Software-Defined Networking (SDN) has been envisioned as a way to reduce the complexity of network configuration and management, enabling innovation in production networks. While SDN started focusing on wired networks, there were proposals specifically for Wireless Sensor Networks (WSN), but all of them required a single controller to be coupled to the sink. This paper presents TinySDN, a TinyOS-based SDN framework that enables multiple controllers within the WSN. It comprises two main components: the SDN-enabled sensor node, which has an SDN switch and an SDN end device, and the SDN controller node, where the control plane is programmed. TinySDN was designed and implemented to be hardware independent. Experiments were conducted on COOJA simulator, and results concerning delay and memory footprint are presented.

In this work we characterize the energy consumption of a visual sensor network testbed. Each node in the testbed consists of a "single-board computer", namely Crossbow's Stargate, equipped with a wireless network card and a Webcam. We assess energy consumption of activities representative of the target application (e.g., perimeter surveillance) using a benchmark that runs (individual and combinations of) "basic" tasks such as processing, flash memory access, image acquisition, and communication over the network. In our characterization, we consider the various hardware states the system switches through as it executes these benchmarks, e.g., different radio modes (sleep, idle, transmission, reception), and Webcam modes (off, on, and acquiring image). We report both steady-state and transient energy consumption behavior obtained by direct measurements of current with a digital multimeter. We validate our measurements against results obtained using the Stargate's on-board energy consumption measuring capabilities

IoT botnets have been used to launch Distributed Denial-of-Service (DDoS) attacks affecting the Internet infrastructure. To protect the Internet from such threats and improve security mechanisms, it is critical to understand the botnets’ intents and characterize their behavior. Current malware analysis solutions, when faced with IoT, present limitations in regard to the network access containment and network traffic manipulation. In this paper, we present an approach for handling the network traffic generated by the IoT malware in an analysis environment. The proposed solution can modify the traffic at the network layer based on the actions performed by the malware. In our study case, we investigated the Mirai and Bashlite botnet families, where it was possible to block attacks to other systems, identify attacks targets, and rewrite botnets commands sent by the botnet controller to the infected devices.

Software-defined networking (SDN) was devised to simplify network management and automate infrastructure sharing in wired networks. These benefits motivated the application of SDN in resource-constrained wireless networks to leverage solutions for complex applications. However, some of the core SDN traits expose the networks to Denial-of-Service (DoS) attacks. There are proposals in the literature to detect DoS in wireless SDN networks; however, not without shortcomings: there is little focus on resource constraints, high detection rates have been reported mostly for small networks and the detection is disengaged from the identification of the type of attack or the attacker. Our work targets these shortcomings by introducing a lightweight, online change point detector to monitor performance metrics that are impacted when the network is under attack. A key novelty is that the proposed detector is able to operate in either centralized or distributed mode. The centralized detector has very high detection rates and can further distinguish the type of attack from a list of known attacks. In turn, the distributed detector can be useful to identify the nodes launching the attack. Our proposal is tested over IEEE 802.15.4 networks. The results show detection rates exceeding 96% in networks of 36 and 100 nodes and identification of the type of attack with a probability exceeding 89% when using the centralized approach.