Bluetooth Low Energy is a widely adopted wireless communication technology in the Internet of Things (IoT). BLE offers secure communication through a set of pairing strategies. However, these pairing strategies are obsolete in the context of IoT: the security of BLE based devices relies on physical security since a BLE enabled IoT device may be deployed in a public environment without supervision. Physical security cannot be fulfilled. In this case, attackers who can physically access a BLE-based device have full control of it. Therefore, manufacturers may implement extra authentication mechanisms to counter this issue. We observed that using nonces and cryptographic keys are critical to BLE application security. In this paper, we then design and implement a BLE Security Scan (BLESS) framework by using taint analysis technology. We scan 1073 BLE apps and find that 93% of them are not secure. To mitigate this problem, we propose and implement an application-level defense on a low-cost $0.55 crypto co-processor using public-key cryptography.

It is widely acknowledged that the Internet of Things (IoT) will bring unprecedented levels of stress to existing wireless protocols and architectures.~Critically, deep learning-based radio fingerprinting has been recently heralded as an effective technique to uniquely identify devices by leveraging tiny, hardware-based, imperfections that are inevitably present in the radio circuitry. This way, devices can be identified directly at the physical layer and without the need of energy-expensive cryptography.

To cope with the exploding mobile traffic in the fifth generation cellular network, the dense deployment of small cells and cognitive radios are two key technologies that significantly increase the network capacity and improve the spectrum utilization efficiency. Despite the desirable features, small-cell cognitive radio networks (SCRNs) also face a higher risk of unauthorized spectrum access, which should not be overlooked. In this paper, we consider a passive monitoring system for SCRNs, which deploys sniffers for wireless traffic capture and network forensics, and study the optimal sniffer channel assignment (SCA) problem to maximize the monitoring performance. Unlike most existing SCA approaches that concentrate on user activity, we highlight the inherent error in wireless data capture (i.e. imperfect monitoring) due to the unreliable nature of wireless propagation, and propose an online-learning based algorithm called OSA (Online Sniffer-channel Assignment). OSA is a type of contextual combinatorial multi-armed bandit learning algorithm, which addresses key challenges in SCRN monitoring including the time-varying spectrum resource, imperfect monitoring, and uncertainty in network conditions. We theoretically prove that OSA has a sublinear learning regret bound and illustrate via simulations that OSA significantly outperforms benchmark solutions.

Cellular network operators deploy base stations with a high density to ensure radio signal coverage for 4G/5G networks. While users enjoy the high-speed connection provided by cellular networks, an adversary could exploit the dense cellular deployment to detect nearby human movements and even recognize keystroke movements of a victim by passively listening to the CRS broadcast from base stations. To demonstrate this, we develop SpiderMon, the first attempt to perform passive continuous keystroke monitoring using the signal transmitted by commercial cellular base stations. Our experimental results show that SpiderMon can detect keystrokes at a distance of 15 meters and can recover a 6-digits PIN input with a success rate of more than 51% within ten trails even when the victim is behind the wall.

We present an active measurement test (netflix) that downloads content from the Netflix content delivery network. The test measures TCP connection establishment times and achievable throughput when downloading the content from Netflix. We deployed the test on ∼100 SamKnows probes connected to dual-stacked networks representing 74 different origin ASes. Using a ∼2.5 years long (Jul 2016 - Apr 2019) dataset we observe that, besides some vantage points that experience low success rates connecting over IPv6, Netflix Open Connect Appliance (OCA) infrastructure appears to be highly available. We witness that clients prefer connecting to Netflix OCAs over IPv6, while the preference over IPv6 tends to drop over peak hours during the day. The TCP connect times towards the OCAs have reduced by ∼40% and achievable throughput has increased over the years. We also capture the forwarding path towards the Netflix OCAs. We observe that the Netflix OCA caches deployed inside the ISP are reachable within six IP hops and can reduce IP path lengths by 40% over IPv4 and by half over IPv6. Consequently, TCP connect times are reduced by ∼64% over both address families. The achieved throughput can increase by a factor of three when such ISP caches are used.

The rapid advancement of social media and communication technology enables video chat to become an important way of daily communication. However, such convenience also makes personal video clips easily obtained and exploited by malicious users who launch scam attacks. Existing studies only deal with the attacks that use fabricated facial masks, while the liveness detection that targets the playback attacks using a virtual camera is still elusive. In this work, we develop a novel video chat liveness detection system, LiveScreen, which can track the weak light changes reflected off the skin of a human face leveraging chromatic eigenspace differences. We design an inconspicuous challenge frame with minimal intervention to the video chat and develop a robust anomaly frame detector to verify the liveness of the remote user in the video chat using the response to the challenge frame. Furthermore, we propose resilient defense strategies to defeat both naive and intelligent playback attacks leveraging spatial and temporal verification. We implemented a prototype over both laptop and smartphone platforms and conducted extensive experiments in various realistic scenarios. We show that our system can achieve robust liveness detection with accuracy and false detection rates 97.7% (94.8%) and 1% (1.6%) on smartphones (laptops), respectively.

In multi-party interactive live streaming, each user can act as both the sender and the receiver of a live video stream. It is challenging to design adaptive bitrate (ABR) algorithm for such applications. To solve the problem, we first develop a quality of experience (QoE) model for multi-party live streaming applications. Based on this model, we design MultiLive, an adaptive bitrate control algorithm for the multi-party scenario. MultiLive models the many-to-many ABR selection problem as a non-linear programming problem. Solving the non-linear programming equation yields the target bitrate for each pair of sender-receiver. To alleviate system errors during the modeling and measurement process, we update the target bitrate through the buffer feedback adjustment. To address the throughput limitation of the uplink, we cluster the ideal streams into a few groups, and aggregate these streams through scalable video coding for transmissions. We also deploy the algorithm on a commercial live streaming platform that provides such services for thousands of users. The experimental results show that MultiLive outperforms the fixed bitrate algorithm, with 2-5x improvement in average QoE. Furthermore, the end-to-end delay is reduced to about 100 ms, much lower than the 400 ms threshold set for the video conference.

The multi-path transmission techniques enable multiple paths to maximize resource usage and increase throughput in transmission, which have been installed over mobile devices in recent years. For video streaming applications, compared to the single-path transmission, the multi-path techniques can establish multiple subflows simultaneously to extend the available bandwidth for streaming high-quality videos in mobile devices. Existing adaptive video streaming systems have difficulty in harnessing multi-path scheduling and balancing the tradeoff between the quality of experience (QoE) and quality of service (QoS) concerns. In this paper, we propose an actor-critic network based on Periodical Experience Replay for Multi-path video streaming (PERM). Specifically, PERM employs two actor modules and a critic module: the two actor modules respectively assign the path usage of each subflow and select bitrates for the next chunk of the video, while the critic module predicts the overall objectives. We conduct trace-driven emulation and real-world testbed experiment to examine the performance of PERM, and results show that PERM outperforms state-of-the-art multi-path and single path streaming systems, with an improvement of 10%-15% on the QoE and QoS metrics.

A significant challenge for future virtual reality (VR) applications is to deliver high quality-of-experience, both in terms of video quality and responsiveness, over wireless networks with limited bandwidth. This paper proposes to address this challenge by leveraging the predictability of user movements in the virtual world. We consider a wireless system where an access point (AP) serves multiple VR users. We show that the VR application process consists of two distinctive phases, whereby during the first (proactive scheduling) phase the controller has uncertain predictions of the demand that will arrive at the second (deadline scheduling) phase. We then develop a predictive scheduling policy for the AP that jointly optimizes the scheduling decisions in both phases.

In addition to our theoretical study, we demonstrate the usefulness of our policy by building a prototype system. We show that our policy can be implemented under Furion, a Unity-based VR gaming software, with minor modifications. Experimental results clearly show visible difference between our policy and the default one. We also conduct extensive simulation studies, which show that our policy not only outperforms others, but also maintains excellent performance even when the prediction of future user movements is not accurate.

Augmented reality (AR) is an emerging technology that can weave virtual objects into physical environments, and enable users to interact with them through viewing devices. This paper targets on multi-user AR applications, where virtual objects (VO) placed by a user can be viewed by other users. We develop a practical framework that supports the basic multi-user AR functions of placing and viewing VOs, and our system can be deployed on off-the-shelf smartphones without special hardware. The main technical challenge we address is that when facing the exact same scene, the user who places the VO and the user who views the VO may have different view angles and distances to the scene. This setting is realistic and the traditional solutions yield poor performance in terms of the accuracy. In this work, we have developed a suite of algorithms that can help the viewers accurately identify the same scene tolerating the view angle differences. We have prototyped our system, and the experimental results have shown significant performance improvements. Our source codes and demos can be accessed at https://github.com/PROMAR2019.

Continuous mobile vision is becoming increasingly important as it finds compelling applications which substantially improve our everyday life. However, meeting the requirements of quality of experience (QoE) diversity, energy efficiency and multi-tenancy simultaneously represents a significant challenge. In this paper, we present SCYLLA, an FPGA-based framework that enables QoE-aware continuous mobile vision with dynamic reconfiguration to effectively addresses this challenge. SCYLLA pre-generates a pool of FPGA design and DNN models, and dynamically applies the optimal software-hardware configuration to achieve the maximum overall performance on QoE for concurrent tasks. We implement SCYLLA on state-of-the-art FPGA platform and evaluate SCYLLA using drone-based traffic surveillance application on three datasets. Our evaluation shows that SCYLLA provides much better design flexibility and achieves superior QoE trade-offs than status-quo CPU-based solution that existing continuous mobile vision applications are built upon.

The advancement in deep learning and edge computing has enabled intelligent mobile augmented reality (MAR) on resource limited mobile devices. However, today very few deep learning based MAR applications are applied in mobile devices because they are significantly energy-guzzling. In this paper, we design a user preference based energy-aware edge-based MAR system that enables MAR clients to dynamically change their configuration parameters, such as CPU frequency and computation model size, based on their user preferences, camera sampling rates, and available radio resources at the edge server. Our proposed dynamic MAR configuration adaptations can minimize the per frame energy consumption of multiple MAR clients without degrading their preferred MAR performance metrics, such as service latency and detection accuracy. To thoroughly analyze the interactions among MAR configuration parameters, user preferences, camera sampling rate, and per frame energy consumption, we propose, to the best of our knowledge, the first comprehensive analytical energy model for MAR clients. Based on the proposed analytical model, we develop a LEAF optimization algorithm to guide the MAR configuration adaptation and server radio resource allocation. Extensive evaluations are conducted to validate the performance of the proposed analytical model and LEAF algorithm.