Department Publications

Due to high costs at initiation, alternative communication strategies to dedicated short range communication (DSRC) have been looked at to facilitate quick deployment of intelligent transportation services. Wi-Fi Direct (WD), has come across as a candidate, and this paper focuses on the drawback of large transmission delays in WD. To this end, it studies the performance gains of using a broadcast mechanism on the downlink between the group owner (GO) and the clients of a WD group, instead of the currently used peer-to-peer method. Gains in terms of average total delay and the average energy consumption of the GO are presented using a theoretical analysis as well as a simulation study using OMNeT++. It is also shown that the degradation in performance on the downlink due to not having retransmissions is within tolerable limits given that the size of the group is selected properly.

This paper introduces a novel traffic reduction method for Networked Control Systems (NCS) called Deadband Error Modulation (DEM). The deadband modifies the periodic dynamics of Delta Modulation (DM) based techniques such as our previously proposed Event Triggered Adaptive Differential Modulation (ETADM). Like ETADM it can be used for encoding individual scalar elements of a vector (i.e., the state vector or control input). It is also robust to bounded packet drops.

Most of the intrusion detection and prevention systems (NIDS/NIPS) are utilizing signature based matching which makes use of a stored rule base for distinguishing malicious network traffic. Dynamic rule-base updates has become a requirement due to the increasingly large number of new attack types identified every day, while the downtime associated with rule base updates has become a major drawback in hardware based Network Intrusion Prevention Systems. In addition, the NIPS are facing the challenge of expanding their throughput to cope with the ever growing high bandwidth requirement. This paper presents a novel scalable architecture for a NIPS with stateful packet inspection. The implementation is capable of processing Snort signatures and also analyzing packet streams to detect attacks with TCP segment manipulation. The system ensures run-time rule reconfigurability, which eliminates the risk of …

There exists some common bottlenecks among the many available Software Defined Networking (SDN) controllers. Of these, the current analysis uses the Floodlight software controller to identify bottlenecks. The analysis has implemented these bottlenecks in a Field Programmable Gate Array (FPGA) in order to assess its feasibility. Thereafter, a Hybrid SDN controller has been developed. Generally Hybrid SDN refers to a networking approach where traditional networking and SDN protocols are used and operated in the same environment. Hybrid in this paper context refers to a controller which is developed both on software and hardware platforms in order to achieve a higher scalability which is a current issue existing in software controller, and thereby overcoming the identified bottlenecks. The analysis has offloaded computational intensive models to an FPGA and tested for performance. These performance figures have then been compared against the performance figures as of a stand-alone software controller.

Power control schemes are proposed for a full-duplex (FD) device-to-device (D2D) network operating as an underlay of a primary FD network. As networks with different quality of service (QoS) requirements may coexist in future heterogeneous networks, it is assumed that the underlay D2D network is operating with best effort QoS provisioning, while the primary FD network requires guaranteed QoS. A centralized power control (CPC) solution is proposed by casting the power control problem as a convex optimization problem. Furthermore, a heuristic distributed power control (DPC) solution is proposed to reduce information feedback overhead. It is found that the heuristic DPC achieves D2D user data rate that is within 87% and 80% of that provided by the CPC scheme in 3-node and 2-node FD primary network, respectively.

The development of computer based systems expands the usage of computer based application in human life. It can be observed that illegal activities such as unauthorized data access, data theft, data modification and various other intrusion activities are rapidly growing during last decade. Hence, deployment and continuous improvement of Intrusion Detection Systems (IDS) are of paramount importance. Training, testing and evaluation of IDS with real network traffic is significant challenge, so most of IDS evaluation is based on intrusion datasets. Therefore, analysis of intrusion datasets are of paramount importance. In this paper, we evaluated Aegean Wi-Fi Intrusion Dataset (AWID) with different machine learning techniques. Feature reduction techniques such as Information Gain (IG) and Chi-Squared statistics (CH) were applied to evaluate dataset performance with feature reduction. Results of experiments show …

Intrusion detection is only a starting step in securing IT infrastructure. Prediction of intrusions is the next step to provide an active defense against incoming attacks. Current intrusion prediction methods focus mainly on prediction of either intrusion type or intrusion category and do not use or provide contextual information such as source and target IP address. In addition most of them are dependant on domain knowledge and specific scenario knowledge. The proposed algorithm employs a bag-of-words model together with a hidden Markov model which not depend on specific domain knowledge. Since this algorithm depends on a training process it is adaptable to different conditions. A key advantage of the proposed algorithm is the inclusion of contextual data such as source IP address, destination IP range, alert type and alert category in its prediction, which is crucial for an eventual response. Experiments conducted using a public data set generated over 2500 alert predictions and achieved accuracy of 81% and 77% for single step and five step predictions respectively for prediction of the next alert cluster. It also achieved an accuracy of prediction of 95% and 92% for single step and five step predictions respectively for prediction of the next alert category. The proposed methods achieved a prediction accuracy improvement of 5% for alert category over existing variable length Markov chain intrusion prediction methods, while providing more information for a possible defense.

Intrusion detection is only a starting step in securing IT infrastructure. Prediction of intrusions is the next step to provide an active defense against incoming attacks. Most of the existing intrusion prediction methods mainly focus on prediction of either intrusion type or intrusion category. Also, most of them are built based on domain knowledge and specific scenario knowledge. This thesis proposes an alert prediction framework which provides more detailed information than just the intrusion type or category to initiate possible defensive measures. The proposed algorithm is based on hidden Markov model and it does not depend on specific domain knowledge. Instead, it depends on a training process. Hence the proposed algorithm is adaptable to different conditions. Also, it is based on prediction of the next alert cluster, which contains source IP address, destination IP range, alert type and alert category. Hence …

Increasing demands for faster, more responsive and manageable networks have brought about a different approach to networking - Software Defined Networking (SDN). SDN introduces flow-based networking with a centralized controller. Matching incoming traffic flows with rules sent by the controller is an integral part of traffic forwarding in SDN. How efficiently this is carried out has a huge impact on network performance. In this paper, we present a high-performance, low-cost architecture for flow matching in an SDN switch. Our architecture consists of a dedicated unit for flow matching and a custom processor. Novel design of the flow match unit reduces matching latency significantly, when compared with the generic architecture, while also reducing usage of costly resources like TCAMs. When testing on FPGA platforms, implementing the system required only a minimum amount (around 10% on Virtex-7) of …

1.1 Background 1 1.2 Problem Statement 3 1.3 Proposed system 4 1.4 Objectives 4 1.5 Deliverables 4

Delay variation or jitter is an inherent feature of packet switched communication networks due to bottlenecks. In communication systems buffering is commonly used to mitigate in real time multimedia applications at the expense of an additional delay. This method is therefore not suitable for control systems implemented over packet switched communication networks due to the additional delay which can make the system unstable. Hence, jitter modelling and management is necessary. This paper focuses on the development and experimental verification of a suitable jitter model for wireless and wired network bottlenecks. The effects of jitter are then investigated by quantifying the performance of a simulated Networked Control System (NCS). According to the results, the reduction in attenuation due to jitter compared to a jitter free benchmark ranges from approximately 0.01-0.04dB depending on the encoding type.

Congestion in a networked control system (NCS) has many undesirable effects that can make a control system unstable if severe enough. These include delays and packet drops. Therefore, reducing network traffic, including traffic generated by the NCS itself is a necessity. In event based control (EBC) a control signal is generated when a specific event is triggered such as the control error exceeding a predetermined threshold. When the rate of change of a variable is bounded, event triggering reduces the effective frequency in which control signals have to be generated when compared to a system with periodic sampling. This paper proposes a new method of event triggering called event triggered adaptive differential modulation (ETADM) that combines the bandwidth reduction strategies of event triggering and human speech coding techniques. The proposed method can be applied to nonlinear systems with a …

Multi field packet classification is the enabling function for many novel and emerging network applications. Exponential growth of Internet traffic and classification rule sets demand novel hardware based architectural approaches to packet classification. Even though this is an immensely studied area, packet classification that supports scalability in both line rates and rule sets is scarce. In this paper we present experience gained while implementing a parallel packet classification engine architecture on a popular reconfigurable router platform. The architecture exploits parallelism offered in modern hardware technologies to classify multiple packets simultaneously to increase the throughput. The architecture is also capable of utilizing temporal locality present in internet traffic to increase the throughput. The Architecture was implemented on NetFPGA platform and packet classification was done at full line rate without …

Packet Classification is the enabling function for many Internet functions like QoS and Security. In this paper we propose a Classification engine architecture which exploits parallelism to increase throughput. The architecture also make use of the Temporal locality observed in Internet traffic positively by employing Popular Rule Caching mechanism to increase the classification throughput. We also introduce Rule Splitting mechanism to increase the accuracy of the rule caching mechanism. Simulation results revealed that the architecture is capable of achieving a throughput of more than 200Gbps when lowest amount of temporal locality is present for worst case packet size of 40 bytes.

The growth of the Sri Lankan healthcare sector is a necessity at this stage due to an increasingly ageing community and a significant increase in non-communicable diseases. Despite many regulations that given the sector, it continues to be inundated with many problems in relation to delivery of healthcare services./ Although the state is a prominent player in the industry, private sector healthcare facilities provide curative out patitent care to 60% of the population in the country. The World Health Organisation strategic agenda, Strategic Framework for Health Development in Sri Lanka as well as the Health Master Plan had highlighted the necessity of Information Systems for improved service delivery in the sector./ The existing Information Systems with it's administrative and financial bias has failed to add value in the interaction between the healthcare worker and the patient. The study investigates the possible …

This paper proposes the use of an intrusion detection system (IDS) tailored to counter the threats to an IEC61850-automated substation based upon simulated attacks on intelligent electronic devices (IEDs). Intrusion detection (ID) is the process of detecting a malicious attacker. It is an effective and mature security mechanism. However, it is not harnessed when securing IEC61850-automated substations. The IDS of this paper is developed by using data collected by launching simulated attacks on IEDs and launching packet sniffing attacks using forged address resolution protocol (ARP) packets. The detection capability of the system is then tested by simulating attacks and through genuine user activity. A new method for evaluating the temporal risk of an intrusion for an electric substation based upon the statistical analysis of known attacks is also proposed.

This paper proposes a scheme for auditing the security of an IEC61850-based network based upon a novel security metric for intelligent electronic devices (IEDs). A detailed security analysis on an IEC61850 automated substation is peformed initially with a focus on the possible goals of the attacker. This is followed by the development of a scheme to audit the security of such a network. Security metrics are considered since they provide a tangible means of quantifying the security of a network. The proposed auditing scheme is tested by using it to audit the security of an IEC61850 network. The results are then compared with two other metric schemes-the mean time to compromise (MTTC) metric and the VEA-bility metric, which are used for auditing conventional computer networks. The input data for both metrics are obtained by using a network security tool to scan the IEDs of the network. The impact of using high …

Network traffic has been shown on numerous occasions to be self similar under normal conditions. This self similar property is however, lost during anomalous conditions such as device failure, congestion and malicious intrusions. Therefore, this loss of self similarity can be used to detect such events. The Hurst parameter (H) is the most widely accepted parameter for determining self similarity. However, an accurate estimate is data and computationally expensive. This paper discusses the potential of using efficient classifier and soft computing based approaches for determining self similarity. Traffic data is obtained for various user activities from genuine browsing to malicious attacks. This data is then analysed for self similarity. The logarithmic normalized histogram of the packet interarrival time is used to obtain a feature set for classification. Various techniques are used to analyse and reduce the feature set …

This paper proposes a novel method for a dynamic ridesharing mechanism using the combination of several modern information and communication technologies.

This paper details the use of possibilistic decision trees for a lightweight Intrusion Detection System (IDS) to be used in Intelligent Electronic Devices (IEDs) of IEC61850 automated electric substations. Traffic data is captured by performing simulated attacks on IEDs. Data is obtained for two types of genuine user activity and two types of common malicious attacks on IEDs. The genuine user activity includes, casual browsing of IED data and downloading of IED data while a Ping flood Denial of Service (DoS) and password crack attack are performed for malicious attacks. Classification is done using possibilistic decision trees for the logarithmic histogram of the time difference between the arrival of two consecutive packets. The main contribution of this paper is the use of non-specificity for obtaining a continuous valued possibilistic decision tree and its cut points. It also includes the use of mean distance metrics to …

Bandwidth scarcity is a common problem faced in multimedia transmission over broadband wireless networks. From a consumer's perspective, the effectiveness of multimedia delivery suffers significantly in such networks. Further, in a mobile environment, when the number of users increases, they experience interruptions in the received multimedia streams. Adaptive streaming is one solution that can be adopted in any network environment regardless of the nature of the network. Adaptive streaming can be achieved using transcoding techniques. Transcoding is a mechanism that converts a video to a form that has less information so that the resulting data volume is appropriate for streaming over a low bandwidth network. However, the quality of the video stream drops due to transcoding. The advantage is that when there is a large number of users sharing the network, users could watch a video at a lower quality …

The development and expansion of broadband technologies has stimulated the multimedia streaming market for the delivery of live streaming services which can be used for a variety of applications. The design of a generic audio and video streaming platform that can be employed for a wide range of applications is presented in this paper. A key feature of the platform is the ‘subscription framework’ which enables the service users to subscribe to a set of live feeds with their application specific requirements. The platform is capable of adjusting its service functionalities and the extent to which the media streams are secured for a particular user based on the requirements given at the service subscription. The platform is designed based on a layered architecture and a prototype implementation is carried out within the University network.