Novel backscatter communication techniques allow battery-free sensor tags to operate with standard IoT devices, thereby augmenting a network’s sensing capabilities. For communicating, sensor tags rely on an unmodulated carrier provided by neighboring IoT devices, with a schedule coordinating this provisioning across the network. Computing schedules to interrogate all sensor tags while minimizing energy, spectrum utilization, and latency—i.e., carrier scheduling—is an NP-hard problem. While recent work introduces learning-based systems for carrier scheduling, we find that their advantage over traditional heuristics progressively decreases for networks with hundreds of IoT nodes. Moreover, we find that their generalization is not consistent: it greatly varies across identically trained models while fixing the dataset, hyperparameters and random seeds used. We present RobustGANTT, a Graph Neural Network scheduler for backscatter networks that learns from optimal schedules of small networks (up to 10 nodes). Our scheduler generalizes, without the need for retraining, to networks of up to hundreds of nodes (100× training topology sizes), and exhibits consistent generalization across independent training rounds. We evaluate our system on both simulated topologies of up to 1000 nodes and real-life IoT network topologies of up to 300 IoT devices. RobustGANTT not only exhibits better generalization than existing systems, it also computes schedules achieving up to 2× less energy and spectrum utilization. Additionally, its polynomial runtime complexity allows it to react fast to changing network conditions. Our work facilitates the operation of large-scale IoT networks, and our machine learning findings further advance the capabilities of learning-based network scheduling. We release our code, datasets and pre-trained models

Low-power IPv6 stacks are being used in a myriad of IoT networks, which makes it essential that they are secure. Fuzz testing has proven an invaluable method to discover vulnerabilities in software that take complex input, including protocol implementations. Still, fuzzing tools typically cannot test state-dependent parts of IoT network stacks. To bridge this gap, we design and implement NESFuzzer, a tool for stateful fuzzing of IoT network stacks. Unlike previous methods in this area, NESFuzzer enables stateful fuzzing while leveraging the techniques of existing coverage-guided and hybrid fuzzing tools such as MOpt and SymCC without modifications. This decoupling is made possible through a modular, network-based architecture in which the system being tested communicates with an external service to generate specific protocol states. We evaluate our work through a case study on the Contiki-NG operating system, and show that the test coverage increases by up to 170% in certain modules of the network stack. Using NESFuzzer, we have discovered four security vulnerabilities that could not be found with conventional fuzzing

Low-power IPv6 stacks are being used in a myriad of IoT networks, which makes it essential that they are secure. Fuzz testing has proven an invaluable method to discover vulnerabilities in software that take complex input, including protocol implementations. Still, fuzzing tools typically cannot test state-dependent parts of IoT network stacks. To bridge this gap, we design and implement NESFuzzer, a tool for stateful fuzzing of IoT network stacks. Unlike previous methods in this area, NESFuzzer enables stateful fuzzing while leveraging the techniques of existing coverage-guided and hybrid fuzzing tools such as MOpt and SymCC without modifications. This decoupling is made possible through a modular, network-based architecture in which the system being tested communicates with an external service to generate specific protocol states. We evaluate our work through a case study on the Contiki-NG operating system, and show that the test coverage increases by up to 170% in certain modules of the network stack. Using NESFuzzer, we have discovered four security vulnerabilities that could not be found with conventional fuzzing

Novel backscatter communication techniques enable battery-free sensor tags to interoperate with unmodified standard IoT devices, extending a sensor network’s capabilities in a scalable manner. Without requiring additional dedicated infrastructure, the battery-free tags harvest energy from the environment, while the IoT devices provide them with the unmodulated carrier they need to communicate. A schedule coordinates the provision of carriers for the communications of battery-free devices with IoT nodes. Optimal carrier scheduling is an NP-hard problem that limits the scalability of network deployments. Thus, existing solutions waste energy and other valuable resources by scheduling the carriers suboptimally. We present DeepGANTT, a deep learning scheduler that leverages graph neural networks to efficiently provide near-optimal carrier scheduling. We train our scheduler with optimal schedules of relatively small networks obtained from a constraint optimization solver, achieving a performance within 3% of the optimum. Without the need to retrain, our scheduler generalizes to networks 6 × larger in the number of nodes and 10 × larger in the number of tags than those used for training. DeepGANTT breaks the scalability limitations of the optimal scheduler and reduces carrier utilization by up to compared to the state-of-the-art heuristic. As a consequence, our scheduler efficiently reduces energy and spectrum utilization in backscatter networks.

Fuzz testing (“fuzzing”) is a widely-used and effective dynamic technique to discover crashes and security vulnerabilities in software, supported by numerous tools, which keep improving in terms of their detection capabilities and speed of execution. In this paper, we report our findings from using state-of-the-art mutation-based and hybrid fuzzers (AFL, Angora, Honggfuzz, Intriguer, MOpt-AFL, QSym, and SymCC) on a non-trivial code base, that of Contiki-NG, to expose and fix serious vulnerabilities in various layers of its network stack, during a period of more than three years. As a by-product, we provide a Git-based platform which allowed us to create and apply a new, quite challenging, open-source bug suite for evaluating fuzzers on real-world software vulnerabilities. Using this bug suite, we present an impartial and extensive evaluation of the effectiveness of these fuzzers, and measure the impact that sanitizers have on it. Finally, we offer our experiences and opinions on how fuzzing tools should be used and evaluated in the future.

Contiki-NG (Next Generation) is an open source, cross-platform operating system for severely constrained wireless embedded devices. It focuses on dependable (reliable and secure) low-power communications and standardised protocols, such as 6LoWPAN, IPv6, 6TiSCH, RPL, and CoAP. Its primary aims are to (i) facilitate rapid prototyping and evaluation of Internet of Things research ideas, (ii) reduce time-to-market for Internet of Things applications, and (iii) provide an easy-to-use platform for teaching embedded systems-related courses in higher education. Contiki-NG started as a fork of the Contiki OS and retains many of its original features. In this paper, we discuss the motivation behind the creation of Contiki-NG, present the most recent version (v4.7), and highlight the impact of Contiki-NG through specific examples. © 2022 The Authors

Low-power wireless networks transmit at low output power and are hence susceptible to cross-technology interference. The latter may cause packet loss which may waste scarce energy resources by requiring the retransmission of packets. Jamming attacks are even more harmful than cross-technology interference in that they may totally prevent packet reception and hence disturb or even disrupt applications. Therefore, it is important to recognize such jamming attacks. In this paper, we present JamSense. JamSense extends SpeckSense, a system that is able to detect multiple sources of interference, with the ability to classify jamming attacks. As SpeckSense, JamSense runs on resource-constrained nodes. Our experimental evaluation on real hardware shows that JamSense is able to identify jamming attacks with high accuracy while not classifying Bluetooth or WiFi interference as jamming attacks.

As research in smart homes and activity recognition is increasing, it is of ever increasing importance to have benchmarks systems and data upon which researchers can compare methods.While synthetic data can be useful for certain method developments, real data sets that are open and shared are equally as important. This paper presents the E-care@home system, its installation in a real home setting, and a series of data sets that were collected using the E-care@home system. Our first contribution, the E-care@home system, is a collection of software modules for data collection, labeling, and various reasoning tasks such as activity recognition, person counting, and configuration planning.It supports a heterogeneous set of sensors that can be extended easily and connects collected sensor data to higher-level Artificial Intelligence (AI) reasoning modules. Our second contribution is a series of open data sets which can be used to recognize activities of daily living. In addition to these data sets, we describe the technical infrastructure that we have developed to collect the data and the physical environment. Each data set is annotated with ground-truth information, making it relevant for researchers interested in benchmarking different algorithms for activity recognition.

Standard protocols for wireless Internet of Things (IoT) communication must be energy-efficient in order to prolong the lifetimes of IoT devices. Two energy-saving strategies for wireless communication are prevalent within the IoT domain: 1) sleepy devices and 2) radio duty cycling. In this paper, we conduct a comprehensive evaluation as to what types of application scenarios benefit the most from either type of energy-saving strategy. We select the lightweight machine to machine (LwM2M) protocol for this purpose because it operates atop the standard constrained application protocol, and has support for sleepy devices through its Queue Mode. We implement the Queue Mode at both the server side and client side, and design enhancements of Queue Mode to further improve the performance. In our experimental evaluation, we compare the performance and characteristics of Queue Mode with that of running LwM2M in a network stack with the standard time-slotted channel hopping as the duty cycling medium access control protocol. By analyzing the results with the support of an empirical model, we find that each energy-saving strategy has different advantages and disadvantages depending on the scenario and traffic pattern. Hence, we also produce guidelines that can help developers to select the appropriate energy-saving strategy based on the application scenario.

This paper describes the design and implementationof a network scheduler prototype for IoT networks within the e-healthcare domain. The network scheduler combines a constraint-based task planner with the Lightweight Machine-to-Machine (LwM2M) protocol to be able to reconfigure IoT networks at run-time based on recognized activities and changes in the environment. To support such network scheduling, we implement a LwM2M application layer for the IoT devices that provides sensor data, network stack information, and a set of controllable parameters that affect the communication performance and the energy consumption.