Sapon Tanachaiwiwat

Location-centric isolation of misbehavior and trust routing in energy-constrained sensor networks

We propose a novel, location-centric, architecture for isolating misbehavior and establishing trust routing in sensor networks. Our scheme fits the data-centric nature of sensor networks and is suitable for use in energy-constrained networks. Much of our protocols operate in the sinks relieving the sensors from a lot of functionality. Our protocols select trusted paths that do not include misbehaving nodes, by identifying insecure locations and routing around them efficiently via detour points using embedded blacklists and modified geographic or trajectory routing. For insecure location discovery we propose efficient one-shot probing. Cheat-proofing is achieved using location correlation to remove false reporting. Our simulations show how our scheme effectively increases the throughput and energy-efficiency of a sensor network and alleviates the effect of route infection in geographic routing.

Poster abstract secure locations: routing on trust and isolating compromised sensors in location-aware sensor networks

In data-centric sensor networks, where data processing and transfer are oblivious to node IDs, conventional node-based security models are not suitable. We introduce the novel concept of secure locations to address non-cooperative and malicious behavior in location-aware sensor networks. Our architecture also introduces a scalable trust-based routing protocol (TRANS) to track, update and route around untrusted locations using variants of geographic and trajectory routing. As part of our protocol we provide an efficient algorithm for identifying and isolating misbehaving or compromised sensors based on their approximate locations. Our simulations show the efficacy of our approach in malicious node isolation and route infection reduction.

Modeling and analysis of worm interactions (war of the worms)

’War of the worms’ is a war between opposing computer worms, creating complex worm interactions as well as detrimental impact on infrastructure. For example, in September 2003 the Welchia worms were launched to terminate the Blaster worms and patch the vulnerable hosts. In this paper, we try to answer the following questions: How can we explain the dynamic of such phenomena with a simple mathematical model? How can one worm win this war? How do other factors such as locality preference, bandwidth, worm replication size and reaction time affect the number of infected hosts? We propose a new Worm Interaction Model (based upon and extending beyond the epidemic model) focusing on random-scan worm interactions. We also propose a new set of metrics to quantify effectiveness of one worm terminating other worm. We validate our worm interaction model using extensive ns-2 simulations. This study provides the first work to characterize and investigate worm interactions of random-scan worms in multi-hop networks.

Computer worm ecology in encounter-based networks

Encounter-based network is a frequently-disconnected wireless ad-hoc network requiring immediate neighbors to store and forward aggregated data for information disseminations. Using traditional approaches such as gateways or firewalls for deterring worm propagation in encounter-based networks is inappropriate. Because this type of network is highly dynamic and has no specific boundary, we need a fully distributed security response mechanism. We propose the worm interaction approach that relies upon automated beneficial worm generation aiming to alleviate problems of worm propagations in such networks. This work is motivated by the ‘War of the Worms’ of the Internet worms between competing worms such as NetSky, Bagle and MyDoom. To understand the dynamic of worm interactions and its performance, we mathematically model several classes of worms and interactions using ordinary differential equations and analyze their behaviors.

On the performance evaluation and prediction of encounter-based worm interactions based on node characteristics

An encounter-based network is a frequently-disconnected wireless ad-hoc network requiring nearby neighbors to store and forward data utilizing mobility and encounters over time. Using traditional approaches such as gateways or firewalls for deterring worm propagation in encounter-based networks is inappropriate. We propose models for the worm interaction approach that relies upon automated beneficial worm generation to alleviate problems of worm propagation in such networks. We study and analyze the impact of key mobile node characteristics including node cooperation, immunization, on-off behavior on the worm propagations and interactions. We validate our proposed model using extensive simulations. We also find that, in addition to immunization, cooperation can reduce the level of worm infection. Furthermore, on-off behavior linearly impacts only timing aspect but not the overall infection. Using realistic mobile network measurements, we find that encounters are non-uniform, the trends are consistent with the model but the magnitudes are drastically different. Immunization seems to be the most effective in such scenarios. These findings provide insight that we hope would aid to develop counter-worm protocols in future encounter-based networks.