@conference {
	title = {Detection and Prevention of MAC Layer Misbehavior in Ad Hoc Networks},
	author = {Cardenas, Alvaro A., Radosavac, Svetlana., Baras, John S.},
	year = {2004},
	month = {10/2004},
	abstract = {Selfish behavior at the MAC layer can have devastating side effects on the performance of wireless networks, similar to the effects of DoS attacks. In this paper, we focus on the prevention and detection of the manipulation of the backoff mechanism by selfish nodes in 802.11. We first propose an algorithm to ensure honest backoffs when at least one, either the receiver or the sender is honest. Then we discuss detection algorithms to deal with the problem of colluding selfish nodes. Although we have focused on the MAC layer of 802.11, our approach is general and can serve as a guideline for the design of any probabilistic distributed MAC protocol.},
	address = {Washington DC},
	booktitle = {2nd ACM workshop on Security of ad hoc and sensor networks},
	pages = {pp. 17-22}
}
@conference {
	title = {Distributed Change Detection for Worms, DDoS and Other Network Attacks},
	author = {Cardenas, Alvaro A., Baras, John S., V. Ramezani},
	year = {2004},
	month = {06/2004},
	abstract = {Self-propagating code (worms) and distributed denial of service (DDoS) attacks are the most frequent and quite devastating attacks on communication networks and the Internet. We provide novel formulations for the rapid detection of these attacks in the control-theoretic framework of change detection. We present algorithms that effectively can detect worms from their temporal spreading characteristics. We describe the effects of the network topology on the algorithms and their performance. We next present algorithms for detecting DDoS while discriminating against changes in the normal traffic. This is accomplished by a distributed detection formalism where a concept of directionality is introduced and exploited. We then turn into attacks to routing protocols in mobile wireless networks. We develop change detection formulations involving hidden Markov models, which match distribution of the number of hops in the mobile and wireless nodes. Using observations that suggest that this distribution is altered substantially in the presence of such attacks we develop and analyze algorithms for their detection.},
	address = {Boston, MA},
	booktitle = {2004 American Control Conference},
	pages = {pp. 1008-1013}
}
