Michel Barbeau

WiMax/802.16 threat analysis

This paper examines threats to the security of the WiMax/ 802.16 broadband wireless access technology. Threats associated with the physical layer and MAC layer are reviewed in detail. The likelihood, impact and risk are evaluated according to a threat assessment methodology proposed by the ETSI. Threats are listed and ranked according to the level of risk they represent. This work can be used to prioritize future research directions in WiMax/802.16 security.

Planning control rules for reactive agents

Abstract A traditional approach for planning is to evaluate goal statements over state trajectories modeling predicted behaviors of an agent. This paper describes a powerful extension of this approach for handling complex goals for reactive agents. We describe goals by using a modal temporal logic that can express quite complex time, safety, and liveness constraints. Our method is based on an incremental planner algorithm that generates a reactive plan by computing a sequence of partially satisfactory reactive plans converging to a completely satisfactory one. Partial satisfaction means that an agent controlled by the plan accomplishes its goal only for some environment events. Complete satisfaction means that the agent accomplishes its goal whatever environment events occur during the execution of the plan. As such, our planner can be stopped at any time to yield a useful plan. An implemented prototype is used to evaluate our planner on empirical problems.

Detecting impersonation attacks in future wireless and mobile networks

Impersonation attacks in wireless and mobile networks by professional criminal groups are becoming more sophisticated. We confirm with simple risk analysis that impersonation attacks offer attractive incentives to malicious criminals and should therefore be given highest priority in research studies. We also survey our recent investigations on Radio Frequency Fingerprinting and User Mobility Profiles and discuss details of our methodologies for building enhanced intrusion detection systems for future wireless and mobile networks.

Anomaly-based intrusion detection using mobility profiles of public transportation users

For the purpose of anomaly-based intrusion detection in mobile networks, the utilization of profiles, based on hardware signatures, calling patterns, service usage, and mobility patterns, have been explored by various research teams and commercial systems, namely the fraud management system by Hewlett-Packard and Compaq. This paper examines the feasibility of using profiles, which are based on the mobility patterns of mobile users, who make use of public transportation, e.g. bus. More specifically, a novel framework, which makes use of an instance based learning technique, for classification purposes, is presented. In addition, an empirical analysis is conducted in order to assess the impact of two key parameters, the sequence length and precision level, on the false alarm and detection rates. Moreover, a strategy for enhancing the characterization of users is also proposed. Based on simulation results, it is feasible to use mobility profiles for anomaly-based intrusion detection in mobile wireless networks.

Centroid localization of uncooperative nodes in wireless networks using a relative span weighting method

Increasingly ubiquitous wireless technologies require novel localization techniques to pinpoint the position of an uncooperative node, whether the target is a malicious device engaging in a security exploit or a low-battery handset in the middle of a critical emergency. Such scenarios necessitate that a radio signal source be localized by other network nodes efficiently, using minimal information. We propose two new algorithms for estimating the position of an uncooperative transmitter, based on the received signal strength (RSS) of a single target message at a set of receivers whose coordinates are known. As an extension to the concept of centroid localization, our mechanisms weigh each receivers coordinates based on the messages relative RSS at that receiver, with respect to the span of RSS values over all receivers. The weights may decrease from the highest RSS receiver either linearly or exponentially. Our simulation results demonstrate that for all but the most sparsely populated wireless networks, our exponentially weighted mechanism localizes a target node within the regulations stipulated for emergency services location accuracy.

Improving Distance Based Geographic Location Techniques in Sensor Networks

Supporting nodes without Global Positioning System (GPS) capability, in wireless ad hoc and sensor networks, has numerous applications in guidance and surveying systems in use today. At issue is that a procedure be available so that the subset of nodes with GPS capability succeed in supporting the maximum possible number of nodes without GPS capability and as a result enable the highest connectivity of the underlying network infrastructure. In this paper, we identify incompleteness in the standard method for computing the position of a node based on three GPS enabled neighbors, in that it may fail to support the maximum possible subset of sensors of the wireless network. We give a new complementary algorithm (the three/two neighbor algorithm) that indeed succeeds in providing a higher fraction of nodes (than the 3-Neighbour algorithm) with their position. We prove its correctness and test its performance with simulations.

Secure Localization of Nodes in Wireless Sensor Networks with Limited Number of Truth Tellers

We provide in this paper three algorithms that enable the sensor nodes of a Wireless Sensor Network (WSN) to determine their location in presence of neighbor sensors that may lie about their position. Our algorithms minimize the number of trusted nodes required by regular nodes to complete their process of localization. The algorithms always work for a given number of neighbors provided that the number of liars is below a certain threshold value, which is also determined.

Analysis of Threats to the Security of EPC Networks

Detecting and responding to security and privacy threats to Electronic Product Code (EPC) and Radio Frequency IDentification (RFID) technologies are becoming major concerns of information security researchers. However, and before going further in these activities, an evaluation of the threats in terms of importance must be done. We present such an evaluation. Our analysis of the threats is based on a methodology proposed by the European Telecommunications Standards Institute (ETSI). According to this methodology, we rank the threats to EPC networks in order of relevance. This assessment is intended to prioritize threats for future research on appropriate countermeasure mechanisms.

Strategies for fast scanning and handovers in WiMAX/802.16

In WiMAX/IEEE 802.16 with mobility support, scanning for an available channel by a mobile station, at start up or when about to perform a handover must be done promptly in order to reduce delays in network access. We propose strategies that a mobile station can use to reduce the time required for scanning operations while attempting to establish network connectivity or perform a handover between neighboring base stations. We model and simulate an area of WiMAX coverage using real-world mobility trace data and show that there are strategies that reduce the time required for scanning operations significantly.

Insider attack attribution using signal strength‐based hyperbolic location estimation

A rogue insider, in a wireless network, is an authenticated member that exploits possession of a valid identity in order to launch an attack. A typical example is the transmission of a verifiable message containing false or incomplete information. An important step, in enabling the network authorities to attribute an attack message to its originator, involves locating the physical source of the transmission. We propose a probabilistic scheme to determine the location of a transmitting rogue, with a degree of confidence, using the relative signal strength received by neighboring devices, even if the effective isotropic radiated power (EIRP) employed by the rogue is unknown. The relative received signal strength (RSS) between pairs of trusted receivers are combined with a range of possible EIRP values to construct an area in Euclidian space bounded by minimum and maximum distance hyperbolas. The area contained within the intersection of multiple hyperbola pairs pinpoints the location of the rogue transmitter with a specific level of confidence. Copyright