入侵检测系统

入侵检测系统是网络安全系统的重要组成部分之一 .本文介绍了入侵检测系统的概念、基本原理和分类 ,讨论了入侵检测系统面临的挑战 。

入侵检测与聚类分析

传统的入侵检测方法在面对网络结构升级和未知攻击时 ,缺乏必要的扩展性和自适应能力 ,而基于机器学习的检测算法首先需要训练数据集进行训练 ,然后建立检测模型并通过测试数据集中入侵行为的检测结果来验证 ,此类方法由于获取类标识数据的困难性及其信息表达的局限性 ,降低了对未知攻击的检则能力。本文提出利用遗传聚类进行入侵检测算法IDUGC(IntrusionDetectionUsingGeneticClustering)。实验结果表明 ,此算法在未知入侵检测方面是可行的、有效的 。

入侵检测技术在网络安全中的应用研究

防火墙和入侵检测技术是目前网络安全领域比较热门的两大话题,它们在网络保护能力方面发挥了不同的作用.文章对入侵检测系统进行了详细的介绍和分析,最后指出了入侵检测系统在网络安全中起着不可替代的重要作用.

探讨入侵检测系统中模式匹配算法的研究与实现

随着我国科学技术的不断发展，计算机与网络的应用越来越广泛，但是随之而来的网络安全问题已不容忽视。随着攻击手段与方法的日益复杂，传统的静态防御技术已经明显落后。本文结合当前计算机发展实际，对入侵检测系统（Intrusion Detection System）以及相关模式匹配算法进行分析与阐述。

风电场SCADA系统边界安全模型设计

针对风电SCADA系统边界安全体系架构问题,将防火墙和入侵检测系统(intrusion detection system,IDS)功能集于一体,融入入侵容忍技术、诱骗系统和数字取证等网络安全技术,设计出风电SCADA系统边界安全模型。该模型提供了多层屏障,可实现风电SCADA网络和外部网络间的深度防御,增加网络的安全性,对解决电力企业进行远程控制和通信的网络安全问题具有参考和应用价值。

Intrusion detection model based on deep belief nets

This paper focuses on the intrusion classification of huge amounts of data in a network intrusion detection system. An intrusion detection model based on deep belief nets （DBN） is proposed to conduct intrusion detection,and the principles regarding DBN are discussed.The DBN is composed of a multiple unsupervised restricted Boltzmann machine （RBM） and a supervised back propagation （BP）network.First,the DBN in the proposed model is pre-trained in a fast and greedy way,and each RBM is trained by the contrastive divergence algorithm.Secondly,the whole network is fine-tuned by the supervised BP algorithm,which is employed for classifying the low-dimensional features of the intrusion data generated by the last RBM layer simultaneously.The experimental results on the KDD CUP 1999 dataset demonstrate that the DBN using the RBM network with three or more layers outperforms the self-organizing maps （SOM）and neural network （NN）in intrusion classification.Therefore,the DBN is an efficient approach for intrusion detection in high-dimensional space.

Optimal configuration of firewall, IDS and vulnerability scan by game theory

The integrated linkage control problem based on attack detection is solved with the analyses of the security model including firewall, intrusion detection system （IDS） and vulnerability scan by game theory. The Nash equilibrium for two portfolios of only deploying IDS and vulnerability scan and deploying all the technologies is investigated by backward induction. The results show that when the detection rates of IDS and vulnerability scan are low, the firm will not only inspect every user who raises an alarm, but also a fraction of users that do not raise an alarm; when the detection rates of IDS and vulnerability scan are sufficiently high, the firm will not inspect any user who does not raise an alarm, but only inspect a fraction of users that raise an alarm. Adding firewall into the information system impacts on the benefits of firms and hackers, but does not change the optimal strategies of hackers, and the optimal investigation strategies of IDS are only changed in certain cases. Moreover, the interactions between IDS ＆ vulnerability scan and firewall ＆ IDS are discussed in detail.

聚类方法在警报数据分类与约简中的应用

提出了一个使用文本聚类方法进行警报数据分类与约简的处理框架.详细描述了警报特征向量的表示方法和直接聚类方法,以及警报数据的简约表示方法.

The Application of Weighted Association Rules in Host-Based Intrusion Detection System

Association rules are useful for determining correlations between items. Applying association rules to intrusion detection system (IDS) can improve the detection rate, but false positive rate is also increased. Weighted association rules are used in this paper to mine intrustion models, which can increase the detection rate and decrease the false positive rate by some extent. Based on this, the structure of host-based IDS using weighted association rules is proposed.

INTERNET INTRUSION DETECTION MODEL BASED ON FUZZY DATA MINING

An intrusion detection （ID） model is proposed based on the fuzzy data mining method. A major difficulty of anomaly ID is that patterns of the normal behavior change with time. In addition, an actual intrusion with a small deviation may match normal patterns. So the intrusion behavior cannot be detected by the detection system.To solve the problem, fuzzy data mining technique is utilized to extract patterns representing the normal behavior of a network. A set of fuzzy association rules mined from the network data are shown as a model of “normal behaviors”. To detect anomalous behaviors, fuzzy association rules are generated from new audit data and the similarity with sets mined from “normal” data is computed. If the similarity values are lower than a threshold value,an alarm is given. Furthermore, genetic algorithms are used to adjust the fuzzy membership functions and to select an appropriate set of features.

An analysis method of topological relations between Snort rules

It is difficult to knowall the relations between Snort rules. To deal with this problem, the topological relations between Snort rules are classified based on the set theory, and a method for calculating the topological relations between Snort rules is proposed. In the existing methods for analyzing the relations of Snort rules, the relations are usually determined only according to the header information of the Snort rules. Without considering the actions of Snort rules, the proposed method improves upon the existing methods and it can classify and calculate the topological relations between Snort rules according to both headers and options information of Snort rules. In addition, the proposed method is implemented by the functional language Haskell. The experimental results showthat the topological relations between Snort rules can be calculated rapidly and effectively. The proposed method also provides an important basis for conflict detection in the succeeding Snort rules.

防黑客的安全解决方案

“黑客”一词对于许多人来说并不陌生,谈到黑客的危害，多数人并没有切身的感受.人们对黑客袭击网站的事件也偶有所闻，但官方就此的报道与统计就不那么多见了。究其原因，大概有两种可能：一是检测到黑客袭击的技术尚不完善ＺＭ是遭受黑客袭击的人或机构大多保持沉默。但是只要稍加留心，用户便可从各种渠道了解到有关黑客的行踪，还可以较轻易地找到如何成为一名黑客之类的文章。由此看来，黑客离我们并不遥远，为对付黑客攻击，人侵检测技术是非常重要的一环。一、入侵检测技术正如许多人了解的一样，利用防火墙技术，经过仔细地配置，通常能够在内外网之间提供安全的网络保护，降低网络的不安全风险。但是。

Intrusion Detection for Wireless Mesh Networks using Finite State Machine

Wireless Mesh Networks is vulnerable to attacks due to the open medium, dynamically changing network topology, cooperative algorithms, Lack of centralized monitoring and management point. The traditional way of protecting networks with firewalls and encryption software is no longer suffi- cient and effective for those features. In this paper, we propose a distributed intrusion detection ap- proach based on timed automata. A cluster-based detection scheme is presented, where periodically a node is elected as the monitor node for a cluster. These monitor nodes can not only make local intrusion detection decisions, but also cooperatively take part in global intrusion detection. And then we con- struct the Finite State Machine （FSM） by the way of manually abstracting the correct behaviors of the node according to the routing protocol of Dynamic Source Routing （DSR）. The monitor nodes can verify every node＇s behavior by the Finite State Ma- chine （FSM）, and validly detect real-time attacks without signatures of intrusion or trained data.Compared with the architecture where each node is its own IDS agent, our approach is much more efficient while maintaining the same level of effectiveness. Finally, we evaluate the intrusion detection method through simulation experiments.

Nicotine enhances migration and invasion of human esophageal squamous carcinoma cells which is inhibited by nimesulide

AIM： To study the effect of nicotine on the migration and invasion of human esophageal squamous carcinoma cells and to investigate whether nimesulide can inhibit the effect of nicotine.METHODS： The esophageal squamous carcinoma cell line （TE-13） was treated with different concentrations of nicotine （100 μg/mL and 200 μg/mL） or 200 μg/mL nicotine plus 100 μmol/L nimesulide. Cell migration and invasion were measured using migration and invasion chamber systems. COX-2 expression was determined by Western blotting. Matrix metalloproteinase-2 （MMP-2） was analyzed by zymography and ELISA.RESULTS： Nicotine （100 μg/mL, 200 μg/mL） enhanced TE-13 cells migration and invasion, and increased the protein expression of COX-2 and the activity of MMP-2. Nicotine （200 μ/mL） stimulated TE-13 cells migration and invasion which were partly blocked by nimesulide. This was associated with decreased protein expression of COX-2 and decreased activity and protein expression of MMP-2. CONCLUSION： Nicotine enhances the migration and invasion of the esophageal squamous carcinoma cell line, and nimesulide partly blocks the effect ofnicotine-enhanced esophageal squamous carcinoma cell migration and invasion.

AN IMMUNITY-BASED SECURITY ARCHITECTURE FOR MOBILE AD HOC NETWORKS

This paper focuses on investigating immunological principles in designing a multi-agent security architecture for intrusion detection and response in mobile ad hoc networks. In this approach, the immunity-based agents monitor the situation in the network. These agents can take appropriate actions according to the underlying security policies. Specifically, their activities are coordinated in a hierarchical fashion while sensing, communicating, decision and generating responses. Such an agent can learn and adapt to its environment dynamically and can detect both known and unknown intrusions. The proposed intrusion detection architecture is designed to be flexible, extendible, and adaptable that can perform real-time monitoring. This paper provides the conceptual view and a general framework of the proposed system. In the end, the architecture is illustrated by an example to show it can prevent the attack efficiently.

Anomaly-based model for detecting HTTP-tunnel traffic using network behavior analysis

Increasing time-spent online has amplified users＇ exposure to tile tilreat oI miormanon leakage. Although existing security systems （such as firewalls and intrusion detection systems） can satisfy most of the security requirements of network administrators, they are not suitable for detecting the activities of applying the HTTP-tunnel technique to steal users＇ private information. This paper focuses on a network behavior-based method to address the limitations of the existing protection systems. At first, it analyzes the normal network behavior pattern over HTI＇P traffic and select four features. Then, it pres- ents an anomaly-based detection model that applies a hierarchical clustering technique and a scoring mechanism. It also uses real-world data to validate that the selected features are useful. The experiments have demonstrated that the model could achieve over 93% hit-rate with only about 3% false- positive rate. It is regarded confidently that the approach is a complementary technique to the existing security systems.

Intrusion Detection Algorithm Based on Density,Cluster Centers,and Nearest Neighbors

Intrusion detection aims to detect intrusion behavior and serves as a complement to firewalls.It can detect attack types of malicious network communications and computer usage that cannot be detected by idiomatic firewalls.Many intrusion detection methods are processed through machine learning.Previous literature has shown that the performance of an intrusion detection method based on hybrid learning or integration approach is superior to that of single learning technology.However,almost no studies focus on how additional representative and concise features can be extracted to process effective intrusion detection among massive and complicated data.In this paper,a new hybrid learning method is proposed on the basis of features such as density,cluster centers,and nearest neighbors(DCNN).In this algorithm,data is represented by the local density of each sample point and the sum of distances from each sample point to cluster centers and to its nearest neighbor.k-NN classifier is adopted to classify the new feature vectors.Our experiment shows that DCNN,which combines K-means,clustering-based density,and k-NN classifier,is effective in intrusion detection.

A NOVEL INTRUSION DETECTION MODE BASED ON UNDERSTANDABLE NEURAL NETWORK TREES

Several data mining techniques such as Hidden Markov Model (HMM), artificial neural network, statistical techniques and expert systems are used to model network packets in the field of intrusion detection. In this paper a novel intrusion detection mode based on understandable Neural Network Tree (NNTree) is pre-sented. NNTree is a modular neural network with the overall structure being a Decision Tree (DT), and each non-terminal node being an Expert Neural Network (ENN). One crucial advantage of using NNTrees is that they keep the non-symbolic model ENN’s capability of learning in changing environments. Another potential advantage of using NNTrees is that they are actually “gray boxes” as they can be interpreted easily if the num-ber of inputs for each ENN is limited. We showed through experiments that the trained NNTree achieved a simple ENN at each non-terminal node as well as a satisfying recognition rate of the network packets dataset. We also compared the performance with that of a three-layer backpropagation neural network. Experimental results indicated that the NNTree based intrusion detection model achieved better performance than the neural network based intrusion detection model.

AN INTRUSION DETECTION SYSTEM BASED ON EVIDENCE THEORY AND ROUGH SET THEORY

In this paper,we propose a novel Intrusion Detection System (IDS) architecture utilizing both the evidence theory and Rough Set Theory (RST). Evidence theory is an effective tool in dealing with uncertainty question. It relies on the expert knowledge to provide evidences,needing the evidences to be independent,and this make it difficult in application. To solve this problem,a hybrid system of rough sets and evidence theory is proposed. Firstly,simplification are made based on Variable Precision Rough Set (VPRS) conditional entropy. Thus,the Basic Belief Assignment (BBA) for all evidences can be calculated. Secondly,Dempster’s rule of combination is used,and a decision-making is given. In the proposed approach,the difficulties in acquiring the BBAs are solved,the correlativity among the evidences is reduced and the subjectivity of evidences is weakened. An illustrative example in an intrusion detection shows that the two theories combination is feasible and effective.