In scenarios of military operations and catastrophes – even when there is no infrastructure available or left – there is a need for communication. Due to the specific context the communication systems used in these tactical scenarios need to be as reliable as possible. Thus, the performance of these systems has to be evaluated. Beside field-tests, computer simulations are an interesting alternative concerning costs, scalability, etc. Results of simulative performance evaluation strongly depend on the models used. Since tactical networks consist of, or, at least, contain mobile devices, the mobility model used has a decisive impact. However, in common performance evaluations mainly simple random-based models are used. In the paper we will provide classification and survey of existing mobility models. Furthermore, we will review these models concerning the requirements for tactical scenarios.

Today’s malware, short term for malicious software, poses one of the major threats to all currently operated computer systems. The scale of the problem becomes obvious by looking at the global economic loss caused by different kinds of malware, which is estimated to be more than US$10 billion every year. This particularly applies for botnets, which are a special kind of malware. In contrast to other kinds of malware, botnets utilize a hidden communication channel to receive commands from their operator and communicate their current status. The ability to execute almost arbitrary commands on the infected machines makes botnets a general-purpose tool to perform malicious cyber-activities. In this context, botnets are used for example by individual perpetrators, organized crime as well as governmentally supported organizations, in order to achieve individual gains. This chapter gives a technical insight into current botnet techniques and discusses state of the art countermeasures to combat the botnet threat in detail. This includes new detection methods as well as different approaches to actively compromise running botnets. Different techniques as well as their impact on current botnets are discussed, considering individual involved stakeholders. In addition to the technical countermeasures, current initiatives countering botnets are introduced.

In typical Mobile Ad-Hoc Network (MANET) applications, the network topology changes frequently due to device movement, or link failure. Consequently, a fast response to connectivity changes is one of the most important challenges in MANETs. Most proactive routing protocols detect changes by exchanging control messages. The Neighborhood Discovery Protocol (NHDP) specifies the exchange of these kind of messages. As shown in prior studies, the proposed fixed intervals of NHDP cause unnecessary protocol overhead or late link detection. Our Adaptive HELLO (AH) scheme adapts the interval dynamically with respect to the actual situation and coordinates it between the nodes when necessary. The result is a fast link change detection and an overhead reduction in certain scenarios.

This book constitutes the refereed proceedings of the 7th Security Research Conference, Future Security 2012, held in Bonn, Germany, in September 2012. The 78 revised full papers presented were carefully reviewed and selected from 137 submissions. The papers are organized in topical sections on supply chain and critical infrastructure protection; security situational awareness; crisis management; security for critical infrastructure and urban areas; sensor technology; social, psychological and political aspects; cyber defense and information security; maritime and border security; detection of hazardous materials; food chain security; aviation security; ergonomic aspects.

Correctness problems in the iBGP routing, the de-facto standard to spread global routing information in Autonomous Systems, are a well-known issue. Configurations may route cost-suboptimal, inconsistent, or even behave non-convergent and -deterministic. However, even if a lot of studies have shown many exemplary problematic configurations, the exact scope of the problem is largely unknown: Up to now, it is not clear which problems may appear under which iBGP architectures. The exact scope of the iBGP correctness problem is of high theoretical and practical interest. Knowledge on the resistance of specific architecture schemes against certain anomaly classes and the reasons may help to improve other iBGP schemes. Knowledge on the specific problems of the dierent schemes helps to identify the right scheme for an AS and develop workarounds.

This paper introduces a new method to predict performance requirements of mobile devices' software tasks using system models describing the hardware and software. With the help of clustering algorithms and linear regression, behavioral models of software tasks are generated automatically. These models are used to project the runtime of representative parts of the software tasks. The runtime of representative execution parts is determined with instruction-accurate simulations which are not feasible for whole executions. The inputs for the projection task a model of the hardware platform and input data parameters, especially the data size. A major advantage of this approach is that the developers do not have to estimate the performance requirements themselves. In this way the method helps to seamlessly integrate the performance analysis process into the development process. The paper introduces the ideas in detail and presents an evaluation of the proposed method for typical software tasks of mobile devices.

The availability of a reliable and precise tracking system for relief units operating in mission critical scenarios would drastically improve the situational awareness and thus facilitate the mission planning and accomplishment as well as increase the safety of human resources. Thus, the demand for such a system is very high both in the military and in the emergency and crisis intervention domain. While there are solutions like GPS for the localization in open areas, problems arise in urban scenarios and indoors due to insufficient or failed signal reception. For indoor use, multiple alternative localization concepts exist that are suited for different use cases and expose varying properties in precision, complexity and required preconditions. The deployment within mission critical scenarios implicates explicit restrictions and requirements so that only some of the techniques are adept or have the potential of being used here. This article identifies the commonly issued requirements to an indoor tracking in mission critical scenarios and introduces basic techniques for position estimation. Subsequently, existing indoor tracking systems specifically in the field of mission critical scenarios are reviewed with a focus on their capabilities in terms of reliability and accuracy. By doing so, an overview of current approaches in this field is given. Furthermore, the most adept techniques are classified with respect to the requirements within mission critical scenarios.

Different species of malicious software (malware) have been around for quite a while. Add a command and control structure — and here you are: A "cyber army" of hijacked machines waiting for the commands of the so-called "bot herder" ready to serve the master's will. Botnets may be used for distributing spam, for installing additional malware, for information harvesting, for distributed denial of service attacks and for other actions initiated and controlled by the bot herder. Today, thousands of botnets are well understood. Their actions are observed and in some cases controlled/limited. In addition, experts active in this field argue that there is a very large number of botnets escaping tracking efforts by mechanisms such as frequent reconfiguration and frequent migration of command-and-control structures. In his keynote, Peter Martini will comment on the challenge of detecting botnets, on aggregation and clustering of similar species of malicious software and on countermeasures used today. He will comment on the relevance of botnet size and the problem of measuring the current size of well-known botnets. Finally, he will comment on legal issues and missing pieces in the fight against botnets: Botnets have come to stay.

Routing Attacks are a serious threat to communication in tactical MANETs. TOGBAD is a centralised approach, using topology graphs to detect such attacks. In this paper, we present TOGBAD's newly added wormhole detection capability. It is an adaptation of a wormhole detection method developed by Hu et al. This method is based on nodes' positions. We adapted it to the specific properties of tactical environments. Furthermore, we present simulation results which show TOGBAD's performance regarding the detection of wormhole attacks.

Improving the path diversity seems to be the next fundamental step in the iBGP evolution. Focusing the advantages an improvement of the path diversity implies, network protocol designers have disregarded the most critical drawback so far: The effect on the scalability of the iBGP routing, a fundamental requirement for production usage. This aspect is examined by the analyses discussed in our paper. In this paper, we provide the theoretical groundwork for scalability analyses of four highly relevant path diversity schemes. Based on this groundwork, we exemplarily predict the information load the schemes induce in a system of a large ISP. Generalizing the system-specific results, we give an outlook on the load that can be expected in comparable ASs. We found that for two schemes currently in the standardization process, scalability problems in large ASs as they are operated by ISPs seem likely.

The usage of link quality based routing metrics significantly improves the quality of the chosen paths and by that the performance of the network. But, attackers may try to exploit link qualities for their purposes. Especially in tactical multi-hop networks, routing may fall prey to an attacker. Such routing attacks are a serious threat to communication. TOGBAD is a centralised approach, using topology graphs to detect routing attacks. In this paper, we enhance TOGBAD with the capability to detect fake link qualities. We use a Challenge/Response method to estimate the link qualities in the network. Based on this, we perform plausibility checks for the link qualities propagated by the nodes in the network. Furthermore, we study the impact of attackers propagating fake link qualities and present simulation results showing TOGBAD's detection rate.

From time to time, global routing is affected by local misconfigurations of global impact. Incorrect routing information leaks into the global routing — IP address space becomes hijacked. As such incidents are highly problematic and may even serve as blueprints for purposeful attacks, concepts to prevent or at least automatically detect such incidents are desirable. As planned architectures to prevent prefix hijacking incidents will need some time to become globally deployed and may be ineffective if manipulations are obfuscated, automatic detection seems to be an crucial facet. In this paper, we study a misconfiguration event that could serve as blueprint for attacks. With this analysis, we try to provide starting points for the development of indicators to detect routing manipulations and classify them automatically.

Underwater networks have attracted significant attention over the last few years. They can be used in scenarios like environmental monitoring and mine countermeasure but may also be part of modern marine warfare. A prominent example is Anti Submarine Warfare (ASW) with multistatic sonars. These networks may be sparse with potentially long distances between single nodes such that direct communication is not always possible. Furthermore, long propagation delays and shadowzones have a negative impact on the communication channel. A solution to overcome these challenges is to realize a multi-hop network by using ad-hoc routing. A well known protocol from terrestrial networks is the On-Demand Multi-cast Routing-Protocol (ODMRP). In this paper, we present an optimization for ODMRP, named Route-Discovery-Suppression, to improve its performance for the deployment in underwater networks. We evaluate the performance through simulations in different scenarios and show its impact in comparison to other routing protocols.

For the simulative and emulative performance evaluation of tactical indoor communication systems modeling mobility is an important task. Typical assumptions are a uniformly distribution of destinations, shortest paths movement without obstacles, and randomly chosen speeds. These assumptions do not hold for tactical indoor scenarios. In this paper, we introduce a new rule-based indoor mobility model for tactical scenarios. We show that the realistic modeling has a great impact on the evaluation of routing protocols. Furthermore, we demonstrate that even complex movements can be represented by small rulesets.

Realistic modeling of the nodes' mobility is essential for obtaining credible results from the simulative performance evaluation of wireless multi-hop networks. However, most of the mobility models in the literature have not been validated with real world movement traces. To overcome this issue, we follow a trace-based approach to mobility modeling, where movement traces from the real world scenario are statistically analyzed and used for parametrization. In this paper, we introduce and evaluate a new realistic mobility model for first responder scenarios based on such an analysis while also considering geographic restrictions by incorporating free publicly available map data.

One threat in wireless multi-hop networks is jamming the wireless channel. Jamming is easy to implement but nevertheless can have severe impact on the performance of the network. To study the impact of different jamming attacks as well as different detection approaches simulative evaluation is performed for scalability and reproducibility reasons. However, realistic propagation modeling in the simulator is often neglected. In this paper, we describe our integration of jamming attacks into the new realistic IEEE802.11 MAC and physical layer ofns-2. Based on this we evaluate different detection metrics: RSSI standard deviation, carrier sensing time, and expected packet delivery rate. In contrast to the related work thresholds for the metrics are dynamically and adaptively parametrized. In contrast to other studies that do not consider realistic MAC and physical models in our evaluation the carrier sensing time with dynamic thresholds shows best results.

Topology graph based anomaly detection (TOGBAD) is a centralized approach to detect routing attacks in tactical multi-hop networks. It uses anomaly detection based on topology graphs to identify attackers trying to launch routing attacks. Such attacks are a serious threat to multi-hop networks since they may be used to disrupt, eavesdrop or manipulate the network. In this work, we present studies on the impact of an attacker launching a routing attack. Furthermore, we show a reasonable choice of attack parameters for the attacker. In our main contribution, we introduce TOGBAD and an evaluation of TOGBAD concerning its detection rate with and without packet loss. Finally, we illustrate TOGBAD's detection rate with an attacker trying to inure TOGBAD's anomaly detection to his attack. Copyright (C) 2010 John Wiley & Sons, Ltd.

Today, spreading global routing information within an Autonomous System (AS) is usually implemented by means of internal BGP (iBGP), a particular operational mode of the Border Gateway Protocol (BGP) [1]. Considering the research activities around BGP, anomalies turned out to be one major issue of iBGP: But even if the trouble iBGP anomalies induce in practice is well known for nearly a decade [2], [3], new iBGP extensions still define highly problematic protocol modifications. Apparently, protocol designers are either not aware of the conceptual defects that induce anomalies or validating correctness appears to be too complex. In this paper, we provide a basis to solve both problems. Focussing the basic correctness properties of routing protocols, we will show that iBGP anomalies are caused by five root causes. These causes provide protocol designers with a tool set to reveal problematic properties of a concept and verify correctness. Based on exemplary studies for two common iBGP architectures, we will provide detailed guidance for practical usage.