The state of the art for rate control algorithms in wireless sensor networks relies on using implicit feed back, in the form of queueing information, to detect congestion in the network. We plan to take an alternate approach by designing rate control algorithms using explicit capacity information. The advantages of this approach are fast convergence times and small queueing delays.

Our research tries to define a usable notion of capacity in a wireless sensor network (currently we focus on the specific scenario of a single sink multi-source data gathering tree). Using this notion of capacity we have defined a model that captures interference and hence the consumption of capacity in a sensor network. Further based on our model, called the receiver capacity model, we have adopted a top down approach for designing practically implementable fair and efficient rate control protocols for a wireless sensor network.

One of the most prominent signatures of an impending worm attack is port scanning activity generated by malicious hosts. Thus an effective strategy to prevent worm propagation across the internet has been to develope tools that can detect port scans. There has been considerable research in developing port scan detection algorithms for enterprise class networks. We are specifically interested in developing port scan detection algorithms for the back bone.

The uniqueness of the problem results from the speed of the links and hence the volume of the traffic that is encountered in the back bone as well as the unidirectional nature of the traffic. The nature of the backbone imposes two constraints on the design of port scan detection algorithms. The first is the speed (in order to analyse large volumes of data in a given time constraint) and the second is that the algorithm needs to be protocol independent. The second constraint arises due to the unidirectional nature of the traffic on the backbone. The uplink and downlink traffic even on a single session might not take the same route.

Currently we have developed a port scan detection algorithm called TAPS, that uses sequential hypothesis tests to tag a given source as a scanner or a benign host. The hypothesis of the test is based on the ratio number of distinct IP's to the number of distinct ports that a scanner visits. The use of sequential hypothesis test makes the algorithm fast and the use of the IP/port ratio as metric makes the algorithm protocol independent.