Project Description

Artificial Intelligence (AI) is expected to be an integral part of next-generation AI-native 6G networks. With the prevalence of AI, researchers have identified numerous use cases of AI in network security. However, there are almost nonexistent studies that analyze the suitability of Large Language Models (LLMs) in network security.

In this project, we investigate the suitability of Large Language Models (LLMs) in network security use cases. For this purpose, we select the case study of “Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege (STRIDE)” threat modeling of 5G threats and vulnerabilities. We perform experiments by selecting six 5G threats and utilizing four different prompting techniques with five LLMs. We provide detailed insights based on the evaluation results of LLM-based STRIDE classification. We provide detailed discussions on potential underlying factors that influence the behavior of LLMs in modeling certain threats, including: incorrect threat perspective, failure to identify second-order threats, and insights on Few-Shot (FS) prompting positively impacting performance. We analyze the suitability of LLMs using numerical testing and various performance metrics, including accuracy, precision, recall, and F1 score. Our results indicate that the performance of the selected LLMs is comparable, highlighting the need for enhancements in these models for STRIDE threat modeling in 5G networks and fine-tuning LLMs for network security use cases.

Evaluation Methodology

Our evaluation methodology is shown in the figure below. We initially select multiple threats and vulnerabilities in the 5G network along with their baseline STRIDE classifications from the published literature and standards. Then, we use various prompting techniques to perform the LLM-based STRIDE classification of the selected threats. Finally, we compare the STRIDE classification by LLMs to the baseline and evaluate the results.

Results

The results of LLM-based STRIDE classification of the six 5G threats are shown in the Table below. The first column of the table includes the prompting techniques we employ in our evaluation, while the second column shows the LLM models we select. The rest of the columns in this table present the baseline STRIDE classification along with the results of LLM-based STRIDE classification of the 5G threats. In this table, the white cells with a dot (∙) represent a positive baseline value, while an empty white cell represents a negative baseline value. According to this baseline, we categorize the LLM-based STRIDE classifications as True Positive (TP) (dark green cell with a dot (∙)), True Negative (TN) (empty green cell), False Positive (FP) (yellow cell with a dot (∙)), and False Negative (FN) (empty red cell). The coloring scheme represents that the greens (TP and TN) are correct classifications. Yellow (FP) is an incorrect classification, but it is not the worst outcome (over-predicting positive), and red (FN) is an incorrect classification and represents the worst outcome (under-predicting positive). The main insights and observations from these results are explained in the paper [1].

The figure below illustrates the performance of the LLMs in terms of accuracy, precision, recall, and F1 score using a heatmap chart. This result is averaged across all threats and all prompting techniques for a specific LLM. We observe that GPT-4o, Claude 3.7 Sonnet, and Grok-2 show ‘relatively’ higher accuracy and precision but lower recall compared to the other two LLMs. On the other hand, Sonar and Gemini 2.5 Pro achieved lower precision and higher recall in comparison. The F1 score indicates that the performance of all the LLMs is comparable for this case study. The maximum accuracy achieved is 72%, which highlights that there are opportunities for improvement across all LLMs, perhaps by fine-tuning for the specific application of STRIDE threat modeling in 5G networks.

Reference:

[1] AbdulGhaffar, AbdulAziz, and Ashraf Matrawy. “.” arXiv preprint arXiv:2505.04101 (2025).

The post LLMs’ Suitability for Network Security: A Case Study of STRIDE Threat Modeling appeared first on Next Generation Networks Lab.

This project enables us to demonstrate the effects of adversarial samples on deep learning-based intrusion detection systems within the context of IoT networks. Our experimental results illustrate the vulnerability of deep learning-based intrusion detection systems. It also provides a performance comparison between the feed forward neural networks and the self-normalizing neural networks. Finally, the effect of feature normalization on the adversarial robustness of deep learning based intrusion detection systems is analyzed.

Project Description:

The NGN laboratory is actively researching into the intersection of Network Security and Artificial Intelligence (AI) techniques such as Deep Learning. In this research project, we analyze the adversarial risks of applying deep learning methods to detect and mitigate security threats against IoT networks.

An adversarial attack on a deep learning model occurs when an adversarial example is fed as an input to the deep learning model. An adversarial example is an instance of the input in which some feature has been intentionally perturbed with the intention of confusing the deep learning model to produce a wrong prediction.

We evaluate two types of deep learning models. A feed forward artificial neural network (FNN) and a self-normalizing neural network (SNN). In our experimental setup, we photo two network intrusion detection systems using each variant of the deep learning model. The intrusion detection systems are then used to analyze network attack traffic of the BoT-IoT dataset from the Cyber Range Lab of the center of UNSW Canberra Cyber. [1.] Olakunle Ibitoye, M. Omair Shafiq and Ashraf Matrawy, “Analyzing Adversarial Attacks Against Deep Learning for Intrusion Detection in IoT Networks”, in Proc. of the , (Accepted) Waikoloa, HI, USA, 9 – 13 December 2019.

Researcher

Olakunle Ibitoye

Supervisors

Ashraf Matrawy M. Omair Shafiq

The post Analysis of Adversarial Attacks in Network Security appeared first on Next Generation Networks Lab.

Our group studies Machine Learning (ML) in network security (as shown in the figure below) and the security of machine learning. Below are some of our projects in this area:

Machine Learning Applications in Network Security [1]

Surveying Adversarial Attacks against Networks Security [1]

Machine learning enhances decision support systems in network security but faces unique adversarial threats. Our survey examines and classifies adversarial attacks against ML in network security, analyzing both attack methods and defenses. It provides taxonomies of ML techniques and security applications, introduces an adversarial risk grid map, and evaluates existing attacks using this framework. The study highlights the ongoing arms race between attackers and defenders in ML-based network security, offering insights into the complex landscape of adversarial machine learning in this domain.

Studying and Testing Adversarial Training to Increase ML Robustness against Adversarial Attacks [2][3][4]

Our projects investigate the effectiveness of various evasion attacks and propose training resilient ML models using different neural networks. We employ a min-max formulation to enhance robustness against adversarial samples. Our experiments show that adversarial training with this formulation significantly strengthens the network against state-of-the-art attacks.

IDS prototype Architecture with the inner-maximizer that generate adversarial samples and the outer-minimizer that reduce False Negative (FN) rates and increase robustness [2]

Studying the practicality of adversarial attacks against network intrusion detection systems and the impact of dynamic learning on them. [5][6]

Our projects examine the practicality of adversarial attacks against ML-NIDS, offering numerous contributions such as identifying practicality issues with an attack tree threat model, creating a taxonomy of these issues, shown in the figure below, and exploring how real-world ML model dynamics affect adversarial attacks. Our findings show that continuous re-training, even without adversarial training, can reduce attack effectiveness, emphasizing the gap between research and real-world application.

Taxonomy of Practicality Issues of Adversarial Attacks Against ML-NIDS [5]

Introducing Adaptive Continuous Adversarial Training (ACAT) to Enhance Machine Learning Robustness [7][8]

Adversarial training boosts the robustness of ML models against attacks, but obtaining labeled training and adversarial data in network security is costly and difficult. Our group presented Adaptive Continuous Adversarial Training (ACAT), a method that incorporates adversarial samples into the model during continuous learning using real-world detected data. Experiments with NIDS and SPAM detection datasets show that ACAT reduces detection time and improves the accuracy of an under-attack ML model.

ACAT Architecture [7]

Differentially private self-normalizing neural networks for adversarial robustness in federated learning [9]

Federated Learning has proven to help protect against privacy violations and information leakage. However, it introduces new risk vectors which make Machine Learning models more difficult to defend against adversarial samples. We consider the problem of improving the resilience of Federated Learning to adversarial samples without compromising the privacy-preserving features that Federated Learning was primarily designed to provide. Common techniques such as adversarial training, in their basic form are not well suited for a Federated Learning environment. Our study shows that adversarial training while improving adversarial robustness, comes at the cost of reducing the privacy guarantee of Federated Learning. We introduce DiPSeN, a Differentially Private Self-normalizing Neural Network that combines elements of differential privacy, self-normalization, and a novel optimization algorithm for adversarial client selection. Our empirical results on publicly available datasets for intrusion detection and image classification show that DiPSeN successfully improves adversarial robustness in Federated Learning while maintaining the privacy-preserving characteristics of Federated Learning.

DiPSeN Architecture [9]

Introducing Perturb-ability Score (PS) to Enhance Robustness Against Evasion Adversarial Attacks on ML-NIDS [10]

Our group proposed a novel Perturb-ability Score (PS) to identify Network Intrusion Detection Systems (NIDS) features that can be easily manipulated by attackers. We demonstrate that using PS to select only non-perturb-able features for ML-based NIDS maintains detection performance while enhancing robustness against adversarial attacks.

References:

[1] Ibitoye, Olakunle, Rana Abou-Khamis, Mohamed el Shehaby, Ashraf Matrawy, and M. Omair Shafiq. “The Threat of Adversarial Attacks on Machine Learning in Network Security–A Survey.” arXiv preprint arXiv:1911.02621 (2019).  

[2] Abou Khamis, Rana, M. Omair Shafiq, and Ashraf Matrawy. “Investigating resistance of deep learning-based ids against adversaries using min-max optimization.” In ICC 2020-2020 IEEE international conference on communications (ICC), pp. 1-7. IEEE, 2020.

[3] Abou Khamis, Rana, and Ashraf Matrawy. “Evaluation of adversarial training on different types of neural networks in deep learning-based idss.” In 2020 international symposium on networks, computers and communications (ISNCC), pp. 1-6. IEEE, 2020.

[4] Abou Khamis, Rana, and Ashraf Matrawy. “Could Min-Max Optimization be a General Defense Against Adversarial Attacks?.” In 2024 International Conference on Computing, Networking and Communications (ICNC), pp. 671-676. IEEE, 2024. 

[5] Shehaby, Mohamed el, and Ashraf Matrawy. “Adversarial Evasion Attacks Practicality in Networks: Testing the Impact of Dynamic Learning.” arXiv preprint arXiv:2306.05494 (2023).

[6] ElShehaby, Mohamed, and Ashraf Matrawy. “The Impact of Dynamic Learning on Adversarial Attacks in Networks (IEEE CNS 23 Poster).” In 2023 IEEE Conference on Communications and Network Security (CNS), pp. 1-2. IEEE, 2023.

[7] ElShehaby, Mohamed, Aditya Kotha, and Ashraf Matrawy. “Introducing Adaptive Continuous Adversarial Training (ACAT) to Enhance Machine Learning Robustness.” IEEE Networking Letters (2024).

[8] ElShehaby, Mohamed, Aditya Kotha, and Ashraf Matrawy. Adaptive Continuous Adversarial Training (ACAT) to Enhance ML-NIDS Robustness. TechRxiv (2024).

[9] Ibitoye, Olakunle, M. Omair Shafiq, and Ashraf Matrawy. “Differentially private self-normalizing neural networks for adversarial robustness in federated learning.” Computers & Security 116 (2022): 102631.

[10] elShehaby, Mohamed, and Ashraf Matrawy. “Introducing Perturb-ability Score (PS) to Enhance Robustness Against Evasion Adversarial Attacks on ML-NIDS.” arXiv preprint arXiv:2409.07448 (2024).

The post Using Machine Learning in Security and Privacy appeared first on Next Generation Networks Lab.

Many organizations were forced to quickly transition to the work-from-anywhere (WFA) model to continue their operations and remain in business despite the restrictions imposed during the COVID-19 pandemic. Many decisions were made in a rush, and cybersecurity decency tools were not in place to support this transition. This project aims to evaluate the cybersecurity awareness and readiness of organizations and their employees when they switch from on-site to remote work. Furthermore, this project aims to provide valuable insights that can help organizations and individuals take proactive steps to protect themselves and their employees from cybersecurity threats by identifying knowledge gaps, assessing employee behavior, evaluating security policies, identifying areas for improvement, and promoting best practices.

Mohammed Mahyoub, Ashraf Matrawy, Kamal Isleem, and Olakunle Ibitoye, (2023).  Cybersecurity Challenge Analysis of Work-from-Anywhere (WFA) and Recommendations guided by a User Study. Under review,  

The post Cybersecurity Challenge Analysis of Work-from-Anywhere (WFA) and Recommendations guided by a User Study appeared first on Next Generation Networks Lab.

Securing RPL Using Network Coding: The Chained Secure Mode (CSM)

Considered the preferred routing protocol for many Internet of Things (IoT) networks, the routing protocol for low power and lossy networks (RPL) incorporates three security modes to protect the integrity and confidentiality of the routing process: 1) the unsecured mode (UM); 2) preinstalled secure mode (PSM); and 3) the authenticated secure mode (ASM). Both PSM and ASM were originally designed to protect against external routing attacks, in addition to some replay attacks (through an optional replay protection mechanism). However, recent research showed that RPL, even when it operates in PSM, is still vulnerable to many routing attacks, both internal and external. In this article, a novel secure mode for RPL, the chained secure mode (CSM), is proposed using the concept of intraflow network coding (NC). The CSM is designed to enhance RPL’s resiliency and mitigation capability against replay attacks. In addition, CSM allows the integration with external security measures such as intrusion detection systems (IDSs). An evaluation of the proposed CSM, from a security and performance point of view, was conducted and compared against RPL in UM and PSM (with and without the optional replay protection) under several routing attacks: the neighbor attack (NA), wormhole (WH), and CloneID attack (CA), using average packet delivery rate (PDR), end-to-end (E2E) latency, and power consumption as metrics. It showed that CSM has better performance and more enhanced security than both the UMandPSMwiththereplay protection while mitigating both the NA and WH attacks and significantly reducing the effect of the CA in the investigated scenarios.

Raoof, C. -H. Lung and A. Matrawy, “Securing RPL Using Network Coding: The Chained Secure Mode (CSM),” in IEEE Internet of Things Journal, vol. 9, no. 7, pp. 4888-4898, 1 April 1, 2022, doi: 10.1109/JIOT.2021.3109109.1

Enhancing Routing Security in IoT: Performance Evaluation of RPL Secure Mode under Attacks

As the routing protocol for low power and lossy networks (RPL)s became the standard for routing in the Internet of Things (IoT) networks, many researchers had investigated the security aspects of this protocol. However, no work (to the best of our knowledge) has investigated the use of the security mechanisms included in RPL’s standard, mainly because there was no implementation for these features in any Internet of Things (IoT) operating systems yet. A partial implementation of RPL’s security mechanisms was presented recently for the Contiki operating system (by Perazzo et al.), which provided us with an opportunity to examine RPL’s security mechanisms. In this article, we investigate the effects and challenges of using RPL’s security mechanisms under common routing attacks. First, a comparison of RPL’s performance, with and without its security mechanisms, under four routing attacks [Blackhole, Selective-Forward (SF), Neighbor, and Wormhole (WH) attacks] is conducted using several metrics (e.g., average data packet delivery rate, average data packet latency, average power consumption, etc.). This comparison is performed using two commonly used radio duty cycle protocols. Second, and based on the observations from this comparison, we propose two techniques that could reduce the effects of such attacks without having added security mechanisms for RPL. An evaluation of these techniques shows improved performance of RPL under the investigated attacks, except for the WH.

Ahmed Raoof, Ashraf Matrawy, and Chung-Horng Lung, “Enhancing Routing Security in IoT: Performance Evaluation of RPL Secure Mode under Attacks,” IEEE Internet of Things Journal (Early Access), September 2020.

Routing Attacks and Mitigation Methods for RPL-Based Internet of Things

The recent bloom of the Internet of Things (IoT) and its prevalence in many security-sensitive environments made the security of these networks a crucial requirement. Routing in many of IoT networks has been performed using the routing protocol for low power and lossy networks (RPL), due to its energy-efficient mechanisms, secure modes availability, and its adaptivity to work in various environments; hence, RPL security has been the focus of many researchers. This paper presents a comprehensive study of RPL, its known attacks, and the mitigation methods proposed to counter these attacks. We conducted a detailed review of the RPL standard, including a recently proposed modification. Also, we investigated all recently published attacks on RPL and their mitigation methods through the literature. Based on this investigation, and to the best of our knowledge, we introduced a first-of-its-kind classification scheme for the mitigation methods that is based on the techniques used for the mitigation. Furthermore, we thoroughly discussed RPL-based intrusion detection systems (IDSs) and their classifications, highlighting the most recently proposed IDSs.

Ahmed Raoof, Ashraf Matrawy, and Chung-Horng Lung, “Routing Attacks and Mitigation Methods for RPL-Based Internet of Things,” IEEE Communications Surveys and Tutorials, (Early Access), December 2019.

On the Impact of the RPL Decreased Rank Attack on 6TiSCH Networks.

The 6TiSCH protocol stack was designed to provide a reliable and time-bound multi-hop routing solution for the Industrial Internet of Things (IIoT), integrating the IPv6 Routing Protocol for Low Power and Lossy Networks (RPL) and Time Slotted Channel Hopping (TSCH) protocols seamlessly. However, deviations from standard procedures by malicious nodes can severely affect network formation and operations, resulting in degraded performance. This study investigates the impact of the decreased rank attack (DRA) on RPL within the 6TiSCH network, examining its effects on network operations and performance. Experimental evaluation reveals that DRA can lead to an average delay of 21.4% in network formation and run time disruptions, thereby affecting the 6TiSCH synchronization process. Consequently, node departures from the network and subsequent rejoining to maintain the topology increase by an average of 60.71%. To deal with this disruption, the nodes need to send more keep-alive and RPL messages, resulting in an average increase of 69.70% and 20.08%, respectively, leading to a 49. 9% increase in energy depletion. Furthermore, the DRA reduces the packet delivery ratio and increases the average end-to-end packet delay by averages of 5.13% and 20%, respectively. However, it is important to note that the impact of the attack can vary significantly depending on the specific configurations and setups used, such as network topology, network size, attacker position, neighboring density, and RPL/TSCH parameter settings.

Mohammed Mahyoub, Sazzad Hossain, and Ashraf Matrawy (2024). On the Impact of the RPL Decreased Rank Attack on 6TiSCH Networks. Accepted at (2024 20th International Conference on the Design of Reliable Communication Networks (

Integrating 6LoWPAN Security with RPL Using the Chained Secure Mode Framework”, The 14th IEEE International Conference on Internet of Things, 2021.

The IPv6 over Low-powered Wireless Personal Area Network (6LoWPAN) protocol was introduced to allow the transmission of Internet Protocol version 6 (IPv6) packets using the smaller-size frames of the IEEE 802.15.4 standard, which is used in many Internet of Things (IoT) networks. The primary duty of the 6LoWPAN protocol is packet fragmentation and reassembly. However, the protocol’s standard currently does not include any security measures, not even authenticating the fragments’ immediate sender. This lack of immediate-sender authentication opens the door for adversaries to launch several attacks on the fragmentation process, such as the buffer-reservation attacks that lead to a Denial of Service (DoS) attack and resource exhaustion of the victim nodes. This paper proposes a security integration between 6LoWPAN and the Routing Protocol for Low Power and Lossy Networks (RPL) through the Chained Secure Mode (CSM) framework as a possible solution. Since the CSM framework provides a mean of immediate-sender trust, through the use of Network Coding (NC), and an integration interface for the other protocols (or mechanisms) to use this trust to build security decisions, 6LoWPAN can use this integration to build a chain of-trust along the fragments routing path. A proof-of-concept implementation was done in Contiki Operating System (OS), and its security and performance were evaluated against an external adversary launching a buffer-reservation attack. The results from the evaluation showed significant mitigation of the attack with almost no increase in power consumption, which presents the great potential for such integration to secure the forwarding process at 6LoWPAN Adaptation Layer.

A Raoof, CH Lung, A Matrawy, “Integrating 6LoWPAN Security with RPL Using the Chained Secure Mode Framework”, The 14th IEEE International Conference on Internet of Things, 2021.

Introducing Network Coding to RPL: The Chained Secure Mode (CSM)

The current standard of Routing Protocol for Low Power and Lossy Networks (RPL) incorporates three modes of security: the Unsecured Mode (UM), Preinstalled Secure Mode (PSM), and the Authenticated Secure Mode (ASM). While the PSM and ASM are intended to protect against external routing attacks through an optional replay protection mechanism, recent research showed that RPL in PSM is still vulnerable to many routing attacks, both internal and external. In this paper, we propose a novel secure mode for RPL, the Chained Secure Mode (CSM), based on the concept of intra-flow Network Coding. The main goal of CSM is to enhance RPL’s resilience against replay attacks, with the ability to mitigate some of them. The security and performance of a proof-of-concept prototype of CSM were evaluated and compared against RPL in UM and PSM (with and without the optional replay protection) in the presence of Neighbor attack as an example. It showed that CSM has better performance and more robustness and efficiency compared to both the UM and PSM with the replay protection. On the other hand, it showed a need for a proper recovery mechanism for the case of losing a control message.

Raoof, C. -H. Lung and A. Matrawy, “Introducing Network Coding to RPL: The Chained Secure Mode (CSM),” 2020 IEEE 19th International Symposium on Network Computing and Applications (NCA), 2020, pp. 1-4, doi: 10.1109/NCA51143.2020.9306744. January 2021

Secure Routing in IoT: Evaluation of RPL’s Secure Mode under Attacks

As the Routing Protocol for Low Power and Lossy Networks (RPL) became the standard for routing in the Internet of Things (IoT) networks, many researchers had investigated the security aspects of this protocol. However, no work (to the best of our knowledge) has investigated the use of the security mechanisms included in the protocol’s standard, due to the fact that there was no implementation for these features in any IoT operating system yet. A partial implementation of RPL’s security mechanisms was presented recently for Contiki operating system (by Perazzo et al.), which provided us with the opportunity to examine RPL’s security mechanisms. In this paper, we investigate the effects and challenges of using RPL’s security mechanisms under common routing attacks. First, a comparison of RPL’s performance, with and without its security mechanisms, under three routing attacks (Blackhole, Selective-Forward, and Neighbor attacks) is conducted using several metrics (e.g., average data packet delivery rate, average data packet delay, average power consumption… etc.) Based on the observations from this comparison, we come up with few suggestions that could reduce the effects of such attacks, without having added security mechanisms for RPL.

Ahmed Raoof, Ashraf Matrawy and Chung-Horng Lung, “Secure Routing in IoT: Evaluation of RPL’s Secure Mode under Attacks”, in Proc. of the IEEE Global Communications Conference (GLOBECOM 2019), Waikoloa, HI, USA, 9 – 13 December 2019.

The post Routing Protocol for Low Power and Lossy Networks (RPL) – Projects appeared first on Next Generation Networks Lab.

Investigating QUIC’s Suitability for the Internet of Things

QUIC is a connection-oriented, stateful, and flow-controlled transport protocol. Instead of identifying connections with IP addresses and port numbers, unique connection IDs are used — allowing for connections to persist after network changes or address re-mappings. QUIC packets consist of long or short headers followed by one or more frame types. Data is securely and reliably exchanged between endpoints. QUIC optionally allows 0-RTT connection establishment. Unlike with TCP, byte-streams can be logically isolated from one another through stream multiplexing. Loss of data on one stream does not affect any other streams, effectively minimizing Head-of-Line Blocking (HoLB). These characteristics prompted the move from TCP to QUIC for the of one of the most widely used protocols on the Internet — HTTP.

We investigate QUIC’s suitability as a transport protocol solution for the Internet of Things (IoT).

Bench-marking Quality of Experience Between HTTP/2 and HTTP/3 using Lighthouse [1]

We investigated an early implementation of HTTP/3 (whose underlying transport protocol is QUIC) against the more traditional HTTP/2 over TLSv1.3. Cloudflare’s QUICHE project delivered draft specification h3-27 support of HTTP/3 to our NGINX web-server. Our specific research focus was to gauge a user’s Quality of Experience (QoE) when it came to either protocol on a web browser. While other research has solely measured Page Load Time (PLT), our study levered Google’s Lighthouse – an open-source and metric diverse auditing tool. PLT only captures a single point in time and does not tell the full QoE story – especially for modern websites with various media sources, objects, and stylesheets. Rather, our investigation included commentary on First Contentful Paint, Time to Interactive, Speed Index, Largest Contentful Paint, Total Blocking Time, and Cumulative Layout Shift. Further, NetEm was used to emulate different network impairments while we collected Lighthouse metric data for HTTP/3 and HTTP/2. We found that this early implementation of HTTP/3 fared mostly worse than HTTP/2 in terms of QoE.

A Pure HTTP/3 Alternative to MQTT-over-QUIC in Resource-Constrained IoT [2]

To address the issue of scalable, interoperable, and timely dissemination of information in resource-constrained IoT, we propose an HTTP/3 publish-subscribe solution. Other works have migrated applications like MQTT to run over QUIC, citing the need to change critical APIs and data structures. We hypothesized that i.) because of HTTP/3’s native support with QUIC in various libraries, it may take better advantage of QUIC’s full feature-set and ii.) QUIC features such as 0-RoundTrip-Time (RTT) and QPACK header compression will help HTTP be a viable publish-subscribe solution. Performance, network overhead, and device overhead were investigated for our solution as well as an open-source MQTT-over-QUIC implementation. Network conditions according to the NarrowBand-IoT (NB-IoT) standard were considered. Our HTTP/3-based solution satisfied our timely dissemination requirement by offering a key performance savings of 1-RTT for published messages to arrive at the broker. In IoT networks, with typically high RTT, this savings is significant. On the other hand, we found that MQTT-over-QUIC was marginally more frugal in terms of resource consumption.

Tuning QUIC-Based Publish-Subscribe Architectures in IoT [3]

Since IoT greatly differs from traditional networks in terms of architecture and resources, IoT specific parameter tuning has proven to be of significance. While RFC 9006 offers a guideline for tuning TCP within IoT, we have not found an equivalent for QUIC. This paper is the first of our knowledge to contribute empirically based insights towards tuning QUIC for IoT. We improved our pure HTTP/3 publish-subscribe architecture and rigorously benchmarked it against an alternative: MQTT-over-QUIC. To investigate the impact of transport-layer parameters, we ran both applications on Raspberry Pi Zero hardware. Eight metrics were collected while emulating different network conditions and message payloads. We enumerate the points we experimentally identified (notably, relating to authentication, MAX_STREAM frames, and timers) and elaborate on how they can be tuned to improve resource consumption and performance. Our application offered lower latency than MQTT-over-QUIC with slightly higher resource consumption, making it preferable for reliable time-sensitive dissemination of information.

Mass Configuration of Heterogeneous IIoT Nodes: A Proposal and Experimental Evaluation [4]

Securely managing IoT devices is a fundamental challenge. Management protocols for IoT must be scalable and extensible, especially when dealing with device heterogeneity. Because of device resource limitations in IoT and the sheer size of such networks, traditional management protocols may not be well-suited. In this paper, we propose our HTTP/3 publish-subscribe architecture to meet the ends of en masse device configuration, on-boarding, and monitoring. We compared our solution to industry-standard protocols by collecting data from real traffic in networks of up to 500 clients. We found our solution to excel in ease of use and performance, while having slightly higher CPU utilization compared to the other protocols.

Trimming the Fat: Introducing QUIC Thin-Apps for the Internet of Things [5]

Researchers have proposed variants of application-layer protocols such as MQTT, CoAP, and AMQP all using QUIC transport. In this paper, we aim to show that since QUIC is so feature-rich on its own, many of the upper-layer complexities of traditional protocols can be greatly reduced or even eliminated. To exemplify this, we have designed what we call a ‘QUIC thin-app’ for IoT relying almost entirely on QUIC’s specification. We achieved comparable functionality to MQTT, doing away with the need for much of its control messaging. Furthermore, our experimentation with our solution against MQTTv5 shows significant reductions in signaling overhead while maintaining comparable CPU and memory utilization.

References

[1] D. Saif, C. -H. Lung and A. Matrawy, “An Early Benchmark of Quality of Experience Between HTTP/2 and HTTP/3 using Lighthouse,” ICC 2021 – IEEE International Conference on Communications, Montreal, QC, Canada, 2021, pp. 1-6, doi: 10.1109/ICC42927.2021.9500258.

[2] D. Saif and A. Matrawy, “A Pure HTTP/3 Alternative to MQTT-over-QUIC in Resource-Constrained IoT,” 2021 IEEE Conference on Standards for Communications and Networking (CSCN), Thessaloniki, Greece, 2021, pp. 36-39, doi: 10.1109/CSCN53733.2021.9686113.

[3] D. Saif and A. Matrawy, “An Experimental Investigation of Tuning QUIC-Based Publish–Subscribe Architectures in IoT,” in IEEE Internet of Things Journal, vol. 11, no. 3, pp. 4924-4933, 1 Feb.1, 2024, doi: 10.1109/JIOT.2023.3302160.

[4] D. Saif and A. Matrawy, “Mass Configuration of Heterogeneous IIoT Nodes: A Proposal and Experimental Evaluation,” 2024 International Conference on Computing, Networking and Communications (ICNC), Big Island, HI, USA, 2024, pp. 932-937, doi: 10.1109/ICNC59896.2024.10556270.

[5] D. Saif, A. Matrawy, â€œTrimming the Fat: Introducing QUIC Thin-Apps for the Internet of Things,” TechRxiv Preprint. November 12, 2024, doi: 10.36227/techrxiv.173143070.04378246/v1

The post Investigating QUIC’s Suitability for the Internet of Things appeared first on Next Generation Networks Lab.

Privacy Engineering in Smart Home (SH) Systems: A Comprehensive Privacy Threat Analysis and Risk Management Approach

Addressing privacy concerns in Smart Home (SH) systems is essential, however, more research is needed in analyzing and evaluation of privacy threats for effective risk management. Although there has been some research on privacy in SH, most existing research primarily focuses on user privacy, while often neglecting the importance privacy of device data especially device identity privacy. This oversight can significantly impact overall user privacy within the SH system. This study incorporates privacy engineering (PE) principles into SH systems, considering user and device data privacy. We have developed a comprehensive reference model for a typical SH system, shown in Figure 1.  

Using the initial stage (Model the system) of the framework for privacy engineering, we present a data flow diagram (DFD) based on this reference model to enhance our understanding of how SH systems operate. 

We utilize the LINDDUN PRO threat model to identify potential privacy threats and conduct a privacy threat analysis (PTA) which the second stage (Elicit threat). After this, we conduct a privacy impact assessment (PIA) to manage privacy risks by prioritizing threats based on their likelihood of occurrence and potential impact. Finally, we recommend various privacy-enhancing techniques (PETs) that can help mitigate these threats which concluded the last stage (manage threats) of the LINDDUN PE PRO framework. 

This approach expresses the correlation between Privacy engineering (PE), privacy threat analysis (PTA), and privacy impact assessment (PIA). 

Alalade, E. D., Mahyoub, M., & Matrawy, A. (2024). . arXiv preprint arXiv:2401.09519. 

The post Privacy in IoT Systems appeared first on Next Generation Networks Lab.

We study the security of 5G mobile networks and securing 5G using slice isolation. Following are our recent projects on 5G security: 

Security Analysis of Critical 5G Interfaces 

In this work, we investigate the interfaces-specific security recommendations presented by most active Standardization Development Organizations (SDOs), analyze the potential security gaps, characterize threats caused by such gaps, and categorize those threats according to the Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege (STRIDE) model. To the best of our knowledge, our work is the first to conduct a 5G security analysis from the perspective of network architecture. 

[1] Mahyoub, M., AbdulGhaffar, A., Alalade, E., Ndubisi, E. and Matrawy, A., 2024. . IEEE Communications Surveys & Tutorials.

A STRIDE Threat Model for 5G Core Slicing

In this research, we use the STRIDE threat modeling methodology to analyze risks associated with 5G slicing. We focus solely on the advent of network slicing, which is the ability to allocate a virtual “slice” of the network to a client and optimize the features of the slice to the specific needs of the client without impacting other slices. Our threat model is exclusively concerned with identifying threats to 5G slicing and supporting network infrastructure. Threats from previous cellular generations are also included if they are specifically a threat to 5G slicing.

[2] Sattar, D., Vasoukolaei, A.H., Crysdale, P. and Matrawy, A., 2021, October. . In 2021 IEEE 4th 5G World Forum (5GWF) (pp. 247-252). IEEE.

A Security-aware Network Function Sharing Model for 5G Slicing

Sharing Virtualized Network Functions (VNFs) among different slices in the 5G is a potential strategy to simplify the system implementation and utilize 5G resources efficiently. In this research, we propose a security-aware VNF-sharing model for 5G networks. The proposed optimization model satisfies the service requirements of various slices, enhances slice security by isolating their critical VNFs, and enhances resource utilization of the underlying physical infrastructure. The model tries to systematically decide on sharing a particular VNF based on the novel security constraints that we propose in this work; the maximum traffic allowed to be processed by the VNF and the exposure of the VNF to procedures sourced via untrusted users or access networks. This sharing problem is formalized to allow for procedure-level modeling that satisfies the requirements of slice requests in 5G systems. The model is tested using standard VNFs and procedures of the 5G system rather than generic ones. The numerical results of the model show the benefits and costs of applying the security constraints along with the network performance in terms of different metrics.

[3] Mahyoub, M., AbdulGhaffar, A., Alalade, E. and Matrawy, A., 2023. . arXiv preprint arXiv:2303.03492.

On the Impact of Flooding Attacks on 5G Slicing with Different VNF Sharing Configurations

The key motivation for this work is to study the impact of flooding attacks on the performance of 5G slices with different VNF sharing configurations. We consider two VNF sharing configurations, in the first configuration, the Session Management Function (SMF) and User Plane Function (UPF) are shared among the deployed slices, while the SMF and UPF of the slices are isolated in the second configuration. The performance of these configurations is evaluated using different traffic types under two flooding attack scenarios; a ping flood attack targeting the data plane of the 5G network, and a registration request flood attack directed at the control plane of the 5G network. Our results showed different responses in the control and data planes. In the data plane, isolating VNFs of the slices provides better performance and mitigates the adverse effects of the attacks studied.

[4] AbdulGhaffar, A., Mahyoub, M. and Matrawy, A., 2024, May. . In 2024 20th International Conference on the Design of Reliable Communication Networks (DRCN) (pp. 136-142). IEEE.

A Study of XR Traffic Characteristics Under Flooding Attacks on 5G Slicing

In this research, we examine the characteristics of Extended Reality (XR) traffic across several 5G slicing configurations in the presence of attacks, including ping flood, User Datagram Protocol (UDP) flood, and registration flood attacks. The primary contribution of our research is the analysis of the impact of these different attacks on the XR traffic using different slice configurations. The results indicate the effects of the different attacks on XR traffic in terms of reducing the traffic throughput (Mbps) and the changes in the XR traffic characteristics in the different slice configurations. Also, the isolation of the Virtual Network Functions (VNFs) in the user plane provides better performance in the presence of these attacks.

[5] Husseinat, A.A., AbdulGhaffar, A. and Matrawy, A., 2024. . Authorea Preprints.

The post Securing 5G Using Slice Isolation appeared first on Next Generation Networks Lab.

The key motivation for this work is that future smart services (e.g. IoT applications) will have competing and perhaps conflicting networking performance requirements. These services will also require flexible and agile deployment. 5G networks, an essential component of future virtualized infrastructures, deal with this issue – in part – by relying on network slicing. To define a network slice, one has to consider the allocation of recourses – both in the radio and core parts – of the 5G network to form a logical entity where a service could be deployed. Network slicing has emerged as a key-enabler for proving heterogeneous services. It takes advantage of the virtualization elements of future networking infrastructures where multiple services can be hosted on the same physical infrastructure.

A shift in the mobile network paradigm also mandates changes in the security architecture with new security challenges that do not exist in the past or present mobile networks. In the current mobile network, if an attacker launches flooding Distributed Denial of Service (DDoS) attack against a mobile service, only that service will be affected, and there is a very low risk of host resource starvation-based attacks in current mobile networks (i.e., usually mobile network infrastructure is not virtualized). However, in a 5G network, a DDoS against one slice might affect other services because they could be tenants of the same shared virtualized infrastructure. An important requirement for 5G network slicing is isolation.

Slice Allocation:

Two key challenges of 5G network slicing are function isolation (intra-slice) and guaranteeing end-to-end delay for a slice. In this work, we address the question of optimal allocation of a slice in 5G core networks by addressing these two challenges. We create a model that satisfies constraints on end-to-end delay as well as isolation between components of a slice for reliability.

[1] D. Sattar and A. Matrawy, “,” in IEEE Networking Letters, vol. 1, no. 2, pp. 48-51, June 2019.

DDoS Mitigation using Slice isolation:

In this research, we address the issue of DDoS attacks in 5G network slicing. In 5G virtualized network, multiple tenants will share the same physical resources. A DDoS attack on one slice could disrupt the services hosted on other slices. We try to mitigate the Distributed Denial-of-Service (DDoS) attacks using slice isolation (i.e., inter-slice and intra-slice isolation).

Inter-slice isolation provides mitigation against the DDoS attacks because the hardware resources are not shared between the slices and DDoS on one slice does not impact the other slices. Whereas intra-slice isolation provides better availability for the slices since the components of the slice are hosted on different hosts. Enabling intra-slice isolation could reduce the impact of DDoS attack and increase the availability of the target slice as well as faster recovery of the service because the slice operator may not need to deploy reactive mitigation defense for all slices (e.g., migrating only affected slices).

[2.] D. Sattar and A. Matrawy, “,” to appear in 7th Annual IEEE Conference on Communications and Network Security (CNS 2019), June 2019.

DSAF: Dynamic Slice Allocation Framework for 5G Core Network:

To automate the process of slice allocation in 5G core network, we propose a framework. In the proposed framework, slices can be allocated and deallocated dynamically [3]. The Dynamic Slice Allocation Framework (DSAF) consists of five components as shown in Fig. 2.
[3.] D. Sattar and A. Matrawy, “,” CoRR, vol. abs/1905.03873, 2019.

The post Secure 5G Core Network Slicing in Support of IoT Application appeared first on Next Generation Networks Lab.

In this research, we address resourced-constrained mobile devices’ ability to get computing support from external sources. This could enhance the performance of their applications and extend their battery life by resource augmentation techniques where more powerful computing sources support the mobile devices. We investigate this in the context of both Cyber Foraging Systems where supporting computing sources exist within the local network and Mobile Cloud environment where these sources exist in the cloud.

Journal papers

M. Nir, A. Matrawy, and M. St-Hilaire, “Economic and Energy Considerations for Resource Augmentation in Mobile Cloud Computing”, accepted (2015) for publication in .

Invited talks

A. Matrawy, “Challenges in Resource Augmentation for Mobile Environments”, Presentation given twice at Simon Fraser University’s School of Engineering Science  and at the University of Victoria’s Department of Computer Science . Both presentations were hosted by 

Conference papers and refereed presentations

M. Nir, A. Matrawy, and M. St-Hilaire, “Challenges of Task Offloading in Mobile Cloud Computing Environments”, A presentation (refereed on abstract) to the 56th Canadian Operational Research Society (CORS) Annual Conference, Ottawa, ON, Canada, May 2014. M. Nir, A. Matrawy, and M. St-Hilaire , Proc. of the 28th IEEE International Conference on Advanced Information Networking and Applications (AINA-2014), Victoria, BC, May 2014 M. Nir, A. Matrawy, and M. St-Hilaire , Proc. of the IEEE INFOCOM Workshop on Mobile Cloud Computing, Toronto, ON, April 2014 M. Nir and A. Matrawy, , Proc. of the 4th International Conference on Emerging Ubiquitous Systems and Pervasive Networks (EUSPN-2013), Niagara Falls, ON, November 2013. M. Nir and A. Matrawy, , Proc. of the 14th International Symposium on Multimedia Network Systems and Applications (MNSA-2012), Victoria, BC, November 2012.

The post Resource augmentation in Mobile Cloud Computing appeared first on Next Generation Networks Lab.