Search

Targeted data breaches and cybersecurity attacks involving IoT devices are becoming ever more concerning. To combat these threats and risks, the IETF standardized Manufacturer Usage Description (MUD), which allows IoT device vendors to specify the intended communication patterns (MUD profile) of an IoT device. MUD profile enables validation of the actual communication pattern of an IoT device with the intended behavior at run-time. However, the MUD specification was primarily intended for enforcement at the Local Area Network (LAN) of the IoT device, thus fragmenting the solution across multiple heterogeneous networks. MUD enforcement at higher levels in the network hierarchy (e.g., private edge for enterprise networks) eases security policy management and reduces processing overheads on the existing security infrastructure. To realize MUD enforcement at the edge, there are mainly two challenges: (1) How to identify an IoT device at the edge so that enforcing device-specific MUD profile on the IoT traffic is possible. (2) How to scale MUD enforcement to a large network of IoT devices. In this paper, we present our approach to address these challenges and validate IoT device communication at the edge. In order to scale MUD enforcement to a large IoT network, we leverage multi-stage pipeline architecture and stateful ALUs of P4 programmable switch and process IoT traffic in the dataplane. © 2022 ACM.

Arrayed Waveguide Grating Router (AWGR) based optical networks are emerging as a promising solution for handling modern data centers due to their wide bandwidth, scalability, high data rates, and lower latency. However, link failures in AWGR based optical networks can significantly impact the network performance and lead to the loss of reachability due to the rigid, passive wavelength routing. In this paper, we present ResiConnect, a scalable, and resilient optical network architecture. ResiConnect is a 3-stage Clos network of AWGR, space switches, and AWGR (ASA) which is managed by a centralized controller. ResiConnect introduces an alternative path to redirect the affected traffic by vertically connecting transmitters, and incorporates an active link fault detection and the failover traffic steering. The evaluation results on various performance metrics confirm that ResiConnect is 1) resilient and scalable against multiple link faults, 2) efficient in detecting any link fault with minimum resource overhead, and 3) efficient in handling uneven traffic demand during link failure. © 2022 IEICE.

In second or foreign language (SFL) education, oral corrective feedback (OCF) is widely used to individually correct students’ erroneous utterances during classroom hours. However, students cannot have sufficient opportunities for oral production and personalized feedback during classroom hours if a class is large-scale with many students. This paper addresses the lack of OCF opportunities in a large-scale class, assuming the causes to be the severe time constraints and the teachers’ labor intensiveness in examining students’ utterances and generating OCF. This research proposes using computer-mediated feedback (CMF) outside classroom hours to complement OCF in an online, semiautomated, and scalable fashion. This paper implements Oral Repetition Practice (ORP) Gym to provide students with sufficient opportunities for speaking practice through two types of CMFs; Hybrid Recast to enhance the recognition of errors and Explicit Error Correction to make errors detectable and correctable. Online External Assistant (OEA) is a mechanism used to increase the amount and quality of feedback by distributing the workload for scoring and generating CMF. The evaluation was conducted as a classroom observational study by introducing ORP Gym to a spoken Japanese SFL basics course with 55 students at an Indian university. Compared with the students who did not utilize ORP Gym, those who utilized ORP Gym performed more ORP and exhibited significant score improvement in the posttest. This research contributes to enabling CMF in large-scale SFL classes and empirically and statistically proving the improvement of the learning effect, including uptake and repair, by CMF using ORP Gym and an OEA.

The hybrid software-defined networks (SDN) architectures are beneficial for a smooth transition and less costly SDN deployment. However, legacy switches and SDN switches coexistence brings new challenges of deployment inconsistency management and security. Security is not well studied for hybrid SDN architecture. In this paper, we study the topology poisoning attacks in hybrid SDN for the first time. We propose new attack vectors for link fabrication in hybrid SDN. The new attack is named 'multi-hop link fabrication,' in which an adversary successfully injects a fake multi-hop link (MHL) by exploiting the link discovery protocols. We presented the Hybrid-Shield, a link verification framework for hybrid SDN link discovery. Hybrid-Shield introduces a novel verification technique that includes: i) monitoring legacy switch and host generated traffic at MHL and ii) validating the existence of legacy switches contained in an MHL. This paper presents the prototype implementation of Hybrid-Shield over a real SDN controller. The experimental evaluation is performed with the mininet virtual network emulation. Our evaluation shows that Hybrid-Shield is capable of detecting MHL fabrication attacks in real-time with high accuracy. Hybrid-Shield's performance evaluation shows that it is lightweight at the controller as it causes less overhead and requires no additional functionalities at the SDN controller for deployment. © 2022 IEEE.

Verifying the integrity of IoT data in cloud-based IoT architectures is crucial for building reliable IoT applications. Traditional data integrity verification methods rely on a Trusted Third Party (TTP) that has issues of risk and operational cost by centralization. Distributed Ledger Technology (DLT) has a high potential to verify IoT data integrity and overcome the problems with TTPs. However, the existing DLTs have low transaction throughput, high computational and storage overhead, and are unsuitable for IoT environments, where a massive scale of data is generated. Recently, Directed Acyclic Graph (DAG) based DLTs have been proposed to address the low transaction throughput of linear DLTs. However, the integration of IoT Gateways (GWs) into the peer to peer (P2P) DLT network is challenging because of their low storage and computational capacity. This paper proposes Lightweight and Scalable DAG based distributed ledger for IoT (LSDI) that can work with resource-constrained IoT GWs to provide fast and scalable IoT data integrity verification. LSDI uses two key techniques: Pruning and Clustering, to reduce 1) storage overhead in IoT GWs by removing sufficiently old transactions, and 2) computational overhead of IoT GWs by partitioning a large P2P network into smaller P2P networks. The evaluation results of the proof of concept implementation showed that the proposed LSDI system achieves high transaction throughput and scalability while efficiently managing storage and computation overhead of the IoT GWs.

Blockchain is a distributed ledger technology operating on top of the peer-to-peer (P2P) network, and the variety of Blockchain deployments have been observed in both public and private manners. In Blockchain, the information dissemination among Blockchain nodes relies on the one-to-all-the-others broadcast mechanism over the P2P network. The underlying network topology introduces a significant impact on the performance of information dissemination in the Blockchain P2P network as well as the effectiveness and stability of Blockchain operation as a consequence. When a private blockchain is deployed in a controlled environment, it is crucial to understand the effect of underlying network topology on Blockchain performance and operational effectiveness. This paper simulates various well-known network topologies, including Hypercube, Torus, Fat-Tree, and Scale-Free as an underlying network of the Blockchain, giving more focus on controlled environments such as Data Center Network (DCN). We comparatively evaluate the performance of each network topology based on both Blockchain and network aspects. The evaluation results show that Hypercube performs the best among the topologies being assessed, especially in information propagation delay and resilience against adverse situations.

Slow HTTP Denial of Service (DoS) attacks are defined as application layer vulnerabilities that make HTTP services degrade their performance or reach a denial state. The Slow HTTP DoS attacks can evade the generic DoS attack detection techniques because of their low volume but long lasting attack traffic. Existing solutions on Slow HTTP DoS attack detection mainly rely on static threshold based detection techniques or supervised machine learning techniques. However, the use of unsupervised learning techniques has not been widely studied. This paper proposes capsAEUL, which uses multiple Autoencoders as an unsupervised learning technique for detecting all of Slowloris, Slowread, and Slow POST of Slow HTTP DoS attack as an integrated system. The PoC implementation of capsAEUL exhibits the comparable prediction performance in terms of the high accuracy and the decent AUC scores. © 2021 ACM.

Optimization of flow rule timeouts promises to reduce the frequency of message exchange between the SDN controller and the switches and contributes to the reduction of the controller load. However, such optimization is challenging due to the dynamically changing traffic patterns. Many algorithm-based solutions are based on the estimation of flow duration. However, such estimation approaches cannot achieve as good results as learning through observation, the actual attempt to optimize the timeout, and evaluating such actions in the network. This paper proposes "DRL-FTO", a Deep Reinforcement Learning based approach to optimize the flow rule timeouts so that the number of message exchanges between the SDN controller and switches is minimized even though the characteristics of incoming traffic dynamically changes. We developed the proof of concept implementation of DRL-FTO and evaluated using the synthesized Internet traffic in Mininet environment with Ryu SDN controller. The evaluation results exhibited that DRL-FTO reduces the message exchange without compromising the throughput in the data plane, and, as a positive consequence, the SDN controller load can also be reduced. © 2021 ACM.

In Second or Foreign Language (SFL) education, a number of studies in applied linguistics have addressed a common issue of how teachers can provide effective feedback to correct learner's erroneous utterances during a classroom hour. Oral Corrective Feedback (OCF) is generally time-consuming and labor-intensive work for teachers. The use of ASR (Automatic Speech Recognition) in SFL education has drawn attention from both teachers and learners to increase the learning effect and efficiency. We designed and integrated Quantitative OCF using Google Cloud Speech-to-Text as a part of the oral assessment using an LMS (Learning Management System) for Japanese SFL courses. The level of learners is a starter's level without any prerequisite knowledge of Japanese language. Preliminary experiments using a total of 214 audio datasets by non-native speakers exhibited that 37.4% of the datasets were recognized properly as Japanese sentences. However, as the remainder of the datasets contains erroneous utterances, characteristics of intonation, or noise, ASR successfully detected word-based errors with high accuracy (82.4%) but low precision (28.1%). Oral assessment employing ASR is highly promising as a complementary system for teachers on partially automating the assessment of audio data from learners with evidence and priority orders as well as significantly reducing teachers' scoring workload and time spent on the most problematic part of the students' speech. While our implementation still requires teachers to double-check, such overhead is small and affordable.

Spoofing the identity of a WiFi access point (AP) is trivial. Consequently, an adversary can impersonate the legitimate AP (LAP) by mimicking its network name (SSID) and MAC address (BSSID). This fake AP is called the evil twin. An evil twin can perform multiple attacks such as man-in-the-middle (MITM) attack between the LAP and a wireless client as well as service blocking of LAP. Existing solutions rely on the collection and calculation of information with the AP and/or client for finding evidence of evil twins in the WiFi network. Some of them require additional hardware to acquire further information that cannot be provided by the AP/client. In this paper, we propose “EvilScout," an evil twin detection and mitigation framework that utilizes the information of the IP-prefix distribution by the LAP. EvilScout exploits the SDN potential for detection of an evil twin without the need of any additional hardware or modifications at the AP or client. Additionally, the information that becomes available at the SDN controller enables simplified and more accurate evil twin detection. This paper presents the implementation of EvilScout over a real SDN WiFi testbed with an actual evil twin. We verify the successful detection of the evil twin with high accuracy and low processing cost at the SDN WiFi. We perform a rigorous analysis of the evil twin in different WiFi setups and discover a new “AP Service Blocking” attack by the evil twin adversary in the WPA2 protected WiFi for the first time.

Validation of network state of Network Function Virtualization Infrastructure (NFVI) under various uncertainties are of primary importance as they directly affect Service Function Chain (SFC) provisioning and its performance. SFC provisioning against the uncertainties, including variable traffic demand and failures of link and switch makes validation challenging because the number of scenarios to validate grows exponentially with the number of such failures. This letter takes advantage of a two-stage validation framework and proposes a validation strategy to verify the underlying NFVI network state that supports SFC provisioning despite various uncertainty in the network. We demonstrate the effectiveness of our strategy through different failure and SFC placement scenarios using realistic network topologies and traffic matrix.

The static deployment of Virtualized Network Functions (VNFs) introduces 1) significant degradation of Quality of Service (QoS), 2) inefficiency in the network and computing resource utilization, and 3) Network Function Virtualization (NFV)-based services with insufficient scalability, optimality, and flexibility. Caching VNFs is a promising solution to satisfy the dynamic demand to deploy a variety of VNFs and to maximize the performance as well as cost effectiveness. Although the concept of Content Delivery Network (CDN) is popular for efficiently caching and distributing contents, VNF deployment does not realize the benefit of CDN-based caching approaches. The challenges to caching VNFs are 1) to cover the large variety of VNFs and their properties, including the necessity of service chaining, and 2) to achieve high acceptance ratio given the limited availability of resources. This paper proposes Function Delivery Network (FDN), which is a cluster of distributed edge hypervisors for caching VNFs over a Software-Defined Network (SDN). The deployment and quality of the network function can be significantly improved by serving them closer to the end-users from the cached VNFs. FDN introduces a new strategy called Value-based caching that considers 1) the locality of reference and performance parameters of network and edge hypervisors together and 2) a partial deployment of service chains across multiple edge hypervisors for further efficient utilization of hypervisors resources. Evaluations on different patterns of input requests confirm that Value-based caching introduces significant improvement on both QoS and resource utilization in NFV.

Electronic Medical Records (EMRs) contain private and sensitive information of the patients and require distribution across multiple stakeholders for sustained and consistent medical care. EMRs are owned and maintained by hospital systems. So, patients often face difficulties in getting their data shared among different stakeholders. Blockchain provides distributed, transparent, and immutable log of records that benefit the design of healthcare systems. There have been several studies done to use Blockchain technology as a mediation tool for sharing sensitive EMRs between multiple stakeholders in the e-health care system. However, these studies lack the requirement of patients to have full control over their EMR data. This work develops PACEX, PAtient-Centric EMR eXchange, that enables patients to share and have complete control over their data using Blockchain. In PACEX, we develop an easy-to-use patient application that interacts with different hospital systems and handles EMR exchanges with integrity. We developed a proof of concept implementation of PACEX using Ethereum Blockchain and Smart Contracts to achieve access control and maintain a history of record exchanges among different stakeholders. The evaluation results provide the quantitative analysis that gives time estimates for various transactions involved in PACEX and the qualitative analysis that describes the security properties of the system. PACEX achieves essential security requirements such as Authentication, Integrity, Access Control, and Traceability over the EMR data exchange.

This paper presents the privacy preserving End-to-End (E2E) Quality of Service (QoS) mechanism in multi-domain Software Defined Network (SDN). Guaranteed E2E QoS needs complete information about the network. But, in multi-domain SDN, information sharing among different operators mainly have privacy and security issues; thus, operators may not share such network information. Moreover, such information collection is not only computationally expensive but also it requires a lot of message exchange between the domain controllers. Hence, we propose PRIME-Q, a PRIvacy aware E2E QoS framework in Multi-domain SDN. In PRIME-Q, instead of collecting the required information about the network at a single location, the data is distributively processed, and only the binary decision is reported at a single point to take the final decision about E2E QoS. To quantify the gain of PRIME-Q, we define Privacy Index to measure the privacy of E2E QoS coordination in multidomain SDN. The results show that the learning approach of PRIME-Q can achieve the required E2E QoS with maximum privacy. Further, the numerical results for PRIME-Q show a significant reduction in the communication and computation overhead in the network.

Multicast is a one-to-many communication model that is important for video streaming like IPTV. However, multicast does not guarantee the reliability of data transfer, and packet loss beyond the performance of error correction mechanism introduce significant degradation of the quality of Multicast streaming. Monitoring quality of multicast streaming is difficult because a) generally intermediate multicast routers and switches do not maintain the fine-grained state about multicast flow and b) sampling QoS statistics from destination clients introduces significant operational overhead. Therefore, it is difficult to properly locate where packet losses happen and how severe they are. This paper proposes selective packet tagging based monitoring (SPTM) mechanism to detect and locate packet losses in real-time using a packet tagging technique in Software-Defined Network(SDN). The proposed system also re-calculates the Multicast Delivery Tree(MDT) upon the detection of packet losses in the tree links. The evaluation results show the feasibility of the proposed approach to detect, locate as well as recover the MDTs from the packet loss.

Software-Defined Networking (SDN) allows applications to control and manage the network from the northbound interface. These network applications can be installed by a third party; that cannot be trusted blindly. A Misconfigured or compromised application is a severe threat to the SDN controller. Providing proper access control mechanism to SDN applications can prevent malicious activities. However, the existing access control mechanisms define the static access permissions, and cannot prevent the malicious activities of the application at runtime. Therefore, we propose "BEAM", a BEhavior-based Access control Mechanism which dynamically grants the permissions based on the analysis of network behavior. BEAM periodically upgrades/downgrades the assigned access permissions, verifies and builds trust for an application.

In the Bitcoin network, the current block interval time of 10 minutes and the maximum block size of 1MB leads to a low transaction throughput compared to visa and other payment methods. Decreasing the block interval time or increasing the block size may increase the probability of inconsistency, leading to frequent blockchain fork in the Bitcoin network. This work attempts to decrease the block interval and increase the block size without hampering the network with excessive forking. It investigates the peer selection technique of the Bitcoin network for improving its performance. Instead of random peer selection as per the current Bitcoin protocol, it studies the effect of improved peer selection using link information on the performance of the Bitcoin network using a real-time testbed created with Bitcoind [4] client. An efficient peer-to-peer network formed by choosing the optimum peers helps to alleviate the frequency of forking even with a low block interval time and high block size. Geographical location based peer selection [1] and low-latency based peer selection [2] provides a better network formation, but their effect on mean propagation delay, transaction throughput, and stale block rate has not been studied. This work explored various techniques for selecting peers to form the peer-to-peer network. All Pair Shortest Path based and network partition using community detection are explored with a view of optimizing the network globally. A local view of optimizing the network formation considering the particular node is also investigated. This work then proposes to choose peers based on a linear combination of both latency and bandwidth since bandwidth also plays an important role when block size increases. The proposed algorithm generates a score for all the peers received either by DNS seed or by peer discovery mechanism and chooses the top scored peers. Simulation results based on the Bitcoin Simulator [3] show a reduction of about 60-70% in mean propagat