@conference {
	title = {Performance Evaluation and Trade-Offs of Optimal Back-Off Misbehavior Detection Schemes in Wireless Networks in the Presence of Interference},
	author = {Radosavac, Svetlana., Baras, John S.},
	year = {2008},
	month = {10/2008},
	abstract = {In this work, we evaluate the impact of interference caused by concurrent transmissions of neighboring stations on the performance of quickest detection schemes for detection of back-off misbehavior in the IEEE 802.11 MAC. We evaluate the trade-offs that both the adversary and the detector face under such conditions using a game theoretic framework. Furthermore, we evaluate the worst-case scenarios under which the given detector can efficiently operate under the predetermined conditions and show by both mathematical analysis and simulation how the presence of uncertainty affects the performance of the detector. Finally, we conclude that in the presence of (i) adaptive intelligent adversaries and (ii) variable environment conditions, the adoption of a static detection system is not advisable and propose employment of an adaptive detection system in order to maintain satisfying performance under a wide range of conditions.},
	address = {Athens, Greece},
	booktitle = {Valuetools 2008},
	pages = {pp. 1-10}
}
@conference {
	title = {Intrusion Detection System Resiliency to Byzantine Attacks: The Case Study of Wormholes in OLSR},
	author = {Baras, John S., Radosavac, Svetlana., Theodorakopoulos, George., Sterne, Dan., Budulas, Peter., Gopaul, Richard.},
	year = {2007},
	month = {10/2007},
	abstract = {In this paper, we extend the work presented in [1] by quantifying the effects of in-band wormhole attacks on Intrusion Detection Systems. More specifically, we propose a mathematical framework for obtaining performance bounds of Byzantine attackers and the Intrusion Detection System (IDS) in terms of detection delay. We formulate the problem of distributed collaborative defense against coordinated attacks in MANET as a dynamic game problem. In our formulation, we have on the one hand a group of attackers that observe what is going on in the network and coordinate their attack in an adaptive manner. On the other side, we have a group of defending nodes (the IDS nodes) that collaboratively observe the network and coordinate their actions against the attackers. Using extensions of the game theoretic framework of [2] we provide a mathematical framework for efficient identification of the worst attacks and damages that the attackers can achieve, as well as the best response of the defenders. This approach leads to quantifying resiliency of the routing-attack IDS with respect to Byzantine attacks.},
	address = {Orlando, FL},
	booktitle = {2007 Military Communication Conference},
	pages = {pp. 1-7}
}
@conference {
	title = {Performance Comparison of Detection Schemes for MAC Layer Misbehavior},
	author = {Cardenas, Alvaro A., Radosavac, Svetlana., Baras, John S.},
	year = {2007},
	month = {05/2007},
	abstract = {This paper revisits the problem of detecting greedy behavior in the IEEE 802.11 MAC protocol by evaluating the performance of two previously proposed schemes: DOMINO and the Sequential Probability Ratio Test (SPRT). The evaluation is carried out in four steps. We first derive a new analytical formulation of the SPRT that takes into account the discrete nature of the problem. Then we develop a new tractable analytical model for DOMINO. As a third step, we evaluate the theoretical performance of SPRT and DOMINO with newly introduced metrics that take into account the repeated nature of the tests. This theoretical comparison provides two major insights into the problem: it confirms the optimality of SPRT and motivates us to define yet another test, a nonparametric CUSUM statistic that shares the same intuition as DOMINO but gives better performance.We finalize the paper with experimental results, confirming our theoretical analysis and validating the introduction of the new nonparametric CUSUM statistic.},
	address = {Anchorage, Alaska},
	booktitle = {Proceedings of the 26th Annual IEEE Conference on Computer Communications (Infocom)},
	pages = {pp. 1496-1504}
}
@conference {
	title = {Detecting IEEE 802.11 MAC Layer Misbehavior in Ad Hoc Networks},
	author = {Radosavac, Svetlana., Cardenas, Alvaro A., Baras, John S., Moustakides, George V.},
	year = {2007},
	month = {01/2007},
	abstract = {Selfish behavior at the Medium Access (MAC) Layer can have devastating side effects on the performance of wireless networks, with effects similar to those of Denial of Service (DoS) attacks. In this paper we consider the problem of detection and prevention of node misbehavior at the MAC layer, focusing on the back-off manipulation by selfish nodes. We first propose an algorithm that ensures honest behavior of non-colluding participants. Furthermore, we analyze the problem of colluding selfish nodes, casting the problem within a minimax robust detection framework and providing an optimal detection rule for the worst-case attack scenarios. Finally, we evaluate the performance of single and colluding attackers in terms of detection delay. Although our approach is general and can be used with any probabilistic distributed MAC protocol, we focus our analysis on the IEEE 802.11 MAC.},
	booktitle = {Robust Strategies Against Individual and Colluding Attacker\&quot; Journal of Computer Security: Special Issue on Security of Ad Hoc and Sensor Networks},
	pages = {pp. 103-128}
}
@conference {
	title = {Detection and Performance Analysis of Greedy Individual and Colluding MAC Layer Attackers},
	author = {Radosavac, Svetlana., Baras, John S.},
	year = {2006},
	month = {11/2006},
	abstract = {Selfish behavior at the Medium Access (MAC) Layer can have devastating side effects on the performance of wireless networks, with effects similar to those of Denial of Service (DoS) attacks. In this paper we consider the problem of misbehavior detection at the MAC layer, focusing on the back-off manipulation by colluding selfish nodes. We cast the problem within a minimax robust detection framework, providing a detection rule of optimum performance for the worst-case attack. We analyze the effects of a single optimal attacker with respect to the detection delay and average number of backoff slots and compare them with the effects of colluding attackers.},
	address = {Myconos, Greece},
	booktitle = {2006 Information Society Technologies Conference}
}
@conference {
	title = {Impact of Optimal MAC Layer Attacks on the Network Layer},
	author = {Radosavac, Svetlana., Baras, John S., Moustakides, George V.},
	year = {2006},
	month = {10/2006},
	abstract = {Node misbehavior in wireless ad hoc networks leads to sudden unpredictable changes in network topology, resulting in fluctuation of traffic load and capacity for already existing links. In this work we consider node misbehavior in the Medium Access Control (MAC) layer and its effects on the performance of the network layer. In order to capture uncertainty of the attacker{\textquoteright}s strategy as well as the unpredictable nature of the wireless medium, we quantify the optimal attack strategy by using the principle of minimum cross entropy. Following that, we apply the obtained results for analysis of the IEEE 802.11 DCF MAC protocol and investigate the effects of such optimal attacks on the network layer. Finally, we evaluate the robustness of two different routing protocols against the worst-case MAC layer attacks and justify the need for the MAC layer-based Intrusion Detection Systems (IDS).},
	address = {Alexendria, VA},
	booktitle = {Fourth ACM Workshop on Security of Ad Hoc and Sensor Networks (SASN 2006)},
	pages = {pp. 135-145}
}
@conference {
	title = {bufSTAT - A Tool for Early Detection and Classification of Buffer Overflow Attacks},
	author = {Radosavac, Svetlana., Seamon, Karl., Baras, John S.},
	year = {2005},
	month = {09/2005},
	abstract = {Buffer overflows constitute by far the most frequently encountered class of attacks against computer systems. In this paper we introduce a tool, termed bufSTAT that achieves a low probability of false alarm and issues early attack warnings. BufSTAT relies on Finite State Machines (FSM) for attack modeling and can detect every stage of an ongoing attack and can thus prevent its execution by issuing early warning in a progressive manner. It can also detect sophisticated multi-stage attacks that are executed over long periods of time. A significant attribute of our approach is that it is amenable to detecting unknown attacks as well after appropriate modification of bufSTAT.},
	address = {Athens, Greece},
	booktitle = {First International Conference on Security and Privacy for Emerging Areas in Communication Networks}
}
@conference {
	title = {A Framework for MAC Protocol Misbehavior Detection in Wireless Networks},
	author = {Radosavac, Svetlana., Baras, John S., Koutsopoulos, Iordanis. },
	year = {2005},
	month = {09/2005},
	abstract = {The pervasiveness of wireless devices and the architectural organization of wireless networks in distributed communities, where no notion of trust can be assumed, are the main reasons for the growing interest in the issue of compliance to protocol rules. Reliable and timely detection of deviation from legitimate protocol operation is recognized as a prerequisite for ensuring efficient and fair use of network resources and minimizing performance losses. Nevertheless, the random nature of protocol operation together with the inherent difficulty of monitoring in the open and highly volatile wireless medium poses significant challenges. In this paper, we consider the fundamental problem of detection of node misbehavior at the MAC layer. Starting from a model where the behavior of a node is observable, we cast the problem within a minimax robust detection framework, with the objective to provide a detection rule of optimum performance for the worst-case attack. The performance is measured in terms of required number of observations in order to derive a decision. This framework is meaningful for studying misbehavior because it captures the presence of uncertainty of attacks and concentrates on the attacks that are most significant in terms of incurred performance losses. It also refers to the case of an intelligent attacker that can adapt its policy to avoid being detected. Although the basic model does not include interference, we show that our ideas can be extended to the case where observations are hindered by interference due to concurrent transmissions. We also present some hints for the problem of notifying the rest of the network about a misbehavior event. Our work provides interesting insights and performance bounds and serves as a prelude to a future study that would capture more composite instances of the problem.},
	address = {Cologne, Germany},
	booktitle = {4th ACM Workshop on Wireless Security,},
	pages = {pp. 33-42}
}
@conference {
	title = {Detection and Prevention of MAC Layer Misbehavior in Ad Hoc Networks},
	author = {Cardenas, Alvaro A., Radosavac, Svetlana., Baras, John S.},
	year = {2004},
	month = {10/2004},
	abstract = {Selfish behavior at the MAC layer can have devastating side effects on the performance of wireless networks, similar to the effects of DoS attacks. In this paper, we focus on the prevention and detection of the manipulation of the backoff mechanism by selfish nodes in 802.11. We first propose an algorithm to ensure honest backoffs when at least one, either the receiver or the sender is honest. Then we discuss detection algorithms to deal with the problem of colluding selfish nodes. Although we have focused on the MAC layer of 802.11, our approach is general and can serve as a guideline for the design of any probabilistic distributed MAC protocol.},
	address = {Washington DC},
	booktitle = {2nd ACM workshop on Security of ad hoc and sensor networks},
	pages = {pp. 17-22}
}
@conference {
	title = {Attacks and Defenses Utilizing Cross-Layer Interactions in MANET},
	author = {Baras, John S., Radosavac, Svetlana.},
	year = {2004},
	month = {06/2004},
	abstract = {Cross-layer protocol design is one of the prevailing methodologies that have recently been adopted in networking research and leads to significant performance benefits. In this study,we assess the performance of cross-layer interaction and investigate its effects with regard to security and information assurance of mobile ad hoc wireless networks. Using attacks in realistic wireless networks as a prototype, we find that natural cross-layer interactions between physical, MAC and network layer protocols in MANET can turn out to be a weak point, causing various attacks and intrusions. However, by allowing a controlled synergy between layers affected by attacks, we facilitate timely detection of such attacks that are otherwise difficult to detect and may have devastating effects on network functionality and operation.},
	address = {Washington DC},
	booktitle = {Workshop on Cross-Layer Issues in the Design of Tactical Mobile Ad Hoc Wireless Networks: Integration of Communication and Networking Functions to Support Optimal Information Management},
	organization = {Naval Research Laboratory}
}
@conference {
	title = {Cross-Layer Attacks in Wireless Ad-Hoc Networks},
	author = {Radosavac, Svetlana., Benammar, Nassir., Baras, John S.},
	year = {2004},
	month = {03/2004},
	abstract = {Denial of Service (DoS) attacks are difficult to prevent and protect against. In this paper we focus on DoS attacks in wireless ad hoc networks that propagate from MAC to routing layer, causing breaking of critical routes. We present several traffic patterns that an intelligent attacker can generate to cause Denial of Service attack in one or several nodes in ad hoc networks. More specifically, we focus on the properties of IEEE 802.11 MAC protocol and attack propagation to the routing layer. We focus on attacks that use low-rate traffic patterns with the goal of disabling one or more specific nodes or partitioning the network. We propose a scheme for attack detection based on modelling of MAC protocols using Extended Finite State Machines (EFSM) and present general outline for an Intrusion Detection System that has the ability to generate attack patterns and check the validity of communication patterns in the network.},
	address = {Princeton, New Jersey},
	booktitle = {Proceedings of 38th Conference on Information Sciences and Systems - CISS 2004,},
	pages = {pp. 1266-1271}
}
@conference {
	title = {Detection and Classification of Network Intrusions Using Hidden Markov Models},
	author = {Radosavac, Svetlana., Baras, John S.},
	year = {2003},
	month = {03/2003},
	abstract = {This paper demonstrates that it is possible to model attacks with a low number of states and classify them using Hidden Markov Models with very low False Alarm rate and very few False Negatives. We also show that the models developed can be used for both detection and classification. We put emphasis on detection and classification of network intrusions and attacks using Hidden Markov Models and training on anomalous sequences. We test several algorithms, apply different rules for classification and evaluate the relative performance of these. Several of the attack examples presented exploit buffer overflow vulnerabilities, due to availability of data for such attacks. We emphasize that the purpose of our algorithms is not only the detection and classification of buffer overflows; they are designed for detecting and classifying a broad range of attacks.},
	address = {Baltimore, Maryland},
	booktitle = {37th Conference on Information Sciences and Systems (CISS)},
	organization = {Johns Hopkins University}
}
@article {
	title = {Evaluation of Detection Algorithms for MAC Layer Misbehavior: Theory and Experiments},
	author = {Cardenas, Alvaro A., Radosavac, Svetlana., Baras, John S.},
	year = {2009},
	month = {04/2009},
	abstract = {We revisit the problem of detecting greedy behavior in the IEEE 802.11 MAC protocol by evaluating the performance of two previously proposed schemes: DOMINO and the Sequential Probability Ratio Test (SPRT). Our evaluation is carried out in four steps. We first derive a new analytical formulation of the SPRT that considers access to the wireless medium in discrete time slots. Then, we introduce an analytical model for DOMINO. As a third step, we evaluate the theoretical performance of SPRT and DOMINO with newly introduced metrics that take into account the repeated nature of the tests. This theoretical comparison provides two major insights into the problem: it confirms the optimality of SPRT and motivates us to define yet another test: a nonparametric CUSUM statistic that shares the same intuition as DOMINO but gives better performance. We finalize the paper with experimental results, con- firming the correctness of our theoretical analysis and validating the introduction of the new nonparametric CUSUM statistic.},
	pages = {pp. 605-617},
	volume = {Vol. 17},
	number = {No 2},
	journal = {IEEE/ACM Transactions on Networking (TON)}
}
@article {
	title = {An Analytic Framework for Modeling and Detecting Access Layer Misbehavior in Wireless Networks},
	author = {Radosavac, Svetlana., Moustakides, George V., Baras, John S., Koutsopoulos, Iordanis. },
	year = {2008},
	month = {07/2008},
	abstract = {The widespread deployment of wireless networks and hot spots that employ the IEEE 802.11 technology has forced network designers to put emphasis on the importance of ensuring efficient and fair use of network resources. In this work, we propose a novel framework for detection of intelligent adaptive adversaries in the IEEE 802.11 MAC by addressing the problem of detection of the worst-case scenario attacks. Utilizing the nature of this protocol we employ sequential detection methods for detecting greedy behavior and illustrate their performance for detection of least favorable attacks. By using robust statistics in our problem formulation, we attempt to utilize the precision given by parametric tests, while avoiding the specification of the adversarial distribution. This approach establishes the lowest performance bound of a given Intrusion Detection System (IDS) in terms of detection delay and is applicable in online detection systems where users who pay for their services want to obtain the information about the best and the worst case scenarios and performance bounds of the system. This framework is meaningful for studying misbehavior due to the fact that it does not focus on specific adversarial strategies and therefore is applicable to a wide class of adversarial strategies.},
	pages = {pp. 19.1 - 19.28},
	volume = {Vol. 11},
	number = {Issue 4, Article 19},
	journal = {ACM Transactions on Information and System Security}
}
@article {
	title = {Application of Sequential Detection Schemes for Obtaining Performance Bounds of Greedy Users in the IEEE 802.11 MAC},
	author = {Radosavac, Svetlana., Baras, John S.},
	year = {2008},
	month = {02/2008},
	abstract = {The widespread deployment of wireless networks and hot spots that employ the IEEE 802.11 technology has forced network designers to put emphasis on the importance of ensuring efficient and fair use of network resources. In order to be able to evaluate the performance of the adversary, we define a set of security guarantees and requirements for an intrusion detection system and precisely define an adversary model. We then apply the proposed model for defining performance bounds of the worst case adversary and the quickest detection IDS in the IEEE 802.11 MAC.},
	pages = {pp. 148-154},
	volume = {Vol. 46},
	journal = {IEEE Communications Magazine special issue on Security in Mobile Ad Hoc and Sensor Networks}
}
@article {
	title = {Application of Sequential Detection Schemes for Obtaining Performance Bounds of Greedy Users in the IEEE 802.11 MAC},
	author = {Radosavac, Svetlana., Baras, John S.},
	year = {2008},
	month = {02/2008},
	abstract = {The widespread deployment of wireless networks and hot spots that employ the IEEE 802.11 technology has forced network designers to put emphasis on the importance of ensuring efficient and fair use of network resources. In order to be able to evaluate the performance of the adversary, we define a set of security guarantees and requirements for an intrusion detection system and precisely define an adversary model. We then apply the proposed model for defining performance bounds of the worst-case adversary and the quickest detection IDS in the IEEE 802.11 MAC.},
	pages = {pp. 148-154},
	volume = {Vol. 46},
	journal = {IEEE Communications Magazine special issue on Security in Mobile Ad Hoc and Sensor Networks}
}
@article {
	title = {Detecting IEEE 802.11 MAC Layer Misbehavior in Ad Hoc Networks: Robust Strategies Against Individual and Colluding Attackers},
	author = {Radosavac, Svetlana., Cardenas, Alvaro A., Baras, John S., Moustakides, George V.},
	year = {2007},
	month = {01/2007},
	abstract = {Selfish behavior at the Medium Access (MAC) Layer can have devastating side effects on the performance of wireless networks, with effects similar to those of Denial of Service (DoS) attacks. In this paper we consider the problem of detection and prevention of node misbehavior at the MAC layer, focusing on the back-off manipulation by selfish nodes. We first propose an algorithm that ensures honest behavior of non-colluding participants. Furthermore, we analyze the problem of colluding selfish nodes, casting the problem within a minimax robust detection framework and providing an optimal detection rule for the worst-case attack scenarios. Finally, we evaluate the performance of single and colluding attackers in terms of detection delay. Although our approach is general and can be used with any probabilistic distributed MAC protocol, we focus our analysis on the IEEE 802.11 MAC.},
	pages = {pp.  103-128},
	volume = {Vol. 15},
	number = {No. 1},
	journal = {Journal of Computer Security: Special Issue on Security of Ad Hoc and Sensor Networks}
}
@techreport {
	title = {Detection of Greedy Individual and Colluding MAC Layer Attackers},
	author = {Radosavac, Svetlana., Cardenas, Alvaro A., Moustakides, George V.},
	year = {2006},
	month = {01/2006},
	abstract = {Selfish behavior at the Medium Access (MAC) Layer can have devastating side effects on the performance of wireless networks, with effects similar to those of Denial of Service (DoS) attacks. In this paper we consider the problem of detection and prevention of node misbehavior at the MAC layer, focusing on the back-off manipulation by selfish nodes. We propose an algorithm that ensures honest behavior of non-colluding participants. Furthermore, we analyze the problem of colluding selfish nodes, casting the problem within a minimax robust detection framework, providing a detection rule of optimum performance for the worst-case attack. Finally, we compare the effects of colluding attackers with a single attacker in terms of the detection delay. Although our approach is general and can serve as a guideline for the design of any probabilistic distributed MAC protocol, we focus our analysis on the IEEE 802.11 MAC.},
	number = {Number: ISR TR 2006-8}
}
@techreport {
	title = {Detection and Classification of Network Intrusions using Hidden Markov Models},
	author = {Radosavac, Svetlana.},
	year = {2003},
	month = {01/2003},
	abstract = {This paper demonstrates that it is possible to model attacks witha low number of states and classify them using Hidden MarkovModels with very low False Alarm rate and very few FalseNegatives. We also show that the models developed can be used forboth detection and classification. We put emphasis on detectionand classification of network intrusions and attacks using HiddenMarkov Models and training on anomalous sequences. We test severalalgorithms, apply different rules for classification and evaluatethe relative performance of these. Several of the attack examplespresented exploit buffer overflow vulnerabilities, due toavailability of data for such attacks. We emphasize that thepurpose of our algorithms is not only the detection andclassification of buffer overflows; they are designed fordetecting and classifying a broad range of attacks.},
	number = {Number: CSHCN TR 2003-6}
}
