We consider routing security in wireless sensor networks. Many sensor network routing protocols have been proposed, but none of them have been designed with security as a goal. We propose security goals for routing in sensor networks, show how attacks against ad-hoc and peer-to-peer networks can be adapted into powerful attacks against sensor networks, introduce two classes of novel attacks against sensor networks sinkholes and HELLO floods, and analyze the security of all the major sensor network routing protocols. We describe crippling attacks against all of them and suggest countermeasures and design considerations. This is the first such analysis of secure routing in sensor networks.

/pdf/secure-routing-in-wireless-sensor-networks-attacks-and-4630unozk9.pdf

Secure routing in wireless sensor networks: attacks and countermeasures

This invention relates to customized electronic identification of desirable objects, such as news articles, in an electronic media environment, and in particular to a system that automatically constructs both a "target profile" for each target object in the electronic media based, for example, on the frequency with which each word appears in an article relative to its overall frequency of use in all articles, as well as a "target profile interest summary" for each user, which target profile interest summary describes the user's interest level in various types of target objects. The system then evaluates the target profiles against the users' target profile interest summaries to generate a user-customized rank ordered listing of target objects most likely to be of interest to each user so that the user can select from among these potentially relevant target objects, which were automatically selected by this system from the plethora of target objects that are profiled on the electronic media. Users' target profile interest summaries can be used to efficiently organize the distribution of information in a large scale system consisting of many users interconnected by means of a communication network. Additionally, a cryptographically-based pseudonym proxy server is provided to ensure the privacy of a user's target profile interest summary, by giving the user control over the ability of third parties to access this summary and to identify or contact the user.

System for generation of user profiles for a system for customized electronic identification of desirable objects

This invention relates to customized electronic identification of desirable objects, such as news articles, in an electronic media environment, and in particular to a system that automatically constructs both a 'target profile' for each target object in the electronic media based, for example, on the frequency with which each word appears in an article relative to its overall frequency of use in all articles, as well as a 'target profile interest summary' for each user, which target profile interest summary describes the user's interest level in various types of target objects. The system then evaluates the target profiles against the users' target profile interest summaries to generate a user-customized rank ordered listing of target objects most likely to be of interest to each user so that the user can select from among these potentially relevant target objects, which were automatically selected by this system from the plethora of target objects that are profiled on the electronic media. Users' target profile interest summaries can be used to efficiently organize the distribution of information in a large scale system consisting of many users interconnected by means of a communication network. Additionally, a cryptographically-based pseudonym proxy server is provided to ensure the privacy of a user's target profile interest summary, by giving the user control over the ability of third parties to access this summary and to identify or contact the user.

System for customized electronic identification of desirable objects

A secure data interchange system enables information about bilateral and multilateral interactions between multiple persistent parties to be exchanged and leveraged within an environment that uses a combination of techniques to control access to information, release of information, and matching of information back to parties. Access to data records can be controlled using an associated price rule. A data owner can specify a price for different types and amounts of information access.

Secure data interchange

Botnets are now the key platform for many Internet attacks, such as spam, distributed denial-of-service (DDoS), identity theft, and phishing. Most of the current botnet detection approaches work only on specific botnet command and control (C&C) protocols (e.g., IRC) and structures (e.g., centralized), and can become ineffective as botnets change their C&C techniques. In this paper, we present a general detection framework that is independent of botnet C&C protocol and structure, and requires no a priori knowledge of botnets (such as captured bot binaries and hence the botnet signatures, and C&C server names/addresses). We start from the definition and essential properties of botnets. We define a botnet as a coordinated group of malware instances that are controlled via C&C communication channels. The essential properties of a botnet are that the bots communicate with some C&C servers/peers, perform malicious activities, and do so in a similar or correlated way. Accordingly, our detection framework clusters similar communication traffic and similar malicious traffic, and performs cross cluster correlation to identify the hosts that share both similar communication patterns and similar malicious activity patterns. These hosts are thus bots in the monitored network. We have implemented our BotMiner prototype system and evaluated it using many real network traces. The results show that it can detect real-world botnets (IRC-based, HTTP-based, and P2P botnets including Nugache and Storm worm), and has a very low false positive rate.

/pdf/botminer-clustering-analysis-of-network-traffic-for-protocol-128yhq3sy0.pdf

BotMiner: clustering analysis of network traffic for protocol- and structure-independent botnet detection

We present an anomaly-based algorithm for detecting IRC-based botnet meshes. The algorithm combines an IRC mesh detection component with a TCP scan detection heuristic called the TCP work weight. The IRC component produces two tuples, one for determining the IRC mesh based on IP channel names, and a sub-tuple which collects statistics (including the TCP work weight) on individual IRC hosts in channels. We sort the channels by the number of scanners producing a sorted list of potential botnets. This algorithm has been deployed in PSU's DMZ for over a year and has proven effective in reducing the number of botnet clients.

/pdf/an-algorithm-for-anomaly-based-botnet-detection-1du5rf7c7z.pdf

An algorithm for anomaly-based botnet detection

We have designed an authenticated link-level ad hoc routing protocol and integrated it with the Portland State University implementation of Mobile-IP. The routing protocol addresses link security issues. In our protocol, mobile nodes, as well as agents, broadcast ICMP router discovery packets. The router discovery packets are authenticated and bind the sender's MAC and IP addresses. Problems caused by tying IP subnet schemes to routing on radio links are eliminated. Security problems associated with ARP spoofing are also reduced. This link-level protocol is integrated with Mobile-IP on links where increased security is needed. The protocol replaces ARP, and may be integrated with higher-level multi-hop ad hoc routing protocols.

Authenticated ad hoc routing at the link layer for mobile systems

Hot swapping technology combined with pervasive heterogeneous networks empowers mobile laptop users to select the best network device for their current environment. Unfortunately, the majority of system software remains “customized”for a particular network configuration, and assumes that many characteristics associated with the network environment remain invariant over the runtime of the software. Mobility causes changes in the environment and nullifies many of these assumptions. This leads to severe loss in system functionality when resources are lost, and failure to benefit when resources are gained. This paper describes Physical Media Independence (PMI), an architecture for dynamically diverse network interface management. PMI addresses three issues concerning dynamic network configuration. First, a model for device availability is proposed to accurately determine when a network device is operational. Second, a structured methodology is used to construct adapters that reconfigure the system when the set of available devices change. The methodology breaks traditional layering using a meta-interface to pass events and information among layers, allowing each layer to adapt in a manner best suited to it. Third, we examine the effect of transparent and non-transparent reconfiguration operations on a variety of applications. We find that adaptive, resource intensive applications behave more efficiently when informed of device availability events. We compare the functionality of an adaptive application running on top of a adaptive operating system (OS) with and without cross-layer notifications.

Dynamic network reconfiguration support for mobile computers

This paper describes Rama, a first generation experimental information retrieval and filtering system that attempts to recover useful information from various Internet sources including USENIX news and anonymous FTP servers. The focus of the Rama system to date has been on building a distributed query and information retrieval system, which provides an interface to heterogeneous information services. A user of Rama sends one or more asynchronous queries to a Rama server using existing SMTP e-mail clients. The server periodically searches local and remote Internet services. Searches are prefiltered with the use of timestamps. Data objects which are newer than the timestamp are then searched via a query mechanism which relies on a combination of vector-distance, pattern matching operands, and boolean operators. Results are weighted according to how closely they match queries and are posted via e-mail to the user. Input to the e-mail client can be further filtered — one can use the MH mail system and sort input by weight. Results indicate that the current system is useful and extensible. So far we have assumed that existing e-mail systems will be used for input and output and have not attempted to construct special client interfaces. Efforts are underway to extend the system with WWW searching capabilities and construct a special WWW oriented user-interface.

Rama: an architecture for Internet information filtering

Ourmon is an open-source network management and anomaly detection system that has been developed over a period of several years at Portland State University. Ourmon monitors a target network both to highlight abnormal network traffic and measure normal traffic loads. In this paper, we describe the features and performance characteristics of Ourmon.

Ourmon features include a novel mechanism for running multiple concurrent Berkeley Packet Filter (BPF) expressions bound to a single RRDTOOL-style graph, as well as various types of top talker (top-N) filters aimed at conventional network flow measurements and anomaly detection. These features permit a variety of useful and easily-understood measurements.

One problem that sniffer-based network monitor systems face is network-intensive attacks that can overwhelm monitoring and analysis resources. Lab experiments with an IXIA high-speed packet generator, as well as experiences with Ourmon in a real network environment, demonstrate this problem. Some recent modifications to Ourmon have greatly improved its performance. However, minimum-size packets in a high-speed network can still easily make a host lose packets even at relatively slow rates and low monitor workloads. We contend that small packet performance is a general network security problem faced by current monitoring systems including both open source systems such as Ourmon and Snort, and commercial systems.

/pdf/ourmon-and-network-monitoring-performance-1kxvcaaz6q.pdf

Jim Binkley

Papers

An algorithm for anomaly-based botnet detection

Authenticated ad hoc routing at the link layer for mobile systems

Dynamic network reconfiguration support for mobile computers

Rama: an architecture for Internet information filtering

Ourmon and network monitoring performance