Andreas Terzis

A multifaceted approach to understanding the botnet phenomenon

The academic community has long acknowledged the existence of malicious botnets, however to date, very little is known about the behavior of these distributed computing platforms. To the best of our knowledge, botnet behavior has never been methodically studied, botnet prevalence on the Internet is mostly a mystery, and the botnet life cycle has yet to be modeled. Uncertainty abounds. In this paper, we attempt to clear the fog surrounding botnets by constructing a multifaceted and distributed measurement infrastructure. Throughout a period of more than three months, we used this infrastructure to track 192 unique IRC botnets of size ranging from a few hundred to several thousand infected end-hosts. Our results show that botnets represent a major contributor to unwanted Internet traffic - 27% of all malicious connection attempts observed from our distributed darknet can be directly attributed to botnet-related spreading activity. Furthermore, we discovered evidence of botnet infections in 11% of the 800,000 DNS domains we examined, indicating a high diversity among botnet victims. Taken as a whole, these results not only highlight the prominence of botnets, but also provide deep insights that may facilitate further research to curtail this phenomenon.

Wireless Sensor Networks for Healthcare

Driven by the confluence between the need to collect data about peoples physical, physiological, psychological, cognitive, and behavioral processes in spaces ranging from personal to urban and the recent availability of the technologies that enable this data collection, wireless sensor networks for healthcare have emerged in the recent years. In this review, we present some representative applications in the healthcare domain and describe the challenges they introduce to wireless sensor networks due to the required level of trustworthiness and the need to ensure the privacy and security of medical data. These challenges are exacerbated by the resource scarcity that is inherent with wireless sensor network platforms. We outline prototype systems spanning application domains from physiological and activity monitoring to large-scale physiological and behavioral studies and emphasize ongoing research challenges.

Surviving wi-fi interference in low power ZigBee networks

Frequency overlap across wireless networks with different radio technologies can cause severe interference and reduce communication reliability. The circumstances are particularly unfavorable for ZigBee networks that share the 2.4 GHz ISM band with WiFi senders capable of 10 to 100 times higher transmission power. Our work first examines the interference patterns between ZigBee and WiFi networks at the bit-level granularity. Under certain conditions, ZigBee activities can trigger a nearby WiFi transmitter to back off, in which case the header is often the only part of the Zig-Bee packet being corrupted. We call this the symmetric interference regions, in comparison to the asymmetric regions where the ZigBee signal is too weak to be detected by WiFi senders, but WiFi activity can uniformly corrupt any bit in a ZigBee packet. With these observations, we design BuzzBuzz to mitigate WiFi interference through header and payload redundancy. Multi-Headers provides header redundancy giving ZigBee nodes multiple opportunities to detect incoming packets. Then, TinyRS, a full-featured Reed Solomon library for resource-constrained devices, helps decoding polluted packet payload. On a medium-sized testbed, BuzzBuzz improves the ZigBee network delivery rate by 70%. Furthermore, BuzzBuzz reduces ZigBee retransmissions by a factor of three, which increases the WiFi throughput by 10%.

Design and evaluation of a versatile and efficient receiver-initiated link layer for low-power wireless

We present A-MAC, a receiver-initiated link layer for low-power wireless networks that supports several services under a unified architecture, and does so more efficiently and scalably than prior approaches. A-MACs versatility stems from layering unicast, broadcast, wakeup, pollcast, and discovery above a single, flexible synchronization primitive. A-MACs efficiency stems from optimizing this primitive and with it the most consequential decision that a low-power link makes: whether to stay awake or go to sleep after probing the channel. Todays receiver-initiated protocols require more time and energy to make this decision, and they exhibit worse judgment as well, leading to many false positives and negatives, and lower packet delivery ratios. A-MAC begins to make this decision quickly, and decides more conclusively and correctly in both the negative and affirmative. A-MACs scalability comes from reserving one channel for the initial handshake and different channels for data transfer. Our results show that: (i) a unified implementation is possible; (ii) A-MACs idle listening power increases by just 1.12x under interference, compared to 17.3x for LPL and 54.7x for RI-MAC; (iii) A-MAC offers high single-hop delivery ratios, even with multiple contending senders; (iv) network wakeup is faster and far more channel efficient than LPL; and (v) collection routing performance exceeds the state-of-the-art.

Koala: Ultra-Low Power Data Retrieval in Wireless Sensor Networks

We present Koala, a reliable data retrieval system designed to operate at permille (.1%) duty cycles, essential for long term environmental monitoring networks. Koala achieves these low duty cycles by letting the networks nodes sleep most of the time and reviving them through an efficient wake-up strategy whenever the gateway performs a bulk data download. Unlike other systems which consume energy to maintain consistent network state (e.g. routes, sleep schedules, etc.) across the networks nodes, Koala maintains no persistent routing state on the motes. Instead, a basestation calculates the network paths using reachability information collected by the motes. The flexible control protocol (FCP), a protocol we developed, is then used to install this routing information on the networks nodes. This paradigm of operation not only eliminates the overhead of maintaining routing state, but also significantly reduces the complexity of the networking code running on the motes. Results from simulation and an actual implementation on TinyOS 2 indicate that Koala can achieve very low duty cycles under a wide range of download and network sizes.

Wireless Medical Sensor Networks in Emergency Response: Implementation and Pilot Results

This project demonstrates the feasibility of using cost- effective, flexible, and scalable sensor networks to address critical bottlenecks of the emergency response process. For years, emergency medical service providers conducted patient care by manually measuring vital signs, documenting assessments on paper, and communicating over handheld radios. When disasters occurred, the large numbers of casualties quickly and easily overwhelmed the responders. Collaboration with EMS and hospitals in the Baltimore Washington Metropolitan region prompted us to develop miTag (medical information tag), a cost- effective wireless sensor platform that automatically track patients throughout each step of the disaster response process, from disaster scenes, to ambulances, to hospitals. The miTag is a highly extensible platform that supports a variety of sensor add-ons - GPS, pulse oximetry, blood pressure, temperature, ECG - and relays data over a self-organizing wireless mesh network Scalability is the distinguishing characteristic of miTag: its wireless network scales across a wide range of network densities, from sparse hospital network deployments to very densely populated mass casualty sites. The miTag system is out-of-the-box operational and includes the following key technologies: 1) cost-effective sensor hardware, 2) self-organizing wireless network and 3) scalable server software that analyzes sensor data and delivers real-time updates to handheld devices and web portals. The system has evolved through multiple iterations of development and pilot deployments to become an effective patient monitoring solution. A pilot conducted with the Department of Homeland Security indicates miTags can increase the patient care capacity of responders in the field A pilot at Washington Hospital showed miTags are capable of reliably transmitting data inside radio-interference-rich critical care settings.

Minimising the effect of WiFi interference in 802.15.4 wireless sensor networks

Interference from colocated networks operating over the same frequency range, becomes an increasingly severe problem as the number of networks overlapping geographically increases. Our experiments show that such interference is indeed a major problem, causing up to 58% packet loss to a multihop 802.15.4 sensor network competing for radio spectrum with a WiFi network. We present interference estimators that can be efficiently implemented on resource constrained motes using off-the-shelf radios and outline distributed algorithms that use these estimators to dynamically switch frequencies as interference is detected. Lastly, we evaluate the proposed algorithms in the context of a real-life application that downloads large amounts of data over multihop network paths. Our results show that the proposed approach successfully detects interference from competing WiFi channels and selects non-overlapping 802.15.4 channels. As a result, the proposed solution reduces end-to-end loss rate from 22% 58% to < 1%.

Using mobile robots to harvest data from sensor fields

We explore synergies among mobile robots and wireless sensor networks in environmental monitoring through a system in which robotic data mules collect measurements gathered by sensing nodes. A proof-of-concept implementation demonstrates that this approach significantly increases the lifetime of the system by conserving energy that the sensing nodes otherwise would use for communication.

Connecting low-power and lossy networks to the internet

Many applications, ranging from wireless healthcare to energy metering on the smart grid, have emerged from a decade of research in wireless sensor networks. However, the lack of an IP-based network architecture precluded sensor networks from interoperating with the Internet, limiting their real-world impact. Given this disconnect, the IETF chartered the 6LoWPAN and RoLL working groups to specify standards at various layers of the protocol stack with the goal of connecting low-power and lossy networks to the Internet. We present the standards proposed by these working groups, and describe how the research community actively participates in this process by influencing their design and providing open source implementations.

RACNet: a high-fidelity data center sensing network

RACNet is a sensor network for monitoring a data centers environmental conditions. The high spatial and temporal fidelity measurements that RACNet provides can be used to improve the data centers safety and energy efficiency. RACNet overcomes the networks large scale and density and the data centers harsh RF environment to achieve data yields of 99% or higher over a wide range of network sizes and sampling frequencies. It does so through a novel Wireless Reliable Acquisition Protocol (WRAP). WRAP decouples topology control from data collection and implements a token passing mechanism to provide network-wide arbitration. This congestion avoidance philosophy is conceptually different from existing congestion control algorithms that retroactively respond to congestion. Furthermore, WRAP adaptively distributes nodes among multiple frequency channels to balance load and lower data latency. Results from two testbeds and an ongoing production data center deployment indicate that RACNet outperforms previous data collection systems, especially as network load increases.