all the local network components of the Smart Grid together. Such large local networks requires significant effort in terms of network management and security, which is costly in terms of labor and hardware upgrades. SDN would be a perfect candidate technology to alleviate the costs while providing fine-grained control of this critical network infrastructure. Hence, in this paper, we explore the potential utilization of the SDN technology over the Smart Grid communication architecture. Specifically, we introduce three novel SDN deployment scenarios in local networks of Smart Grid. Moreover, we also investigate the pertinent security aspects with each deployment scenario along with possible solutions.
21.
Sakthi Vignesh Radhakrishnan, A. Selcuk Uluagac, Raheem Beyah
GTID: A Technique for Physical Device and Device Type Fingerprinting Journal Article
IEEE Transactions on Dependable and Secure Computing Journal, 2015.
Abstract | Links | BibTeX | Tags: Fingerprinting, Network Security
@article{RadhakrishnanGTIDIEEE,
title = {GTID: A Technique for Physical Device and Device Type Fingerprinting},
author = {Sakthi Vignesh Radhakrishnan and A. Selcuk Uluagac and Raheem Beyah},
url = {https://ieeexplore.ieee.org/document/6951398},
year = {2015},
date = {2015-01-01},
urldate = {2015-01-01},
journal = {IEEE Transactions on Dependable and Secure Computing Journal},
abstract = {In this paper, we introduce GTID, a technique that can actively and passively fingerprint wireless devices and their types using wire-side observations in a local network. GTID exploits information that is leaked as a result of heterogeneity in devices, which is a function of different device hardware compositions and variations in devices' clock skew. We apply statistical techniques on network traffic to create unique, reproducible device and device type signatures, and use artificial neural networks (ANNs) for classification. We demonstrate the efficacy of our technique on both an isolated testbed and a live campus network (during peak hours) using a corpus of 37 devices representing a wide range of device classes (e.g., iPads, iPhones, Google Phones, etc.) and traffic types (e.g., Skype, SCP, ICMP, etc.). Our experiments provided more than 300 GB of traffic captures which we used for ANN training and performance.},
keywords = {Fingerprinting, Network Security},
pubstate = {published},
tppubtype = {article}
}
In this paper, we introduce GTID, a technique that can actively and passively fingerprint wireless devices and their types using wire-side observations in a local network. GTID exploits information that is leaked as a result of heterogeneity in devices, which is a function of different device hardware compositions and variations in devices' clock skew. We apply statistical techniques on network traffic to create unique, reproducible device and device type signatures, and use artificial neural networks (ANNs) for classification. We demonstrate the efficacy of our technique on both an isolated testbed and a live campus network (during peak hours) using a corpus of 37 devices representing a wide range of device classes (e.g., iPads, iPhones, Google Phones, etc.) and traffic types (e.g., Skype, SCP, ICMP, etc.). Our experiments provided more than 300 GB of traffic captures which we used for ANN training and performance.
22.
Shouling Ji, A. Selcuk Uluagac, Raheem Beyah, Zhipeng Cai
Practical unicast and convergecast scheduling schemes for Cognitive Radio Networks Journal Article
Journal of Combinatorial Optimization, 2013.
Abstract | Links | BibTeX | Tags: Network Security, Wireless Security
@article{JiRadioNetworksSpringer2013,
title = {Practical unicast and convergecast scheduling schemes for Cognitive Radio Networks},
author = {Shouling Ji and A. Selcuk Uluagac and Raheem Beyah and Zhipeng Cai},
url = {https://link.springer.com/article/10.1007/s10878-011-9446-7},
doi = {10.1007/s10878-011-9446-7},
year = {2013},
date = {2013-07-01},
urldate = {2013-07-01},
journal = {Journal of Combinatorial Optimization},
abstract = {Cognitive Radio Networks (CRNs) have paved a road for Secondary Users (SUs) to opportunistically exploit unused spectrum without harming the communications among Primary Users (PUs). In this paper, practical unicast and convergecast schemes, which are overlooked by most of the existing works for CRNs, are proposed. We first construct a cell-based virtual backbone for CRNs. Then prove that SUs have positive probabilities to access the spectrum and the expected one hop delay is bounded by a constant, if the density of PUs is finite. According to this fact, we proposed a three-step unicast scheme and a two-phase convergecast scheme. We demonstrate that the induced delay from our proposed Unicast Scheduling (US) algorithm scales linearly with the transmission distance between the source and the destination. Furthermore, the expected delay of the proposed Convergecast Scheduling (CS) algorithm is proven to be upper bounded by O(logn + sqrt(n/logn)). To the best of our knowledge, this is the first study of convergecast in CRNs. Finally, the performance of the proposed algorithms is validated through simulations.},
keywords = {Network Security, Wireless Security},
pubstate = {published},
tppubtype = {article}
}
Cognitive Radio Networks (CRNs) have paved a road for Secondary Users (SUs) to opportunistically exploit unused spectrum without harming the communications among Primary Users (PUs). In this paper, practical unicast and convergecast schemes, which are overlooked by most of the existing works for CRNs, are proposed. We first construct a cell-based virtual backbone for CRNs. Then prove that SUs have positive probabilities to access the spectrum and the expected one hop delay is bounded by a constant, if the density of PUs is finite. According to this fact, we proposed a three-step unicast scheme and a two-phase convergecast scheme. We demonstrate that the induced delay from our proposed Unicast Scheduling (US) algorithm scales linearly with the transmission distance between the source and the destination. Furthermore, the expected delay of the proposed Convergecast Scheduling (CS) algorithm is proven to be upper bounded by O(logn + sqrt(n/logn)). To the best of our knowledge, this is the first study of convergecast in CRNs. Finally, the performance of the proposed algorithms is validated through simulations.
23.
Shouling Ji, Jing (Selena) He, A. Selcuk Uluagac, Raheem Beyah, Yingshu Li
Cell-Based Snapshot and Continuous Data Collection in Wireless Sensor Networks Journal Article
ACM Transactions on Sensor Networks (TOSN), 2013.
Abstract | Links | BibTeX | Tags: Network Security
@article{JiCell-BasedACM2013,
title = {Cell-Based Snapshot and Continuous Data Collection in Wireless Sensor Networks},
author = {Shouling Ji and Jing (Selena) He and A. Selcuk Uluagac and Raheem Beyah and Yingshu Li},
url = {https://dl.acm.org/doi/abs/10.1145/2489253.2489264},
doi = {10.1145/2489253.2489264},
year = {2013},
date = {2013-07-01},
urldate = {2013-07-01},
journal = {ACM Transactions on Sensor Networks (TOSN)},
publisher = {Association for Computing Machinery},
address = {New York, NY, USA},
abstract = {Data collection is a common operation of wireless sensor networks (WSNs). The performance of data collection can be measured by its achievable network capacity. However, most existing works focus on the network capacity of unicast, multicast or/and broadcast. In this article, we study the snapshot/continuous data collection (SDC/CDC) problem under the physical interference model for randomly deployed dense WSNs. For SDC, we propose a Cell-Based Path Scheduling (CBPS) algorithm based on network partitioning. Theoretical analysis shows that its achievable network capacity is order-optimal. For CDC, a novel Segment-Based Pipeline Scheduling (SBPS) algorithm is proposed which combines the pipeline technique and the compressive data gathering technique. Theoretical analysis shows that SBPS significantly speeds up the CDC process and achieves a high network capacity.},
keywords = {Network Security},
pubstate = {published},
tppubtype = {article}
}
Data collection is a common operation of wireless sensor networks (WSNs). The performance of data collection can be measured by its achievable network capacity. However, most existing works focus on the network capacity of unicast, multicast or/and broadcast. In this article, we study the snapshot/continuous data collection (SDC/CDC) problem under the physical interference model for randomly deployed dense WSNs. For SDC, we propose a Cell-Based Path Scheduling (CBPS) algorithm based on network partitioning. Theoretical analysis shows that its achievable network capacity is order-optimal. For CDC, a novel Segment-Based Pipeline Scheduling (SBPS) algorithm is proposed which combines the pipeline technique and the compressive data gathering technique. Theoretical analysis shows that SBPS significantly speeds up the CDC process and achieves a high network capacity.
24.
A. Selcuk Uluagac, Raheem A. Beyah, John A. Copeland
Secure SOurce-BAsed Loose Synchronization (SOBAS) for Wireless Sensor Networks Journal Article
In proceedings of IEEE Transactions on Parallel and Distributed Systems, 2013.
Abstract | Links | BibTeX | Tags: IoT Security, Network Security, Wireless Security
@article{UluagacSOBASIEEE2013,
title = {Secure SOurce-BAsed Loose Synchronization (SOBAS) for Wireless Sensor Networks},
author = {A. Selcuk Uluagac and Raheem A. Beyah and John A. Copeland},
url = {https://ieeexplore.ieee.org/abstract/document/6216359},
doi = {10.1109/TPDS.2012.170},
year = {2013},
date = {2013-01-01},
urldate = {2013-01-01},
journal = {In proceedings of IEEE Transactions on Parallel and Distributed Systems},
abstract = {We present the Secure SOurce-BAsed Loose Synchronization (SOBAS) protocol to securely synchronize the events in the network, without the transmission of explicit synchronization control messages. In SOBAS, nodes use their local time values as a one-time dynamic key to encrypt each message. In this way, SOBAS provides an effective dynamic en-route filtering mechanism, where the malicious data is filtered from the network. With SOBAS, we are able to achieve our main goal of synchronizing events at the sink as quickly, as accurately, and as surreptitiously as possible. With loose synchronization, SOBAS reduces the number of control messages needed for a WSN to operate providing the key benefits of reduced energy consumption as well as reducing the opportunity for malicious nodes to eavesdrop, intercept, or be made aware of the presence of the network. Albeit a loose synchronization per se, SOBAS is also able to provide (7.24μ)s clock precision given today's sensor technology, which is much better than other comparable schemes (schemes that do not employ GPS devices). Also, we show that by recognizing the need for and employing loose time synchronization, necessary synchronization can be provided to the WSN application using half of the energy needed for traditional schemes. Both analytical and simulation results are presented to verify the feasibility of SOBAS as well as the energy consumption of the scheme under normal operation and attack from malicious nodes.},
keywords = {IoT Security, Network Security, Wireless Security},
pubstate = {published},
tppubtype = {article}
}
We present the Secure SOurce-BAsed Loose Synchronization (SOBAS) protocol to securely synchronize the events in the network, without the transmission of explicit synchronization control messages. In SOBAS, nodes use their local time values as a one-time dynamic key to encrypt each message. In this way, SOBAS provides an effective dynamic en-route filtering mechanism, where the malicious data is filtered from the network. With SOBAS, we are able to achieve our main goal of synchronizing events at the sink as quickly, as accurately, and as surreptitiously as possible. With loose synchronization, SOBAS reduces the number of control messages needed for a WSN to operate providing the key benefits of reduced energy consumption as well as reducing the opportunity for malicious nodes to eavesdrop, intercept, or be made aware of the presence of the network. Albeit a loose synchronization per se, SOBAS is also able to provide (7.24μ)s clock precision given today's sensor technology, which is much better than other comparable schemes (schemes that do not employ GPS devices). Also, we show that by recognizing the need for and employing loose time synchronization, necessary synchronization can be provided to the WSN application using half of the energy needed for traditional schemes. Both analytical and simulation results are presented to verify the feasibility of SOBAS as well as the energy consumption of the scheme under normal operation and attack from malicious nodes.
25.
Sakthi V. Radhakrishnan, A. Selcuk Uluagac, Raheem Beyah
Realizing an 802.11-based covert timing channel using off-the-shelf wireless cards Conference Paper
In the proceedings of the IEEE Global Communications Conference (GLOBECOM), 2013.
Abstract | Links | BibTeX | Tags: Covert channels, Network Security
@conference{RadhakrishnanRealizingIEEE2013,
title = {Realizing an 802.11-based covert timing channel using off-the-shelf wireless cards},
author = {Sakthi V. Radhakrishnan and A. Selcuk Uluagac and Raheem Beyah},
url = {https://ieeexplore.ieee.org/abstract/document/6831158/},
year = {2013},
date = {2013-01-01},
urldate = {2013-01-01},
booktitle = {In the proceedings of the IEEE Global Communications Conference (GLOBECOM)},
abstract = {By using covert channels, a malicious entity can hide messages within regular traffic and can thereby circumvent security mechanisms. This same method of obfuscation can be used by legitimate users to transmit messages over hostile networks. A promising area for covert channels is wireless networks employing carrier sense multiple access with collision avoidance (CSMA/CA) (e.g., 802.11 networks). These schemes introduce randomness in the network that provides good cover for a covert timing channel. Hence, by exploiting the random back-off in distributed coordination function (DCF) of 802.11, we realize a relatively high bandwidth covert timing channel for 802.11 networks, called Covert-DCF. As opposed to many works in the literature focusing on theory and simulations, Covert-DCF is the first fully implemented covert timing channel for 802.11 MAC using off-the-self wireless cards. In this paper, we introduce the design and implementation of Covert-DCF that is transparent to the users of the shared medium. We also evaluate the performance of Covert-DCF and provide discussions on the feasibility of this technique in a real world scenario.},
keywords = {Covert channels, Network Security},
pubstate = {published},
tppubtype = {conference}
}
By using covert channels, a malicious entity can hide messages within regular traffic and can thereby circumvent security mechanisms. This same method of obfuscation can be used by legitimate users to transmit messages over hostile networks. A promising area for covert channels is wireless networks employing carrier sense multiple access with collision avoidance (CSMA/CA) (e.g., 802.11 networks). These schemes introduce randomness in the network that provides good cover for a covert timing channel. Hence, by exploiting the random back-off in distributed coordination function (DCF) of 802.11, we realize a relatively high bandwidth covert timing channel for 802.11 networks, called Covert-DCF. As opposed to many works in the literature focusing on theory and simulations, Covert-DCF is the first fully implemented covert timing channel for 802.11 MAC using off-the-self wireless cards. In this paper, we introduce the design and implementation of Covert-DCF that is transparent to the users of the shared medium. We also evaluate the performance of Covert-DCF and provide discussions on the feasibility of this technique in a real world scenario.
26.
Troy Nunnally, Penyen Chi, Kulsoom Abdullah, A. Selcuk Uluagac, John A. Copeland, Raheem Beyah
P3D: A parallel 3D coordinate visualization for advanced network scans Conference Paper
In the proceedings of the IEEE International Conference on Communications (ICC), 2013.
Abstract | Links | BibTeX | Tags: Network Security, Security Visualization
@conference{NunnallyP3DIEEE2013,
title = {P3D: A parallel 3D coordinate visualization for advanced network scans},
author = {Troy Nunnally and Penyen Chi and Kulsoom Abdullah and A. Selcuk Uluagac and John A. Copeland and Raheem Beyah},
url = {https://ieeexplore.ieee.org/abstract/document/6654828/},
year = {2013},
date = {2013-01-01},
urldate = {2013-01-01},
booktitle = {In the proceedings of the IEEE International Conference on Communications (ICC)},
abstract = {As network attacks increase in complexity, network administrators will continue to struggle with analyzing security data immediately and efficiently. To alleviate these challenges, researchers are looking into various visualization techniques (e.g., two-dimensional (2D) and three-dimensional (3D)) to detect, identify, and analyze malicious attacks. This paper discusses the benefits of using a stereoscopic 3D parallel visualization techniques for network scanning, in particular, when addressing occlusion-based visualization attacks intended to confuse network administrators. To our knowledge, no 2D or 3D tool exists that analyzes these attacks. Hence, we propose a novel 3D Parallel coordinate visualization tool for advanced network scans and attacks called P3D. P3D uses flow data, filtering techniques, and state-of-the art 3D technologies to help network administrators detect distributed and coordinated network scans. Compared to other 2D and 3D network security visualization tools, P3D prevents occlusion-based visualization attacks (e.g., Windshield Wiper and Port Source Confusion attacks). We validate our tool with use-cases from emulated distributed scanning attacks. Our evaluation shows P3D allows users to extract new information about scans and minimize information overload by adding an extra dimension and awareness region in the visualization.},
keywords = {Network Security, Security Visualization},
pubstate = {published},
tppubtype = {conference}
}
As network attacks increase in complexity, network administrators will continue to struggle with analyzing security data immediately and efficiently. To alleviate these challenges, researchers are looking into various visualization techniques (e.g., two-dimensional (2D) and three-dimensional (3D)) to detect, identify, and analyze malicious attacks. This paper discusses the benefits of using a stereoscopic 3D parallel visualization techniques for network scanning, in particular, when addressing occlusion-based visualization attacks intended to confuse network administrators. To our knowledge, no 2D or 3D tool exists that analyzes these attacks. Hence, we propose a novel 3D Parallel coordinate visualization tool for advanced network scans and attacks called P3D. P3D uses flow data, filtering techniques, and state-of-the art 3D technologies to help network administrators detect distributed and coordinated network scans. Compared to other 2D and 3D network security visualization tools, P3D prevents occlusion-based visualization attacks (e.g., Windshield Wiper and Port Source Confusion attacks). We validate our tool with use-cases from emulated distributed scanning attacks. Our evaluation shows P3D allows users to extract new information about scans and minimize information overload by adding an extra dimension and awareness region in the visualization.
27.
Troy Nunnally, Kulsoom Abdullah, A. Selcuk Uluagac, John A. Copeland, Raheem Beyah
NAVSEC: A Recommender System for 3D Network Security Visualizations Conference Paper
In the proceedings of the 10th Workshop on Visualization for Cyber Security, 2013.
Abstract | Links | BibTeX | Tags: Network Security, Security Visualization
@conference{NunnallyNAVSECVizSec2013,
title = {NAVSEC: A Recommender System for 3D Network Security Visualizations},
author = {Troy Nunnally and Kulsoom Abdullah and A. Selcuk Uluagac and John A. Copeland and Raheem Beyah},
url = {https://dl.acm.org/doi/abs/10.1145/2517957.2517963},
year = {2013},
date = {2013-01-01},
urldate = {2013-01-01},
booktitle = {In the proceedings of the 10th Workshop on Visualization for Cyber Security},
abstract = {As network attacks increase in complexity, the ability to quickly analyze security data and mitigate the effect of these attacks becomes a difficult problem. To alleviate these challenges, researchers are looking into various two-dimensional (2D) and three-dimensional (3D) visualization tools to detect, identify, and analyze malicious attacks. These visualization tools often require advanced knowledge in networking, visualization, and information security to operate, navigate, and successfully examine malicious attacks. Novice users, deficient in the required advanced knowledge, may find navigation within these visualization tools difficult. Furthermore, expert users may be limited and costly. We discuss the use of a modern recommender system to aid in navigating within a complex 3D visualization for network security applications. We developed a visualization module called NAVSEC, a recommender system prototype for navigating in 3D network security visualization tools. NAVSEC recommends visualizations and interactions to novice users. Given visualization interaction input from a novice user and expert communities, NAVSEC is instrumental in reducing confusion for a novice user while navigating in a 3D visualization. We illustrate NAVSEC with a use-case from an emulated stealthy scanning attack disguised as a file transfer with multiple concurrent connections. We show that using NAVSEC, a novice user's visualization converges towards a visualization used to identify or detect a suspected attack by an expert user. As a result, NAVSEC can successfully guide the novice user in differentiating between complex network attacks and benign legitimate traffic with step-by-step created visualizations and suggested user interactions.},
keywords = {Network Security, Security Visualization},
pubstate = {published},
tppubtype = {conference}
}
As network attacks increase in complexity, the ability to quickly analyze security data and mitigate the effect of these attacks becomes a difficult problem. To alleviate these challenges, researchers are looking into various two-dimensional (2D) and three-dimensional (3D) visualization tools to detect, identify, and analyze malicious attacks. These visualization tools often require advanced knowledge in networking, visualization, and information security to operate, navigate, and successfully examine malicious attacks. Novice users, deficient in the required advanced knowledge, may find navigation within these visualization tools difficult. Furthermore, expert users may be limited and costly. We discuss the use of a modern recommender system to aid in navigating within a complex 3D visualization for network security applications. We developed a visualization module called NAVSEC, a recommender system prototype for navigating in 3D network security visualization tools. NAVSEC recommends visualizations and interactions to novice users. Given visualization interaction input from a novice user and expert communities, NAVSEC is instrumental in reducing confusion for a novice user while navigating in a 3D visualization. We illustrate NAVSEC with a use-case from an emulated stealthy scanning attack disguised as a file transfer with multiple concurrent connections. We show that using NAVSEC, a novice user's visualization converges towards a visualization used to identify or detect a suspected attack by an expert user. As a result, NAVSEC can successfully guide the novice user in differentiating between complex network attacks and benign legitimate traffic with step-by-step created visualizations and suggested user interactions.
28.
Venkatachalam Subramanian, A. Selcuk Uluagac, Hasan Cam, Raheem Beyah
Examining the characteristics and implications of sensor side channels Conference Paper
In the proceedings of IEEE International Conference on Communications (ICC), 2013.
Abstract | Links | BibTeX | Tags: CPS Security, Network Security, Side Channel
@conference{SubramanianIEEE2013,
title = {Examining the characteristics and implications of sensor side channels},
author = {Venkatachalam Subramanian, A. Selcuk Uluagac and Hasan Cam and Raheem Beyah},
url = {https://ieeexplore.ieee.org/abstract/document/6654855/},
year = {2013},
date = {2013-01-01},
urldate = {2013-01-01},
booktitle = {In the proceedings of IEEE International Conference on Communications (ICC)},
abstract = {The nodes in wireless sensor networks (WSNs) utilize the radio frequency (RF) channel to communicate. Given that the RF channel is the primary communication channel, many researchers have developed techniques for securing that channel. However, the RF channel is not the only interface into a sensor. The sensing components, which are primarily designed to sense characteristics about the outside world, can also be used (or misused) as a communication (side) channel. In this paper, we characterize the side channels for various sensory components (i.e., light sensor, acoustic sensor, and accelerometer). While previous work has focused on the use of these side channels to improve the security and performance of a WSN, we seek to determine if the side channels have enough capacity to potentially be used for malicious activity. Specifically, we evaluate the feasibility and practicality of the side channels using today's sensor technology and illustrate that these channels have enough capacity to enable the transfer of common, well-known malware. The ultimate goal of this work is to illustrate the need for intrusion detection systems (IDSs) that not only monitor the RF channel, but also monitor the values returned by the sensory components.},
keywords = {CPS Security, Network Security, Side Channel},
pubstate = {published},
tppubtype = {conference}
}
The nodes in wireless sensor networks (WSNs) utilize the radio frequency (RF) channel to communicate. Given that the RF channel is the primary communication channel, many researchers have developed techniques for securing that channel. However, the RF channel is not the only interface into a sensor. The sensing components, which are primarily designed to sense characteristics about the outside world, can also be used (or misused) as a communication (side) channel. In this paper, we characterize the side channels for various sensory components (i.e., light sensor, acoustic sensor, and accelerometer). While previous work has focused on the use of these side channels to improve the security and performance of a WSN, we seek to determine if the side channels have enough capacity to potentially be used for malicious activity. Specifically, we evaluate the feasibility and practicality of the side channels using today's sensor technology and illustrate that these channels have enough capacity to enable the transfer of common, well-known malware. The ultimate goal of this work is to illustrate the need for intrusion detection systems (IDSs) that not only monitor the RF channel, but also monitor the values returned by the sensory components.
29.
Marco Valero, A. Selcuk Uluagac, S. Venkatachalam, K. C. Ramalingam, Raheem Beyah
The Monitoring Core: A framework for sensor security application development Conference Paper
In the proceedings of the IEEE 9th International Conference on Mobile Adhoc and Sensor Systems (MASS) , 2012.
Abstract | Links | BibTeX | Tags: IoT Security, Network Security, Wireless Security
@conference{ValeroMonitoringCoreIEEE2012,
title = {The Monitoring Core: A framework for sensor security application development},
author = {Marco Valero, A. Selcuk Uluagac, S. Venkatachalam, K. C. Ramalingam and Raheem Beyah},
url = {https://ieeexplore.ieee.org/abstract/document/6502525/},
year = {2012},
date = {2012-01-01},
urldate = {2012-01-01},
booktitle = {In the proceedings of the IEEE 9th International Conference on Mobile Adhoc and Sensor Systems (MASS)
},
abstract = {Wireless sensor networks (WSNs) are used for the monitoring of physical and environmental phenomena, and applicable in a range of different domains (e.g., health care, military, critical infrastructure). When using WSNs in a variety of real-world applications, security is a vital problem that should be considered by developers. As the development of security applications (SAs) for WSNs require meticulous procedures and operations, the software implementation process can be more challenging than regular applications. Hence, in an effort to facilitate the design, development and implementation of WSN security applications, we introduce the Monitoring Core (M-Core). The M-Core is a modular, lightweight, and extensible software layer that gathers necessary data including the internal and the external status of the sensor (e.g., information about ongoing communications, neighbors, and sensing), and provides relevant information for the development of new SAs. Similar to other software development tools, the M-Core was developed to facilitate the design and development of new WSN SAs on different platforms. Moreover, a new user-friendly domain-specific language, the M-Core Control Language (MCL), was developed to further facilitate the use of the M-Core and reduce the developer's coding time. With the MCL, a user can implement new SAs without the overhead of learning the details of the underlying sensor software architecture (e.g., TinyOS). The M-Core has been implemented in TinyOS-2.x and tested on real sensors (Tmote Sky and MicaZ). Using the M-Core architecture, we implemented several SAs to show that the M-Core allows easy and rapid development of security programs efficiently and effectively.},
keywords = {IoT Security, Network Security, Wireless Security},
pubstate = {published},
tppubtype = {conference}
}
Wireless sensor networks (WSNs) are used for the monitoring of physical and environmental phenomena, and applicable in a range of different domains (e.g., health care, military, critical infrastructure). When using WSNs in a variety of real-world applications, security is a vital problem that should be considered by developers. As the development of security applications (SAs) for WSNs require meticulous procedures and operations, the software implementation process can be more challenging than regular applications. Hence, in an effort to facilitate the design, development and implementation of WSN security applications, we introduce the Monitoring Core (M-Core). The M-Core is a modular, lightweight, and extensible software layer that gathers necessary data including the internal and the external status of the sensor (e.g., information about ongoing communications, neighbors, and sensing), and provides relevant information for the development of new SAs. Similar to other software development tools, the M-Core was developed to facilitate the design and development of new WSN SAs on different platforms. Moreover, a new user-friendly domain-specific language, the M-Core Control Language (MCL), was developed to further facilitate the use of the M-Core and reduce the developer's coding time. With the MCL, a user can implement new SAs without the overhead of learning the details of the underlying sensor software architecture (e.g., TinyOS). The M-Core has been implemented in TinyOS-2.x and tested on real sensors (Tmote Sky and MicaZ). Using the M-Core architecture, we implemented several SAs to show that the M-Core allows easy and rapid development of security programs efficiently and effectively.
30.
KC Ramalingam, Venkatachalam Subramanian, Selcuk Uluagac, Raheem Beyah
SIMAGE: Secure and Link-Quality Cognizant Image Distribution for wireless sensor networks Conference Paper
In the proceedings of IEEE Global Communications Conference (GLOBECOM), 2012.
Abstract | Links | BibTeX | Tags: IoT Security, Network Security, Wireless Security
@conference{RamalingamSimageIEEE2012,
title = {SIMAGE: Secure and Link-Quality Cognizant Image Distribution for wireless sensor networks},
author = {KC Ramalingam, Venkatachalam Subramanian, Selcuk Uluagac and Raheem Beyah},
url = {https://ieeexplore.ieee.org/abstract/document/6503181/},
year = {2012},
date = {2012-01-01},
urldate = {2012-01-01},
booktitle = {In the proceedings of IEEE Global Communications Conference (GLOBECOM)},
abstract = {Wireless sensor networks (WSNs) are used in a range of critical domains (e.g., health care, military, critical infrastructure) where it is necessary that the nodes be reprogrammed with a new or modified code image without removing them from the deployment area. Various protocols have been developed for the dissemination of code images between sensors in multi-hop WSNs, where these sensor nodes may have varying levels of link quality. However, the code dissemination process in these protocols is hindered by the nodes with poor link quality. This results in an increased number of retransmissions and code dissemination time. Also, in several of the techniques, the code dissemination process is not secure and can be eavesdropped or disrupted by a malicious wireless sensor node in the transmission range. In this paper, we propose a simple approach, Secure and Link-Quality Cognizant Image Distribution (SIMAGE), to enhance the existing code dissemination protocol using the available resources in the sensors. Specifically, our approach adapts to the varying link conditions via dynamic packet sizing to reduce the number of retransmissions and overall code dissemination time. Our approach also provides confidentiality and integrity to the code dissemination process by utilizing energy-efficient encryption and authentication mechanisms with RC4 and the CBC-MAC. We have evaluated SIMAGE in a network of real sensors and the results show that adjusting the packet size as a function of link quality reduces the retransmitted data by 93% and the image transmission time by 35% when compared to the existing code dissemination protocols. The trade-offs between reliability, security overhead, and overall transmission time for SIMAGE are also discussed.},
keywords = {IoT Security, Network Security, Wireless Security},
pubstate = {published},
tppubtype = {conference}
}
Wireless sensor networks (WSNs) are used in a range of critical domains (e.g., health care, military, critical infrastructure) where it is necessary that the nodes be reprogrammed with a new or modified code image without removing them from the deployment area. Various protocols have been developed for the dissemination of code images between sensors in multi-hop WSNs, where these sensor nodes may have varying levels of link quality. However, the code dissemination process in these protocols is hindered by the nodes with poor link quality. This results in an increased number of retransmissions and code dissemination time. Also, in several of the techniques, the code dissemination process is not secure and can be eavesdropped or disrupted by a malicious wireless sensor node in the transmission range. In this paper, we propose a simple approach, Secure and Link-Quality Cognizant Image Distribution (SIMAGE), to enhance the existing code dissemination protocol using the available resources in the sensors. Specifically, our approach adapts to the varying link conditions via dynamic packet sizing to reduce the number of retransmissions and overall code dissemination time. Our approach also provides confidentiality and integrity to the code dissemination process by utilizing energy-efficient encryption and authentication mechanisms with RC4 and the CBC-MAC. We have evaluated SIMAGE in a network of real sensors and the results show that adjusting the packet size as a function of link quality reduces the retransmitted data by 93% and the image transmission time by 35% when compared to the existing code dissemination protocols. The trade-offs between reliability, security overhead, and overall transmission time for SIMAGE are also discussed.
31.
Aaron D Goldman, A. Selcuk Uluagac, Raheem Beyah, John A Copeland
Plugging the leaks without unplugging your network in the midst of Disaster Conference Paper
In the proceedings of 37th Annual IEEE Conference on Local Computer Networks (LCN), 2012.
Abstract | Links | BibTeX | Tags: Network Security
@conference{GoldmanIEEE2012,
title = {Plugging the leaks without unplugging your network in the midst of Disaster},
author = {Aaron D Goldman and A. Selcuk Uluagac and Raheem Beyah and John A Copeland},
url = {https://ieeexplore.ieee.org/abstract/document/6423620/},
year = {2012},
date = {2012-01-01},
urldate = {2012-01-01},
booktitle = {In the proceedings of 37th Annual IEEE Conference on Local Computer Networks (LCN)},
abstract = {Network Disaster Recovery research has examined behavior of networks after disasters with an aim to restoring normal conditions. In addition to probable loss of connectivity, a disaster scenario can also lead to security risks. However, network security has been examined extensively under normal conditions, and not under conditions that ensue after disasters. Therefore, security issues should be addressed during the period of chaos after a disaster, but before operating conditions return to normal. Furthermore, security should be assured, while still allowing access to the network to enable public communication in order to assist in disaster relief efforts. In general, the desire to help with public assistance requires opening up access to the network, while security concerns add pressure to close down or limit access to the network. In this study, we show that the objectives of availability and confidentiality, two objectives that have not previously been considered together in disaster scenarios, can be simultaneously achieved. For our study, we evaluated six wireless devices with various network configurations, including a laptop, a Kindle Fire e-reader, an Android tablet, a Google Nexus phone, an IP camera, and an Apple TV, to approximate behaviors of a communication network under a disaster scenario. Actual data leakage was tracked and observed for these devices. To the best of our knowledge this has not previously been examined in a systematic manner for post-disaster scenarios. After illustrating the data leakage of various devices, we analyze the risk associated with the various types of leakage. Moving private traffic to a VPN would free the physical network for use as a public resource.},
keywords = {Network Security},
pubstate = {published},
tppubtype = {conference}
}
Network Disaster Recovery research has examined behavior of networks after disasters with an aim to restoring normal conditions. In addition to probable loss of connectivity, a disaster scenario can also lead to security risks. However, network security has been examined extensively under normal conditions, and not under conditions that ensue after disasters. Therefore, security issues should be addressed during the period of chaos after a disaster, but before operating conditions return to normal. Furthermore, security should be assured, while still allowing access to the network to enable public communication in order to assist in disaster relief efforts. In general, the desire to help with public assistance requires opening up access to the network, while security concerns add pressure to close down or limit access to the network. In this study, we show that the objectives of availability and confidentiality, two objectives that have not previously been considered together in disaster scenarios, can be simultaneously achieved. For our study, we evaluated six wireless devices with various network configurations, including a laptop, a Kindle Fire e-reader, an Android tablet, a Google Nexus phone, an IP camera, and an Apple TV, to approximate behaviors of a communication network under a disaster scenario. Actual data leakage was tracked and observed for these devices. To the best of our knowledge this has not previously been examined in a systematic manner for post-disaster scenarios. After illustrating the data leakage of various devices, we analyze the risk associated with the various types of leakage. Moving private traffic to a VPN would free the physical network for use as a public resource.
32.
Marco Valero, Sang Shin Jung, A. Selcuk Uluagac, Yingshu Li, Raheem Beyah
Di-Sec: A distributed security framework for heterogeneous Wireless Sensor Networks Conference Paper
In the proceedings IEEE International Conference on Computer Communications (INFOCOM), 2012.
Abstract | Links | BibTeX | Tags: IoT Security, Network Security, Wireless Security
@conference{ValeroDi-SecIEEE2012,
title = {Di-Sec: A distributed security framework for heterogeneous Wireless Sensor Networks},
author = {Marco Valero and Sang Shin Jung and A. Selcuk Uluagac and Yingshu Li and Raheem Beyah},
url = {https://ieeexplore.ieee.org/abstract/document/6195801/},
year = {2012},
date = {2012-01-01},
urldate = {2012-01-01},
booktitle = {In the proceedings IEEE International Conference on Computer Communications (INFOCOM)},
abstract = {Wireless Sensor Networks (WSNs) are deployed for monitoring in a range of critical domains (e.g., health care, military, critical infrastructure). Accordingly, these WSNs should be resilient to attacks. The current approach to defending against malicious threats is to develop and deploy a specific defense mechanism for a specific attack. However, the problem with this traditional approach to defending sensor networks is that the solution for the Jamming attack does not defend against other attacks (e.g., Sybil and Selective Forwarding). In reality, one cannot know a priori what type of attack an adversary will launch. This work addresses the challenges with the traditional approach to securing sensor networks and presents a comprehensive framework, Di-Sec, that can defend against all known and forthcoming attacks. At the heart of Di-Sec lies the monitoring core (M-Core), which is an extensible and lightweight layer that gathers statistics relevant for the defense mechanisms. The M-Core allows for the monitoring of both internal and external threats and supports the execution of multiple detection and defense mechanisms (DDMs) against different threats in parallel. Along with Di-Sec, a new user-friendly domain-specific language was developed, the M-Core Control Language (MCL). Using the MCL, a user can implement new defense mechanisms without the overhead of learning the details of the underlying software architecture (i.e., TinyOS, Di-Sec). Hence, the MCL expedites the development of sensor defense mechanisms by significantly simplifying the coding process for developers. The Di-Sec framework has been implemented and tested on real sensors to evaluate its feasibility and performance. Our evaluation of memory, communication, and sensing components shows that Di-Sec is feasible on today's resource-limited sensors and has a nominal overhead. Furthermore, we illustrate the basic functionality of Di-Sec by implementing and simultaneously executing DDMs for attacks at various layers of the communication stack (i.e., Jamming, Selective Forwarding, Sybil, and Internal attacks).},
keywords = {IoT Security, Network Security, Wireless Security},
pubstate = {published},
tppubtype = {conference}
}
Wireless Sensor Networks (WSNs) are deployed for monitoring in a range of critical domains (e.g., health care, military, critical infrastructure). Accordingly, these WSNs should be resilient to attacks. The current approach to defending against malicious threats is to develop and deploy a specific defense mechanism for a specific attack. However, the problem with this traditional approach to defending sensor networks is that the solution for the Jamming attack does not defend against other attacks (e.g., Sybil and Selective Forwarding). In reality, one cannot know a priori what type of attack an adversary will launch. This work addresses the challenges with the traditional approach to securing sensor networks and presents a comprehensive framework, Di-Sec, that can defend against all known and forthcoming attacks. At the heart of Di-Sec lies the monitoring core (M-Core), which is an extensible and lightweight layer that gathers statistics relevant for the defense mechanisms. The M-Core allows for the monitoring of both internal and external threats and supports the execution of multiple detection and defense mechanisms (DDMs) against different threats in parallel. Along with Di-Sec, a new user-friendly domain-specific language was developed, the M-Core Control Language (MCL). Using the MCL, a user can implement new defense mechanisms without the overhead of learning the details of the underlying software architecture (i.e., TinyOS, Di-Sec). Hence, the MCL expedites the development of sensor defense mechanisms by significantly simplifying the coding process for developers. The Di-Sec framework has been implemented and tested on real sensors to evaluate its feasibility and performance. Our evaluation of memory, communication, and sensing components shows that Di-Sec is feasible on today's resource-limited sensors and has a nominal overhead. Furthermore, we illustrate the basic functionality of Di-Sec by implementing and simultaneously executing DDMs for attacks at various layers of the communication stack (i.e., Jamming, Selective Forwarding, Sybil, and Internal attacks).
33.
Troy Nunnally, A. Selcuk Uluagac, John A. Copeland, Raheem Beyah
3DSVAT: A 3D Stereoscopic Vulnerability Assessment Tool for network security Conference Paper
In the proceedings of 37th Annual IEEE Conference on Local Computer Networks (LCN), 2012.
Abstract | Links | BibTeX | Tags: Network Security, Security Visualization
@conference{Nunnally3DSVATIEEE2012,
title = {3DSVAT: A 3D Stereoscopic Vulnerability Assessment Tool for network security},
author = {Troy Nunnally and A. Selcuk Uluagac and John A. Copeland and Raheem Beyah},
url = {https://ieeexplore.ieee.org/abstract/document/6423586/},
year = {2012},
date = {2012-01-01},
urldate = {2012-01-01},
booktitle = {In the proceedings of 37th Annual IEEE Conference on Local Computer Networks (LCN)},
abstract = {As the volume of network data continues to increase and networks become more complex, the ability to accurately manage and analyze data quickly becomes a difficult problem. Many network management tools already use two-dimensional (2D) and three-dimensional (3D) visualization techniques to help support decision-making and reasoning of network anomalies and activity. However, a poor user interface combined with the massive amount of data could obfuscate important network details. As a result, administrators may fail to detect and identify malicious network behavior in a timely manner. 3D visualizations address this challenge by introducing monocular and binocular visual cues to portray depth and to increase the perceived viewing area. In this work, we explore these cues for 3D network security applications, with a particular emphasis on binocular disparity or stereoscopic 3D. Currently, no network security tool takes advantage of the enhanced depth perception provided by stereoscopic 3D technologies for vulnerability assessment. Compared to traditional 3D systems, stereoscopic 3D helps improve the perception of depth, which can, in turn reduce the number of errors and increase response times of network administrators. Thus, we introduce a stereoscopic 3D visual Framework for Rendering Enhanced 3D Stereoscopic Visualizations for Network Security (FRE3DS). Our novel framework uses state-of-the art 3D graphics rendering to assist in 3D visualizations for network security applications. Moreover, utilizing our framework, we propose a new 3D Stereoscopic Vulnerability Assessment Tool (3DSVAT). We illustrate the use of 3DSVAT to assist in rapid detection and correlation of attack vulnerabilities in a subset of a modified local area network data set using the enhanced perception of depth in a stereoscopic 3D environment.},
keywords = {Network Security, Security Visualization},
pubstate = {published},
tppubtype = {conference}
}
As the volume of network data continues to increase and networks become more complex, the ability to accurately manage and analyze data quickly becomes a difficult problem. Many network management tools already use two-dimensional (2D) and three-dimensional (3D) visualization techniques to help support decision-making and reasoning of network anomalies and activity. However, a poor user interface combined with the massive amount of data could obfuscate important network details. As a result, administrators may fail to detect and identify malicious network behavior in a timely manner. 3D visualizations address this challenge by introducing monocular and binocular visual cues to portray depth and to increase the perceived viewing area. In this work, we explore these cues for 3D network security applications, with a particular emphasis on binocular disparity or stereoscopic 3D. Currently, no network security tool takes advantage of the enhanced depth perception provided by stereoscopic 3D technologies for vulnerability assessment. Compared to traditional 3D systems, stereoscopic 3D helps improve the perception of depth, which can, in turn reduce the number of errors and increase response times of network administrators. Thus, we introduce a stereoscopic 3D visual Framework for Rendering Enhanced 3D Stereoscopic Visualizations for Network Security (FRE3DS). Our novel framework uses state-of-the art 3D graphics rendering to assist in 3D visualizations for network security applications. Moreover, utilizing our framework, we propose a new 3D Stereoscopic Vulnerability Assessment Tool (3DSVAT). We illustrate the use of 3DSVAT to assist in rapid detection and correlation of attack vulnerabilities in a subset of a modified local area network data set using the enhanced perception of depth in a stereoscopic 3D environment.
34.
Christopher P. Lee, Arif Selcuk Uluagac, Kevin D. Fairbanks, John A. Copeland
The Design of NetSecLab: A Small Competition-Based Network Security Lab Journal Article
IEEE Transactions on Education Journal, 2011.
Abstract | Links | BibTeX | Tags: Network Security, Security Education
@article{LeeIEEE2011,
title = {The Design of NetSecLab: A Small Competition-Based Network Security Lab},
author = {Christopher P. Lee and Arif Selcuk Uluagac and Kevin D. Fairbanks and John A. Copeland},
url = {https://ieeexplore.ieee.org/abstract/document/5454381/},
year = {2011},
date = {2011-01-01},
urldate = {2011-01-01},
journal = { IEEE Transactions on Education Journal},
abstract = {This paper describes a competition-style of exercise to teach system and network security and to reinforce themes taught in class. The exercise, called NetSecLab, is conducted on a closed network with student-formed teams, each with their own Linux system to defend and from which to launch attacks. Students are expected to learn how to: 1) install the specified Linux distribution; 2) set up the required services; 3) find ways to harden the box; 4) explore attack methods; and 5) compete. The informal write-up at the end of the lab focuses on their research into defense and attack methods, which contributes to their grade, while their competition score is dependent on their abilities to attack during the competition. Surveys were performed to evaluate the efficacy of the exercise in teaching system security.},
keywords = {Network Security, Security Education},
pubstate = {published},
tppubtype = {article}
}
This paper describes a competition-style of exercise to teach system and network security and to reinforce themes taught in class. The exercise, called NetSecLab, is conducted on a closed network with student-formed teams, each with their own Linux system to defend and from which to launch attacks. Students are expected to learn how to: 1) install the specified Linux distribution; 2) set up the required services; 3) find ways to harden the box; 4) explore attack methods; and 5) compete. The informal write-up at the end of the lab focuses on their research into defense and attack methods, which contributes to their grade, while their competition score is dependent on their abilities to attack during the competition. Surveys were performed to evaluate the efficacy of the exercise in teaching system security.
35.
A. Selcuk Uluagac, Raheem A. Beyah, Yingshu Li, John A. Copeland
VEBEK: Virtual Energy-Based Encryption and Keying for Wireless Sensor Networks Journal Article
IEEE Transactions on Mobile Computing Journal, 2010.
Abstract | Links | BibTeX | Tags: IoT Security, Network Security, Wireless Security
@article{UluagacVEBEKIEEE2010,
title = {VEBEK: Virtual Energy-Based Encryption and Keying for Wireless Sensor Networks},
author = {A. Selcuk Uluagac, Raheem A. Beyah, Yingshu Li and John A. Copeland},
url = {https://ieeexplore.ieee.org/abstract/document/5438995/},
doi = {10.1109/TMC.2010.51},
year = {2010},
date = {2010-01-01},
urldate = {2010-01-01},
journal = {IEEE Transactions on Mobile Computing Journal},
abstract = {Designing cost-efficient, secure network protocols for Wireless Sensor Networks (WSNs) is a challenging problem because sensors are resource-limited wireless devices. Since the communication cost is the most dominant factor in a sensor's energy consumption, we introduce an energy-efficient Virtual Energy-Based Encryption and Keying (VEBEK) scheme for WSNs that significantly reduces the number of transmissions needed for rekeying to avoid stale keys. In addition to the goal of saving energy, minimal transmission is imperative for some military applications of WSNs where an adversary could be monitoring the wireless spectrum. VEBEK is a secure communication framework where sensed data is encoded using a scheme based on a permutation code generated via the RC4 encryption mechanism. The key to the RC4 encryption mechanism dynamically changes as a function of the residual virtual energy of the sensor. Thus, a one-time dynamic key is employed for one packet only and different keys are used for the successive packets of the stream. The intermediate nodes along the path to the sink are able to verify the authenticity and integrity of the incoming packets using a predicted value of the key generated by the sender's virtual energy, thus requiring no need for specific rekeying messages. VEBEK is able to efficiently detect and filter false data injected into the network by malicious outsiders. The VEBEK framework consists of two operational modes (VEBEK-I and VEBEK-II), each of which is optimal for different scenarios. In VEBEK-I, each node monitors its one-hop neighbors where VEBEK-II statistically monitors downstream nodes. We have evaluated VEBEK's feasibility and performance analytically and through simulations. Our results show that VEBEK, without incurring transmission overhead (increasing packet size or sending control messages for rekeying), is able to eliminate malicious data from the network in an energy-efficient manner. We also show that our framework performs better than other comparable schemes in the literature with an overall 60-100 percent improvement in energy savings without the assumption of a reliable medium access control layer.},
keywords = {IoT Security, Network Security, Wireless Security},
pubstate = {published},
tppubtype = {article}
}
Designing cost-efficient, secure network protocols for Wireless Sensor Networks (WSNs) is a challenging problem because sensors are resource-limited wireless devices. Since the communication cost is the most dominant factor in a sensor's energy consumption, we introduce an energy-efficient Virtual Energy-Based Encryption and Keying (VEBEK) scheme for WSNs that significantly reduces the number of transmissions needed for rekeying to avoid stale keys. In addition to the goal of saving energy, minimal transmission is imperative for some military applications of WSNs where an adversary could be monitoring the wireless spectrum. VEBEK is a secure communication framework where sensed data is encoded using a scheme based on a permutation code generated via the RC4 encryption mechanism. The key to the RC4 encryption mechanism dynamically changes as a function of the residual virtual energy of the sensor. Thus, a one-time dynamic key is employed for one packet only and different keys are used for the successive packets of the stream. The intermediate nodes along the path to the sink are able to verify the authenticity and integrity of the incoming packets using a predicted value of the key generated by the sender's virtual energy, thus requiring no need for specific rekeying messages. VEBEK is able to efficiently detect and filter false data injected into the network by malicious outsiders. The VEBEK framework consists of two operational modes (VEBEK-I and VEBEK-II), each of which is optimal for different scenarios. In VEBEK-I, each node monitors its one-hop neighbors where VEBEK-II statistically monitors downstream nodes. We have evaluated VEBEK's feasibility and performance analytically and through simulations. Our results show that VEBEK, without incurring transmission overhead (increasing packet size or sending control messages for rekeying), is able to eliminate malicious data from the network in an energy-efficient manner. We also show that our framework performs better than other comparable schemes in the literature with an overall 60-100 percent improvement in energy savings without the assumption of a reliable medium access control layer.
36.
Selcuk Uluagac, Raheem A. Beyah, John A. Copeland
Time-Based Dynamic Keying and En-Route Filtering (TICK) for Wireless Sensor Networks Conference Paper
In the proceedings of IEEE Global Telecommunications Conference (GLOBECOM), 2010.
Abstract | Links | BibTeX | Tags: IoT Security, Network Security, Wireless Security
@conference{UluagacTICKIEEE2010,
title = {Time-Based Dynamic Keying and En-Route Filtering (TICK) for Wireless Sensor Networks},
author = {Selcuk Uluagac, Raheem A. Beyah and John A. Copeland},
url = {https://ieeexplore.ieee.org/abstract/document/5683787/},
year = {2010},
date = {2010-01-01},
urldate = {2010-01-01},
booktitle = {In the proceedings of IEEE Global Telecommunications Conference (GLOBECOM)},
abstract = {Given that transmission cost is significant in a Wireless Sensor Network (WSN), sending explicit keying control messages significantly increases the amount of energy consumed by each sensing device. Thus, in this paper, we address the issue of security for WSNs from a completely novel perspective. We present a technique to secure the network, without the transmission of explicit keying messages needed to avoid stale keys. Our protocol, the TIme-Based DynamiC Keying and En-Route Filtering (TICK) protocol for WSNs secures events as they occur. As opposed to current chatty schemes that incur regular keying message overhead, nodes use their local time values as a one-time dynamic key to encrypt each message. Further, this mechanism prevents malicious nodes from injecting false packets into the network. TICK is as a worst case twice more energy efficient than existing related work. Both an analytical framework and simulation results are presented to verify the feasibility of TICK as well as the energy consumption of the scheme under normal operation and attack from malicious nodes.},
keywords = {IoT Security, Network Security, Wireless Security},
pubstate = {published},
tppubtype = {conference}
}
Given that transmission cost is significant in a Wireless Sensor Network (WSN), sending explicit keying control messages significantly increases the amount of energy consumed by each sensing device. Thus, in this paper, we address the issue of security for WSNs from a completely novel perspective. We present a technique to secure the network, without the transmission of explicit keying messages needed to avoid stale keys. Our protocol, the TIme-Based DynamiC Keying and En-Route Filtering (TICK) protocol for WSNs secures events as they occur. As opposed to current chatty schemes that incur regular keying message overhead, nodes use their local time values as a one-time dynamic key to encrypt each message. Further, this mechanism prevents malicious nodes from injecting false packets into the network. TICK is as a worst case twice more energy efficient than existing related work. Both an analytical framework and simulation results are presented to verify the feasibility of TICK as well as the energy consumption of the scheme under normal operation and attack from malicious nodes.
37.
Selcuk Uluagac, Raheem A Beyah,, John A. Copeland
Analysis of Varying AS Path Lengths from the Edge of the Network Conference Paper
In the proceedings of IEEE Global Telecommunications Conference (GLOBECOM), 2010.
Abstract | Links | BibTeX | Tags: IoT Security, Network Security, Wireless Security
@conference{UluagacIEEE2010,
title = {Analysis of Varying AS Path Lengths from the Edge of the Network},
author = {Selcuk Uluagac, Raheem A Beyah, and John A. Copeland},
url = {https://ieeexplore.ieee.org/abstract/document/5683787/},
year = {2010},
date = {2010-01-01},
urldate = {2010-01-01},
booktitle = {In the proceedings of IEEE Global Telecommunications Conference (GLOBECOM)},
abstract = {Understanding and analyzing the past and current behavior of the Internet will be instrumental in building tomorrow's more efficient and scalable networks (e.g., the future Internet). In this paper, we study the impact of Autonomous Systems (ASs) paths' end-to-end latency. Unfortunately, due to the diverse set of non-disclosed routing policies among ASs, packets belonging to a certain end-to- end connection may traverse different ASs, causing fluctuating AS paths. Fluctuation of AS paths has been studied in the literature directly from the core of the network. In this paper, we take a different approach to the analysis of the fluctuation, solely from the edge of the network. Specifically, from the end user's perspective, some AS paths may be optimal (or better) and some sub-optimal. Furthermore, there is not a unique definition for sub- optimality as it may be reflected with various measures (e.g., latency) depending on the application requirements and expectations. In this paper we analyze fluctuating AS path lengths (ASPLs) and investigate their impact on the end-to-end latency over the Internet at a greater scale than previous studies. This study was conducted using Scriptroute to probe various PlanetLab nodes. Our results show that all of the source nodes experienced some AS path differences and the ASPL values that the sources use greatly vary. At worst, some nodes experienced different paths over 70% of the time during our measurements. We observed that the largest difference in ASPLs on a particular connection was as high as 6 with an average of 2.5. Moreover, we present real cases where ASPL and latency values are related, inversely related, and not related at all. Finally, we provide a simple definition for suboptimality and analyze the collected data against this definition. We show that overall 82% of the fluctuating paths and 9% of all the traces between source-destination pairs faced sub-optimal AS paths.},
keywords = {IoT Security, Network Security, Wireless Security},
pubstate = {published},
tppubtype = {conference}
}
Understanding and analyzing the past and current behavior of the Internet will be instrumental in building tomorrow's more efficient and scalable networks (e.g., the future Internet). In this paper, we study the impact of Autonomous Systems (ASs) paths' end-to-end latency. Unfortunately, due to the diverse set of non-disclosed routing policies among ASs, packets belonging to a certain end-to- end connection may traverse different ASs, causing fluctuating AS paths. Fluctuation of AS paths has been studied in the literature directly from the core of the network. In this paper, we take a different approach to the analysis of the fluctuation, solely from the edge of the network. Specifically, from the end user's perspective, some AS paths may be optimal (or better) and some sub-optimal. Furthermore, there is not a unique definition for sub- optimality as it may be reflected with various measures (e.g., latency) depending on the application requirements and expectations. In this paper we analyze fluctuating AS path lengths (ASPLs) and investigate their impact on the end-to-end latency over the Internet at a greater scale than previous studies. This study was conducted using Scriptroute to probe various PlanetLab nodes. Our results show that all of the source nodes experienced some AS path differences and the ASPL values that the sources use greatly vary. At worst, some nodes experienced different paths over 70% of the time during our measurements. We observed that the largest difference in ASPLs on a particular connection was as high as 6 with an average of 2.5. Moreover, we present real cases where ASPL and latency values are related, inversely related, and not related at all. Finally, we provide a simple definition for suboptimality and analyze the collected data against this definition. We show that overall 82% of the fluctuating paths and 9% of all the traces between source-destination pairs faced sub-optimal AS paths.
38.
A. Selcuk Uluagac, Christopher P. Lee, Raheem A. Beyah, John A. Copeland
Designing Secure Protocols for Wireless Sensor Networks Book
Springer Berlin Heidelberg, Berlin, Heidelberg, 2008.
Abstract | Links | BibTeX | Tags: IoT Security, Network Security
@book{UluagacSpringer2008,
title = {Designing Secure Protocols for Wireless Sensor Networks},
author = {A. Selcuk Uluagac and Christopher P. Lee and Raheem A. Beyah and John A. Copeland},
editor = {Yingshu Li and Dung T. Huynh and Sajal K. Das and Ding-Zhu Du},
url = {https://link.springer.com/chapter/10.1007/978-3-540-88582-5_47},
year = {2008},
date = {2008-01-01},
urldate = {2008-01-01},
booktitle = {Wireless Algorithms, Systems, and Applications},
publisher = {Springer Berlin Heidelberg},
address = {Berlin, Heidelberg},
abstract = {Over the years, a myriad of protocols have been proposed for resource-limited Wireless Sensor Networks (WSNs). Similarly, security research for WSNs has also evolved over the years. Although fundamental notions of WSN research are well established, optimization of the limited resources has motivated new research directions in the field. In this paper, we seek to present general principles to aid in the design of secure WSN protocols. Therefore, building upon both the established and the new concepts, envisioned applications, and the experience garnered from the WSNs research, we first review the desired security services (i.e., confidentiality, authentication, integrity, access control, availability, and nonrepudiation) from WSNs perspective. Then, we question which services would be necessary for resource-constrained WSNs and when it would be most reasonable to implement them for a WSN application.},
keywords = {IoT Security, Network Security},
pubstate = {published},
tppubtype = {book}
}
Over the years, a myriad of protocols have been proposed for resource-limited Wireless Sensor Networks (WSNs). Similarly, security research for WSNs has also evolved over the years. Although fundamental notions of WSN research are well established, optimization of the limited resources has motivated new research directions in the field. In this paper, we seek to present general principles to aid in the design of secure WSN protocols. Therefore, building upon both the established and the new concepts, envisioned applications, and the experience garnered from the WSNs research, we first review the desired security services (i.e., confidentiality, authentication, integrity, access control, availability, and nonrepudiation) from WSNs perspective. Then, we question which services would be necessary for resource-constrained WSNs and when it would be most reasonable to implement them for a WSN application.
39.
A. Selcuk Uluagac, Jon M. Peha
IP Multicast over Cable TV Networks Book
Springer Berlin Heidelberg, Berlin, Heidelberg, 2003.
Abstract | Links | BibTeX | Tags: Network Security
@book{UluagacCableTVSpringer2003,
title = {IP Multicast over Cable TV Networks},
author = {A. Selcuk Uluagac and Jon M. Peha},
editor = {Burkhard Stiller and Georg Carle and Martin Karsten and Peter Reichl},
url = {https://link.springer.com/chapter/10.1007/978-3-540-39405-1_15},
year = {2003},
date = {2003-01-01},
urldate = {2003-01-01},
booktitle = {Group Communications and Charges. Technology and Business Models},
publisher = {Springer Berlin Heidelberg},
address = {Berlin, Heidelberg},
abstract = {When a cable TV network that provides Internet access is connected to multiple ISPs, there are instances where multicast does not work or works inefficiently. This paper identifies causes of these problems, and proposes solutions, demonstrating that it is possible to provide efficient multicast with any of the architectures under consideration. In addition, the de facto industry standard for data transmission over cable networks, DOCSIS TM , guarantees that a cable company will have the ability to block certain multicast traffic (such as traffic generated by Internet television broadcasters which compete with the cable companys core business.) This paper describes how an ISP can circumvent this. Under the assumption that there is a significant amount of multicast traffic, we show thatcable companies and ISPs would be motivated to provide multicast services in all cases, but there are cases},
keywords = {Network Security},
pubstate = {published},
tppubtype = {book}
}
When a cable TV network that provides Internet access is connected to multiple ISPs, there are instances where multicast does not work or works inefficiently. This paper identifies causes of these problems, and proposes solutions, demonstrating that it is possible to provide efficient multicast with any of the architectures under consideration. In addition, the de facto industry standard for data transmission over cable networks, DOCSIS TM , guarantees that a cable company will have the ability to block certain multicast traffic (such as traffic generated by Internet television broadcasters which compete with the cable companys core business.) This paper describes how an ISP can circumvent this. Under the assumption that there is a significant amount of multicast traffic, we show thatcable companies and ISPs would be motivated to provide multicast services in all cases, but there are cases
Citations: 8413
h-index: 44
i10-index: 107
