David Starobinski

Jiguang Yu, Nicholas Brendle, Joel T. Johnson et al.

We propose a physics-grounded mechanism design for dynamic spectrum sharing that bridges the gap between radiometric retrieval constraints and economic incentives. We formulate the active and passive users coexistence problem as a Vickrey-Clarke-Groves (VCG) auctions mechanism, where the radiometer dynamically procures ``quiet'' time-frequency tiles from active users based on the marginal reduction in retrieval error variance. This approach ensures allocative efficiency and dominant-strategy incentive compatibility (DSIC). To overcome the computational intractability of exact VCG on large grids, we derive an approximation algorithm by using the monotone submodularity induced by the radiometer equation. AMSR-2-based simulations show that the approach avoids high-cost tiles by aggregating low-cost spectrum across time and frequency. In an interference-trap case study, the proposed framework reduces procurement costs by about 60% over a fixed-band baseline while satisfying accuracy targets.

Sevval Simsek, Varsha Athreya, David Starobinski

Accurate mapping between Common Vulnerabilities and Exposures (CVE) and Common Weakness Enumeration (CWE) entries is critical for effective vulnerability management and risk assessment. However, public databases, such as the National Vulnerability Database (NVD), suffer from inconsistent and incomplete CVE to CWE mappings, complicating automated analysis and remediation. We introduce FixV2W, a lightweight approach that leverages knowledge graph embeddings and longitudinal trends to improve mapping accuracy of the NVD. FixV2W systematically analyzes historical remapping patterns and leverages hierarchical relationships within NVD and CWE data to predict more precise CWE mappings for vulnerabilities linked to Prohibited or Discouraged categories. We run extensive experimental evaluation of FixV2W, based on test data set collected between August 2021 and December 2024. Considering the Top 10 ranked predictions, the results show that FixV2W predicts the correct CWE mappings for 69% of exploited vulnerabilities that had invalid CWEs before they were exploited. We also show that FixV2W significantly improves the performance of ML models relying on NVD data. For instance, for a model geared at uncovering unknown CVE-CWE mappings, FixV2W improves the Mean Reciprocal Rank (MRR) from 0.174 to 0.608. These results show that FixV2W is a promising approach to identify and thwart emerging threats.

Nataša Trkulja, David Starobinski, Randall A. Berry

Cellular Vehicle-to-Everything (C-V2X) networks are increasingly adopted by automotive original equipment manufacturers (OEMs). C-V2X, as defined in 3GPP Release 14 Mode 4, allows vehicles to self-manage the network in absence of a cellular base-station. Since C-V2X networks convey safety-critical messages, it is crucial to assess their security posture. This work contributes a novel set of Denial-of-Service (DoS) attacks on C-V2X networks operating in Mode 4. The attacks are caused by adversarial resource block selection and vary in sophistication and efficiency. In particular, we consider "oblivious" adversaries that ignore recent transmission activity on resource blocks, "smart" adversaries that do monitor activity on each resource block, and "cooperative" adversaries that work together to ensure they attack different targets. We analyze and simulate these attacks to showcase their effectiveness. Assuming a fixed number of attackers, we show that at low vehicle density, smart and cooperative attacks can significantly impact network performance, while at high vehicle density, oblivious attacks are almost as effective as the more sophisticated attacks.

Muhammad Anas Imtiaz, David Starobinski, Ari Trachtenberg

Orphan transactions are those whose parental income-sources are missing at the time that they are processed. These transactions are not propagated to other nodes until all of their missing parents are received, and they thus end up languishing in a local buffer until evicted or their parents are found. Although there has been little work in the literature on characterizing the nature and impact of such orphans, it is intuitive that they may affect throughput on the Bitcoin network. This work thus seeks to methodically research such effects through a measurement campaign of orphan transactions on live Bitcoin nodes. Our data show that, surprisingly, orphan transactions tend to have fewer parents on average than non-orphan transactions. Moreover, the salient features of their missing parents are a lower fee and larger size than their non-orphan counterparts, resulting in a lower transaction fee per byte. Finally, we note that the network overhead incurred by these orphan transactions can be significant, exceeding 17% when using the default orphan memory pool size (100 transactions). However, this overhead can be made negligible, without significant computational or memory demands, if the pool size is merely increased to 1000 transactions.

Nabeel Younis, Muhammad Anas Imtiaz, David Starobinski et al.

Efficient and reliable block propagation on the Bitcoin network is vital for ensuring the scalability of this peer-to-peer network. To this end, several schemes have been proposed over the last few years to speed up the block propagation, most notably the compact block protocol (BIP 152). Despite this, we show experimental evidence that nodes that have recently joined the network may need about ten days until this protocol becomes 90% effective. This problem is endemic for nodes that do not have persistent network connectivity. We propose to mitigate this ineffectiveness by maintaining mempool synchronization among Bitcoin nodes. For this purpose, we design and implement into Bitcoin a new prioritized data synchronization protocol, called FalafelSync. Our experiments show that FalafelSync helps intermittently connected nodes to maintain better consistency with more stable nodes, thereby showing promise for improving block propagation in the broader network. In the process, we have also developed an effective logging mechanism for bitcoin nodes we release for public use.