Cigdem Sengul

Log correlation for intrusion detection: a proof of concept

Intrusion detection is an important part of networked-systems security protection. Although commercial products exist, finding intrusions has proven to be a difficult task with limitations under current techniques. Therefore, improved techniques are needed. We argue the need for correlating data among different logs to improve intrusion detection systems accuracy. We show how different attacks are reflected in different logs and argue that some attacks are not evident when a single log is analyzed. We present experimental results using anomaly detection for the virus Yaha. Through the use of data mining tools (RIPPER) and correlation among logs we improve the effectiveness of an intrusion detection system while reducing false positives.

Exploring the Energy-Latency Trade-Off for Broadcasts in Energy-Saving Sensor Networks

Networking protocols for multi-hop wireless sensor networks (WSNs) are required to simultaneously minimize resource usage as well as optimize performance metrics such as latency and reliability. This paper explores the energy-latency-reliability trade-off for broadcast in multi-hop WSNs, by presenting a new protocol called PBBF (probability-based broadcast forwarding). PBBF works at the MAC layer and can be integrated into any sleep scheduling protocol. For a given application-defined level of reliability for broadcasts, the energy required and latency obtained are found to be inversely related to each other. Our analysis and simulation study quantify this relationship at the reliability boundary, as well as performance numbers to be expected from a deployment. PBBF essentially offers a WSN application designer considerable flexibility in choice of desired operation points

Bypass routing: An on-demand local recovery protocol for ad hoc networks

On-demand routing protocols for ad hoc networks reduce the cost of routing in high mobility environments. However, route discovery in on-demand routing is typically performed via network-wide flooding, which consumes a substantial amount of bandwidth. In this paper, we present bypass routing, a local recovery protocol that aims to reduce the frequency of route request floods triggered by broken routes. Specifically, when a broken link is detected, a node patches the affected route using local information, which is acquired on-demand, and thereby bypasses the broken link. We implemented SLR (Source Routing with Local Recovery) as a prototype of our approach. Simulation studies show that SLR achieves efficient and effective local recovery while maintaining acceptable overhead.

Improving Energy Conservation Using Bulk Transmission over High-Power Radios in Sensor Networks

Low power radios, such as the CC2420, have been widely popular with recent sensor platforms. This paper explores the potential for energy savings from adding a high-power, high-bandwidth radio to current sensor platforms. High-bandwidth radios consume more power but significantly reduce the time for transmissions. Consequently, they offer net savings in total communication energy when there is enough data to offset wake-up energy overhead. The analysis on energy characteristics of several IEEE 802.11 radios show that a feasible crossover point exists (in terms of data size) after which energy savings are possible. Based on this analysis, we present a bulk data transmission protocol for dual radio systems. The results of simulations and prototype implementation show significant energy savings at the expense of introducing acceptable delay.

Conserving energy with on-demand topology management

To reduce idle-time energy consumption, nodes in ad hoc networks can switch to a power-save mode. However, since operating all nodes in power-save mode limits network capacity, some nodes may need to stay in active mode to support forwarding. The main challenge of selecting nodes to stay in active mode stems from the need to conserve energy while maintaining communication. Although topology management protocols build a forwarding backbone of active nodes by powering down redundant nodes, such protocols incur proactive backbone maintenance overhead. The reactive approach, on-demand power management, manages node transitions from active to power-save mode based on routing information. However, node transitions are only traffic-driven and may result in keeping redundant nodes awake. To this end, we propose TITAN, which builds a backbone reactively using information about both ongoing communication and the current power-management mode of nodes. The design of TITAN is based on the trade-offs between waking up power-saving nodes on shorter routes and using longer routes that contain active nodes. Simulation results show that TITAN conserves energy while maintaining efficient communication without additional control overhead for topology management

Reconsidering power management

Power-management approaches have been widely studied in an attempt to conserve idling energy by allowing nodes to switch to a low-power sleep mode. However, due to the inherent inability of current approaches to match sleep schedules to different traffic patterns, energy is wasted switching needlessly from sleep to idle or large delays in traffic delivery are incurred due to being in the sleep state too long. In this paper, we explore such effects of various traffic patterns on current power management protocols. Our results show the importance of traffic information to obtain larger benefits from power management. While some proposals that exploit traffic information exist, they rely primarily on individual sender traffic patterns to develop sleep schedules, ignoring aggregate traffic observed by receivers. This deficiency motivates the design of a new power management protocol that use traffic information at the receivers to adapt sleep schedules.

Adaptive probability-based broadcast forwarding in energy-saving sensor networks

Networking protocols for multihop wireless sensor networks (WSNs) are required to simultaneously minimize resource usage as well as optimize performance metrics such as latency and reliability. This article explores the energy-latency-reliability tradeoff for broadcast in WSNs by presenting a new protocol called PBBF. Essentially, for a given reliability level, energy and latency are found to be inversely related and our study quantifies this relationship at the reliability boundary. Therefore, PBBF offers an application designer considerable flexibility in the choice of desired operation points. Furthermore, we propose an extension to dynamically adjust the PBBF parameters to minimize the input required from the designer.

TITAN: on-demand topology management in ad hoc networks

An ad hoc network is a multi-hop wireless network that is established by a group of mobile nodes without depending on any infrastructure. Due to the disconnected nature of such mobile nodes, a fundamental problem in ad hoc networks is energy-efficient operation to extend the lifetime of the nodes and the network. A promising strategy is to reduce the power consumption of the wireless interface since it is a significant contributer to the overall energy consumption. Essentially, while traffic load defines energy consumption by the wireless interface during active communication [1, 2], idle-time energy dissipation dominates total system energy consumption in the presence of low to moderate traffic [3, 4]. To this end, current approaches allow nodes to switch to a power-save mode where they spend most of their time in a low-power sleep state. However, allowing all nodes to operate in power-save mode imposes additional delay on all communication and can severely limit the capacity of the network as load increases [4]. To compensate for these limitations, some nodes can stay in active mode and serve as stable relays in the network to support low delay and high throughput [3, 4, 5]. Since the choice of nodes that remain active determines both energy consumption and communication quality, the main challenge to any idle-time energy conservation protocol is selecting the set of active nodes through which all traffic flows.

Heuristic Approaches to Energy-Efficient Network Design Problem

Energy management remains a critical problem in wireless networks since battery technology cannot keep up with rising communication expectations. Current approaches to energy conservation reduce the energy consumption of the wireless interface either for a given communication task or during idling. However, a complete solution requires minimizing the energy spent for both communication (i.e., for data and control overhead) and idling. This problem can be expressed as an energy-efficient network design problem, which is, not surprisingly, NP-hard. Therefore, in this paper, we study three heuristic approaches. Our study shows that the first approach that prioritizes communication energy conservation does not save energy. The second approach, which tries to reduce energy used for both data and in idling, becomes cost-prohibitive due to its high control overhead. Hence, we propose a third approach that prioritizes idling energy conservation. Due to its low control overhead, this approach meets the challenge of operating the network with low energy cost.

Energy-Efficient Multimedia Communications in Lossy Multi-hop Wireless Networks

A key concern in multi-hop wireless networks is energy-efficiency due to battery-power constrained mobile nodes. The network interface is a significant consumer of energy [7, 8, 15] causing a substantial amount of energy to be wasted by sending packets that cannot be used by the receiver. Given the small MAC layer packet sizes of wireless channels as compared to multimedia application data frames, inter-packet dependencies are formed (i.e., the loss of a single packet renders a group of packets useless). In this paper, we present an application-aware link layer protocol to reduce the energy wasted by sending such useless data in lossy networks.