Juan-Mariano de Goyeneche

Improving Security for SCADA Sensor Networks with Reputation Systems and Self-Organizing Maps.

The reliable operation of modern infrastructures depends on computerized systems and Supervisory Control and Data Acquisition (SCADA) systems, which are also based on the data obtained from sensor networks. The inherent limitations of the sensor devices make them extremely vulnerable to cyberwarfare/cyberterrorism attacks. In this paper, we propose a reputation system enhanced with distributed agents, based on unsupervised learning algorithms (self-organizing maps), in order to achieve fault tolerance and enhanced resistance to previously unknown attacks. This approach has been extensively simulated and compared with previous proposals.

Distributed intrusion detection system for wireless sensor networks based on a reputation system coupled with kernel self-organizing maps

Security of sensor networks is a complicated task, mostly due to the limited resources of sensor units. The first line of defense, i.e. encryption and authentication, is useless if an attacker has entered the system, and it is also vulnerable to side-channel attacks. Thus, a second line of defense, known as Intrusion Detection, must be added in order to detect and eliminate attacks. In the recent past, various solutions for detecting intrusions have been proposed. Most of them are able to detect only a limited number of attacks. Further, the solutions that deploy machine learning techniques exhibit higher level of flexibility and adaptability. Yet, these techniques consume significant power and computational resources. In this work we propose a distributed intrusion detection system organized as a reputation system where the reputation of each node is assigned by self-organizing maps (SOM) trained for detecting intrusions. The response of the system consists in assigning low reputation values to the compromised nodes rendering them isolated from the rest of the network. Further, we propose the implementation of SOM algorithm using the energy-efficient SORU (Stream Oriented Reconfigurable Unit) co-processor developed by our research group. Our solution offers many benefits: scalable solution, fast response to adversarial activities, ability to detect unknown attacks, high adaptability and energy efficiency. The testing results demonstrate its high potential.

Improving security in WMNs with reputation systems and self-organizing maps

One of the most important problems of WMNs, that is even preventing them from being used in many sensitive applications, is the lack of security. To ensure security of WMNs, two strategies need to be adopted: embedding security mechanisms into the network protocols, and developing efficient intrusion detection and reaction systems. To date, many secure protocols have been proposed, but their role of defending attacks is very limited. We present a framework for intrusion detection in WMNs that is orthogonal to the network protocols. It is based on a reputation system, that allows to isolate ill-behaved nodes by rating their reputation as low, and distributed agents based on unsupervised learning algorithms (self-organizing maps), that are able to detect deviations from the normal behavior. An additional advantage of this approach is that it is quite independent of the attacks, and therefore it can detect and confine new, previously unknown, attacks. Unlike previous approaches, and due to the inherent insecurity of WMN nodes, we assume that confidentiality and integrity cannot be preserved for any single node.

Using Reputation Systems and Non-Deterministic Routing to Secure Wireless Sensor Networks

Security in wireless sensor networks is difficult to achieve because of the resource limitations of the sensor nodes. We propose a trust-based decision framework for wireless sensor networks coupled with a non-deterministic routing protocol. Both provide a mechanism to effectively detect and confine common attacks, and, unlike previous approaches, allow bad reputation feedback to the network. This approach has been extensively simulated, obtaining good results, even for unrealistically complex attack scenarios.

Bio-inspired enhancement of reputation systems for intelligent environments

Providing security to the emerging field of ambient intelligence will be difficult if we rely only on existing techniques, given their dynamic and heterogeneous nature. Moreover, security demands of these systems are expected to grow, as many applications will require accurate context modeling. In this work we propose an enhancement to the reputation systems traditionally deployed for securing these systems. Different anomaly detectors are combined using the immunological paradigm to optimize reputation system performance in response to evolving security requirements. As an example, the experiments show how a combination of detectors based on unsupervised techniques (self-organizing maps and genetic algorithms) can help to significantly reduce the global response time of the reputation system. The proposed solution offers many benefits: scalability, fast response to adversarial activities, ability to detect unknown attacks, high adaptability, and high ability in detecting and confining attacks. For these reasons, we believe that our solution is capable of coping with the dynamism of ambient intelligence systems and the growing requirements of security demands.

SORU: A Reconfigurable Vector Unit for Adaptable Embedded Systems

In this article we describe SORU, a reconfigurable instruction set processor architecture (RISP) specially designed for run-time self-adaptation in environments with tight resource and power restrictions. It allows to accelerate computationally intensive multimedia processing on portable/embedded devices while maintaining a low energy consumption. The experimental results show a mean speedup of 4 with half the energy consumption. The main datapath can be left in a hibernate state during more than 75% of the execution time in our experiments, what leads also to a significant reduction of energy consumption in the I-cache and the main datapath, including the register file.

Image Processing Based Services for Ambient Assistant Scenarios

Guaranteeing ubiquity and appropriateness of security and monitoring services provision to the users constitutes a priority issue for the authorities. This paper presents an innovative Wireless Personal Area Network architecture that takes advantage of some of the features provided by Intelligent Environments -large number of devices, heterogeneous networks and mobility enhancement- in order to adapt and personalise ambient conditions to the user profile. This system is based on image processing and its main aim is to provide an AAL solution that is integrated with other control devices for the home to make everyday tasks easier for users.

Low-Cost Gesture-Based Interaction for Intelligent Environments

User interaction with the intelligent environment should not require the user to adapt to special conventions or rules. It should be the environment who should adapt to the natural way of users interaction, but the tight resource constraints of the embedded sensors do not allow complex video processing algorithms to be executed in real time. In this paper we present a low-cost approach to camera-based gesture recognition for intelligent environments, minimizing the required communication between sensors and servers, and performing most of the image processing in low-cost battery-powered microcontrollers.

Detecting and Confining Sybil Attack in Wireless Sensor Networks Based on Reputation Systems Coupled with Self-organizing Maps

The Sybil attack is one of the most aggressive and evasive attacks in sensor networks that can affect on many aspects of network functioning. Thus, its efficient detection is of highest importance. In order to resolve this issue, in this work we propose to couple reputation systems with agents based on self-organizing map algorithm trained for detecting outliers in data. The response of the system consists in assigning low reputation values to the compromised node rendering them isolated from the rest of the network. The main improvement of this work consists in the way of calculating reputation, which is more flexible and discriminative in distinguishing attacks from normal behavior. Self-organizing map algorithm deploys feature space based on sequences of sensor outputs. Our solution offers many benefits: scalable solution, fast response to adversarial activities, ability to detect unknown attacks, high adaptability and low consumption. The testing results demonstrate its high ability in detecting and confining Sybil attack.

Compiler Optimizations as a Countermeasure against Side-Channel Analysis in MSP430-Based Devices

Ambient Intelligence (AmI) requires devices everywhere, dynamic and massively distributed networks of low-cost nodes that, among other data, manage private information or control restricted operations. MSP430, a 16-bit microcontroller, is used in WSN platforms, as the TelosB. Physical access to devices cannot be restricted, so attackers consider them a target of their malicious attacks in order to obtain access to the network. Side-channel analysis (SCA) easily exploits leakages from the execution of encryption algorithms that are dependent on critical data to guess the key value. In this paper we present an evaluation framework that facilitates the analysis of the effects of compiler and backend optimizations on the resistance against statistical SCA. We propose an optimization-based software countermeasure that can be used in current low-cost devices to radically increase resistance against statistical SCA, analyzed with the new framework.