Ming Yang

Unmanned aerial vehicles (UAVs) have emerged as an efficient platform for periodically collecting massive amounts of data from distributed ground nodes (GNs) deployed for environmental and infrastructure monitoring.Given the limited onboard energy of UAVs, energy-efficient trajectory optimization is critical, yet existing studies often restrict vertical movement or treat height adjustments independently as discrete transitions between horizontal segments.To capture realistic three-dimensional motion, we adopt a practical 3D flight energy consumption model that accounts for the continuous coupling between horizontal and vertical propulsion power through joint horizontal--vertical speed optimization.Moreover, because the ground-to-air communication range varies with flight height, the horizontal and vertical speeds must be jointly optimized to balance communication coverage and flight energy consumption.Accordingly, we formulate a joint horizontal--vertical speed optimization (JHVSO) problem that simultaneously considers horizontal and vertical motions, height-dependent communication ranges, and the required data collection time of each GN.We establish key optimality properties by proving that constant-velocity straight-line flight minimizes the energy between two states for a given duration and deriving the pitch-angle-dependent speed that minimizes energy consumption per unit distance during unconstrained flight.Based on these properties, we develop an Optimal Reached Energy (ORE) dynamic programming algorithm that decomposes the trajectory into gap and task segments, recursively evaluates feasible communication-boundary transition states, and guarantees global optimality over the discretized state space through the non-aftereffect property between successive stages.Extensive simulations across 34 experimental configurations show that ORE consistently consumes less energy than ASSUME, MSMO, ACO, and a greedy speed--height baseline, reducing energy consumption by up to 14.8\% compared with the greedy speed--height baseline and by up to 5.1\% over the strongest competing baseline, while a case study involving 10 real-world traffic-camera locations further demonstrates its practical applicability.

Trusted execution environments (TEEs), like TrustZone, are pervasively employed to protect security sensitive programs and data from various attacks issued by untrusted rich execution environments (REEs) while they execute compact TEE operating systems which implement minimum security-critical operations but have poor device driver support. In this paper, we propose a twin driver approach where a pair of TEE and REE drivers is generated and cooperate to enable secure and efficient TEE driver support. To begin with, we propose a driver data flow analysis framework named driver analyzer (DrvAna) to automatically analyze the shared states between the TEE and REE driver where a novel data structure named value-type tree is investigated to facilitate field-sensitive data flow analysis upon the driver state. Furthermore, in order to maintain a minimal trusted computing base, we propose a Linux driver runtime (LDR) inside the TEE, a sandbox environment that confines the TEE driver based on the ARM domain access control features and mediates the driver's interaction with the TEE. We implement a DrvAna prototype based on LLVM as well as an LDR prototype on an NXP IMX6Q SABRE-SD evaluation board, adapt 6 existing Linux drivers into LDR, and evaluate their performance. The experimental results show that the LDR drivers can achieve comparable performance with their Linux counterparts with negligible overheads.

Anonymous networks facilitate privacy-preserving information transmission by ensuring data confidentiality and communication anonymity. While encryption effectively secures content, anonymity remains vulnerable to traffic analysis, which can expose users' network identities and communication relationships. Consequently, anonymity alone is insufficient, necessitating integrated technologies to further strengthen communication security. This paper introduces covert communication to anonymous networks by proposing a novel Covert Information Transmission Framework over Anonymous Networks, designed to realize both covert and anonymous data transfer. To the best of our knowledge, this is the first work to propose covert communication schemes specifically within anonymous networks. In our framework, we establish covert channels in the Tor network and transmit covert information based on Tor's hidden service protocol. Utilizing Tor's anonymous circuits, we strategically select suitable protocol data fields as information carriers and propose three covert communication schemes with distinct characteristics. These schemes enable secure data exchanges between clients and hidden services, catering to diverse communication requirements. Finally, we implement the proposed framework in a real-world Tor network and conduct extensive experiments to evaluate its feasibility and performance.

In recent years, the Internet of Things (IoT) has rapidly advanced, with applications ranging from smart homes to industrial manufacturing, often involving densely deployed nodes such as temperature and humidity sensors. Since these nodes have limited computation and energy, the use of stuffed Wi-Fi management frames for data transmission has emerged as a promising way to avoid the association overhead of the traditional transmission mode. However, this unassociated data transmission mode continues to encounter significant channel contention in dense deployments. To this end, we propose ODGMAC, an on-demand grouping-based MAC solution that dynamically groups transmission-awaiting nodes and allocates time slots on a per-group basis, thereby enabling intra-group contention to improve transmission efficiency and reduce node energy consumption. Firstly, we present a fuzzy control-based algorithm at the access point (AP) to dynamically identify nodes with transmission demands in the current beacon period. On this basis, we then propose a hierarchical group-based time slot allocation methodology. Specifically, the nodes are initially clustered according to their per-packet airtime requirements. Within each cluster, we evenly partition nodes into multiple groups and assign each group to a unique time slot for channel contention, where the optimal slot count is determined by a renewal-theory-based analytical model with a discrete search over candidate counts. Finally, we implement the ODGMAC testbed with one AP and 100 IoT nodes, and conduct real-world experiments in a dense environment. The experimental results show that our solution outperforms existing methods in terms of both data delivery rate and node power consumption. Specifically, under severe channel collision conditions, our solution achieves an average increase of 14.77% in data delivery rate and an average reduction of 8.21% in node power consumption, while maintaining excellent fairness. Moreover, extended simulations show that our solution scales to 1000 nodes and maintains excellent performance under node mobility.

Network Covert Channels (NCC) enhance covertness by concealing the existence of information transmission. However, traditional NCCs remain vulnerable to traffic analysis. Once NCC is detected, adversaries can breach anonymity by uncovering users' network identities and even communication relationships. While certain indirect NCCs offer limited anonymity to protect the identity of at most one party and the relationship, this level proves insufficient. This paper proposes ANCC, an innovative Anonymous Network Covert Channel that is the first to achieve comprehensive anonymity for the sender, the receiver and the communication relationship. By leveraging the Tor network's Hidden Service Directories (HSDirs) as intermediate nodes, Tor-based ANCC modulates covert information through the publication and retrieval statuses of hidden services distributed on multiple HSDirs. This mechanism allows ANCC traffic to blend seamlessly into legitimate Tor traffic, ensuring both robust covertness and high-level anonymity. Theoretical analysis demonstrates that even against a powerful adversary compromising fifty intermediate nodes, the detection probability remains below 0.25%, with the risk of identity or relationship exposure staying negligible (under 0.0021% and 0.00002% respectively). Additionally, the multiple HSDirs supporting parallel transmission enhance the channel capacity and error correction encoding strengthens the robustness. Extensive evaluation within the real-world Tor network demonstrates a transmission accuracy exceeding 99.6% and a channel capacity of around 3 Kbps, proving its effectiveness for practical applications.

Remote Procedure Call (RPC) services have become a primary gateway for users to access public blockchains. While they offer significant convenience, RPC services also introduce critical privacy challenges that remain insufficiently examined. Existing deanonymization attacks either do not apply to blockchain RPC users or incur costs like transaction fees assuming an active network eavesdropper. In this paper, we propose a novel deanonymization attack that can link an IP address of a RPC user to this user's blockchain pseudonym. Our analysis reveals a temporal correlation between the timestamps of transaction confirmations recorded on the public ledger and those of TCP packets sent by the victim when querying transaction status. We assume a strong passive adversary with access to network infrastructure, capable of monitoring traffic at network border routers or Internet exchange points. By monitoring network traffic and analyzing public ledgers, the attacker can link the IP address of the TCP packet to the pseudonym of the transaction initiator by exploiting the temporal correlation. This deanonymization attack incurs zero transaction fee. We mathematically model and analyze the attack method, perform large-scale measurements of blockchain ledgers, and conduct real-world attacks to validate the attack. Our attack achieves a high success rate of over 95% against normal RPC users on various blockchain networks, including Ethereum, Bitcoin and Solana.

Due to the diversity of architectures and peripherals of Internet of Things (IoT) systems, blackbox fuzzing stands out as a prime option for discovering vulnerabilities of IoT devices. Existing blackbox fuzzing tools often rely on companion apps to generate valid fuzzing packets. However, existing methods encounter the challenges of bypassing the cloud server side validation when it comes to fuzz devices that rely on cloud-based communication. Moreover, they tend to concentrate their efforts on Java components within Android companion apps, limiting their effectiveness in assessing non-Java components such as JavaScript-based mini-apps. In this paper, we introduce a novel blackbox fuzzing method, named RIoTFuzzer, designed to remotely uncover vulnerabilities of IoT devices with the assistance of companion apps, particularly those powered by All-in-one Apps with the JavaScript-based mini-apps feature enabled. Our approach utilizes document-based control command extraction, hybrid analysis for mutation point identification and side-channel-guided fuzzing to effectively address the challenges of fuzzing IoT devices remotely. We apply RIoTFuzzer to 27 IoT devices on prominent platforms and discovered 11 vulnerabilities. All of them have been acknowledged by the corresponding vendors. 8 have been confirmed by the vendors and have been assigned 4 CVE IDs. Our experiment results also demonstrate that side-channel-guided fuzzing can significantly enhance the efficiency of fuzzing packets sent to IoT devices, with an average increase of 76.62% and a maximum increase of 362.62%.