With the rapid advances in computing and information technologies, traditional access control models have become inadequate in terms of capturing fine-grained, and expressive security requirements of newly emerging applications. An attribute-based access control (ABAC) model provides a more flexible approach to addressing the authorization needs of complex and dynamic systems. While organizations are interested in employing newer authorization models, migrating to such models pose as a significant challenge. Many large-scale businesses need to grant authorizations to their user populations that are potentially distributed across disparate and heterogeneous computing environments. Each of these computing environments may have its own access control model. The manual development of a single policy framework for an entire organization is tedious, costly, and error-prone. In this paper, we present a methodology for automatically learning ABAC policy rules from access logs of a system to simplify the policy development process. The proposed approach employs an unsupervised learning-based algorithm for detecting patterns in access logs and extracting ABAC authorization rules from these patterns. In addition, we present two policy improvement algorithms, including rule pruning and policy refinement algorithms to generate a higher quality mined policy. Finally, we implement a prototype of the proposed approach to demonstrate its feasibility.

This paper considers primary user emulation attacks in cognitive radio networks operating in the white spaces of the digital TV (DTV) band. We propose a reliable AES-assisted DTV scheme, in which an AES-encrypted reference signal is generated at the TV transmitter and used as the sync bits of the DTV data frames. By allowing a shared secret between the transmitter and the receiver, the reference signal can be regenerated at the receiver and used to achieve accurate identification of the authorized primary users. In addition, when combined with the analysis on the autocorrelation of the received signal, the presence of the malicious user can be detected accurately whether or not the primary user is present. We analyze the effectiveness of the proposed approach through both theoretical analysis and simulation examples. It is shown that with the AES-assisted DTV scheme, the primary user, as well as malicious user, can be detected with high accuracy under primary user emulation attacks. It should be emphasized that the proposed scheme requires no changes in hardware or system structure except for a plug-in AES chip. Potentially, it can be applied directly to today's DTV system under primary user emulation attacks for more efficient spectrum sharing.

This paper explores reliable data fusion in mobile access wireless sensor networks under Byzantine attacks. We consider the q-out-of-m rule, which is popular in distributed detection and can achieve a good tradeoff between the miss detection probability and the false alarm rate. However, a major limitation with it is that the optimal scheme parameters can only be obtained through exhaustive search, making it infeasible for large networks. In this paper, first, by exploiting the linear relationship between the scheme parameters and the network size, we propose simple but effective sub-optimal linear approaches. Second, for better flexibility and scalability, we derive a near-optimal closed-form solution based on the central limit theorem. Third, subjecting to a miss detection constraint, we prove that the false alarm rate of q-out-of-m diminishes exponentially as the network size increases, even if the percentage of malicious nodes remains fixed. Finally, we propose an effective malicious node detection scheme for adaptive data fusion under time-varying attacks; the proposed scheme is analyzed using the entropy-based trust model, and shown to be optimal from the information theory point of view. Simulation examples are provided to illustrate the performance of proposed approaches under both static and dynamic attacks.

This paper introduces the mobile access coordinated wireless sensor network (MC-WSN)-a novel energy efficient scheme for time-sensitive applications. In conventional sensor networks with mobile access points (SENMA), the mobile access points (MAs) traverse the network to collect information directly from individual sensors. While simplifying the routing process, a major limitation with SENMA is that data transmission is limited by the physical speed of the MAs and their trajectory length, resulting in low throughput and large delay. In an effort to resolve this problem, we introduce the MC-WSN architecture, for which a major feature is that: through active network deployment and topology design, the number of hops from any sensor to the MA can be limited to a pre-specified number. In this paper, we investigate the optimal topology design that minimizes the average number of hops from sensor to MA, and provide the throughput analysis under both single-path and multipath routing cases. Moreover, putting MC-WSN in the bigger picture of network design and development, we provide a unified framework for wireless network modeling and characterization. Under this general framework, it can be seen that MC-WSN reflects the integration of structure-ensured reliability/efficiency and ad-hoc enabled flexibility.

This paper considers cooperative sensing in cognitive networks under Spectrum Sensing Data Falsification attack (SSDF) in which malicious users can intentionally send false sensing information. One effective method to deal with the SSDF attack is the q-out-of-m scheme, where the sensing decision is based on q sensing reports out of m polled nodes. The major limitation with the q-out-of-m scheme is its high computational complexity due to exhaustive search. In this paper, we prove that for a fixed percentage of malicious users, the detection accuracy increases almost exponentially as the network size increases. Motivated by this observation, as well as the linear relationship between the scheme parameters and the network size, we propose a simple but accurate approach that significantly reduces the complexity of the q-out-of-m scheme. The proposed approach can easily be applied to the large scale networks, which can be much more reliable under malicious attacks.