Theses supervised by Prof. Dr. Fatih Alagöz
16 theses · Boğaziçi University
Effect of social relations on cooperative sensing in cognitive radio networks
Previous works in cognitive radio networks (CRNs) have shown that cooperation in sensing improves sensing reliability and in turn enhances the network throughput. Although this altruistic cooperative behavior is accepted as the default mode of oper- ation, it may often be invalid under practical circumstances. In this thesis, we loosen this assumption and introduce a cooperative mode of operation conditioned on social relations between Cognitive Radios (CRs). Rather than taking CRs as wireless devices with no context, we associate each CR with its user that has some social relations, e.g. friendship, community, selfishness. Using these relations among CRs, we propose a social-aware cooperative sensing scheme (SAC) and analyze its effects on sensing performance. We examine that exploiting social metrics is highly beneficial for cooper- ative sensing in CRNs and a model with social relations embedded will fit better to the next decade?s networking paradigm. Furthermore, we show in this thesis that a social aware sensing scheme outperforms a randomly cooperating candidate selecting scheme in terms of opportunity discovery, cooperation message overhead, and avoidance of cooperation with malicious users under various simulation scenarios.
Energy efficiency analysis and modeling of cognitive and heterogeneous wireless networks
The surging energy costs and the environmental consequences of energy generation and exploitation have put energy efficiency aspect of wireless systems into focus in an unprecedented manner. Moreover, the capacity expectations and requirements for wireless networks have been relentlessly increasing with the adoption of new services and sophisticated wireless terminals. In this thesis, we evaluate cognitive and heterogeneous wireless network paradigms from energy efficiency perspective that has become vital due to the above mentioned phenomena. We specifically focus on energy efficiency analysis and modeling of these systems for realizing the "green networks" objective. We first provide a comprehensive account of energy efficiency of wireless networks. At a cross-sectional level, we consider cognitive radios (CR) paradigm which is affecting all facets of wireless data communications. The CR concept is evaluated from the "energy-efficient operation" and "energy efficiency enabler" perspectives. At the microscopic level, we focus on small cells, namely femtocells, and propose a new networking paradigm called cognitive femtocell networks (CFN). We analyze them in terms of energy efficiency via our analytical model and compare their performance with that of macrocell-only networks as well as traditional femtocell networks.
A biometric authentication technique using spread spectrum audio watermarking
Watermarking has become important in the last decade because of the copyright protection applications. Embedding information into an audio file is more difficult as compared to images, because human auditory system is more sensitive than human visual system. Therefore, the proposed watermarking algorithms for digital audio have been less than those for digital image and video. This thesis presents a biometric authentication scheme based on spread spectrum watermarking technique. We add a biometric authentication system to the Sipdroid open source VoIP program. Firstly, senders must register to the system with their unique biometric features. T.C Identity number, keystroke dynamics and voice are used as biometric features. After registration, these biometric features are used as watermarked material. Before embedding, the watermark is spread with the Direct Sequence Spread Spectrum (DSSS) technique. While talking, this watermark material is embedded to speech and sent to receiver using Frequency Hopping Spread Spectrum(FHSS) technique. The watermarked biometric data is constructed in the receiver's phone after conversation is finished. This method does not need the original audio carrier signal when extracting watermark because it is using the blind extraction. The experimental results demonstrate that the embedding technique is not only less audible but also more robust against the common signal processing attacks like low-pass filter, adding white Gaussian noise, shearing, and compression. In order for receiver to be able to login to the system, biometric features of the user should match with the watermarked biometric data.
Cost-aware network hardening using compact attack graphs
Attack graphs provide analytical support to prevent multistep network attacks by showing all possible sequences of vulnerabilities and their interactions. Since attack graphs generally consist of a very large number of nodes, it is computationally challenging to analyze them for hardening a network against attacks. In this thesis, we propose a greedy heuristic method to find a cost-effective solution to protect a network using compact attack graphs. First, we extract all possible attack paths which reach predetermined critical resources embedded in the network. The exploit or initial condition which contributes the most to attack paths with least cost is selected to be removed. This process continues iteratively and a security analyst can stop it when the total cost exceeds the allocated budget. The experimental results show that our algorithm scales almost linearly with the size of the networks and it can be applied to large-scale graphs with a very large number of nodes. They also show that the algorithm finds nearly minimum cost solution compared to optimal solution. In addition to providing a network-hardening solution, our proposal measures the security level of the network in every step to demonstrate how vulnerable the network is against threats. This accompanying feature is beneficial for network security assessment and situation awareness.
Controller load balancing schemes in software defined networks
Software-defined networking (SDN) has been proposed as a new networking paradigm which separates the control and data forwarding planes. The controllers which are centralized network control entities are crucial for meeting the performance and efficiency requirements of these systems. The placement of these network entities, switch assignment and their load-aware operation is a challenging research question. Although various load-balancing schemes are proposed in the literature, this research topic is yet to be explored adequately. In this thesis, we discuss load-balancing issues in SDN and propose a load-balancing scheme, namely Cooperative Load Balancing Scheme For Hierarchical SDN Controllers (COLBAS). Moreover, we evaluate the performance of this scheme and investigate important trade-offs.
Priority scheduling for heterogeneous workloads in computing clusters
Nowadays, large computing clusters constantly strive for an optimal tradeoff between resource efficiency and performance. In this thesis, we are concerned with the efficient use of system resources and we also aim to improve response time of the tasks. We tackle with the challenges of task scheduling on large heterogeneous clusters executing highly heterogeneous bursty workloads with different priorities, resource demands, and performance objectives. Firstly, we propose a scheduling algorithm for tasks with communication needs which improves the response time and resource utilization by controlling communication and computation resources at the same time. Secondly, we propose a novel scheduling framework for exploring various aspects of priority scheduling with heterogeneous workloads while investigating the tradeoff between evictions and response time. To better understand the impact of evictions, we first analyze simple eviction policies and wasted resources associated with evictions by using trace-driven simulations. Furthermore, by exploiting the heterogeneity of the workload, we propose a workload-aware slot configuration and task assignment methodology incorporated with slot-based priority scheduling to improve class-based response time and resource efficiency. Finally, we introduce a task scheduling policy which aims to provide scheduling and execution guarantees for low priorities while preserving the performance benefits of high priority tasks. The proposed scheduling effectively handles both prioritization and performance issues of low priorities by utilizing a combination of preemptive and non-preemptive scheduling.
Layered content delivery over satellite integrated cognitive radio networks
Although the spectrum is a scarce and valuable resource, the utilization of spectrum in various frequency bands in certain areas are shown to be very low. Because of this under-utilization and inefficiency, cognitive radio (CR) concept where licensed bands are allowed to be used by a secondary network is being developed. Moreover, this new phenomenon has been coexisting with the exploding content consumption over wireless networks. Upcoming fifth generation (5G) wireless standards have been developed to address this capacity crunch. In 5G "toolkit", Device-to-device (D2D) communications is an important approach adopted to alleviate this issue. Moreover, heterogeneous wireless networks composed of different network tiers are expected to provide services in an omnipresent setting. In this thesis, we develop an analytical Markovian model for content delivery over satellite integrated cognitive radio networks. Additionally, we devise a simulation for studying this infrastructure-based mobile network. The simulation model is focused on energy efficiency. However, it can be extended for other performance evaluation purposes. We also investigate the effect of various system parameters on the performance of these systems such as network density, preference ratios for content retrieval from different content holders and average content size in this setting.
Filtering based defense mechanisms against ddos attacks for core networks
In this thesis, we present filtering based defense mechanisms against Distributed Denial of Service (DDoS) attacks for core networks. Initially, several filtering techniques are analyzed and their advantages and disadvantages are presented. A comparative classification of these methods is provided for security analysts. Classification results suggest that there are a few filtering methods that are both proactive and collaborative. Proactivity provides prevention of attacks before it spreads whereas collaboration enables getting knowledge about different points of the network and deciding filters together. Thus, we proposed a proactive and collaborative model called ScoreForCore. It is a statistical packet based defense mechanism that selects the most appropriate attributes for current attack traffic. Our results suggest that the success of the system's behavior on legal and attack packets increased considerably. This strategy is also convenient for current emerging technology for core networks, called Software Defined Networking (SDN). It has several problems related to security that are largely induced by the centralized control paradigm. In that regard, DDoS attacks are specifically valid for SDN environment. Several defense mechanisms in SDN environment are analyzed and comparative classification is provided for rendering the current state of the art in the literature. Then, our defense strategy is applied on SDN environment with capable switches. This mechanism's(SDNScore) results suggest that it gives perfect results for several known attacks and 84% success for an unknown attack. Since there is a trade-off between SDN paradigm and capable switches in SDNScore, we improved it and proposed another model called Joint Entropy based Scoring for SDN (JESS) that carries all burden to the controller and does not need capable switches. The results suggest that it is an elegant defense method for SDN environment.
A security framework for software-defined networks
Software-Defined Networking (SDN) emerges as a transformative technology, offering the flexibility and scalability crucial for modern digital services. While SDN presents opportunities to address security shortcomings in traditional networks, it also introduces new vulnerabilities, particularly in data and control plane communications. This thesis proposes a security framework to mitigate these risks, focusing on securing data exchange among SDN entities (controllers, switches, and applications). In our model, Transport Layer Security (TLS) can be activated between SDN nodes to ensure confidentiality, integrity, authentication, and authorization, leveraging specialized certificate fields. Additionally, an integrated security module enhances communication security by enforcing Access Control Lists (ACLs), hardening TLS configuration, and mitigating the risk of private key hijacking. From an availability perspective, the limited flow table capacity of switches leads to table saturation attacks. Besides, disaggregated and layered architecture of SDN is susceptible to time-based fingerprinting attacks. To address this, we introduce an automated attacker tool that utilizes probing-based measurements for fingerprinting. This tool can discern network types (SDN or traditional), extract flow rule timeout values (hard and idle), determine flow table utilization rate, size, and replacement algorithm. Armed with this information, the attacker can execute intelligent saturation attacks. Furthermore, we propose a lightweight defense mechanism that randomizes rule timeouts and proactively deletes flow rules based on network status. Through comprehensive simulations under various network conditions, we demonstrate the efficacy of our proposed techniques, achieving superior success rates across diverse scenarios.
Multi-model multi-agent defense against LLM jailbreak attacks
The robustness of Large Language Models (LLMs) against adversarial attacks such as jailbreak techniques is critical for their safe deployment especially in the sensitive domains. These attacks exploit LLM flexibility to bypass safety protocols, generating harmful, misleading, or unauthorized outputs. Existing single-agent and static defense mechanisms often struggle to address the dynamic and evolving jailbreak vulnerabilities. This paper introduces a Multi-Model Multi-Agent Defense (MAMAD) system designed to defend jailbreak attacks on LLMs. The proposed architecture incorporates specialized agents—Input Analyzer, Intent Analyzer, and Output Analyzer—utilizing the unique strengths of distinct LLMs to collaboratively evaluating inputs and mitigating potential threats. The system demonstrates significant improvements in detection accuracy against diverse attack vectors, including adversarial suffixes, latent injections, and role-playing techniques. Evaluation results show that the MAMAD system achieves a detection accuracy of 94%, outperforming individual LLMs and single-model multi-agent systems. Furthermore, this work explores the trade-offs between computational and latency overhead and system efficiency between individual LLMs and multi-agent defense architectures. The findings demonstrates the capability of multi-agent systems to improve the safety and reliability of LLM applications, while maintaining minimal false positive rates and scalability.
Adaptive timeout & eviction orchestrator for software-defined networking
Flow table management plays a vital role in enhancing the scalability, efficiency, and overall performance of Software-Defined Networking (SDN). In this thesis, an innovative mechanism called Adaptive Timeout Assignment and Eviction Orchestrator (ATEO) is presented. Multi-layered timeout assignment module enhanced with Z-score-based flow classification, a reactive heuristic-driven eviction mechanism, and a dynamic threshold adjuster module to adapt to various network conditions are introduced as a comprehensive flow management strategy with ATEO. The timeout assignment module of ATEO intelligently modifies timeout values by analyzing the statistical characteristics of flows. The Z-score-based flow classification module differentiates between short-lived "mice" flows and long-lived "elephant" flows. This classification helps ATEO to dynamically allocate more persistent timeouts to frequently accessed or critical flows. On the other hand, the heuristic-based eviction module identifies and removes flow rules that are expected to have a lower impact in the future. This allows ATEO to create space for the newcomer flows that are potentially more important. In addition, it ensures that the flow table is populated with high-priority flows which minimizes the unnecessary packet-in messages and the controller overhead. Additionally, ATEO's proposed dynamic threshold adjuster monitors the occupancy of the flow table and the changes in the number of rejected flows. It uses these data to generate a near real-time response. Thresholds that are used in timeout and eviction processes are updated to keep the number of rejected flows lower while having high Quality of Service (QoS). It significantly reduces the rejected flows while keeping the packet-in count competitive with other algorithms. The results show that ATEO achieved an efficient flow table management which is essential for modern network infrastructures.
Authenticated quality of service aware routing in software defined networks
Quality of Service (QoS) aware routing is an ongoing and major problem for traditional networks since they are not able to manage network traffic for an immense variety of users due to their inflexible and static architectures. Software Defined Networking (SDN) has emerged to remove these limitations by separating the control plane and the data plane to provide centralized control with the help of programmable controllers. Such improvements also make SDN more flexible than traditional networks in terms of achieving QoS-aware routing. However, providing QoS-aware routing in SDN without using any security mechanism may become a challenging issue. For instance, malicious users in the network may escalate their privileges to monopolize resource utilization. The provision of an authentication mechanism that jointly works with QoS-aware routing is expected to solve the issue. In this thesis, we propose an Authenticated QoS-Aware Routing (AQoSAR) for Software Defined Networks to determine routing paths of a single user and a group of users in an authenticated manner. AQoSAR consists of the authentication application and the routing application. In the authentication application, we employ Ciphertext Policy Attribute Based Encryption since it easily operates with a huge variety of users by defining attributes such as QoS-aware routing metrics. In the routing application, we propose a routing approach based on a metric list rather than a single metric for determining the QoS level of users. To show the applicability of AQoSAR, the security analysis and the performance analysis are presented.
Robust controller assignment for sdn survivability
Robustness in software defined networks (SDN) control plane is a challenging goal when a single controller is employed. Thus, distributed controllers are deployed to realize a robust, resilient and reliable software defined network. However, such a strategy can not succeed without an efficacious controller-switch assignment scheme. In addition to zero-day assignment, online re-assignment is crucial since due to network failures, the connections between controllers and switches may break off intermittently and impair the network operation. In this thesis, we propose a reactive assignment model against network failures using integer linear programming based on the load distribution of controllers. We also use a complementary strategy to monitor the network by using monitoring agents as network beacons at the edge via the flexibility of SDN. Real-time information about network connectivity and latency is provided by these agents and used in the assignment decisions. We augment our proposal with simulated annealing and random assignment approaches for switch, link and controller failures. Our proposed framework is evaluated using different types of traffic such as VoIP, video, and network gaming. Our model is also investigated using two different test scenarios to assess the contribution of monitoring agents. The experimental results show that our model gives resilience against network failures while load-awareness is an effective strategy for controller assignment.
A blockchain based group key agreement protocol (B-gkap)
Group key agreement protocols are crucial in the case of multiple parties agreeing on a common key without a centralized entity. However, the decentralized characteristic of these protocols causes performance challenges where parties need to communicate and verify other participants in the group. To overcome this issue, we propose a new approach to the group key agreement protocols by utilizing Hyperledger Fabric framework as a blockchain platform. To this end, we migrate the communication and verification overhead of the group key agreement participants to the blockchain network in our developed scheme. This paradigm allows a flexible group key agreement protocol that considers resource-constrained entities and trade-offs regarding distributed computation. According to our performance analysis, participants with low computing resources can efficiently utilize our protocol. In addition, the secret parameters of the participants are distributed among the isolated participants that constitute the blockchain network. Thus, the only way for the network participants to compute group keys is to collude maliciously. Furthermore, we have demonstrated that our protocol has the same security features as other comparable protocols in the literature.
Driving behavior classification using smartphone sensor data
The need for driver behavior monitoring systems has increased due to the significant amount of accidents that are brought on by human mistakes. These systems have the potential to lower accident rates and increase overall road safety by offering real-time monitoring and analysis of driving behavior. Based on the data collected from passengers' smartphones, we propose a novel analysis framework for classifying driving behavior in this thesis. Our mobile phone application was used to collect the data, which was then subjected to machine learning algorithms for processing. We utilized several Machine Learning (ML) classification techniques, with a particular emphasis on developing a Long Short Term Memory (LSTM) algorithm for increased accuracy and sequence-based prediction. The outcomes show how successfully the suggested method classifies driving behavior using the data obtained from smartphone applications. After having a successful result with LSTM, instead of collecting all data from users into one area, we developed a federated learning algorithm to train and test each data on users' phones. The results of the study show that federated learning is useful for the classification of driver behavior and thus increases accuracy.
Cost-effective and ddos-aware network function sharing models for next-generation networks
As next-generation communication networks evolve to meet increasingly diverse service requirements, optimizing resource efficiency and ensuring sustain- ability have become paramount. Network Function (NF) sharing has emerged as a promising solution for achieving both environmentally friendly and cost- effective resource allocation by maximizing resource utilization. However, main- taining Quality of Service (QoS) continuity and addressing security vulnerabilities together with NF sharing remain significant challenges. This thesis introduces a framework to optimize NF sharing for next-generation networks, with a focus on balancing cost efficiency with QoS and security. We propose a set of cost-efficient heuristics, CNFSH, along with its delay-aware version, D-CNFSH, to effectively manage the allocation and sharing of NFs. By prioritizing NF sharing, our ap- proach significantly reduces underutilized resources, lowers operational costs, and supports green network initiatives, all while ensuring QoS continuity through the use of a priority-aware load balancer (LB). A novel metric, the ratio of underuti- lized to allocated resources, demonstrates the effectiveness of this method, with results showing underutilization reduced from around 30% in NoShare schemes to less than 0.4% with D-CNFSH. Additionally, the thesis addresses the security concerns associated with NF sharing by introducing SliceScore, an NF sharing- aware DDoS filtering mechanism designed to mitigate resource exhaustion threats. Simulations indicate that SliceScore outperforms traditional filtering methods by leveraging slice-specific insights to enhance defense strategies. These contributions lay the foundation for designing sustainable, secure, and cost-efficient communi- cation networks in next-generation systems and pave the way for further research in the area.