pages tagged 2004

Detecting Early Worm Propagation through Packet Matching

Mon, 18 Jul 2011 16:44:27 -0700

Detecting Early Worm Propagation through Packet Matching Xuan Chen and John Heidemann USC/Information Sciences Institute Abstract In this paper, we present DEWP, a router-based system designed to automatically detect and quarantine Internet worm propagation. DEWP detects worm probing traffic by matching destination port numbers between incoming and outgoing connections. This approach does not require knowledge of worm packet contents or profiles of normal traffic conditions; it can automatically detect and suppress worms due to their unusual traffic patterns. We describe how DEWP works and evaluate its performance with simulations. We study the speed of detection and the effectiveness of vulnerable host protection relative to factors including worm scanning techniques, DEWP deployment coverage and detection intervals. We also investigate false detections with network trace playback. We show that DEWP detects worm propagation within about 4 seconds. By blocking worm probing traffic automatically, DEWP can protect more than 99% hosts from random-scanning worms. Availability This paper is available in several formats: abstract web page with pointers and cites, PDF, paper copies can be obtained by mail to the authors. Copyright terms for this paper appear below. Reference Chen04a Xuan Chen and John Heidemann. Detecting Early Worm Propagation through Packet Matching. Technical Report ISI-TR-2004-585, USC/Information Sciences Institute, February, 2004. <http://www.isi.edu/~johnh/PAPERS/Chen04a.html>. @techreport{Chen04a, author = "Xuan Chen and John Heidemann", title = "Detecting Early Worm Propagation through Packet Matching", institution = "USC/Information Sciences Institute", year = "2004", number = "ISI-TR-2004-585", month = "February", keywords = "DEWP, worm propagation, NEWS", url = "http://www.isi.edu/~johnh/PAPERS/Chen04a.html", pdfurl = "http://www.isi.edu/~johnh/PAPERS/Chen04a.pdf", copyrightholder = "authors", myorganization = "USC/Information Sciences Institute", } Copyright This paper is copyright © 2004 by its authors. Permission to make digital or hard copies of part or all of this work for personal use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that new copies bear this notice and the full citation on the first page. Abstracting with credit is permitted. To copy otherwise, to republish, to post on servers or to redistribute to lists, requires prior specific permission of the authors.

Application-specific Modeling of Information Routing in Sensor Networks

Mon, 18 Jul 2011 16:44:27 -0700

Application-specific Modeling of Information Routing in Sensor Networks Bhaskar Krishnamachari and John Heidemann USC/Information Sciences Institute Abstract Sensor network applications have a diverse set of requirements-some involve extraction of sensor data to a single point, others exploit sensor-to-sensor communication; some employ long-lasting data streams while connections in others are mainly ephemeral. Different variants of the directed diffusion routing protocol-pull-based, push-based and hybrid rendezvous-based-have been developed, along with in-network processing and geographic routing techniques. However, there has been no prior systematic study comparing their performance with respect to the diverse application characteristics. In this paper, we develop novel abstract parameterized models for traffic and topology that can incorporate data aggregation and geographic scoping. Using these models, we mathematically analyze the performance of these routing techniques across a range of application scenarios (with varying numbers of nodes, sources, sinks, data settings etc.). Besides quantifying the conditions under which the different routing algorithms outperform each other, we obtain a number of useful design insights. Our analysis shows that algorithms mismatched to applications can result in drastically poor performance; demonstrates the desirability of reducing flooded interest and exploratory messages when data aggregation is used; and suggests that it may be difficult to implement efficient hybrid schemes because their performance is very sensitive to the optimal placement of rendezvous points. Availability This paper is available in several formats: abstract web page with pointers and cites, PDF, paper copies can be obtained by mail to the authors. Copyright terms for this paper appear below. Reference Krishnamachari04a Bhaskar Krishnamachari and John Heidemann. Application-specific Modeling of Information Routing in Sensor Networks. In Proceedings of the IEEE International on Performance, Computing, and Communications Conference, pp. 717-722. Phoenix, Arizona, USA, IEEE. April, 2004. <http://www.isi.edu/~johnh/PAPERS/Krishnamachari04a.html>. @inproceedings{Krishnamachari04a, author = "Bhaskar Krishnamachari and John Heidemann", title = "Application-specific Modeling of Information Routing in Sensor Networks", booktitle = "Proceedings of the IEEE International on Performance, Computing, and Communications Conference", year = "2004", publisher = "{IEEE}", address = "Phoenix, Arizona, USA", month = "April", pages = "717--722", keywords = "diffusion, trade-offs", otherurl = "http://ieeexplore.ieee.org/iel5/9115/28907/01301184.pdf?isNumber=28907&prod=STD&arnumber=1301184&arNumber=1301184&arSt=+717&ared=+722&arAuthor=+Krishnamachari%2C+B.%3B++Heidemann%2C+J.", url = "http://www.isi.edu/~johnh/PAPERS/Krishnamachari04a.html", pdfurl = "http://www.isi.edu/~johnh/PAPERS/Krishnamachari04a.pdf", myorganization = "USC/Information Sciences Institute", copyrightholder = "{IEEE}", } Copyright This paper is copyright © 2004 by IEEE. Personal use of this material is permitted. However, permission to reprint/republish this material for advertising or promotional purposes or for creating new collective works for resale or redistribution to servers or lists, or to reuse any copyrighted component of this work in other works must be obtained from the IEEE.

Application-Based Collision Avoidance in Wireless Sensor Networks

Mon, 18 Jul 2011 16:44:27 -0700

Application-Based Collision Avoidance in Wireless Sensor Networks Thanos Stathopoulos, Rahul Kapur, Deborah Estrin, John Heidemann, and Lixia Zhang USC/Information Sciences Institute Abstract Wireless sensor networks are characterized by collections of small, low-power nodes that collect information about the physical world. Concurrent transmissions caused by the well-known hidden terminal problem result in collisions and packet corruption. Since corrupted packets must be retransmitted, collisions add an additional burden to the already energy constrained system. In this paper, we present an application-based approach to collision avoidance.We propose two specific algorithms; the first one follows TCP's congestion avoidance algorithm and adjusts the transmission rate when a collision occurs, while the second one shifts packet transmission times to minimize collisions. We evaluated both algorithms through simulations and our results show that our approach can reduce the number of collision-induced retransmissions by a factor of 8 and the energy consumption by up to 50%. Availability This paper is available in several formats: abstract web page with pointers and cites, PDF, paper copies can be obtained by mail to the authors. Copyright terms for this paper appear below. Reference Stathopoulos04a Thanos Stathopoulos, Rahul Kapur, Deborah Estrin, John Heidemann, and Lixia Zhang. Application-Based Collision Avoidance in Wireless Sensor Networks. In Proceedings of the 29th IEEE International Conference on Local Computer Networks, pp. 506-514. Tampa, Florida, USA, IEEE. November, 2004. <http://www.isi.edu/~johnh/PAPERS/Stathopoulos04a.html>. @inproceedings{Stathopoulos04a, author = "Thanos Stathopoulos and Rahul Kapur and Deborah Estrin and John Heidemann and Lixia Zhang", title = "Application-Based Collision Avoidance in Wireless Sensor Networks", booktitle = "Proceedings of the 29th {IEEE} International Conference on Local Computer Networks", year = "2004", publisher = "{IEEE}", address = "Tampa, Florida, USA", month = "November", pages = "506--514", doi = "http://dx.doi.org/10.1109/LCN.2004.24", otherurl = "http://lecs.cs.ucla.edu/~thanos/collision.pdf", url = "http://www.isi.edu/~johnh/PAPERS/Stathopoulos04a.html", pdfurl = "http://www.isi.edu/~johnh/PAPERS/Stathopoulos04a.pdf", copyrightholder = "{IEEE}", } Copyright This paper is copyright © 2004 by IEEE. Personal use of this material is permitted. However, permission to reprint/republish this material for advertising or promotional purposes or for creating new collective works for resale or redistribution to servers or lists, or to reuse any copyrighted component of this work in other works must be obtained from the IEEE.

Energy Conservation in Sensor Networks at the Link and Network Layers

Mon, 18 Jul 2011 16:44:27 -0700

Energy Conservation in Sensor Networks at the Link and Network Layers John Heidemann and Wei Ye USC/Information Sciences Institute Abstract This chapter surveys network-level approaches to conserve energy in sensor networks. We consider protocols for transmission power control, media access control, topology control, and energy-aware routing, surveying relevant literature and describing approaches that have been considered. Availability This paper is available in several formats: abstract web page with pointers and cites, PDF, paper copies can be obtained by mail to the authors. Copyright terms for this paper appear below. Reference Heidemann04c John Heidemann and Wei Ye. Energy Conservation in Sensor Networks at the Link and Network Layers. Technical Report ISI-TR-2004-599, USC/Information Sciences Institute, 2004. book chapter to appear in \emphWireless Sensor Networks: A Systems Perspective, Nirupama Bulusu and Sanjay Jha (editors), Artech House, 2005. <http://www.isi.edu/~johnh/PAPERS/Heidemann04c.html>. @techreport{Heidemann04c, author = "John Heidemann and Wei Ye", title = "Energy Conservation in Sensor Networks at the Link and Network Layers", institution = "USC/Information Sciences Institute", year = "2004", number = "ISI-TR-2004-599", note = "book chapter to appear in \emph{Wireless Sensor Networks: A Systems Perspective}, Nirupama Bulusu and Sanjay Jha (editors), Artech House, 2005", keywords = "sensor network overview, energy conservation overview", url = "http://www.isi.edu/~johnh/PAPERS/Heidemann04c.html", url = "http://www.isi.edu/~johnh/PAPERS/Heidemann04c.html", pdfurl = "http://www.isi.edu/~johnh/PAPERS/Heidemann04c.pdf", myorganization = "USC/Information Sciences Institute", copyrightholder = "authors", } Copyright This paper is copyright © 2004 by its authors. Permission to make digital or hard copies of part or all of this work for personal use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that new copies bear this notice and the full citation on the first page. Abstracting with credit is permitted. To copy otherwise, to republish, to post on servers or to redistribute to lists, requires prior specific permission of the authors.

Distinguishing between Single and Multi-source Attacks using Signal Processing

Mon, 18 Jul 2011 16:44:27 -0700

Distinguishing between Single and Multi-source Attacks using Signal Processing Alefiya Hussain, John Heidemann, and Christos Papadopoulos USC/Information Sciences Institute Abstract Launching a denial of service (DoS) attack is trivial, but detection and response is a painfully slow and often a manual process. Automatic classification of attacks as single- or multi-source can help focus a response, but current packet-header-based approaches are susceptible to spoofing. This paper introduces a framework for classifying DoS attacks based on header content, transient ramp-up behavior, and novel techniques such as spectral analysis. Although headers are easily forged, we show that characteristics of attack ramp-up and attack spectrum are more difficult to spoof. To evaluate our framework we monitored access links of a regional ISP detecting 80 live attacks. Header analysis identified the number of attackers in 67 attacks, while the remaining 13 attacks were classified based on ramp-up and spectral analysis. We validate our results through monitoring at a second site, controlled experiments, and simulation. We use experiments and simulation to understand the underlying reasons for the characteristics observed. In addition to helping understand attack dynamics, classification mechanisms such as ours are important for the development of realistic models of DoS traffic, can be packaged as an automated tool to aid in rapid response to attacks, and can also be used to estimate the level of DoS activity on the Internet. Availability This paper is available in several formats: abstract web page with pointers and cites, PDF, paper copies can be obtained by mail to the authors. Copyright terms for this paper appear below. Reference Hussain04b Alefiya Hussain, John Heidemann, and Christos Papadopoulos. Distinguishing between Single and Multi-source Attacks using Signal Processing. Computer Networks, 46 (4 ), pp. 479-503, November, 2004. this paper is an expanded version of ``A Framework for Classifying Denial of Service Attacks''. <http://www.isi.edu/~johnh/PAPERS/Hussain04b.html>. @article{Hussain04b, author = "Alefiya Hussain and John Heidemann and Christos Papadopoulos", title = "Distinguishing between Single and Multi-source Attacks using Signal Processing", journal = "Computer Networks", year = "2004", volume = "46", number = "4", month = "November", pages = "479--503", note = "this paper is an expanded version of ``A Framework for Classifying Denial of Service Attacks''", keywords = "ddos classification, spectral analysis", otherurl = "http://www.isi.edu/~hussain/pubs/Hussain04b.pdf", url = "http://www.isi.edu/~johnh/PAPERS/Hussain04b.html", pdfurl = "http://www.isi.edu/~johnh/PAPERS/Hussain04b.pdf", } Copyright This paper is copyright © 2004 by its authors. Permission to make digital or hard copies of part or all of this work for personal use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that new copies bear this notice and the full citation on the first page. Abstracting with credit is permitted. To copy otherwise, to republish, to post on servers or to redistribute to lists, requires prior specific permission of the authors.

Energy and Latency Control in Low Duty Cycle MAC Protocols

Mon, 18 Jul 2011 16:44:27 -0700

Energy and Latency Control in Low Duty Cycle MAC Protocols Yuan Li, Wei Ye, and John Heidemann USC/Information Sciences Institute Abstract Recently, several MAC protocols such as S-MAC and T-MAC have exploited scheduled sleep/wakeup cycles to conserve energy in sensor networks. Until now, most protocols have assumed all nodes in the network were configured to follow the same schedule, or they assumed border nodes would follow multiple schedules, but did not evaluate those cases. This paper develops two new algorithms to control and exploit the presence of multiple schedules to reduce energy consumption and latency. The first one is the global schedule algorithm (GSA). Through experiments, we demonstrate that, because of radio propagation vagaries, large sensor networks have very ragged, overlapping borders where many nodes listen to two or more schedules. GSA is a fully distributed algorithm that allows a large network to converge on a single global schedule to conserve energy. Secondly, we demonstrate that strict schedules incur a latency penalty in a multi-hop network when packets must wait for the next schedule for transmission. To reduce latency in multi-hop paths we develop the fast path algorithm (FPA). FPA provides fast data forwarding paths by adding additional wake-up periods on the nodes along paths from sources to sinks. We evaluate both algorithms through experiments on Berkeley motes and demonstrate that the protocols accomplish their goals of reducing energy consumption and latency in large sensor networks. Availability This paper is available in several formats: abstract web page with pointers and cites, PDF, paper copies can be obtained by mail to the authors. Copyright terms for this paper appear below. Reference Li04b Yuan Li, Wei Ye, and John Heidemann. Energy and Latency Control in Low Duty Cycle MAC Protocols. Technical Report ISI-TR-2004-595, USC/Information Sciences Institute, September, 2004. <http://www.isi.edu/~johnh/PAPERS/Li04b.html>. @techreport{Li04b, author = "Yuan Li and Wei Ye and John Heidemann", title = "Energy and Latency Control in Low Duty Cycle MAC Protocols", institution = "USC/Information Sciences Institute", year = "2004", number = "ISI-TR-2004-595", month = "September", url = "http://www.isi.edu/~johnh/PAPERS/Li04b.html", pdfurl = "http://www.isi.edu/~johnh/PAPERS/Li04b.pdf", otherurl = "http://www-scf.usc.edu/~yuanl/myresearch/smac_schedules.pdf", copyrightholder = "authors", myorganization = "USC/Information Sciences Institute", } Copyright This paper is copyright © 2004 by its authors. Permission to make digital or hard copies of part or all of this work for personal use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that new copies bear this notice and the full citation on the first page. Abstracting with credit is permitted. To copy otherwise, to republish, to post on servers or to redistribute to lists, requires prior specific permission of the authors.

Demo Abstract: Follow-Me Application--Active Visitor Guidance System

Mon, 18 Jul 2011 16:44:27 -0700

Demo Abstract: Follow-Me Application--Active Visitor Guidance System Xi Wang, Fabio Silva, and John Heidemann USC/Information Sciences Institute Abstract (no abstract) This abstract describes the ``follow-me'' application of sensor networks that was demonstrated at Sensys 2004. Availability This paper is available in several formats: abstract web page with pointers and cites, PDF, paper copies can be obtained by mail to the authors. Copyright terms for this paper appear below. Reference Wang04d Xi Wang, Fabio Silva, and John Heidemann. Demo Abstract: Follow-Me Application--Active Visitor Guidance System. In Proceedings of the 2nd ACM SenSys Conference , Baltimore, Maryland, USA, ACM. November, 2004. <http://www.isi.edu/~johnh/PAPERS/Wang04d.html>. @inproceedings{Wang04d, author = "Xi Wang and Fabio Silva and John Heidemann", title = "Demo Abstract: Follow-Me Application---Active Visitor Guidance System", booktitle = "Proceedings of the 2nd {ACM} {SenSys} Conference ", year = "2004", publisher = "{ACM}", address = "Baltimore, Maryland, USA", month = "November", xpages = "xxx", url = "http://www.isi.edu/~johnh/PAPERS/Wang04d.html", pdfurl = "http://www.isi.edu/~johnh/PAPERS/Wang04d.pdf", myorganization = "USC/Information Sciences Institute", copyrightholder = "{ACM}", } Copyright This paper is copyright © 2004 by ACM. Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. To copy otherwise, to republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee.

Self-configuring localization systems: Design and Experimental Evaluation

Mon, 18 Jul 2011 16:44:27 -0700

Self-configuring localization systems: Design and Experimental Evaluation Nirupama Bulusu, John Heidemann, Deborah Estrin, and Tommy Tran USC/Information Sciences Institute Abstract Embedded networked sensors promise to revolutionize the way we interact with our physical environment and require scalable, ad hoc deployable and energy-efficient node localization/positioning. This paper describes the motivation, design, implementation, and experimental evaluation (on sharply resource-constrained devices) of a self-configuring localization system using radio beacons. We identify beacon density as an important parameter in determining localization quality, which saturates at a transition density. We develop algorithms to improve localization quality by (i) automating placement of new beacons at low densities (HEAP) and (ii) rotating functionality among redundant beacons while increasing system lifetime at high densities (STROBE). Availability This paper is available in several formats: abstract web page with pointers and cites, PDF, paper copies can be obtained by mail to the authors. Copyright terms for this paper appear below. Reference Bulusu04a Nirupama Bulusu, John Heidemann, Deborah Estrin, and Tommy Tran. Self-configuring localization systems: Design and Experimental Evaluation. ACM Transactions on Embedded Computing Systems, 3 (1 ), pp. 24-60, February, 2004. <http://www.isi.edu/~johnh/PAPERS/Bulusu04a.html>. @article{Bulusu04a, author = "Nirupama Bulusu and John Heidemann and Deborah Estrin and Tommy Tran", title = "Self-configuring localization systems: Design and Experimental Evaluation", journal = "{ACM} Transactions on Embedded Computing Systems", year = "2004", volume = "3", number = "1", month = "February", pages = "24--60", keywords = "localization", url = "http://www.isi.edu/~johnh/PAPERS/Bulusu04a.html", pdfurl = "http://www.isi.edu/~johnh/PAPERS/Bulusu04a.pdf", copyrightholder = "{ACM}", myorganization = "USC/Information Sciences Institute", } Copyright This paper is copyright © 2004 by ACM. Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. To copy otherwise, to republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee.

Spectral Characteristics of Saturated Links

Mon, 18 Jul 2011 16:44:27 -0700

Spectral Characteristics of Saturated Links Xinming He, Christos Papadopoulos, John Heidemann, and Alefiya Hussain USC/Information Sciences Institute Abstract Internet protocols frequently create periodic patterns in traffic. Examples included packets paced by bottleneck links, periodic exchange of information such as routing, transport-layer effects such as TCP self-clocking, and application-level effects. Although measurement of such periodicities could shed light on Internet traffic, current understanding of periodic behavior in general traffic is quite limited. This paper explores this area by studying the spectral behavior of these kinds of traffic. Our technique is completely passive and can be applied to aggregate traces gathered at various observation points on the network. Unlike techniques measuring packet inter-arrival time, our technique does not require per-flow separation. Our experiments show that the signature of a saturated link persists in the presence of background traffic or when we observe only a portion of the traffic through the saturated link. We investigate how such signatures evolve as the traffic traverses through the network and identify the major influential factors that affect the signatures. Developing a technique to detect saturated links is part of our future work. Availability This paper is available in several formats: abstract web page with pointers and cites, PDF, paper copies can be obtained by mail to the authors. Copyright terms for this paper appear below. Reference He04a Xinming He, Christos Papadopoulos, John Heidemann, and Alefiya Hussain. Spectral Characteristics of Saturated Links. Technical Report USC-CSD-TR-827, University of Southern California Computer Science Department, June, 2004. submitted for review. <http://www.isi.edu/~johnh/PAPERS/He04a.html>. @techreport{He04a, author = "Xinming He and Christos Papadopoulos and John Heidemann and Alefiya Hussain", title = "Spectral Characteristics of Saturated Links", institution = "University of Southern California Computer Science Department", year = "2004", number = "USC-CSD-TR-827", month = "June", note = "submitted for review", keywords = "spectral analysis", url = "http://www.isi.edu/~johnh/PAPERS/He04a.html", pdfurl = "http://www.isi.edu/~johnh/PAPERS/He04a.pdf", otherurl = "http://www.cs.usc.edu/Research/TechReports/04-827.zip", myorganization = "USC/Information Sciences Institute", } Copyright This paper is copyright © 2004 by its authors. Permission to make digital or hard copies of part or all of this work for personal use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that new copies bear this notice and the full citation on the first page. Abstracting with credit is permitted. To copy otherwise, to republish, to post on servers or to redistribute to lists, requires prior specific permission of the authors.

Infrastructureless Location Aware Configuration for Sensor Networks

Mon, 18 Jul 2011 16:44:27 -0700

Infrastructureless Location Aware Configuration for Sensor Networks Xi Wang, Fabio Silva, and John Heidemann USC/Information Sciences Institute Abstract In large sensor networks nodes must self-configure their communication, location, and other characteristics. GPS and similar systems determine location today, but they require substantial infrastructure in the environment or on sensor nodes to locate nodes in a physical coordinate system. For many applications, logical location-the relationhip of nodes with each other and their environment-can be more important than physical location. For example, distance along a road and presence of intersections may be more relevant than Euclidean coordinates for applications that track or guide drivers. In this paper we present a novel algorithm, deployment order, for logical location determination. Deployment order exploits node deployment patterns and simple user interactions to define log- ical topologies in a completely distributed manner. With minimal user interaction it can establish arbitrarily complex logical topologies. We illustrate the algorithm through the ``follow-me'' application, which is an easy-to-deploy sensornet guidance system suitable for use in office buildings as well as inhospitable environments (underground, in damaged buildings, etc.). Finally, we demonstrate how the addition of landmarks allows the conversion from logical locations to approximate physical locations. Availability This paper is available in several formats: abstract web page with pointers and cites, PDF, paper copies can be obtained by mail to the authors. Copyright terms for this paper appear below. Reference Wang04a Xi Wang, Fabio Silva, and John Heidemann. Infrastructureless Location Aware Configuration for Sensor Networks. Technical Report ISI-TR-2004-589, USC/Information Sciences Institute, June, 2004. <http://www.isi.edu/~johnh/PAPERS/Wang04a.html>. @techreport{Wang04a, author = "Xi Wang and Fabio Silva and John Heidemann", title = "Infrastructureless Location Aware Configuration for Sensor Networks", institution = "USC/Information Sciences Institute", year = "2004", number = "ISI-TR-2004-589", month = "June", url = "http://www.isi.edu/~johnh/PAPERS/Wang04a.html", pdfurl = "http://www.isi.edu/~johnh/PAPERS/Wang04a.pdf", myorganization = "USC/Information Sciences Institute", copyrightholder = "authors", } Copyright This paper is copyright © 2004 by its authors. Permission to make digital or hard copies of part or all of this work for personal use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that new copies bear this notice and the full citation on the first page. Abstracting with credit is permitted. To copy otherwise, to republish, to post on servers or to redistribute to lists, requires prior specific permission of the authors.