A privilege flow oriented intrusion detection method based on HSMM (Hidden semi-Markov Model) is discussed. The privilege flow model and HSMM are incorporated in the implementation of an anomaly detection IDS (Intrusi...A privilege flow oriented intrusion detection method based on HSMM (Hidden semi-Markov Model) is discussed. The privilege flow model and HSMM are incorporated in the implementation of an anomaly detection IDS (Intrusion Detection System). Using the dataset of DARPA 1998, our experiment results reveal good detection performance and acceptable computation cost.展开更多
In order to enforce the least privilege principle in the operating system, it is necessary for the process privilege to be effectively controlled; but this is very difficult because a process always changes as time ch...In order to enforce the least privilege principle in the operating system, it is necessary for the process privilege to be effectively controlled; but this is very difficult because a process always changes as time changes. In this paper, based on the analysis on how the process privilege is generated and how it works, a hierarchy implementing the least privilege principle with three layers, i.e. administration layer, functionality control layer and performance layer, is posed. It is clearly demonstrated that to bound privilege's working scope is a critical part for controlling privilege, but this is only mentioned implicitly while not supported in POSIX capability mechanism. Based on analysis of existing control mechanism for privilege, not only an improved capability inheritance formula but also a new complete formal model for controlling process based on integrating RBAC, DTE, and POSIX capability mechanism is introduced. The new invariants in the model show that this novel privilege control mechanism is different from RBAC's, DTE's, and POSIX's, and it generalizes subdomain control mechanism and makes this mechanism dynamic.展开更多
PMI是构建在PKI基础上实施特权管理的服务体系,目前普遍采用基于角色的安全架构和基于属性证书的实现机制。该文提出了一种面向PMI环境基于角色和权限两级的开放分布式委托授权模型――DM for PMI(Delegation Model for PMI),并在该模...PMI是构建在PKI基础上实施特权管理的服务体系,目前普遍采用基于角色的安全架构和基于属性证书的实现机制。该文提出了一种面向PMI环境基于角色和权限两级的开放分布式委托授权模型――DM for PMI(Delegation Model for PMI),并在该模型的基础上引入委托证书,给出了一种扩展的PMI体系架构――EPMI(Extension PMI)。EPMI增强了原有PMI中委托授权的语义和机制,解决了开放分布式环境下电子政务与电子商务实际应用中的特权委托问题。展开更多
文摘A privilege flow oriented intrusion detection method based on HSMM (Hidden semi-Markov Model) is discussed. The privilege flow model and HSMM are incorporated in the implementation of an anomaly detection IDS (Intrusion Detection System). Using the dataset of DARPA 1998, our experiment results reveal good detection performance and acceptable computation cost.
基金supported by the National Key Basic Research Program of China(Grant No.G1999035802)the National Natural Science Foundation of China(Grant No.60083007)
文摘In order to enforce the least privilege principle in the operating system, it is necessary for the process privilege to be effectively controlled; but this is very difficult because a process always changes as time changes. In this paper, based on the analysis on how the process privilege is generated and how it works, a hierarchy implementing the least privilege principle with three layers, i.e. administration layer, functionality control layer and performance layer, is posed. It is clearly demonstrated that to bound privilege's working scope is a critical part for controlling privilege, but this is only mentioned implicitly while not supported in POSIX capability mechanism. Based on analysis of existing control mechanism for privilege, not only an improved capability inheritance formula but also a new complete formal model for controlling process based on integrating RBAC, DTE, and POSIX capability mechanism is introduced. The new invariants in the model show that this novel privilege control mechanism is different from RBAC's, DTE's, and POSIX's, and it generalizes subdomain control mechanism and makes this mechanism dynamic.
文摘PMI是构建在PKI基础上实施特权管理的服务体系,目前普遍采用基于角色的安全架构和基于属性证书的实现机制。该文提出了一种面向PMI环境基于角色和权限两级的开放分布式委托授权模型――DM for PMI(Delegation Model for PMI),并在该模型的基础上引入委托证书,给出了一种扩展的PMI体系架构――EPMI(Extension PMI)。EPMI增强了原有PMI中委托授权的语义和机制,解决了开放分布式环境下电子政务与电子商务实际应用中的特权委托问题。
