Biblio

It is predicted that, the number of connected Internet of Things (IoT) devices will rise to 38.6 billion by 2025 and an estimated 50 billion by 2030. The increased deployment of IoT devices into diverse areas of our life has provided us with significant benefits such as improved quality of life and task automation. However, each time a new IoT device is deployed, new and unique security threats emerge or are introduced into the environment under which the device must operate. Instantaneous detection and mitigation of every security threat introduced by different IoT devices deployed can be very challenging. This is because many of the IoT devices are manufactured with no consideration of their security implications. In this paper therefore, we review existing literature and present IoT threat detection research advances with a focus on the various IoT security challenges as well as the current developments towards combating cyber security threats in IoT networks. However, this paper also highlights several future research directions in the IoT domain.

The real-time information of enemy locations is capable to transform the outcome of combat operations. Such information gathered using connected soldiers on the Internet of Battlefield Things (IoBT) is highly beneficial to create situational awareness (SA) and to plan an effective war strategy. This article presents the novel enemy localization method that uses the soldier's own locations and their gunshot direction. The hardware prototype has been developed that uses a triangulation for an enemy localization in two soldiers and a single enemy scenario. 4.24±1.77 m of average localization error and ±4° of gunshot direction error has been observed during this prototype testing. This basic model is further extended using three-stage software simulation for multiple soldiers and multiple enemy scenarios with the necessary assumptions. The effective algorithm has been proposed, which differentiates between the ghost and true predictions by analyzing the groups of subsequent shooting intents (i.e., frames). Four different complex scenarios are tested in the first stage of the simulation, around three to six frames are required for the accurate enemy localization in the relatively simple cases, and nine frames are required for the complex cases. The random error within ±4° in gunshot direction is included in the second stage of the simulation which required almost double the number of frames for similar four cases. As the number of frames increases, the accuracy of the proposed algorithm improves and better ghost point elimination is observed. In the third stage, two conventional clustering algorithms are implemented to validate the presented work. The comparative analysis shows that the proposed algorithm is faster, computationally simple, consistent, and reliable compared with others. Detailed analysis of hardware and software results for various scenarios has been discussed in this article.

With the increasing attention to ocean and the development of data-intensive sciences, a large amount of ocean data has been acquired by various observing platforms and sensors, which poses new challenges to data management and utilization. Typically, nowadays we target to move ocean data management toward the FAIR principles of being findable, accessible, interoperable, and reusable. However, the data produced and managed by different organizations with wide diversity, various structures and increasing volume make it hard to be FAIR, and one of the most critical reason is the lack of unified data representation and publication methods. In this paper, we propose novel techniques to try to solve the problem by introducing semantics with ontologies. Specifically, we first propose a unified semantic model named OEDO to represent ocean data by defining the concepts of ocean observing field, specifying the relations between the concepts, and describing the properties with ocean metadata. Then, we further optimize the state-of-the-art quick service query list (QSQL) data structure, by extending the domain concepts with WordNet to improve data discovery. Moreover, based on the OEDO model and the optimized QSQL, we propose an ocean data service publishing method called DOLP to improve data discovery and data access. Finally, we conduct extensive experiments to demonstrate the effectiveness and efficiency of our proposals.

Machine to Machine (M2M) a sub area of Internet of Things (IoT) will link billions of devices or things distributed around the world using the Internet. These devices when connected exchange information obtained from the environment such as temperature or humidity from industrial or residential control process. Information Security (IS) and Trust are one of the fundamental points for users and the industry to accept the use of these devices with Confidentiality, Integrity, Availability and Authenticity. The key reason is that most of these devices use wireless media especially in residential and smart city environments. The overall goal of this work is to implement a Middleware Security to improve Safety and Security between the control network devices used in IoT/M2M and the Internet for residential or industrial environments. This implementation has been tested with different protocols as CoAP and MQTT, a microcomputer with free Real-Time Operating System (RTOS) implemented in a Raspberry Pi Gateway Access Point (RGAP), Network Address Translator (NAT), IPTable firewall and encryption is part of this implementation for secure data transmission

The Ad-hoc Vehicular networks (VANET) was developed through the implementation of the concepts of ad-hoc mobile networks(MANET), which is swiftly maturing, promising, emerging wireless communication technology nowadays. Vehicular communication enables us to communicate with other vehicles and Roadside Infrastructure Units (RSU) to share information pertaining to the safety system, traffic analysis, Authentication, privacy, etc. As VANETs operate in an open wireless connectivity system, it increases permeable of variant type's security issues. Security concerns, however, which are either generally seen in ad-hoc networks or utterly unique to VANET, present significant challenges. Access Control List (ACL) can be an efficient feature to solve such security issues by permitting statements to access registered specific IP addresses in the network and deny statement unregistered IP addresses in the system. To establish such secured VANETs, the License number of the vehicle will be the Identity Number, which will be assigned via a DNS server by the Traffic Certification Authority (TCA). TCA allows registered vehicles to access the nearest two or more regions. For special vehicles, public access should be restricted by configuring ACL on a specific IP. Smart-card given by TCA can be used to authenticate a subscriber by checking previous records during entry to a new network area. After in-depth analysis of Packet Delivery Ratio (PDR), Packet Loss Ratio (PLR), Average Delay, and Handover Delay, this research offers more secure and reliable communication in VANETs.

The main method for long-distance underwater communication is underwater acoustic communication(UAC). The bandwidth of UAC channel is narrow and the frequency band resources are scarce. Therefore, it is important to improve the frequency band utilization of UAC system. Cognitive underwater acoustic (CUA) technology is an important method. CUA network can share spectrum resources with the primary network. Spectrum sensing (SS) technology is the premise of realizing CUA. Therefore, improving the accuracy of spectral sensing is the main purpose of this paper. However, the realization of underwater SS technology still faces many difficulties. First, underwater energy supplies are scarce, making it difficult to apply complex algorithms. Second, and more seriously, CUA network can sometimes be attacked and exploited by hostile forces, which will not only lead to data leakage, but also greatly affect the accuracy of SS. In order to improve the utilization of underwater spectrum and avoid attack, an underwater spectrum sensing model based on the two-threshold energy detection method and K of M fusion decision method is established. Then, the trust mechanism based on beta function and XOR operation are proposed to combat individual attack and multi-user joint attack (MUJA) respectively. Finally, simulation result shows the effectiveness of these methods.

The recent advancements in ubiquitous sensing powered by Wireless Computing Technologies (WCT) and Cloud Computing Services (CCS) have introduced a new thinking ability amongst researchers and healthcare professionals for building secure and connected healthcare systems. The integration of Internet of Things (IoT) in healthcare services further brings in several challenges with it, mainly including encrypted communication through vulnerable wireless medium, authentication and access control algorithms and ownership transfer schemes (important patient information). Major concern of such giant connected systems lies in creating the data handling strategies which is collected from the billions of heterogeneous devices distributed across the hospital network. Besides, the resource constrained nature of IoT would make these goals difficult to achieve. Motivated by aforementioned deliberations, this paper introduces a novel approach in designing a security framework for edge-computing based connected healthcare systems. An efficient, multi-factor access control and ownership transfer mechanism for edge-computing based futuristic healthcare applications is the core of proposed framework. Data scalability is achieved by employing distributed approach for clustering techniques that analyze and aggregate voluminous data acquired from heterogeneous devices individually before it transits the to the cloud. Moreover, data/device ownership transfer scheme is considered to be the first time in its kind. During ownership transfer phase, medical server facilitates user to transfer the patient information/ device ownership rights to the other registered users. In order to avoid the existing mistakes, we propose a formal and informal security analysis, that ensures the resistance towards most common IoT attacks such as insider attack, denial of distributed service (DDoS) attack and traceability attacks.

The increasing vehicles have brought convenience to people as well as many traffic problems. The Internet of Vehicles (IoV) is an extension of the intelligent transportation system based on the Internet of Things (IoT), which is the omnibearing network connection among “Vehicles, Loads, Clouds”. However, IoV also faces threats from various known and unknown security vulnerabilities. Traditional security defense methods can only deal with known attacks, while there is no effective way to deal with unknown attacks. In this paper, we show an IoV system deployed on a Mimic Common Operating Environment (MCOE). At the sensing layer, we introduce a lightweight cryptographic algorithm, LBlock, to encrypt the data collected by the hardware. Thus, we can prevent malicious tampering of information such as vehicle conditions. At the application layer, we firstly put the IoV system platform into MCOE to make it dynamic, heterogeneous and redundant. Extensive experiments prove that the sensing layer can encrypt data reliably and energy-efficiently. And we prove the feasibility and security of the Internet of Vehicles system platform on MCOE.

Due to environmental influence and technology limitation, a wireless sensor/sensors module can neither store or process all raw data locally nor reliably forward it to a destination in heterogeneous IoT environment. As a result, the data collected by the IoT's sensors are inherently noisy, unreliable, and may trigger many false alarms. These false or misleading data can lead to wrong decisions once the data reaches end entities. Therefore, it is highly recommended and desirable to acquire trustworthy data before data transmission, aggregation, and data storing at the end entities/cloud. In this paper, we propose an In-network Generalized Trustworthy Data Collection (IGTDC) framework for trustworthy data acquisition and faulty sensor detection in the IoT environment. The key idea of IGTDC is to allow a sensor's module to examine locally whether the raw data is trustworthy before transmitting towards upstream nodes. It further distinguishes whether the acquired data can be trusted or not before data aggregation at the sink/edge node. Besides, IGTDC helps to recognize a faulty or compromised sensor. For a reliable data collection, we use collaborative IoT technique, gate-level modeling, and programmable logic device (PLD) to ensure that the acquired data is reliable before transmitting towards upstream nodes/cloud. We use a hardware-based technique called “Gray Code” to detect a faulty sensor. Through simulations we reveal that the acquired data in IGTDC framework is reliable that can make a trustworthy data collection for event detection, and assist to distinguish a faulty sensor.

Design for trust approaches can protect an MPSoC system from hardware Trojan attack due to the high penetration of third-party intellectual property. However, this incurs significant design cost by purchasing IP cores from various IP vendors, and the IP vendors providing particular IP are always limited, making these approaches unable to be performed in practice. This paper treats IP vendor as constraint, and tasks are scheduled with a minimized security constraint violations, furthermore, the area of MPSoC is also optimized during scheduling. Experimental results demonstrate the effectiveness of our proposed algorithm, by reducing 0.37% security constraint violations.

With a storage space limit on the sensors, WSN has some drawbacks related to bandwidth and computational skills. This limited resources would reduce the amount of data transmitted across the network. For this reason, data aggregation is considered as a new process. Iterative filtration (IF) algorithms, which provide trust assessment to the various sources from which the data aggregation has been performed, are efficient in the present data aggregation algorithms. Trust assessment is done with weights from the simple average method to aggregation, which treats attack susceptibility. Iteration filter algorithms are stronger than the ordinary average, but they do not handle the current advanced attack that takes advantage of false information with many compromise nodes. Iterative filters are strengthened by an initial confidence estimate to track new and complex attacks, improving the solidity and accuracy of the IF algorithm. The new method is mainly concerned with attacks against the clusters and not against the aggregator. In this process, if an aggregator is attacked, the current system fails, and the information is eventually transmitted to the aggregator by the cluster members. This problem can be detected when both cluster members and aggregators are being targeted. It is proposed to choose an aggregator which chooses a new aggregator according to the remaining maximum energy and distance to the base station when an aggregator attack is detected. It also save time and energy compared to the current program against the corrupted aggregator node.

With an incredible growth in MEMS and Internet, IoT has developed to an inevitable invention and resource for human needs. IoT reframes the communication and created a new way of machine to machine communication. IoT utilizes smart sensor to monitor and track environmental changes in any area of interest. The high volume of sensed information is processed, formulated and presented to the user for decision making. In this paper a model is designed to perform trust evaluation and data aggregation with confidential transmission of secured information in to the network and enables higher secure and reliable data transmission for effective analysis and decision making. The Sensors in IoT devices, senses the same information and forwards redundant data in to the network. This results in higher network congestion and causes transmission overhead. This could be control by introducing data aggregation. A gateway sensor node can act as aggregator and a forward unique information to the base station. However, when the network is adulterated with malicious node, these malicious nodes tend to injects false data in to the network. In this paper, a trust based malicious node detection technique has been introduced to isolate the malicious node from forwarding false information into the network. Simulation results proves the proposed protocol can be used to reduce malicious attack with increased throughput and performance.

As a key technology in cognitive radio, cooperative spectrum sensing has been paid more and more attention. In cooperative spectrum sensing, multi-user cooperative spectrum sensing can effectively alleviate the performance degradation caused by multipath effect and shadow fading, and improve the spectrum utilization. However, as there may be malicious users in the cooperative sensing users, sending forged false messages to the fusion center or neighbor nodes to mislead them to make wrong judgments, which will greatly reduce the spectrum utilization. To solve this problem, this paper proposes an intelligent anti spectrum sensing data falsification (SSDF) attack algorithm using trust-based non consensus message passing algorithm. In this scheme, only one perception is needed, and the historical propagation path of each message is taken as the basis to calculate the reputation of each cognitive user. Every time a node receives different messages from the same cognitive user, there must be malicious users in its propagation path. We reward the nodes that appear more times in different paths with reputation value, and punish the nodes that appear less. Finally, the real value of the tampered message is restored according to the calculated reputation value. The MATLAB results show that the proposed scheme has a high recovery rate for messages and can identify malicious users in the network at the same time.

This paper studies initial-value privacy problems of linear dynamical systems. We consider a standard linear time-invariant system with random process and measurement noises. For such a system, eavesdroppers having access to system output trajectories may infer the system initial states, leading to initial-value privacy risks. When a finite number of output trajectories are eavesdropped, we consider a requirement that any guess about the initial values can be plausibly denied. When an infinite number of output trajectories are eavesdropped, we consider a requirement that the initial values should not be uniquely recoverable. In view of these two privacy requirements, we define differential initial-value privacy and intrinsic initial-value privacy, respectively, for the system as metrics of privacy risks. First of all, we prove that the intrinsic initial-value privacy is equivalent to unobservability, while the differential initial-value privacy can be achieved for a privacy budget depending on an extended observability matrix of the system and the covariance of the noises. Next, the inherent network nature of the considered linear system is explored, where each individual state corresponds to a node and the state and output matrices induce interaction and sensing graphs, leading to a network system. Under this network system perspective, we allow the initial states at some nodes to be public, and investigate the resulting intrinsic initial- value privacy of each individual node. We establish necessary and sufficient conditions for such individual node initial-value privacy, and also prove that the intrinsic initial-value privacy of individual nodes is generically determined by the network structure.

Controller Area Network is the prominent communication protocol in automotive systems. Its salient features of arbitration, message filtering, error detection, data consistency and fault confinement provide robust and reliable architecture. Despite of this, it lacks security features and is vulnerable to many attacks. One of the common attacks over the CAN communication is the replay attack. It can happen even after the implementation of encryption or authentication. This paper proposes a methodology of supressing the replay attacks by implementing authenticated encryption embedded with timestamp and pre-shared initialisation vector as a primary key. The major advantage of this system is its flexibility and configurability nature where in each layer can be chosen with the help of cryptographic algorithms to up to the entire size of the keys.

the significant area in the growing field of internet security and IIoT connectivity is the way that forensic investigators will conduct investigation process with devices connected to industrial sensors. This part of process is known as IIoT digital forensics and investigation. The main research on IIoT digital forensic investigation has been done, but the current investigation process has revealed and identified major security issues need to be addressed. In parallel, major security issues faced by traditional forensic investigators dealing with IIoT connectivity and data security. This paper address the issues of the challenges and major security issues identified by review conducted in the prospective and emphasizes on the aforementioned security and challenges.

Cyber-Physical Systems (CPS) use computational resources to control physical processes and provide critical services. For this reason, an attack in these systems may have dangerous consequences in the physical world. Hence, cyber- resilience is a fundamental property to ensure the safety of the people, the environment and the controlled physical processes. In this paper, we present metrics to quantify the cyber-resilience level based on the design, structure, stability, and performance under the attack of a given CPS. The metrics provide reference points to evaluate whether the system is better prepared or not to face the adversaries. This way, it is possible to quantify the ability to recover from an adversary using its mathematical model based on actuators saturation. Finally, we validate our approach using a numeric simulation on the Tennessee Eastman control challenge problem.

Cyber-Physical Systems (CPS) often rely on network boundary defence as a primary means of access control; therefore, the compromise of one device threatens the security of all devices within the boundary. Resource and real-time constraints, tight hardware/software coupling, and decades-long service lifetimes complicate efforts for more robust, host-based access control mechanisms. Distributed capability systems provide opportunities for restoring access control to resource-owning devices; however, such a protection model requires a capability-based architecture for CPS devices as well as task compartmentalisation to be effective.This paper demonstrates hardware enforcement of network bearer tokens using an efficient translation between CHERI (Capability Hardware Enhanced RISC Instructions) architectural capabilities and Macaroon network tokens. While this method appears to generalise to any network-based access control problem, we specifically consider CPS, as our method is well-suited for controlling resources in the physical domain. We demonstrate the method in a distributed robotics application and in a hierarchical industrial control application, and discuss our plans to evaluate and extend the method.

Internet of Medical Things (IoMT) is the connection between medical devices and information systems to share, collect, process, store, and integrate patient and health data using network technologies. X-Rays, MR, MRI, and CT scans are the most frequently used patient medical image data. These images usually include patient information in one of the corners of the image. In this research work, to protect patient information, a new robust and secure watermarking algorithm developed for a selected region of interest (ROI) of medical images. First ROI selected from the medical image, then selected part divided equal blocks and applied Discrete Cosine Transformation (DCT) algorithm to embed a watermark into the selected coefficients. Several geometric and removal attacks are applied to the watermarked multimedia element such as lossy image compression, the addition of Gaussian noise, denoising, filtering, median filtering, sharpening, contrast enhancement, JPEG compression, and rotation. Experimental results show very promising results in PSNR and similarity ratio (SR) values after blocked DCT (B-DCT) based embedding algorithm against the Discrete Wavelet Transformation (DWT), Least Significant Bits (LSB) and DCT algorithms.

In this paper, we present the concept of boosting the resiliency of optimization-based observers for cyber-physical systems (CPS) using auxiliary sources of information. Due to the tight coupling of physics, communication and computation, a malicious agent can exploit multiple inherent vulnerabilities in order to inject stealthy signals into the measurement process. The problem setting considers the scenario in which an attacker strategically corrupts portions of the data in order to force wrong state estimates which could have catastrophic consequences. The goal of the proposed observer is to compute the true states in-spite of the adversarial corruption. In the formulation, we use a measurement prior distribution generated by the auxiliary model to refine the feasible region of a traditional compressive sensing-based regression problem. A constrained optimization-based observer is developed using l1-minimization scheme. Numerical experiments show that the solution of the resulting problem recovers the true states of the system. The developed algorithm is evaluated through a numerical simulation example of the IEEE 14-bus system.

The increasing vulnerabilities in Android kernel make it an attractive target to the attackers. Most kernel-targeted attacks are initiated through system calls. For security purpose, Google has introduced a Linux kernel security mechanism named “seccomp” since Android O to constrain the system calls accessible to the Android apps. Unfortunately, existing Android seccomp mechanism provides a fairly coarse-grained restriction by enforcing a unified seccomp policy containing more than 250 system calls for Android apps, which greatly reduces the effectiveness of seccomp. Also, it lacks an approach to profile the unnecessary system calls for a given Android app. In this paper we present a two-level control scheme named SASAK, which can shrink the attack surface of Android kernel by strictly constraining the system calls available to the Android apps with seccomp mechanism. First, instead of leveraging a unified seccomp policy for all Android apps, SASAK introduces an architecture- dedicated system call constraining by enforcing two separate and refined seccomp policies for the 32-bit Android apps and 64-bit Android apps, respectively. Second, we provide a tool to profile the necessary system calls for a given Android app and enforce an app-dedicated seccomp policy to further reduce the allowed system calls for the apps selected by the users. The app-dedicated control could dynamically change the seccomp policy for an app according to its actual needs. We implement a prototype of SASAK and the experiment results show that the architecture-dedicated constraining reduces 39.6% system calls for the 64-bit apps and 42.5% system calls for the 32-bit apps. 33% of the removed system calls for the 64-bit apps are vulnerable, and the number for the 32-bit apps is 18.8%. The app-dedicated restriction reduces about 66.9% and 62.5% system calls on average for the 64-bit apps and 32-bit apps, respectively. In addition, SASAK introduces negligible performance overhead.

With the deployment of artificial intelligent (AI) algorithms in a large variety of applications, there creates an increasing need for high-performance computing capabilities. As a result, different hardware platforms have been utilized for acceleration purposes. Among these hardware-based accelerators, the field-programmable gate arrays (FPGAs) have gained a lot of attention due to their re-programmable characteristics, which provide customized control logic and computing operators. For example, FPGAs have recently been adopted for on-demand cloud services by the leading cloud providers like Amazon and Microsoft, providing acceleration for various compute-intensive tasks. While the co-residency of multiple tenants on a cloud FPGA chip increases the efficiency of resource utilization, it also creates unique attack surfaces that are under-explored. In this paper, we exploit the vulnerability associated with the shared power distribution network on cloud FPGAs. We present a stealthy power attack that can be remotely launched by a malicious tenant, shutting down the entire chip and resulting in denial-of-service for other co-located benign tenants. Specifically, we propose stealthy-shutdown: a well-timed power attack that can be implemented in two steps: (1) an attacker monitors the realtime FPGA power-consumption detected by ring-oscillator-based voltage sensors, and (2) when capturing high power-consuming moments, i.e., the power consumption by other tenants is above a certain threshold, she/he injects a well-timed power load to shut down the FPGA system. Note that in the proposed attack strategy, the power load injected by the attacker only accounts for a small portion of the overall power consumption; therefore, such attack strategy remains stealthy to the cloud FPGA operator. We successfully implement and validate the proposed attack on three FPGA evaluation kits with running real-world applications. The proposed attack results in a stealthy-shutdown, demonstrating severe security concerns of co-tenancy on cloud FPGAs. We also offer two countermeasures that can mitigate such power attacks.

An open source and low-cost Supervisory Control and Data Acquisition System based on Node-RED and Arduino microcontrollers is presented in this paper. The system is designed for monitoring, supervision, and remotely controlling motors and sensors deployed for oil and gas facilities. The Internet of Things (IoT) based SCADA system consists of a host computer on which a server is deployed using the Node-RED programming tool and two terminal units connected to it: Arduino Uno and Arduino Mega. The Arduino Uno collects and communicates the data acquired from the temperature, flowrate, and water level sensors to the Node-Red on the computer through the serial port. It also uses a local liquid crystal display (LCD) to display the temperature. Node-RED on the computer retrieves the data from the voltage, current, rotary, accelerometer, and distance sensors through the Arduino Mega. Also, a web-based graphical user interface (GUI) is created using Node-RED and hosted on the local server for parsing the collected data. Finally, an HTTP basic access authentication is implemented using Nginx to control the clients' access from the Internet to the local server and to enhance its security and reliability.

Embedded systems often consist of deeply intertwined hardware and software components. At the same time, they are often used in safety-critical applications, where an error may result in enormous costs or even loss of human lives. Existing verification techniques that show the absence of errors do not scale well for complex integrated HW/SW systems. In this paper, we present a dependence analysis and automated partitioning approach for the formal analysis of HW/SW codesigns that are modeled in SystemC. The key idea of our approach is threefold: first, we partition a given system into loosely coupled submodels. Second, we analyze the dependences between these submodels and compute an abstract verification interface for each of them, which captures all possible influences of all other submodels. Third, we verify global properties of the overall system by verifying them separately for each subsystem. We demonstrate that our approach significantly reduces verification times and increases scalability with results for an anti-lock braking system.

One important aspect in protecting Cyber Physical System (CPS) is ensuring that the proper control and measurement signals are propagated within the control loop. The CPS research community has been developing a large set of check blocks that can be integrated within the control loop to check signals against various types of attacks (e.g., false data injection attacks). Unfortunately, it is not possible to integrate all these “checks” within the control loop as the overhead introduced when checking signals may violate the delay constraints of the control loop. Moreover, these blocks do not completely operate in isolation of each other as dependencies exist among them in terms of their effectiveness against detecting a subset of attacks. Thus, it becomes a challenging and complex problem to assign the proper checks, especially with the presence of a rational adversary who can observe the check blocks assigned and optimizes her own attack strategies accordingly. This paper tackles the inherent state-action space explosion that arises in securing CPS through developing DeepBLOC (DB)-a framework in which Deep Reinforcement Learning algorithms are utilized to provide optimal/sub-optimal assignments of check blocks to signals. The framework models stochastic games between the adversary and the CPS defender and derives mixed strategies for assigning check blocks to ensure the integrity of the propagated signals while abiding to the real-time constraints dictated by the control loop. Through extensive simulation experiments and a real implementation on a water purification system, we show that DB achieves assignment strategies that outperform other strategies and heuristics.