Rusty O. Baldwin

Bluetooth Inquiry Time Characterization and Selection

The Bluetooth discovery process requires use of the inquiry substate which not only consumes significant power, but prevents normal data traffic flow and simultaneously acts as a potential noise source for neighboring networks. Therefore, the inquiry substate dwell time should be limited to discovering an acceptable number of neighboring devices. Although an estimate of the probability density function of the time to discover scanning devices is straightforward, the complex temporal and spectral interactions between two devices make precise inquiry time characterization difficult. We characterize these interactions and derive detailed analytical expressions for the probability distribution of the inquiry time for a Bluetooth-enabled device that follows v1.1 of the Bluetooth specification and uses the default 11.25 ms inquiry scan window that opens every 1.28 s. Subsequently, we show a single inquirer will locate 99 percent of all scanning devices within transmission range in 5.12 seconds rather than the 10.24 s recommended in the specification. Using specification v1.2, we show that the inquiry time can be reduced to 3.84 seconds and 1.28 seconds using the standard and interlaced inquiry scan modes, respectively. Substantial inquiry time reduction results in reduced power requirements and increased throughput by increasing data traffic and reducing interference with neighboring piconets. Our results are validated via comparison with existing simulation models and measurement studies. The models used to derive the distribution also lend themselves to characterizing the discovery time with variations in the discovery process

An analysis of XML compression efficiency

XML simplifies data exchange among heterogeneous computers, but it is notoriously verbose and has spawned the development of many XML-specific compressors and binary formats. We present an XML test corpus and a combined efficiency metric integrating compression ratio and execution speed. We use this corpus and linear regression to assess 14 general-purpose and XML-specific compressors relative to the proposed metric. We also identify key factors when selecting a compressor. Our results show, XMill or WBXML may be useful in some instances, but a general-purpose compressor is often the best choice.

Intrinsic Physical-Layer Authentication of Integrated Circuits

Radio-frequency distinct native attribute (RF-DNA) fingerprinting is adapted as a physical-layer technique to improve the security of integrated circuit (IC)-based multifactor authentication systems. Device recognition tasks (both identification and verification) are accomplished by passively monitoring and exploiting the intrinsic features of an ICs unintentional RF emissions without requiring any modification to the device being analyzed. Device discrimination is achieved using RF-DNA fingerprints comprised of higher order statistical features based on instantaneous amplitude, phase, and frequency responses as a device executes a sequence of operations. The recognition system is trained using multiple discriminant analysis to reduce data dimensionality while retaining class separability, and the resultant fingerprints are classified using a linear Bayesian classifier. Demonstrated identification and verification performance includes average identification accuracy of greater than 99.5% and equal error rates of less than 0.05% for 40 near-identical devices. Depending on the level of required classification accuracy, RF-DNA fingerprint-based authentication is well-suited for implementation as a countermeasure to device cloning, and is promising for use in a wide variety of related security problems.

Using Relocatable Bitstreams for Fault Tolerance

The regular structure and addressing scheme for the Virtex-IIfamily of field programmable gate arrays (FPGAs) allows the relocation of partial bitstreams through direct bitstream manipulation. Our bitstream translation program relocates modules on an FPGA by changing the partial bitstream of the module. To take advantage of relocatable modules, three fault tolerant circuit designs are developed and tested. While operating through a fault, these designs provide support for efficient and transparent replacement of the faulty module with a relocated fault-free module. The architecture of the FPGA and static logic significantly constrain the placement of relocatable modules, especially when a microprocessor is placed on the FPGA.

Physical layer identification of embedded devices using RF-DNA fingerprinting

RF distinct native attribute (RF-DNA) fingerprinting is introduced as a means to uniquely identify embedded processors and other integrated circuit devices by passively monitoring and exploiting unintentional RF emissions. Device discrimination is accomplished using RF-DNA fingerprints comprised of higher-order statistical features based on instantaneous amplitude and frequency responses as a device executes a sequence of operations. The resultant fingerprints are input to a Multiple Discriminant Analysis/Maximum Likelihood (MDA/ML) processor for subsequent device discrimination. Using devices from a given manufacturer and experimentally collected side channel signals, 90–100% identification accuracy is achieved for SNR ≥ 12 dB for devices with identical part numbers from the same production lot. Depending on the level of required classification accuracy, RF-DNA fingerprinting is well-suited for realistic environments and practical operating distances. Applications of device RF-DNA fingerprints include supplementary physical layer authentication of secure tokens (e.g. smart cards), detection of counterfeit electronic devices or unauthorized modification, and forensic attribution of a devices unique identity in criminal or other investigations.

Packetized voice transmission using RT-MAC, a wireless real-time medium access control protocol

RT-MAC is a simple, elegant, and robust medium access control (MAC) protocol for use in transmitting real-time data in point-to-point ad hoc wireless local area networks (WLANs). Our enhancement of IEEE 802.11, real-time MAC (RT-MAC), dramatically reduces missed deadlines and packet collisions while increasing throughput by selectively discarding packets and sharing station state information. For example, RT-MAC is able to successfully transmit 40 2-way voice conversations in addition to a normalized offered load of 80%. IEEE 802.11 is only able to transmit 10 2-way conversations under the same conditions. In another instance, RT-MAC reduced packet collisions from 50% to less than 15% while increasing throughput by more than 50%. Herein we extend our previous performance analysis of RT-MAC to include integrated voice-data transmission. Stations using RT-MAC are interoperable with stations using IEEE 802.11 and show a significant performance improvement even when a minority of stations in the network employ RT-MAC.

A survey of state-of-the-art in anonymity metrics

Anonymization enables organizations to protect their data and systems from a diverse set of attacks and preserve privacy; however, in the area of anonymized network data, few, if any, are able to precisely quantify how anonymized their information is for any particular dataset. Indeed, recent research indicates that many anonymization techniques leak some information. An ability to confidently measure this information leakage and any changes in anonymity levels plays a crucial role in facilitating the free-flow of cross-organizational network data sharing and promoting wider adoption of anonyimzation techniques. Fortunately, multiple methods of analyzing anonymity exist. Typical approaches use simple quantifications and probabilistic models; however, to the best of our knowledge, only one network data anonymization metric has been proposed. More importantly, no one-stop-shop paper exists that comprehensively surveys this area for other candidate measures; therefore, this paper explores the state-of-the-art of anonymity metrics. The objective is to provide a macro-level view of the systematic analysis of anonymity preservation, degradation, or elimination for data anonymization as well as network communciations anonymization.

Network Intrusion Detection: Automated and Manual Methods Prone to Attack and Evasion

In this article, the authors describe common intrusion detection techniques, NIDS evasion methods, and how NIDSs detect intrusions. Additionally, the authors introduce new evasion methods, present test results for confirming attack outcomes based on server responses, and propose a methodology for confirming response validity

Program Fragmentation as a Metamorphic Software Protection

This paper proposes a Distributed Intrusion Prevention System (DIPS), which consists of several IPS over a large network (s), all of which communicate with each other or with a central server, that facilitates advanced network monitoring. A Hidden Markov Model is proposed for sensing intrusions in a distributed environment and to make a one step ahead prediction against possible serious intrusions. DIPS is activated based on the predicted threat level and risk assessment of the protected assets. Intrusions attempts are blocked based on (1) a serious attack that has already occurred (2) rate of packet flow (3) prediction of possible serious intrusions and (4) online risk assessment of the assets possibly available to the intruder. The focus of this paper is on the distributed monitoring of intrusion attempts, the one step ahead prediction of such attempts and online risk assessment using fuzzy inference systems. Preliminary experiment results indicate that the proposed framework is efficient for real time distributed intrusion monitoring and prevention.

A novel communications protocol using geographic routing for swarming UAVs performing a Search Mission

This paper develops a novel communications protocol for autonomous swarms of unmanned aerial vehicles (UAVs) searching a 2-dimensional grid. The search protocol, the UAV Search Mission Protocol (USMP), combines inter-UAV communication with geographic routing to improve search efficiency in terms of total searches, distance traveled by UAVs, and the minimization of UAV direction changes. By determining where search state updates impact search decisions, messages are geographically routed to improve search efficiency. USMP and the geographic greedy perimeter stateless routing (GPSR) protocol are studied via simulation using OPNET Modeler 12.0. Geographic routing degrades performance by at least 20% in total searches and distance traveled, but improves direction changes by 6.7%. Overall, USMP improves performance by as much as 188% compared to scenarios without inter-UAV communication.