A Data Intrusion Tolerance Model Based on an Improved Evolutionary Game Theory for the Energy Internet

Malicious attacks against data are unavoidable in the interconnected,open and shared Energy Internet(EI),Intrusion tolerant techniques are critical to the data security of EI.Existing intrusion tolerant techniques suffered from problems such as low adaptability,policy lag,and difficulty in determining the degree of tolerance.To address these issues,we propose a novel adaptive intrusion tolerance model based on game theory that enjoys two-fold ideas:(1)it constructs an improved replica of the intrusion tolerance model of the dynamic equation evolution game to induce incentive weights;and (2)it combines a tournament competition model with incentive weights to obtain optimal strategies for each stage of the game process.Extensive experiments are conducted in the IEEE 39-bus system,whose results demonstrate the feasibility of the incentive weights,confirm the proposed strategy strengthens the system’s ability to tolerate aggression,and improves the dynamic adaptability and response efficiency of the aggression-tolerant system in the case of limited resources.

Quorum systems for intrusion-tolerance based on trusted timely computing base

Quorum systems have been used to solve the problem of data consistency in distributed fault-tolerance systems. But when intrusions occur, traditional quorum systems have some disadvantages. For example, synchronous quorum systems are subject to DOS attacks, while asynchronous quorum systems need a larger system size （at least 3f＋1 for generic data, and f fewer for self-verifying data）. In order to solve the problems above, an intrusion-tolerance quorum system （ITQS） of hybrid time model based on trust timely computing base is presented （TTCB）. The TTCB is a trust secure real-time component inside the server with a well defined interface and separated from the operation system. It is in the synchronous communication environment while the application layer in the server deals with read-write requests and executes update-copy protocols asynchronously. The architectural hybridization of synchrony and asynchrony can achieve the data consistency and availability correctly. We also build two kinds of ITQSes based on TTCB, i.e., the symmetrical and the asymmetrical TTCB quorum systems. In the performance evaluations, we show that TTCB quorum systems are of smaller size, lower load and higher availability.

Building Intrusion Tolerant Software System

In this paper, we describe and analyze the hypothesis about intrusiontolerance software system, so that it can provide an intended server capability and deal with theimpacts caused by the intruder exploiting the inherent security vulnerabilities. Wepresent someintrusion tolerance technology by exploiting N-version module threshold method in constructingmultilevel secure software architecture, by detecting with hash value, by placing an 'antigen' wordnext to the return address on the stack thatis similar to human immune system, and by adding 'Honeycode' nonfunctional code to disturb intruder, so that the security and the availability of thesoftware system are ensured.

Building a highly available and intrusion tolerant database security and protection system （ DSPS）

Database Security and Protection System (DSPS) is a security platform for fighting malicious DBMS. The security and performance are critical to DSPS. The authors suggested a key management scheme by combining the server group structure to improve availability and the key distribution structure needed by proactive security. This paper detailed the implementation of proactive security in DSPS. After thorough performance analysis, the authors concluded that the performance difference between the replicated mechanism and proactive mechanism becomes smaller and smaller with increasing number of concurrent connections; and that proactive security is very useful and practical for large, critical applications.

Wide temperature range-and damage-tolerant microsupercapacitors from salt-tolerant, anti-freezing and self-healing organohydrogel via dynamic bonds modulation

The advance of microelectronics requires the micropower of microsupercapacitors(MSCs) to possess wide temperature-and damage-tolerance beyond high areal energy density.The properties of electrolyte are crucial for MSCs to meet the above requirements.Here,an organohydrogel electrolyte,featured with high salt tolerance,ultralow freezing point,and strong self-healing ability,is experimentally realized via modulating its inner dynamic bonds.Spectroscopic and theoretical analysis reveal that dimethyl sulfoxide has the ability to reconstruct Li^(+)solvation structure,and interact with free water and polyvinyl alcohol chains via forming hydrogen bonds.The organohydrogel electrolyte is employed to build MSCs,which show a boosted energy density,promising wide temperature range-and damage-tolerant ability.These attractive features make the designed organohydrogel electrolyte have great potential to advance MSCs.

An Automatic Intrusion Diagnosis Approach for Clouds

Virtual machines have attracted significant attention especially within the high performance computing community. How- ever, there remain problems with respect to security in general and intrusion detection and diagnosis in particular which underpin the realization of the potential offered by this emerging technology. In this paper, one such problem has been highlighted, i.e., intrusion severity analysis for large-scMe virtual machine based systems, such as clouds. Furthermore, the paper proposes a solution to this prob- lem for the first time for clouds. The proposed solution achieves virtual machine specific intrusion severity analysis while preserving isolation between the security module and the monitored virtual machine. Furthermore, an automated approach is adopted to signif- icantly reduce the overall intrusion response time. The paper includes a detailed description of the solution and an evaluation of our approach with the objective to determine the effectiveness and potential of this approach. The evaluation includes both architectural and experimentM evaluation thereby enabling us to strengthen our approach at an architectural level as well. Finally, open problems and challenges that need to be addressed in order to make further improvements to the proposed approach have been highlighted.

Quantitative Analysis of Multi-Recovery-Based Intrusion Tolerance Model

Quantitative analysis has always been a difficult problem in security analysis of intrusion tolerance systems. An intrusion tolerance model based on multiple recovery mechanisms is introduced in this paper and how to quantify the security attributes of the model is proposed. A state transition model with recovery states more accurately describes the dynamic behavior of the system. Considering that recovery mechanisms have a great impact on the security performance of the system, we set up the cost models corresponding to different recovery mechanisms. We propose a feasible security measure based on mean cost to security failure in order to evaluate the system cost during the recovery phase. The experimental results confirmed the feasibility of the proposed methods.

Atomic multicast protocol for intrusion-tolerance based on trusted timely computing base

Distributed architecture is often adopted for the intrusion-tolerance system currently.However,this distributed intrusiontolerance system has a consensus problem.To solve this problem,this article explores a distributed intrusion-tolerance system of hybrid time model based on trusted timely computing base（TTCB） and implement an atomic multicast protocol using TTCB services.The TTCB is a trust secure real-time component inside the server,with a well defined interface and separated from the operation system.It is in the synchronous communication environment,while the application layer in the server works asynchronously.By the atomic multicast protocol,it can be achieved that when the servers are over twice the number of faulty servers,the consensus can be satisfied.The performance evaluations show that the proposed protocol can yield larger good throughput with a lower unavailability.

水电站入侵监控视频数据扩容存储系统设计

设计水电站入侵监控视频数据扩容存储系统,有效提升水电站入侵监控视频数据存储容量,为水电站安全保障工作提供可靠依据。视频数据采集层使用基于FPGA的视频采集技术采集水电站入侵监控视频数据,经有效预处理后,由网络通信层发送给扩容存储层,扩容存储层接收到由网络通信层发送过来的水电站入侵监控视频数据后,采用合理的数据处理技术删除重复的水电站入侵监控视频数据,并利用视频数据容错算法结合数据扩容存储约束,合理控制水电站入侵监控视频数据弹性,实现水电站入侵监控视频数据扩容存储。实验结果表明,该系统可较好采集、传输与存储水电站入侵监控视频数据,有效提升系统存储容量,入侵监控视频数据存储的安全性以及稳定性均较高。

一种并行容侵系统研究模型———RC模型

继防火墙和入侵检测系统之后 ,容侵系统成为了保护大型网络服务器的又一重要技术 .该文在目前的基于状态转换模型的容侵系统研究模型的基础上 ,针对入侵行为对系统的资源和控制所造成的影响进行了分类 ,并进而提出了一种并行容侵系统研究模型———RC模型 .文章也给出了在RC模型上进行入侵恢复的基本方法 ,最后给出了容侵实例 .

电子证据的获取及可靠性关键技术研究

电子证据作为一种新的证据形式,逐渐成为新的诉讼证据之一。本文提出了一种结合法学、密码学、计算机网络安全技术、知识发现与人工智能技术来获取电子证据并保证其可靠性的研究方法,包括基于数据挖掘、入侵检测和入侵容忍技术的电子证据的高效获取技术,基于加密和网络公证技术的电子证据的可靠保全技术以及基于数据挖掘技术的电子证据的智能分析技术等。设计了一个智能取证系统Intelligent-Forensic System(IFS),以解决电子证据的获取、传输、保存、分析、使用和可靠性保证问题。

网络取证及其应用技术研究

网络取证技术的研究目前还很不成熟,术语的使用也较混乱.本文主要研究了网络取证的分析技术,着重分析了基于IDS、蜜阱、Agent、模糊专家系统和SVM等技术的网络取证实现方法,提出了基于入侵容忍、网络监控等技术的网络取证系统设计思想,从而系统地介绍了网络取证技术的概念、分析方法、取证技术、系统实现方法及其发展趋势.

基于多代理的容忍入侵体系结构

该文提出了一种基于多代理(Agent)技术的容忍入侵体系结构。通过在系统组件中引入一定的冗余度,将冗余和多样性技术相结合,利用门限秘密共享技术将秘密信息分布于多个系统组件上来达到容忍入侵的目的。通过分布在每个服务器上的多个代理,建立一个容忍入侵的安全内核,重要信息通过安全内核来传递,保证系统关键部件为合法用户提供连续和可靠的基本服务。该方案采用系统整体安全策略,将容忍入侵与多代理的入侵检测相结合,使系统具有更好的实用性和可生存性。

基于轻量云模型的WSN不确定性信任表示方法

参考云模型定性定量不确定性转换特性,设计了适用于WSN的轻量云模型,使用此模型对直接信任、间接信任、推荐行为的信任进行全面的不确定性表示。轻量云模型计算简单,每一个WSN节点均可独立建立轻量云模型,并对邻居节点信任情况进行全面的评估,从而发现WSN应用中的安全问题。实验结果表明,该方法克服了传统信任管理框架中敏感度与容忍度之间的矛盾,既保证了多种异常情况的高容忍度,又具备较敏感的攻击识别能力。

基于表决的分布式入侵容忍系统模型及量化分析

针对现有入侵容忍系统模型没有考虑响应时间、自适应性差和入侵容忍能力低的问题,提出一种基于表决的分布式入侵容忍系统模型。该模型能够提供响应时间稳定的服务,具有更好的自适应性和入侵容忍能力。通过对模型的量化分析,总结了使用门限隐藏和表决技术所产生的三种情况,分析了这三种情况对模型入侵容忍能力的影响以及在这三种情况下各因素与入侵容忍度之间的联系。仿真结果表明,该模型具有更好的完整度、保密度和入侵容忍度,对建立提供连续可靠服务的高入侵容忍能力的系统具有积极的指导意义。

基于频繁模式挖掘的报警关联与分析算法

提出了一个入侵检测与响应协作模型,结合入侵容忍的思想扩展了入侵检测消息交换格式IDMEF,增加了怀疑度属性.除了发现的入侵事件外,一些可疑的事件也会报告给协作部件.提出了一个基于修改的CLOSET频繁闭模式挖掘算法的报警关联与分析算法,在分布式入侵检测与响应协作系统中,帮助协作部件对收到的IDMEF格式的报警消息进行关联和分析,以便做出合适的响应.为此,修改了CLOSET算法来按照最小支持度和最小怀疑度来得到频繁闭模式.实验结果表明,应用该算法可以很好地缩减报警数量,同时对于所有可疑的和入侵事件,都可以做出适宜的响应.

无线传感器网络拓扑的容错度与容侵度

研究传感器网络拓扑对节点失败的容忍能力,必须解决三个基本问题,容忍节点失败的定义是什么,如何评价拓扑的这种容忍能力,什么样的拓扑具有较高的容忍能力.当前有关无线网络容错拓扑的研究均将图的多连通性看成拓扑的容错性,以图形多连通度的大小来衡量拓扑容错性的高低.本文通过实例分析指出图的多连通性与容错性是不同的,并结合网络的可用性,给出拓扑对失败节点容忍的定义,在此基础上,根据随机故障和恶意入侵两类节点失败形成原因,给出了拓扑容错度和容侵度作为拓扑对节点失败容忍能力高低的评价标准,并利用这两个标准分析了传感器网络分层拓扑,得出其拓扑容错度随簇头节点比例提高递减、而容侵度随之递增的理论结果.

基于容忍入侵的数据库安全体系结构

提出了一种容忍入侵的数据库安全体系结构.这种体系结构是建立在三层安全模型,即"外层防御+中间层入侵检测+内层容忍入侵"的基础上,将冗余和多样性技术相结合,采用门限秘密共享方案,实现数据库系统的可生存性及关键数据的机密性.与其他容忍入侵的数据库系统相比,文中提出的数据库安全体系结构,采用系统整体安全策略,综合多种安全措施,实现了系统关键功能的安全性和健壮性.

数据库入侵检测研究综述

网络的发展使数据库面临的安全形势更加复杂,而传统的以预防为中心的数据库安全机制存在不足,在此基础上总结了数据库入侵检测技术的发展现状,指出了在此方面进行研究的难点和需要解决的关键问题,最后对今后的发展趋势进行了展望。

基于多级入侵容忍的数据库安全解决方案

传统的数据库安全解决方案的缺点是不能很好地解决以合法身份进行的恶意攻击,对具有不同安全需求的用户,只能提供固定的安全级别,造成资源浪费。它采用多级安全模型,即“用户+ OS + DBMS +事务级入侵容忍”,将冗余和多样性技术相结合,采用整体安全策略及面向服务的入侵容忍技术,实现数据库的可生存性、可用性及关键数据的机密性、完整性,能有效抵御以合法身份进行的恶意攻击,降低安全成本。