Mitigating Traffic Remapping Attacks in Autonomous Multi-hop Wireless Networks

TL;DR

This paper proposes a game-theoretic, distributed mitigation strategy called DISTRESS to counter traffic remapping attacks in autonomous multi-hop wireless networks, promoting honest behavior and maintaining QoS.

Contribution

It introduces a novel QoS metric and a self-enforcing game-theoretic approach with a signaling mechanism to encourage honest node behavior in the presence of TRAs.

Findings

DISTRESS encourages honest behavior after limited play time

The approach maintains acceptable QoS for most nodes

Simulations confirm effectiveness in static and mobile scenarios

Abstract

Multi-hop wireless networks with autonomous nodes are susceptible to selfish traffic remapping attacks (TRAs). Nodes launching TRAs leverage the underlying channel access function to receive unduly high quality of service (QoS) for packet flows traversing source-to-destination routes. TRAs are easy to execute, impossible to prevent, difficult to detect, and harmful to the QoS of honest nodes. Recognizing the need for providing QoS security, we use a novel network-oriented QoS metric to propose a self-enforcing game-theoretic mitigation approach. By switching between TRA and honest behavior, selfish nodes engage in a noncooperative multistage game in pursuit of high QoS. We analyze feasible node strategies and design a distributed signaling mechanism called DISTRESS, under which, given certain conditions, the game produces a desirable outcome: after an upper-bounded play time, honesty tends to become a selfish node's best-reply behavior, while yielding acceptable QoS to most or all nodes. We verify these findings by Monte Carlo and ns-3 simulations of static and mobile nodes.

Figures

Tables

Table 1. TABLE I: Summary of Notation Used

Symbol	Definition
$ac$	An e2e-flow’s intrinsic AC
$A$	Set of attackers
$cost$	Nodal cost metric
$C{H}_i(r,ac)$	Set of h-flows competing with outgoing h-flow $(i,r,ha{c}_i(r,ac))$
$s_r,d_r$	Source and destination nodes of route $r$
$\Delta$	Set of in-distress nodes
${\Delta }^{\ast }$	Set of in-exposure nodes
$E_{R_F}\left(M\right)$	Set of nodes whose source traffic is forwarded by nodes in $M$
$E_{R_F^{\ast }}\left(M\right)$	Set of nodes forward-reliant on nodes in $M$
$fcost$	e2e-flow cost metric
$F$	Set of e2e-flows in the network
$F^{\ast }$	Set of survivable e2e-flows in the network
$G\left(k\right)$	Set of in-game nodes in stage $k$
$\Gamma$	Set of best-reply nodes
${𝐡}_i$	Node $i$’s history of membership in $A\left(k-1\right)$ and $A\left(k\right)$
$H$	Set of recognizable h-flows
$I$	Set of ill-behaved nodes
$(j,r,hac)$	An h-flow of e2e-flow $(r,ac)$ incoming from node $j$
$k$	Stage of the TRA game
$mang\left(\right)$	Packet mangling function (CoS-to-AC mapping)
$map$	Function determining ACs of outgoing h-flows
$O{H}_i$	Set of outgoing h-flows at node $i$
$pre{d}_{r,i}$	Predecessor (previous-hop node) to node $i$ on route $r$
$P_{r,i}$	Set of nodes that precede or coincide with node $i$ on route $r$
$\sigma$	An action selection rule in the TRA game
$suc{c}_{r,i}$	Successor (next-hop node) to node $i$ on route $r$
$r$, $\Vert r\Vert$	An end-to-end route and its hop-length
$(r,ac)$	An e2e-flow of intrinsic AC $ac$ following route $r$
$ran{k}_i(r,ac)$	Performance metric for e2e-flow $(r,ac)$ at node $i$
$R$	Set of all end-to-end routes in the network
$R_F$	Forwarding relationship
$R_F^{\ast }$	Forward-reliance relationship
$T=⟨N,L⟩$	Network topology graph (set of nodes, set of links representing node hearability)

Table 2. TABLE II: Simulation results: average after-game characteristics for action selection rules (a) to (f); ∥ r ∥ min = 1 subscript delimited-∥∥ 𝑟 min 1 \lVert r\rVert_{\text{min}}=1 .

Action selection rule	Honest in $I$ [%]	Rationality [%]∗	Efficiency [%]	Defensibility [%]	Survivability [%]	Game duration [stages]
(a)	0	87.3 (79.4)	68.9	49.3	26.5	3
(b)	31.1	82.9 (66.8)	72.9	48.6	29.3	3.8
(c)	42.6	64.4 (37.0)	76.6	54.0	36.9	4.6
(d)	49.0	93.2 (79.2)	81.5	75.2	50.7	4.9
(e)	77.1	97.1 (90.7)	91.2	87.4	73.3	5.1
(f)	100	76.9 (48.6)	100	100	100	3.7

Table 3. TABLE III: ns-3 simulation parameters

Parameter	Value
Total number of nodes	16
Node placement	grid, random
Area size	20 x 20 m
Grid spacing	8 m
Mobility model	random waypoint
Waiting time	20 s
Velocity	0 – 1.4 m/s
PHY/MAC	IEEE 802.11ac
RTS/CTS	Enabled
Channel width	20 MHz
Modulation	256-QAM
Coding rate	3/4
aCWmin	631
Routing	OLSR2
Transport protocol	UDP
Traffic generator	CBR
Traffic rate	2 Mb/s

Equations

$$\{s_r|(r,ac)\in F\}=N.$$

$$ha{c}_i(r,BE)=\{\begin{array}{rl}& VO,s_r\in A\wedge P_{r,i}\setminus \{s_r\}\cap A=\varnothing ,\\ & BE,\text{otherwise},\end{array}$$

$$ha{c}_i(r,VO)=\{\begin{array}{rl}& VO,P_{r,i}\setminus \{s_r\}\cap A=\varnothing ,\\ & BE,\text{otherwise}.\end{array}$$

$$O{H}_i=\{(i,r,ha{c}_i(r,ac))|(r,ac)\in F\wedge i\in r\setminus \{d_r\}\}.$$

$$\begin{gathered} C{H}_i(r,ac)=O{H}_i\setminus \{(i,r,ha{c}_i(r,ac))\} \\ \cup {\bigcup }_{j:(j,i)\in L}O{H}_j\cup {\bigcup }_{j:(j,suc{c}_{r,i})\in L\wedge (j,i)\notin L}O{H}_j. \end{gathered}$$

$$\begin{gathered} ran{k}_i(r,ac){|}_{hac,vo,be}\le ran{k}_i(r,ac){|}_{ha{c}^{\prime },v{o}^{\prime },b{e}^{\prime }} \\ \text{iff}{S}_i(r,ac){|}_{hac,vo,be}\ge S_i(r,ac){|}_{ha{c}^{\prime },v{o}^{\prime },b{e}^{\prime }} \end{gathered}$$

$$\begin{gathered} ran{k}_i(r,ac)=\text{mathbbm}{1}_{hac=BE}\cdot \alpha \cdot (vo+\text{mathbbm}{1}_{vo>1\vee be>2}) \\ +\beta \cdot (vo+\text{mathbbm}{1}_{hac=BE})+be, \end{gathered}$$

$$fcos{t}_{(r,ac)}(A)=\{\begin{array}{rlr}& \frac{{\sum }_{i\in r\setminus \{d_r\}}ran{k}_i(hac,r,ac)}{\Vert r\Vert -1},& ac=VO,\\ & \underset{i\in r\setminus \{d_r\}}{\max }ran{k}_i(hac,r,ac),& ac=BE,\end{array}$$

$$cos{t}_i(A)=\sum _{(r,ac)\in F:s_r=i}{\gamma }_{r,i}\cdot fcos{t}_{(r,ac)}(A),$$

$$⟨N,2^N,cost:N\times 2^N\to {\mathbf{R}}^{+}⟩.$$

$$cos{t}_i^{\prime }(A)=\{\begin{array}{rlr}& cos{t}_i(A),& i\notin {\Delta }^{\ast }(A),\\ & \infty ,& i\in {\Delta }^{\ast }(A),\end{array}$$

$$⟨N,2^N,cos{t}^{\prime }:N\times 2^N\to {\mathbf{R}}^{+}⟩.$$

$$A(k+1)={\sigma }_{A(k),\Delta (A(k)),{\Delta }^{\ast }(A(k-1))},$$

$${\sigma }_{X,Y,Z}=\bigcup _{(x,y,z)\in \Phi \subseteq \{-1,1{\}}^3}{X}^x\cap Y^y\cap Z^z,$$

$$\forall X\subseteq N:X^1=X,X^{-1}=N\setminus X.$$

$$A(k+1)=I\cap (G^{-1}(k)\cap A(k))\cup (G(k)\cap \Sigma ),$$

$$\forall 1\le c\le \min \{c_{max},k-1\}:{\mathbf{h}}_i(k)\ne {\mathbf{h}}_i(k-c).$$

Full text

I Introduction

Multihop wireless transmission is the underlying principle of various types of wireless networks: sensor, mesh, ad hoc, cellular (using cooperative user-to-base-station relays), vehicular, opportunistic (delay tolerant) and Internet of Things (IoT) segments. In this paper we focus on wireless networks with autonomous nodes, referred to as multi-hop autonomous wireless networks (MAWiNs), which are an active research field exploring the self-organizing network concept [1] and its numerous embodiments, such as autonomous mobile mesh networks [2, 3], autonomous vehicular networks [4], autonomous sensor networks [5], and flying ad hoc networks [6]. In large-scale IoT systems, multihop cooperative relaying has been observed to improve the throughput, reliability, and energy efficiency of the data exchange between end-user devices (e.g., smart meters) and gateway nodes (e.g., data aggregation points) [7, 8, 9, 10, 11].

Besides classical threats to wireless transmission, MAWiNs face unique security threats due to node autonomy. Sustained operation of such networks relies on the nodes’ benevolent compliance with cooperative protocols, such as fair channel access, transit packet forwarding on behalf of out-of-range source and destination nodes, and route discovery. Nodal cooperation entails certain costs in terms of energy expenditure and quality of service (QoS) received by source (locally generated) traffic: fair channel access requires deferment of one’s own packet transmission, which causes delays; transit packet forwarding consumes energy and bandwidth, which diminishes source traffic throughput; and route discovery introduces communication overhead and processing burden. Autonomous nodes thus tend to exhibit rational (selfish) behavior, seeking a favorable tradeoff between received QoS and incurred costs. This makes MAWiNs susceptible to selfish attacks that abuse the employed network protocols to the attacker’s benefit.

Selfish attacks can be categorized as “supply-side” (attempts to reduce costs of performing network services for other nodes) and “demand-side” (attempts to acquire undue network resources through aggressive competition). The former are common at the Internet layer, e.g., refusal to forward transit packet saves energy and bandwidth for source traffic, and falsifying route advertisements may deactivate incident routes and thus relieve a node from transit traffic. In response, defense mechanisms need to be deployed, such as secure routing protocols [12], intrusion detection/prevention systems [13], credit-based schemes [14], and trust management frameworks [15].

Known “demand-side” selfish attacks range from the link layer to the transport layer and usually consist in manipulation of sensitive protocol parameters, e.g., the contention window of IEEE 802.11 [16] or congestion control settings of TCP [17]. They have been countered by a number of detection- or prevention-type mechanisms [18] and often investigated using game theory [19], e.g., for incentivizing selfish IoT devices to participate in cooperative communication [20, 21]. A less known variety of selfish attacks by the name QoS abuse [22] or traffic remapping attack (TRA) [23] emerges in environments supporting traffic class-based QoS differentiation to enforce user-network QoS contracts such as Service Level Agreements (SLAs) [24]. By falsely assigning traffic to classes, an attacker node abuses provisioned QoS policies and can receive a higher QoS level for its source traffic at the cost of honest nodes’ source traffic. MAWiNs make a perfect scene for TRAs especially if they offer QoS differentiation as part of the network’s mission rather than a metered service, which makes launching a TRA costless, whereas their inherent lack of node accountability reduces the risk of detection and punishment. Thus on top of classical problems with network resource deficiency and/or mismanagement, threats to contractual QoS can arise from QoS abuse and should be addressed by a new class of defense mechanisms that can be collectively termed QoS security. Their task is to protect information security, in the sense of enforcing QoS guaranteed to honest nodes, in the presence of QoS abuse.

In wireless networks using IEEE 802.11, TRAs can exploit the enhanced distributed channel access (EDCA) function. EDCA defines four access categories (ACs), each with its own parameters controlling the priority and duration of medium access [16]. Packets are mapped to ACs based on the Differentiated Services Code Point (DSCP) in their IP header, which reflects the traffic’s Class of Service (CoS) [25]. For simplicity assume that DSCP can be either expedited forwarding (EF) or best effort (BE). The CoS-to-DSCP mapping is implemented by Internet layer packet mangling software, such as Linux iptables. TRAs can be easily executed by setting DSCP = EF in source traffic whose CoS maps to BE and DSCP = BE in forwarded (transit) traffic whose CoS maps to EF, cf. Fig. 1. In contrast, AC parameter modification requires tampering with the DSCP-to-AC mapping embedded in wireless card drivers. Furthermore, TRAs are difficult to detect: determining if higher-layer traffic matches its DSCP designation requires deep packet inspection [26] and global knowledge of the DSCP assignment policy.

In single-hop settings, TRAs have been shown to drastically reduce the throughput of honest nodes unless the latter employ a carefully designed MAC-layer discouragement scheme [26]. The multi-hop nature of MAWiNs poses a number of additional challenges for a defense scheme:

• •

a selfish node can both promote its source traffic and demote transit traffic,

• •

a locally performed TRA has an end-to-end impact: once assigned a false QoS designation, a packet retains it further down the route,

• •

the impact of TRA is unclear ex ante, due to the complex interplay of multiple layers: PHY (hidden nodes), MAC (channel contention), and transport (flow control); this interplay also blurs QoS perception and rules out straightforward detection-based countermeasures,

• •

the absence of single-broadcast hearability rules out simple punitive measures such as threats of jamming,

• •

heuristic end-to-end countermeasures against TRAs are moderately effective [23]; in particular, countermeasures that work well in single-hop settings, such as ACK dropping, fail in multi-hop settings [27].

Being rationally motivated, easy to execute, impossible to prevent, difficult to detect, and harmful to honest nodes, TRAs call for incentive-based defense. Unfortunately, the lack of a central authority rules out common approaches based on reputation building or Stackelberg games [7, 8, 15], hence a novel game-theoretic methodology is also needed. In [28], we presented an early formulation of the multihop TRA problem and preliminary insights into its impact upon the nodes’ cost metric. A multistage game-type TRA mitigation scheme was proposed, whose convergence and alignment with nodes’ rationality was only supported by numerical and Monte Carlo simulation arguments. Building on a more rigorous network model we offer herein a provably convergent, rational, and effective TRA mitigation scheme in the spirit of “brinkmanship game theory” [29]: credible threats force nodes to toggle between TRA and honest behavior, and so engage in a noncooperative game in pursuit of high QoS. Although our analytical results apply to networks with static nodes, simulations show the scheme is also effective with node mobility. Our main contributions are:

Based on a MAWiN model with a static topology and traffic flows, we formally define plausible opportunistic TRAs, and discuss their motivation and impact. 2. 2.

We develop a heuristic end-to-end QoS metric that only uses information about the network topology and traffic flows, and verify it by simulation and comparison with alternative heuristics. 3. 3.

We design a distributed DISTRESS mechanism to signal the threat of service suspension due to ongoing TRAs. DISTRESS requires little data analysis and inter-node synchronization, and needs not distinguish between TRA and objectively harsh traffic conditions. 4. 4.

Using the developed QoS metric as a payoff function, we analyze the game arising among ill-behaved nodes under DISTRESS and state conditions of its desirable outcome. We show that after an upper-bounded play time, honesty tends to become an ill-behaved node’s best-reply behavior, keeping QoS acceptable to most or all nodes. These findings are verified by extensive Monte Carlo and time-true simulations of static and mobile nodes.

The remainder of the paper is organized as follows. In Section II we outline related work on QoS abuse in wireless networks and highlight the unsolved problems which justify our research, including the need for a macroscopic MAWiN network model. In Section III-A we formulate a topology and traffic flow model, next used in Section III-B to formalize the notion of TRA. In Section III-C we develop a MAWiN performance model and propose an end-to-end QoS metric; the latter is shown in Section III-D to yield quantitative insight into the motivation and impact of TRAs. In Sections IV-A and IV-B, respectively, we describe the one-shot TRA game arising among ill-behaved nodes, and propose a model of multistage play to discourage TRAs. “Good” multistage strategies are analyzed in Section IV-C and validated by simulations in Section V. Section VI concludes the paper.

II Related Work

Selfish attacks in MAWiNs have mostly been studied at the Internet layer. The main attack under consideration has been packet dropping, also referred to as forwarding/relaying misbehavior. This attack can be considered as launched either on all packets (full dropping) or only on selected packets (partial dropping). In the latter case the dropping can be either probabilistic or deterministic (e.g., may specifically target some packet types such as routing control packets, or some source-to-destination routes).

The packet dropping attack has been widely analyzed. Due to node autonomy and lack of any administrative control only “soft” countermeasures are possible. Some proposals involve micropayment (credit) schemes, where a virtual currency is earned for relaying and next used to buy similar services [14]. Others have focused on explicit identification of attackers. This can be done passively, e.g., through a watchdog mechanism where nodes promiscuously listen to the channel and observe offending behavior [30], or actively, e.g., using additional end-to-end acknowledgments to determine which routes contain packet dropping attackers [31]. Attacker identification can be enhanced through complex audit- and reputation-based schemes where a node derives a reputation score of any other node from first-hand (watchdog-based) experience, and possibly from reputation scores calculated by third-party nodes; low-reputation nodes are identified as attackers [32].

The main response to Internet layer attacks has been of a reciprocation nature, i.e., restricted forwarding of attackers’ source packets. This gives rise to numerous analyses of the underlying forwarding game. Various strategies (e.g., tit-for-tat) have been considered to enforce honest packet forwarding; see [33] for a systematic treatment. A complementary response is to route traffic around attackers. However, this is in fact beneficial to them, as they can expend less energy and bandwidth on forwarding [34].

At the link layer, most attacks have found the IEEE 802.11 channel access function [16] an easy target. Numerous studies have shown that launching a backoff attack, i.e., changing the transmission deferment parameters (such as idle carrier sensing or backoff times) yields the attacker a considerable increase in throughput and access delays at the cost of honest nodes [35, 36]. Link layer attacks have mostly been studied in a single-hop setting, which is not surprising given their local-scope nature.

QoS differentiation opens new vulnerabilities to attacks referred to in the literature as “QoS abuse” [37, 38] or “class hijacking” [39, 40]. In this area, researchers have also studied selfishness in forwarding multimedia streams [41], nodes misreporting channel request parameters [42], and various cooperative forwarding strategies [43]. Campus network designers have long foreseen that too much high-priority traffic may overwhelm the available bandwidth and/or switch capacity [22]; in infrastructure-based networks under administrative supervision an obvious solution is to allow traffic marking with CoS/DSCP only at the network edge, subject to valid traffic contracts, rather than at users’ premises. However, QoS abuse, exemplified by TRAs, is much harder to defend against in ad hoc networks, which lack a well-defined user-to-network interface.

TRAs are tied to the link layer: despite being launched at the Internet layer (through modifying DSCP), they exploit the underlying channel access prioritization. Local-scope TRAs were considered in [26] and acknowledged as a threat to transmission opportunity sharing protocols [44]. Multi-hop settings are also vulnerable [45]; [46] discusses attacks in IEEE 802.11s mesh networks, [27] – in two-hop relay networks, while [23] provides an overview of TRAs in ad hoc networks along with a discussion of attack detection and defense measures. Additionally, [47] studies a practical relaying scenario where users may execute TRAs.

From a detection viewpoint, TRAs are more challenging in multi-hop settings than in single-hop ones, because it is not always clear how local-scope manipulation of per-traffic class handling translates into end-to-end per-flow or per-packet performance – link layer attacks such as TRAs consist in aggressive competition for a limited resource (the radio channel), bringing more benefit to the attacker and more harm to the honest nodes than do Internet layer attacks, where the benefit or harm is less pronounced. Single-hop settings are also easier to defend: when a traffic remapping attacker has been identified, it can be punished by neighbor honest nodes via responding in kind, e.g., increased transmission rate or jamming [48]. In a multi-hop setting, however, punishment of TRAs may prove ineffective if known local-scope defense mechanisms are directly mimicked. Thus studies of selfish link layer attacks in multi-hop wireless networks leave many insights to be gained.

In this paper we are interested in MAWiN-oriented defense mechanisms justifiable by noncooperative game-theoretic considerations, i.e., rendering TRAs non-beneficial for attackers in terms of perceived QoS. This requires simple performance models of MAWiNs under TRAs that yield closed-form solutions and thus handy payoff functions for arising games. Few such models are known, none of them able to capture on a macroscopic level the complex interplay of channel access queuing and contention, EDCA prioritization, node mobility, and intra-flow competition due to multi-hop forwarding in the presence of hidden nodes (where packet transmissions from one node compete with those from up- and downstream nodes one or two hops away). Existing models are usually limited to chain topologies [49, 50] or tied to specific analytical models of high complexity [51]; they do not consider traffic differentiation.

III Network Model

In this section we formalize the network and TRA description, and develop an end-to-end performance model to quantify TRA motivation and impact. A summary of the notation used in the paper is presented in Table I.

III-A Topology, Routes, and Flows

A static MAWiN topology is represented by a directed graph $T=\langle N,L\rangle$, where $N$ is the set of nodes, $L\subset N\times N$, and $(i,j)\in L$ iff $i\neq j$ and $j$ is in the hearability range of $i$. Let $N^{*}$ be the set of all directed acyclic routes in $T$ and $R\subseteq N^{*}$ be the set of end-to-end routes in $T$ as determined by the routing algorithm in use. Each route $r\in R$ is represented as a sequence of nodes $r=(i_{1},\dots,i_{m})$ such that $i_{1},\dots,i_{m}$ are all distinct and $(i_{m^{\prime}},i_{m^{\prime}+1})\in L$ for all $m^{\prime}=1,\cdots,m-1$; $i_{1}$ and $i_{m}$ are the source and destination nodes of $r$, denoted $s_{r}$ and $d_{r}$, $i_{2},\dots,i_{m-1}$ are the transit nodes, and $\lVert r\rVert=m-1$ is the hop length of $r$. We write $i\in r$ if $r$ involves node $i$; for $i,j\in r$ write $i<_{r}j$ ($i\leq_{r}j)$ if $i$ precedes (precedes or coincides with) $j$ on $r$. For $i\in r\setminus\{d_{r}\}$ denote by $succ_{r,i}$ the immediate successor of $i$ on $r$, and for $i\in r\setminus\{s_{r}\}$ define $pred_{r,i}$ as the immediate predecessor of $i$ on $r$; for uniformity, $pred_{r,s_{r}}$ is defined as $s_{r}$. (In the parlance of wireless multi-hop networks, a node $i^{\prime}$ is said to be hidden from $i$ if $(i,i^{\prime})\notin L$ and $\exists j\in N,r,r^{\prime}\in R$ : $j=succ_{r,i}=succ_{r^{\prime},i^{\prime}}$.) Denote by $P_{r,i}=\{j|j\leq_{r}i\}$ the set of nodes that precede or coincide with $i$ on $r$.

We model network traffic as composed of end-to-end (e2e-) flows, each of which is a collection of packets of the same CoS $\in\{\text{EF},\text{BE}\}$ and moving along the same route. The corresponding link layer frames are handled by EDCA according to assigned ACs, contained in the AC fields of their headers. For ease of presentation we restrict the used ACs to VO (real-time traffic such as voice/video) and BE (best-effort traffic), with VO having (statistical) priority over BE at the link layer. Since packet mangling amounts to a CoS-to-AC mapping, we define a function $mang:\{\text{EF},\text{BE}\}\to\{VO,BE\}$ such that $mang(\text{EF})=VO$ and $mang(\text{BE})=BE$. An e2e-flow of a given CoS is represented as $(r,ac)$, where $r\in R$ is its route and $ac=mang(\text{CoS})$ is its intrinsic AC as returned at $s_{r}$. Let $F\subseteq R\times\{VO,BE\}$ be the (quasi-static) set of e2e-flows offered by MAWiN users. Presumably, only nodes generating their own source traffic are interested in staying connected, therefore we assume that at least one e2e-flow is offered at each node, i.e.,

[TABLE]

For further analysis, it is necessary to formally state the fact that a source of a traffic flow is reliant on a set of nodes for forwarding its packets.

Definition 1**.**

Let $R_{F}\subseteq N\times N$ be a binary relationship such that $(i,j)\in R_{F}$ iff $j$ forwards $i$’s source traffic, i.e., $\exists(r,ac)\in F:i=s_{r}\land j\in r\setminus\{d_{r}\}$ (in particular, $(s_{r},s_{r})\in R_{F}$). The transitive closure of $R_{F}$, denoted $R_{F}^{*}$, will be referred to as forward-reliance, i.e., $(i,j)\in R^{*}_{F}$ iff there exists a sequence of nodes $i_{1},i_{2},...,i_{k}$ with $i_{1}=i$ and $i_{k}=j$ such that $i_{l+1}$ forwards $i_{l}$’s source traffic, $l=1,\dots,k-1$.

Assume that a removal from the network of a forwarding node on $r$ causes $s_{r}$ to be removed as well. Then $(i,j)\in R^{*}_{F}$ expresses node $i$’s forward-reliance on node $j$ in that a removal of $j$ ultimately causes a removal of $i$. For $M\subseteq N$, let $E_{R_{F}}(M)=\{i\in N|\exists j\in M:(i,j)\in R_{F}\}$; the set of nodes forward-reliant on nodes in $M$ is therefore $E_{R_{F}^{*}}(M)$. We have $M\subseteq E_{R_{F}}(M)\subseteq E_{R_{F}^{*}}(M)$, the first inclusion due to (1).

We use the notion of hop (h-) flows as the granulation level at which incoming traffic is recognized at a next-hop node. Packets of e2e-flow $(r,ac)$ forwarded by $j=pred_{r,i}$, whose AC fields contain $hac\in\{VO,BE\}$, are recognized at node $i\in r$ as an h-flow $(j,r,hac)$. (Possibly $hac\neq ac$, because AC fields can be modified hop-by-hop.) By convention, let e2e-flow $(r,ac)$ be recognized at $s_{r}$ as h-flow $(s_{r},r,ac)$. For example, if node 3 in Fig. 2 changes the AC fields of incoming packets then e2e-flow #1, designated as (1, $VO$), is recognized as (1, $r_{1}$, $VO$) at node 1, (1, $r_{1}$, $VO$) at node 3, (3, $r_{1}$, $BE$) at node 4 etc., where $r_{1}=(1,3,4,5,8,10)$. Let $H\subseteq N\times R\times\{VO,BE\}$ be the set of recognizable h-flows.

Autonomous operation of node $i$ is expressed as a function $map_{i}:H\rightarrow\{VO,BE\}$ according to which it sets ACs of h-flows. For an incoming h-flow $(j,r,hac)$, where $j=pred_{r,i}$ and $i\in r\setminus\{s_{r},d_{r}\}$, the new AC field forwarded by $i$ further along $r$ is given by $map_{i}(j,r,hac)$.

III-B Attack Model

We consider an attacker to be a selfish node which aims to receive a higher QoS level for its source traffic by performing a TRA, i.e., changing the traffic class of incoming transit or source flows. The Internet layer’s packet mangling functionality is used as explained in Section I (Fig. 1) to interfere with the default CoS-to-AC mapping and modify the IP header fields of incoming packets, which are transmitted further along their path with a different MAC-layer priority. Except for the path’s destination node, any node can potentially become an attacker. We assume that:

• •

a MAWiN node is capable of assessing received QoS,

• •

in terms of received QoS, a TRA can be beneficial to the attacker and harmful to other nodes,

• •

a TRA can be performed at no expense and at no risk of detection or administrative punishment, and

• •

a subset of nodes are selfish and ready to become attackers.

A TRA can be formally described as follows.

Definition 2**.**

A traffic remapping attack (TRA) that a node $i\in r\setminus\{d_{r}\}$ launches upon an incoming h-flow $(j,r,hac)$, where $j=pred_{r,i}$, consists in changing its AC, i.e., configuring $map_{i}(j,r,hac)\neq hac$.

Such a definition captures the fact that the setting of AC fields under a TRA is both protocol compliant (the use of $map_{j}$ is feasible) and ill-willed (inconsistent with $mang(\cdot)$).

We consider the behavior of a node which does not perform a TRA to be honest, whereas attackers can either upgrade or downgrade an incoming h-flow’s AC. We formally define these behaviors as follows.

Definition 3**.**

The behavior of node $i$ with respect to h-flow $(j,r,hac)$ can be classified as (i) honest, if the AC remains unchanged (i.e., $map_{i}(j,r,hac)=hac$), (ii) upgrading TRA (TRA+), if $hac=BE$ and $map_{i}(j,r,BE)=VO$, or (iii) downgrading TRA (TRA-) if $hac=VO$ and $map_{i}(j,r,VO)=BE$. Nodes that exhibit behavior (ii) or (iii) will be called attackers.

We adopt a simple model of an attacker: it will launch a TRA on all its source and transit flows provided that the former can be upgraded and the latter downgraded.

Definition 4**.**

An attacker is called plausible if it never downgrades its own source traffic or upgrades transit traffic, i.e., $map_{i}(j,r,hac)=hac$ if $(hac=VO$ and $i=s_{r})$ or $(hac=BE$ and $i\neq s_{r})$, and opportunistic if it launches a TRA+ or a TRA- upon all h-flows it recognizes, subject to the plausibility constraints.

In our model, each attacker is assumed to be plausible opportunistic. Let $A\subseteq N$ denote the set of attackers. Given $A$, the new AC field $hac_{i}(r,ac)$ is derived as:

[TABLE]

That is, $hac_{i}(r,BE)=VO$ if a TRA+ at $s_{r}$ and no TRA- have been launched by the time the flow’s packets reach $i$, and $hac_{i}(r,BE)=BE$ if no TRA or both a TRA+ and a TRA- have been launched. Similarly, $hac_{i}(r,VO)=VO$ if no TRA- has been launched at nodes other than $s_{r}$, and $hac_{i}(r,VO)=BE$ if a TRA- has been launched111This type of downgrading attack is detectable at $d_{r}$ by comparing the $hac$ of the incoming h-flow with the flow’s intrinsic AC (e.g., sent from $s_{r}$ to $d_{r}$ as encrypted metadata). While feasible, such detection is highly troublesome [23] and unable to pinpoint the attacker..

For a 10-node MAWiN with $|N|=|F|=10$, route hop lengths varying from $\lVert r\rVert_{\text{min}}=2$ to $\lVert r\rVert_{\text{max}}=5$, and $A=\{2,3,5,8\}$, Fig. 2 displays TRAs experienced by each e2e-flow. One notes in particular that:

• •

e2e-flow #3 with $ac=VO$ has an attacker source which, however, does not launch a TRA*-* due to the plausibility constraints,

• •

likewise, e2e-flows #3, #7, and #9 have an attacker destination which behaves honestly due to the plausibility constraints,

• •

e2e-flow #6 is not attacked at an attacker transit node 3, which could only have launched a TRA*+*,

• •

e2e-flow #1 with $ac=VO$ encounters three attacker transit nodes, of which the first launches a TRA*-*, hence the second and third no longer have to,

• •

e2e-flows #2 and #8 experience a TRA*+* at their source nodes and a TRA*-* at node 5; this is the maximum number of attacks an e2e-flow can experience.

III-C End-to-End Performance Model

Evaluation of the impact of and countermeasures against TRAs requires an analytical performance model of a MAWiN in the presence of TRAs that can deal with arbitrary topologies $T$ and flow sets $F$, and thus obviate the need for time consuming and setting specific full-stack simulations. Motivated by the deficit of such models in existing literature, cf. Section II, and building on the models of Section III-A and Section III-B, we have developed an approximate rank-based model, described below. Each h-flow is assigned a rank depending on the number and priorities of h-flows it has to compete with for channel access; the collection of ranks of all h-flows constituting a given e2e-flow is then translated into an informative end-to-end QoS metric. At node $i$, the set of outgoing h-flows is

[TABLE]

For an outgoing h-flow $(i,r,hac_{i}(r,ac))$, the set $CH_{i}(r,ac)$ of competing h-flows consists of: (a) other outgoing h-flows at $i$, which compete via the local transmission queue, (b) outgoing h-flows at nodes in the hearability range of $i$, which compete via CSMA/CA, and (c) outgoing h-flows at nodes hidden from $i$, which compete via exclusive-OR reception at $succ_{r,i}$:

[TABLE]

For the above outgoing h-flow, the pair $[hac,CH]_{i}(r,ac)$ determines per-hop performance at node $i$, where we use a succinct notation $[a,b]_{i}(x)$ instead of $[a_{i}(x),b_{i}(x)]$. We propose a per-hop performance metric $rank_{i}(r,ac)$ reflecting that an h-flow is better off at a node if it is VO, and competes with fewer and preferably BE h-flows. Accordingly, the metric should rank $[hac,vo,be]_{i}(r,ac)$ vectors, where $vo_{i}(r,ac)$ and $be_{i}(r,ac)$ represent the number of VO and BE h-flows in $CH_{i}(r,ac)$.

To evaluate $rank(\cdot)$, we used the Markovian model of EDCA [52] to calculate the normalized per-hop saturation throughput $S_{i}(r,ac)$ of e2e-flow $(r,ac)$ at node $i$ for various $hac=hac_{i}(r,ac)\in\{VO,BE\}$, $vo=vo_{i}(r,ac)\in\{0,\dots,10\}$, and $be=be_{i}(r,ac)\in\{0,\dots,10\}$. For the resulting 14,520 pairs of $(hac,vo,be)$ vectors, $rank(\cdot)$ represents a good fit if

[TABLE]

holds for a high percentage of the pairs. (Obviously, a small rank is desirable.) A heuristic metric is

[TABLE]

where $\mathbbm{1}_{(\cdot)}$ is the indicator function, and the best fit (99.13% of the pairs) occurs at $\alpha=40$ and $\beta=10$. The preferences of h-flows are reflected: $vo$ has more impact upon $rank_{i}(r,ac)$ than does $be$ (because $\beta>1$), and there is distinct separation between $hac=VO$ and $hac=BE$ (because $\alpha\gg\beta$).

For any $A\subseteq N$, $rank(\cdot)$ induces a heuristic e2e-flow cost metric we call $fcost$, additive for VO traffic delay and bottleneck-type for BE traffic throughput, defined as:

[TABLE]

where $hac$ is given by (LABEL:hacBEVO) and the notation $fcost_{(r,ac)}(A)$ is meaningful, because $hac$ depends on $A$. From (7), a nodal cost metric $cost$ can be derived as a weighted sum

[TABLE]

where $\gamma_{r,i}\geq 0$ and $\sum_{r}\gamma_{r,i}=1$. The status of an attacker (honest) node whose cost relative to the $A=\varnothing$ case has increased is lose (mind), otherwise it is don’t lose (don’t mind).

To validate the rank-based model, we implemented the network topology and flow set of Fig. 2 in the ns-3 simulator, assuming error-free radio channels, static routing, and constant bit-rate saturation-level UDP traffic of 1500 B packets. Each simulation run lasted 200 s with an additional 50 s warm-up time and was repeated five times. Nodes were classified as mind or lose if the throughput of their BE flows dropped by 5% or more, or if the per-hop delay of their VO flows increased by more than 20 ms and exceeded 100 ms. We assessed congruity, defined as the proportion of nodes whose status (mind, lose, don’t mind, or don’t lose) upon TRAs launched by a random attacker set agrees between the simulation and the rank-based model. Fig. 3 presents the cumulative distribution function (CDF) of congruity obtained after simulating all the 256 possible attacker sets222Nodes 1 and 10 cannot launch a TRA+ or a TRA- due to the plausibility constraints of Definition 4., producing a mean congruity of 0.89.

For comparison consider a heuristic inspired by the $|N|$-person Prisoners’ Dilemma (PD) game [53]: if the number of attackers exceeds (does not exceed) a certain threshold then all the attacker nodes’ status is guessed as lose (don’t lose) and the honest nodes’ as don’t mind (mind). The corresponding CDFs depicted in Fig. 3 for the threshold varying from [math] to $|N|$ produce mean values between 0.49 and 0.54, not far from a fair coin toss. As another baseline, an unrealistic “informed gambler”, who knew an attacker (honest) node’s statistical chance of acquiring a lose (mind) status under a random attacker set, might guess the node’s status for a given $A$ by tossing an appropriately biased coin. Congruity would then be measured by the expected number of guesses that match the simulation. The corresponding CDF depicted in Fig. 3 produces a mean value of 0.82, inferior to our model’s. We conclude that the rank-based model is a reasonably good predictor of the impact of TRAs in MAWiNs with saturation-level traffic.

It will be convenient to identify nodes directly impacted by a given attacker set.

Definition 5**.**

A node whose status is lose or mind is said to be in distress. Let $\Delta(A)$ be the set of such nodes in the presence of the attacker set $A\subseteq N$.

Hence, the set of in-distress nodes contains nodes whose costs have increased in comparison to the $A=\varnothing$ case: $\Delta(A)=\{i\in N|cost_{i}(A)>cost_{i}(\varnothing)\}$. Note that $\Delta(A)=\varnothing\neq A$ is possible, e.g., if $A=\{1,10\}$ in Fig. 2.

III-D Attack Incentives and Impact

In realistic MAWiN settings, TRAs pose a threat whose credibility (i.e., incentives to launch) and seriousness (i.e., harmful impact upon honest nodes) we now quantify. We ask if, regardless of the currently ongoing TRAs, an honest node turning attacker perceives a QoS improvement and causes some other nodes to perceive a QoS degradation. Neither of these effects is certain, as it depends on a node’s position in the network topology. Referring to Fig. 2, suppose that $A=\varnothing$ and node 3 turns attacker. Since flow #3 is VO, the attack amounts to a $\text{TRA}^{-}$ upon flows #1 and #4. While these two flows suffer, for all the remaining flows the contention softens and their QoS improves. Hence, the TRA is harmless for other nodes. Consider an alternative scenario where it is node 5 that turns attacker. Its source traffic (flow #5) now enjoys elevated priority when forwarded at nodes 5, 4, and 7, but experiences increased contention from itself at node 5 (being forwarded by node 4 and via exclusive-OR reception from node 5 at node 4) and at node 4 (being forwarded by nodes 5 and 7), the likely net effect of which is a QoS degradation.

To investigate the above effects and their scaling with the network size $|N|$, both numerical calculation using the cost metric (8) and ns-3 simulations were conducted. In the numerical calculation we assumed $|N|\leq 200$, uniformly distributed route hop lengths with $\lVert r\rVert_{\text{min}}=$ 1, and $\lVert r\rVert_{\text{max}}=$ 3 or 5, and $|A|$ = 1, 2, 5, 10, or 20. For a fixed parameter configuration, the results were averaged over 10,000 instances of random network topologies, e2e-flow routes, and attacker sets. The transit nodes for a route were chosen at random in geographical proximity to the source node. We examined the scaling with $|N|$ of:

• •

the incentives to launch a TRA, measured as the percentage of attacker nodes whose cost metric did not worsen when turning attacker, i.e., nodes $i\in A$ satisfying $cost_{i}(A)\leq cost_{i}(A\setminus\{i\})$, and

• •

the harmful impact of a TRA launched in the presence of a number of ongoing TRAs, measured as $|\Delta(A)|/|A|$, i.e., the average in-distress nodes per attacker node.

The results depicted in Fig. 4 indicate that the threat of TRAs is not limited to small-size networks. The incentives for a TRA remain 100% for $|A|=1$ and decrease with $|A|$, but slightly increase with $|N|$ on account of more dispersed attacker nodes. They also slightly increase with the route hop length. A similar scaling, insensitive to route hop lengths, is visible for the harmful impact of a TRA.

For the ns-3 simulations we assumed square grid topologies with $|N|=$ 9, 16, and 25. Each node was the source of an e2e-flow following a minimum-hop route to a randomly chosen destination, and half of the flows were $VO$ (other settings are described in Section V). As before, we used end-to-end throughput and delay as QoS metrics for BE and VO flows, respectively, and the same rules of deciding node status. The results are marked in Fig. 4 with dotted lines. The incentives for TRAs are somewhat lower now, reflecting the fact that nodes located at the edge of the square grid have no transit traffic to downgrade. Meanwhile, in-distress nodes are more numerous, reflecting inter-flow competition effects unaccounted for by the cost metric. Nonetheless, these results confirm that the incentives for and harmful impact of TRAs are significant for large $|N|$.

IV TRA Game Description

A selfish node performs a TRA whenever this improves its cost, anticipating similar conduct of other selfish nodes. This gives rise to a noncooperative TRA game, whose one-shot and multistage variants we now describe. We propose to mitigate TRAs by introducing a distributed exposure signaling mechanism called DISTRESS, under which “good” multistage strategies lead to few nodes performing TRAs when the game terminates.

IV-A One-Shot TRA Game

In the noncooperative one-shot TRA game, the nodes are players, $map_{i}\in\{TRA,honest\}$ is node $i$’s action, and cost is the (negative) payoff function (i.e., small costs are pursued). A given action profile $(map_{i},i\in N)$ is equivalent of the set $A\subseteq N$ of plausible opportunistic attackers (nodes launching TRA). Using a $\langle\text{players, action space, payoffs}\rangle$ representation, the game is defined as

[TABLE]

Some interesting action profiles are: $\varnothing$ (all-honest), and $N$ (all-TRA). In the latter, any e2e-flow $(r,BE)$ experiences a TRA+ at $s_{r}$, and any e2e-flow $(r,VO)$ experiences a TRA- at the first encountered node in $r\setminus\{s_{r},d_{r}\}$.

Contrary to the intuition that it is always beneficial to upgrade source traffic and downgrade competing transit traffic, the TRA game is not an $|N|$-person PD. Specifically, due to the complexities of mechanisms determining MAWiN performance, the $TRA$ action does not dominate $honest$, nor is it necessarily harmful to honest nodes. Moreover, $A=\varnothing$ need not be Pareto superior to $A=N$; in fact, for some traffic patterns, the reverse is true [28].

The following definition identifies nodes indirectly impacted by a given attacker set.

Definition 6**.**

A node forward-reliant on a node in distress (cf. Definitions 1 and 5) is said to be in exposure. Let $\Delta^{*}(A)$ be the set of such nodes in the presence of the attacker set $A\subseteq N$.

Hence, the set of in-exposure nodes contains nodes which are forward-reliant on nodes currently in distress: $\Delta^{*}(A)=E_{R_{F}^{*}}(\Delta(A))$. The rationale behind Definition 6 is the following. Nodes in distress perceive unsatisfactory QoS and so lose incentives to continue packet forwarding services. Thus they pose a credible threat of imminent service suspension, to which exposed are they themselves along with the set of source nodes whose traffic they forward. In the case of service suspension by a node in distress, each of these source nodes registers an infinite e2e-flow cost (8), and also loses incentives to continue packet forwarding services. By recursion, similarly exposed are all nodes forward-reliant on nodes in $\Delta(A)$, i.e., $\Delta^{*}(A)$.

TRAs can be mitigated by leveraging node exposure in a way not unlike an immune response is triggered by a foreign toxin. Namely, even a small attacker set creates a ripple effect across the network, causing exposure in a much larger set of nodes than those in distress. Instead of suspending service, nodes in exposure start playing the TRA game, occasionally selecting $TRA$ rather than $honest$, which may cause exposure in the initial attackers. If exposure, i.e., the threat of imminent service suspension, is reflected in the game payoffs as a large enough (say infinite) $cost$, such play brings most or all of the attackers back to honesty, which the nodes in distress alone may be too few to achieve. A rigorous argument is given in Section  IV-C.

For various $|N|$, we examined the size of the “immune response” triggered by a TRA, measured as $|\Delta^{*}(A)|/|A|$, the average in-exposure nodes per attacker node. Using cost metric-based calculation we verified that it remains nontrivial and does not distinctly decrease at least up to $|N|=200$ (especially under longer routes), cf. Fig. 5. In the ns-3 simulations of square grid topologies up to $|N|=25$, $\Delta^{*}(A)$ was inferred by keeping track of the source nodes of flows currently forwarded by each node. The results (marked with dotted lines) show a nontrivial size of the “immune response”, which even scales with $|N|$.

To incorporate exposure into the game payoffs we redefine nodal costs (8) and the TRA game (9) as

[TABLE]

[TABLE]

IV-B Multistage Play under the DISTRESS Mechanism

Mitigation of TRAs using the above approach requires that nodes signal exposure to one another and can toggle between $TRA$ and $honest$ in response to other nodes’ play, as modeled by a multistage game. Let the TRA game (9) be played in stages $k=1,2,{\dots}$, and let $A(k)\subseteq N$ be the set of attackers in stage $k$. Each stage $k$ is assumed long enough for each node $i$ to produce an accurate estimate of $cost_{i}(A(k))$ and signal exposure throughout the network if needed, hence to also determine $cost^{\prime}_{i}(A(k))$.

Assume that there are no attackers prior to stage 1, i.e., $A(0)=\varnothing$. In stage 1, a set $I\subset N$ of ill-behaved (selfish) nodes spontaneously select $TRA$, i.e., $A(1)=I$; the other nodes are further called well-behaved. The stage-1 TRAs may bring about distress in some (possibly also ill-behaved) nodes, i.e., induce the set $\Delta(A(1))=\Delta(I)$. At the end of a generic stage $k-1$, each node $i$ estimates its current cost metric and if it finds itself in distress, i.e., $i\in\Delta(A(k-1))$, then marks itself as in-exposure and sends a DISTRESS$(i)$ flag to all nodes whose source traffic it forwards; that is, copies of the flag are sent to all nodes of $E_{R_{F}}(\{i\})$, including node $i$ itself. (The flag is also timestamped to avoid confusion with exposure signaling in another stage.) Having received DISTRESS$(j)$ and checked that $(i,j)\in R_{F}$, node $i$ ignores the flag if it is already in exposure, otherwise marks itself as in-exposure and sends DISTRESS$(i)$ to $E_{R_{F}}(\{i\})$ as above. It is easy to see that if $M$ is the set of nodes so far marked as in-exposure then the process stops when $E_{R_{F}}(M)=M$. Thus, assuming that each flag is issued and reliably delivered to the intended recipient within one stage, at the end of stage $k$ we have $M=\Delta^{*}(A(k-1))$. This mechanism, specified as Algorithm 1, will be termed DISTRESS (DIstributed Signaling of TRaffic Exposure to Service Suspension).

It is vital that the threat signified by signaled exposure be credible. Therefore a received DISTRESS$(j)$ flag, where $j\in r\setminus\{s_{r}\}$, should imply to $s_{r}$ that $j$ is indeed a transit node on $r$ and not an off-route one that does not pose a threat. This is granted if a source-routing protocol such as DSR [54] is employed, in which $r$ is known to $s_{r}$. Otherwise, DISTRESS$(j)$ can be appended to forwarded packets and at $d_{r}$ returned to $s_{r}$ through a (trusted) end-to-end feedback connection.

Fig. 6 provides an illustration. Here, $R_{F}^{*}=\{(1,3),(1,4),(1,5),(1,6),(1,7),\allowbreak(1,8),(2,4),(2,5),(2,6),(2,7),(2,8),(3,6),\allowbreak(5,4),(5,7)\}$. Following a TRA at node 3 in stage $k-1$, node 4 sends DISTRESS(4) to $s_{\#1}=1$ via $d_{\#1}=10$ and to $s_{\#5}=5$ via $d_{\#1}=6$; subsequently, node 5 sends DISTRESS(5) to $s_{\#2}=2$ via $d_{\#2}=9$ and to $s_{\#1}=1$ via $d_{\#1}=10$; the latter flag is ignored by already in-exposure node 1 (to minimize the communication overhead, it could have been suppressed at node 10). At the end of the present stage, $\Delta^{*}(\{3\})=\{1,2,4,5\}$.

We remark that the DISTRESS mechanism is lightweight in terms of the required synchronization and communication overhead (roughly $\mathcal{O}(|R|)$ per node in the worst case). Exposure signaling is triggered asynchronously by nodes in distress based on local QoS perception. The cause of the distress, either a TRA or temporarily harsh traffic conditions (e.g., transmission impairments, frequent collisions, or buffer overflow), does not influence a node’s behavior. Such distinction is a troublesome aspect of many known misbehavior mitigation schemes [26], [55], because responding to distress caused by exogenous factors may result in punishment of honest nodes. In our solution, exposure signaling can only encourage a node to select $honest$, therefore does not affect the behavior of an already honest node unintentionally causing distress. By processing a received DISTRESS flag as described above, such a node simply acknowledges an objectively existing threat of imminent service suspension and no punishment occurs. Importantly, exposure signaling is costless, hence performed without incentive calculation, while fake signaling despite satisfactory QoS perception is not beneficial.

The above considerations also indirectly imply that the effectiveness of the DISTRESS mechanism is unaffected by the network traffic volume, in particular background traffic competing with the e2e-flows: under light traffic conditions no node finds itself in distress and the mechanism is not triggered; otherwise DISTRESS signaling simply encourages honest behavior.

IV-C “Good” Multistage Strategies

A multistage strategy prescribes a node which of the two actions ($TRA$ or $honest$) to select in each stage, based on the current history of play. To specify a desirable course of play under DISTRESS we use two auxiliary definitions. The first describes flows whose source nodes are not forward-reliant on in-distress nodes and so are expected to survive a service suspension. The second describes a node that cannot benefit from selecting a different action, given the other nodes’ actions.

Definition 7**.**

An e2e-flow is called survivable if its source node is not in exposure. Let $F^{*}(A)$ be the set of such flows in the presence of the attacker set $A\subseteq N$.

Definition 8**.**

A node is called (weakly) best-reply if it cannot unilaterally improve its nodal cost (10) by selecting a different action. Let $\Gamma_{cost^{\prime}}(A)$ be the set of such nodes in the presence of the attacker set $A\subseteq N$.

Thus, we have $F^{*}(A)=\{(r,ac)\in F|s_{r}\notin\Delta^{*}(A)\}$ and $\Gamma_{cost^{\prime}}(A)=\{i\in N|cost^{\prime}_{i}(A)\leq cost^{\prime}_{i}(A^{[i]})\}$, where $A^{[i]}=A\setminus\{i\}$ if $i\in A$ and $A^{[i]}=A\cup\{i\}$ if $i\notin A$. Note that if $\Gamma_{cost^{\prime}}(A)=N$ then $A$ constitutes a (weak) Nash equilibrium (NE) [53] of the one-shot TRA game (11).

We now formulate the following postulates:

• •

Opt-out – while ill-behaved nodes may occasionally select $TRA$, well-behaved nodes select $honest$ at all times; that is, being non-selfish, refuse to play the game. Thus $A(k)\subseteq I$ for all $k$.

• •

Termination – after $k_{0}$ stages the game terminates and no node thereafter changes its action. That is, $A(k)=A(\infty)$ for all $k\geq k_{0}$, where $k_{0}$ is finite, known in advance, and preferably small.

• •

Rationality – ill-behaved nodes tend to select (weakly) best-reply actions; ideally, $I\subseteq\Gamma_{cost^{\prime}}(A(\infty))$, i.e., $A(\infty)$ is a weak NE of the one-shot game restricted to the ill-behaved nodes. A suitable quantitative measure is the fraction of ill-behaved nodes that are best-reply, i.e., $|\Gamma_{cost^{\prime}}(A(\infty))|/|I|$.

• •

Efficiency – ill-behaved nodes eventually cause one another no distress; ideally, $\Delta(A(\infty))\cap I=\varnothing$. A suitable quantitative measure is the fraction of ill-behaved nodes that are not in distress, i.e., $|I\setminus\Delta(A(\infty))|/|I|$.

• •

Defensibility – well-behaved nodes are eventually defended against distress caused by ill-behaved nodes’ TRAs; ideally, $\Delta(A(\infty))\subseteq I$. A suitable quantitative measure is the fraction of well-behaved nodes that are not in distress, i.e., $|(N\setminus I)\setminus\Delta(A(\infty))|/|N\setminus I|$.

• •

Survivability – eventually, few e2e-flows rely upon forwarding by nodes in exposure. A suitable quantitative measure of survivable network throughput is the fraction of survivable flows, i.e., $|F^{*}(A(\infty))|/|F|$.

To satisfy these postulates, a multistage strategy has to employ well-designed action selection and participation rules. The DISTRESS mechanism enables more informed rules by enriching the history of the play: apart from recent actions, a node may recall in-distress conditions and received DISTRESS flags (i.e., in-exposure conditions) in recent stages. We confine a node’s memory to the last two stages; the simulations in Section V indicate that it can produce satisfactory quantitative measures related to the above postulates.

We allow node $i$ selecting an action for stage $k+1$ to recall its membership in the sets of current attackers, current in-distress nodes, and recent in-exposure nodes, i.e., $A(k)$, $\Delta(A(k))$, and $\Delta^{*}(A(k-1))$, without the knowledge of the entire sets that the DISTRESS mechanism does not guarantee. Subject to this restriction, a wide class of feasible action selection rules can be expressed as follows:

[TABLE]

where

[TABLE]

[TABLE]

Determined by the index set $\Phi$, there are $2^{8}=256$ distinct action selection rules. E.g., if $\Phi=\{(-1,1,-1)\}$ then $\sigma_{X,Y,Z}=X^{-1}\cap Y\cap Z^{-1}$, hence $A(k+1)=\Delta(A(k))\setminus(A(k)\cup\Delta^{*}(A(k-1)))$, and if $\Phi=\{(-1,1,-1),(1,1,-1)\}$ then $\sigma_{X,Y,Z}=(X^{-1}\cap Y\cap Z^{-1})\cup(X\cap Y\cap Z^{-1})=Y\setminus Z$, hence $A(k+1)=\Delta(A(k))\setminus\Delta^{*}(A(k-1))$. Note that $\Phi=\varnothing$ and $\Phi=\{-1,1\}^{3}$ correspond to “persistent honest” and “persistent TRA” strategies, respectively, and that (12) subsumes action selection rules with a reduced set of arguments, e.g., $\Phi=\{(-1,y,z),(1,y,z)|(y,z)\in\Phi^{\prime}\}$, where $\Phi^{\prime}\subseteq\{-1,1\}^{2}$, corresponds to an action selection rule that does not explicitly condition $A(k+1)$ on $A(k)$, i.e., of the form $A(k+1)=\sigma_{\Delta(A(k)),\Delta^{*}(A(k-1))}$.

Participation in the game can change stage by stage as governed by some in-game condition; let $G(k)$ be the set of in-game nodes in stage $k$ that select action according to (12), whereas the rest, i.e., $G^{-1}(k)$, retain the previous-stage action. In line with the opt-out postulate, action selection rules and in-game conditions only apply to ill-behaved nodes, i.e., $G(k)\subseteq I$, which we do not reflect in the ensuing formulae to keep them simple. The dynamics (12) become:

[TABLE]

where $\Sigma=\sigma_{A(k),\Delta(A(k)),\Delta^{*}(A(k-1))}$. If (13) is a deterministic finite-order recurrence then the sequence $(A(k),k=0,1,2,\ldots)$ eventually becomes periodic and detection of this may terminate the game. It is enough to formulate the in-game condition for a given node that only depends on its recent membership in $A$, $\Delta(A)$, and $\Delta^{*}(A)$. Specifically, let $\mathbf{h}_{i}(k)=(\mathbbm{1}_{i\in A(k-1)},\mathbbm{1}_{i\in A(k)})$ be node $i$ membership history with respect to $A(k-1)$ and $A(k)$. We formulate the following in-game condition for node $i$ in stage $k+1$:

[TABLE]

That is, a node is out-of-game if its membership history has repeated itself within recent $c_{max}$ stages (since well-behaved nodes stay honest at all times, they formally become out-of-game as of stage $k=1$).

We now show that under certain conditions the game is guaranteed to terminate.

Proposition 1**.**

If $c_{max}\geq 4$ then termination is guaranteed with $A(k)=A(\infty)$ and $G(k)=\varnothing$ for all $k\geq 8$.

Proof.

Observe that out-of-game nodes repeat previous-stage actions, thus if $i\notin G(k)$ and $i\notin G(k+1)$ then $i\notin G(k^{\prime})$ for all $k^{\prime}\geq k$. This is due to $\mathbf{h}_{i}(k)=\mathbf{h}_{i}(k+1)$ being true for all $k^{\prime}\geq k$, in violation of (14) with $c=1$.

For any node $i\in I$ consider an infinite sequence $\mathbf{a}=(a_{0},a_{1},a_{2},\ldots)$, where $a_{0}=1$ and $a_{k}=\mathbbm{1}_{i\in A(k)}$ for $k>0$, inducing a sequence of node membership histories $(a_{0},a_{1}),(a_{1},a_{2}),\ldots$ Call $\mathbf{a}$ proper if it is compatible with (14), i.e., if $\exists 1\leq c\leq\min{\{c_{max},k-1\}}:(a_{k}=a_{k-c})\land(a_{k-1}=a_{k-1-c})$ then $a_{k+1}=a_{k}$ (hence, $G(k+1)=\varnothing$). Let $\Pi$ be the set of all proper sequences. Denote $k_{0}(\mathbf{a})=\max{\{k|a_{k}\neq a_{k}-1\}}$ and, with a little abuse of notation, $k_{0}(S)=\max{\{k_{0}(\mathbf{a})|\mathbf{a}\in S\}}$ for $S\subseteq\Pi$. We need to prove that $k_{0}(\Pi)=8$.

Let $\Pi_{n}$ be the set of all $n$-symbol prefixes of the form $(a_{0},\ldots,a_{n-1})$ of sequences in $\Pi$. Based on (14) one verifies that if $k_{0}(\Pi_{n})=k_{0}(\Pi_{n+3})$ then $k_{0}(\Pi_{n})=k_{0}(\Pi)$. Inspection shows that among the infinity of sequences $\mathbf{a}$, only 18 are in $\Pi$, and the smallest $n$ satisfying $k_{0}(\Pi_{n})=k_{0}(\Pi_{n+3})$ is 8, with $k_{0}(\Pi_{8})=k_{0}(\Pi_{11})=8$. Maximum $k_{0}(\mathbf{a})$ is achieved at $\mathbf{a^{*}}=(1,1,0,1,0,0,1,1,0,0,0,0,\ldots)$, inducing a sequence of node membership histories (1,1), (1,0), (0,1), (1,0), (0,0), (0,1), (1,1), (1,0), (0,0), (0,0), …, where the underlined histories correspond to out-of-game stages. ∎

It turns out that under certain conditions the above specification includes multistage strategies exhibiting ideal rationality and defensibility. We will need two more definitions. First, we define a nodal cost function under which the benefit of an attacker always causes distress in some other node. Second, we define a flow set such that a service suspension at any node threatens every flow’s survival.

Definition 9**.**

The cost function $cost_{i}(\cdot)$ satisfies all-honest dominance if $\varnothing$ is Pareto effective (not Pareto dominated by any $A\subseteq N$), i.e., for all $i\in N$ and $A\subseteq N$, $cost_{i}(A)<cost_{i}(\varnothing)$ implies $cost_{j}(A)>cost_{j}(\varnothing)$ for some $j\neq i$.

Definition 10**.**

The flow set $F$ satisfies full forward-reliance if $R_{F}^{*}=N\times N$, i.e., each source node is forward-reliant on every other node (cf. Definition 1).

In general, all-honest dominance and full forward-reliance are not guaranteed; obviously, the latter is impossible if $R=\{r|(r,ac)\in F\}$ contains single-hop routes. However, if both features are present in a given network, then we can show that there exists at least one action selection rule which is ideally efficient (no ill-behaved nodes cause distress), ideally defensible (all well-behaved nodes are defended against distress), and ideally rational (all ill-behaved nodes select best-reply strategies).

Proposition 2**.**

If all-honest dominance and full forward-reliance are satisfied then there exists at least one action selection rule $\sigma_{(\cdot)}$ for which:

1. (i)

$\Delta(A(\infty))=\varnothing$, consequently, $\Delta^{*}(A(\infty))=\varnothing$ and $cost_{i}^{\prime}(A(\infty))=cost_{i}(\varnothing)$, i.e., when the multistage game terminates, no node is in exposure and nodal costs are the same as under all-honest (this implies ideal efficiency and defensibility), and 2. (ii)

$A(\infty)$* is a weak NE of the one-shot game (11) restricted to $I$, i.e., $I\subseteq\Gamma_{cost^{\prime}}(A(\infty))$ (this implies ideal rationality).*

Proof.

Clearly, all-honest dominance implies $cost_{i}(\varnothing)\leq cost_{i}^{\prime}(A)$ for all $A\subseteq N$ and $i\in N$, i.e., with respect to $cost_{i}^{\prime}(\cdot)$, $\varnothing$ weakly Pareto dominates every other action profile, and as such is a weak NE of the one-shot game (11). The same pertains to any $A\subseteq N$ such that $\Delta(A)=\varnothing$ (indeed, for any such $A$, $cost_{i}(A)=cost_{i}(\varnothing)$ for all $i\in N$). Since under full forward-reliance it holds that $\Delta(A)=\varnothing$ iff $\Delta^{*}(A)=\varnothing$, it is enough to show that $\Delta^{*}(A(\infty))=\varnothing$.

Let $k-1=\min\{k^{\prime}|G(k^{\prime})=\varnothing\}$, then from (14) it follows that $A(k-1)=A(k)=A(k+1)=A(\infty)$, where $A(\infty)=\sigma_{A(\infty),\Delta(A(\infty)),\Delta^{*}(A(\infty))}$. If $A(\infty)=\varnothing$ then the proposition trivially holds true, so assume $A(\infty)\neq\varnothing$. Take $\Phi=\{(-1,-1,-1),(-1,1,-1),(1,-1,-1),(1,1,-1)\}$, i.e., $\sigma_{X,Y,Z}=Z^{-1}$ and $A(k+1)=I\cap(N\setminus\Delta^{*}(A(k-1)))$. Then either $\Delta(A(\infty))=\Delta^{*}(A(\infty))=\varnothing$ and the proposition holds true, or $\Delta(A(\infty))\neq\varnothing$, which implies $\Delta^{*}(A(\infty))\neq N$, impossible under full forward-reliance. ∎

Proposition 2 states conditions of existence of ideally rational, efficient, and defensible action selection rules. Simulations show that these conditions are often satisfied in randomly generated MAWiN instances; otherwise, “good” rules (12) nevertheless exist that ensure satisfactory characteristics across various MAWiN topologies and flow sets $F$, cf. Section V. These rules can be adopted* á priori*, relieving nodes from seeking “good” rules for a specific topology and flow set, which they are typically unaware of.

Note that $\Delta(A)=\varnothing$ implies that $A$ is a weak NE of (11), but the converse is not true; in fact, simulations show that a vast majority of Nash equilibria $A$ feature $\Delta(A)\neq\varnothing$.

V Simulations

Simulations involved network topologies with both static and mobile nodes, respectively using the Monte Carlo method based on the network model of Section III and the ns-3 simulator implementing a full MAWiN protocol stack. The goal of the Monte Carlo simulations was to assess the rationality, efficiency, defensibility, and survivability measures in realistic settings, when the two assumptions of Proposition 2 (all-honest dominance and full forward-reliance) were not necessarily satisfied. The ns-3 simulations were carried out to investigate the impact of fast-changing MAWiN topology and flow routes on the effectiveness of the DISTRESS mechanism.

V-A Static Nodes

For the analysis of static topologies, we implemented the network model of Section III (including network topology, routing, flow configuration, attack behavior, and rank-based estimation of flow cost) as well as the multi-stage TRA game and DISTRESS mechanism of Section IV in a Monte Carlo simulator. Each simulation run consisted of a stage-by-stage play of the TRA game, with nodes deciding their action (TRA or honest) in each stage. 1000 MAWiN instances were generated with $|N|=|F|=10$ and e2e-flow routes of uniformly distributed hop lengths with $\lVert r\rVert_{\text{min}}$ = 1 or 2 and $\lVert r\rVert_{\text{max}}$ = 5. Full forward-reliance occurred in 6.5% and 55.2% of the MAWiN instances with $\lVert r\rVert_{\text{min}}$ = 1 and $\lVert r\rVert_{\text{min}}$ = 2, respectively. We observed that:

• •

All-honest dominance was never violated (violations are in general possible but unlikely, e.g., when traffic flows do not impact one another’s performance).

• •

For $\lVert r\rVert_{\text{min}}$ = 1 and $\lVert r\rVert_{\text{min}}$ = 2, weak Nash equilibria amounted to 40.2% and 94% of all action profiles $A\subseteq N$, respectively; however, those with $\Delta(A)=\varnothing$ were a rarity, amounting to 0.1% and 0.3%, respectively.

For each MAWiN instance, 100 independent multistage game runs were conducted with $I\neq N$ chosen at random subject to $\Delta(I)\neq\varnothing$. All 256 feasible action selection rules were tried. It was observed that:

• •

With $\lVert r\rVert_{\text{min}}$ = 1 and $\lVert r\rVert_{\text{min}}$ = 2, respectively 44 and 54 action selection rules (including the trivial “persistent honest”) ensured (i) and (ii) of Proposition 2 even in the absence of full forward-reliance.

• •

Conditioning $A(k+1)$ on $A(k)$ besides $\Delta(A(k))$ and $\Delta^{*}(A(k-1))$ did not extend the interesting range of key after-game (asymptotic) characteristics.

• •

On the other hand, conditioning $A(k+1)$ on $A(k)$ alone, i.e., disregarding information provided by the DISTRESS mechanism, produced about the worst measures of rationality and defensibility.

To explain the first observation consider, e.g., $A(k+1)=I\cap\Delta(A(k))$. It must be that $A(\infty)=\Delta(A(\infty))$, but $A(\infty)=\Delta(A(\infty))\neq\varnothing$ is possible only if eventually all the attacker nodes and none of the honest ones are caused distress, a highly improbable situation. The latter two observations are illustrated in Fig. 7, where each dot represents a pair of after-game (rationality, defensibility) measures for a given action selection rule, averaged over the generated MAWiN instances and game runs. The outer contour encompasses all action selection rules (12) and the inner one only rules of the form $A(k+1)=\sigma_{\Delta(A(k)),\Delta^{*}(A(k-1))}$. The latter captures most of the Pareto front including the best rationality and defensibility measures. Rules of the form $A(k+1)=\sigma_{A(k)}$ correspond to the two lower corners of the outer contour, the farthest from the Pareto front.

For more detailed analysis, several representative action selection rules have been chosen. They are listed below in the order of diminishing survivability and tendency to launch TRAs, and improving efficiency and defensibility:

1. (a)

$A(k+1)=N$ (“persistent TRA”), 2. (b)

$A(k+1)=\Delta(A(k))\cap\Delta^{*}(A(k-1))$, 3. (c)

$A(k+1)=\Delta(A(k))\oplus\Delta^{*}(A(k-1))$, where $\oplus$ denotes disjunctive union, 4. (d)

$A(k+1)=(N\setminus\Delta^{*}(A(k-1)))\cup\Delta(A(k))$, 5. (e)

$A(k+1)=N\setminus\Delta^{*}(A(k-1))$, 6. (f)

$A(k+1)=\Delta(A(k))\setminus\Delta^{*}(A(k-1))$.

These rules were observed to differ visibly in the speed of convergence to the after-game characteristics; example stage-by-stage trajectories for rules (e) and (f) are shown in Fig. 8. Table II presents relevant after-game characteristics, averaged as above. One notes in particular that:

• •

Rule (e) is the most likely to be adopted by rational ill-behaved nodes, as it leads to highly efficient Nash equilibria in the vast majority of game runs. It also produces good defensibility and survivability.

• •

On the other hand, rule (f) produces ideal efficiency and survivability, but is far from rational, thus likely to be dismissed by ill-behaved nodes.

• •

Rule (a) (“persistent TRA”) is moderately rational, but, due to the DISTRESS mechanism, very inefficient. This latter fact is fortunate, as rule (a) produces disastrous defensibility and survivability.

• •

Rules adversely affecting defensibility and survivability, such as (a) through (c), are not very rational and so unattractive to ill-behaved nodes. Rule (d) is moderately attractive, but from rationality and efficiency viewpoints is Pareto dominated by rule (e).

Hence, under DISTRESS, ill-behaved nodes are likely to follow rule (e), in which in-exposure nodes cannot be attackers.

V-B Mobile Nodes

To study the impact of node mobility, we implemented the multi-stage play of Section IV-C under rule (e) in the ns-3 simulator, using the settings of Table III. Each node was the source of an e2e-flow, half of them of high priority. We considered two topologies for initial node placement: grid – all nodes arranged on a square grid, and random – all nodes uniformly distributed in the area. The adopted high modulation and coding scheme limits the nodes’ transmission range to approximately 10 m. For a more realistic IEEE 802.11 range of 100 m, the maximum evaluated velocity would scale to 14 m/s (50 km/h). In summary, the chosen settings created conditions when TRAs are likely to negatively impact the performance of honest nodes.

With node mobility, $\Delta(A)$ and $\Delta^{*}(A)$ can change stage by stage although $A$ remains the same, due to changing MAWiN topology and flow routes. Except for quasi-static environments, where typical TRA game duration (on order of a few stages) fits between successive route changes, this may complicate ill-behaved nodes’ strategic behavior. For preliminary insight we assumed that they nevertheless stick to rule (e); in particular, they calculate $cost_{i}(\varnothing)$ only once for distress perception, at game start, and maintain the current action (TRA or honest) indefinitely when the out-of-game condition is satisfied. The key question was whether the DISTRESS mechanism would still be able to restrain TRAs. As an evaluation metric for our DISTRESS mechanism, we used the percentage of after-game attackers, which reflects how many of the network’s ill-behaved nodes remain attackers after the game has terminated. Using this metric, we compared the performance of a MAWiN under the DISTRESS mechanism with a baseline MAWiN, where nodes do not fear service suspension and remain attackers if such behavior improves the QoS metrics (8) of their source flows.

In Fig. 9 each point is an average of 100 independent simulation runs with half the nodes being ill-behaved ($|I|=|N|/2$). Simulations confirmed that even for the maximum node velocity the adopted settings created a quasi-static environment – route changes during the TRA game were occasional or none and the play closely resembled that of Section IV-C. Hence, irrespective of node velocity and initial placement, after-game attackers were indeed distinctly fewer than for the baseline MAWiN with the DISTRESS mechanism disengaged; they were mostly limited to ill-behaved sources of single-hop flows, which, having no forwarding services to rely upon, remained unaffected by the DISTRESS mechanism.

To evaluate our proposed mechanism against a varying attack intensity, we note that Definitions 2-4 do not leave room for any gradation of TRA intensity: a node either behaves honestly or executes a plausible opportunistic TRA. Therefore, overall attack intensity in the network is sufficiently reflected by the percentage of ill-behaved nodes in $N$. Fig. 10 presents the respective simulation results for a high-mobility (1.4 m/s) scenario of the grid topology. DISTRESS is uniformly able to incentivize honest behavior in all (or almost all) of those ill-behaved nodes which are the sources of multi-hop flows. As before, only the sources of single-hop flows remain attackers.

Finally, even though a node’s placement in the network topology does influence the potential benefits of becoming an attacker (as is visible in Fig. 2), one suspects that the effectiveness of the DISTRESS mechanism does not depend on the placement of attackers. This is because DISTRESS signaling is network-wide and affects the cost metric (11) of each node regardless of its location. Fig. 11 shows that indeed the initial placement (interior, edge, or corner) of ill-behaved nodes in a grid-topology MAWiN does not impact the percentage of after-game attackers.

VI Conclusion

A traffic remapping attack (TRA) is hard to defend against in MAWiNs due to their multi-hop topology, node autonomy, and complex interplay of factors affecting end-to-end performance. We have proposed a systematic game-theoretic approach to TRA mitigation. The adopted model of a MAWiN under plausible opportunistic TRAs allows to define a noncooperative multistage TRA game arising among selfish nodes, in which the payoff function is provided by a novel network-oriented end-to-end QoS metric. We have augmented this function to reflect the threat of forwarding service suspension due to ongoing TRAs, as disseminated by a robust and low-cost distributed signaling mechanism called DISTRESS.

Our work distinguishes itself by proposing the first distributed self-enforcing mitigation approach for TRAs in MAWiNs. Existing solutions are not directly comparable: they counteract other types of attacks, rely on attack detection, require centralized control, or have been designed for single-hop networks and cannot cope with the multi-hop nature of TRAs. However, an advantage of the proposed framework is that by analyzing all feasible action selection rules (12), it enables an exhaustive search of a wide class of selfish nodes’ multistage strategies. Therefore, optimum rules can be found according to the selected criteria, so that comparisons with particular solutions, existing or to be found in the future, are less relevant.

Our framework also enables a precise statement of postulates regarding a desirable game outcome: opt-out (well-behaved nodes need not play), termination (finite game duration is guaranteed), rationality (ill-behaved nodes select best-reply behavior), defensibility and efficiency (well- and ill-behaved nodes receive satisfactory QoS), and survivability (little traffic is threatened by forwarding service suspension). We have argued that ill-behaved nodes are likely to use a strategy which, under certain assumptions regarding MAWiN topology and traffic flows, guarantees that these postulates are satisfied. The game outcome remains desirable even for a broader class of static-topology MAWiNs, as demonstrated by Monte Carlo simulations; time-true simulations using ns-3 extend this conclusion to networks with mobile nodes.

Although it has been analyzed assuming fixed e2e-flow routes, the DISTRESS mechanism can work with alternate routing as well. Provided that a node is aware of all currently available routes for the originated e2e-flow, it only needs to mark itself as in-exposure upon reception of a DISTRESS flag from at least one node on each of these routes. Under dynamic routing, the forward-reliance relationship may be time-varying; a DISTRESS flag received from a node on a given route can then be interpreted by a source node as a noncommittal signal to propagate DISTRESS flags further, depending on the projected route stability.

Finally, mechanisms providing QoS security, similar to DISTRESS, might produce viable game-theoretic defense against QoS abuse in other distributed settings offering QoS differentiation; this is left for future research.

Acknowledgments

The work of Jerzy Konorski is funded by the National Science Center, Poland, under Grant UMO-2016/21/B/ST6/03146. The work of Szymon Szott is supported by the Polish Ministry of Science and Higher Education with the subvention funds of the Faculty of Computer Science, Electronics and Telecommunications of AGH University. This research was supported in part by PLGrid Infrastructure.