入侵检测与防火墙的联动平台研究

通过分析入侵检测系统和防火墙技术的各自优势,认为实现防火墙的数据过滤与入侵检测的实时监控间的有效互补是非常重要的。提出了网络安全事件的基本分类方法,定义出入侵检测系统提供给防火墙的信息格式,采用向入侵检测系统和防火墙中嵌入相关模块的方法,实现了入侵检测系统对攻击行为的自动响应,从而实现了防火墙与入侵检测系统间的协同工作。这样无论是来自内网还是外网的攻击,都可以被联动平台识别并自动响应。

互联网安全及防范措施

随着互联网络的发展,信息传递越来越来快捷。国家政府机构、各企事业单位不仅大多建立了自己的局域网系统,而且通过各种方式与互联网相连。文章以影响计算机网络安全的主要因素为突破口,从不同角度全面介绍了影响计算机网络安全的情况,从而可以将不利因素扼杀在萌芽状态,以确保计算机网络的安全管理和有效运行。

Optimal configuration of firewall, IDS and vulnerability scan by game theory

The integrated linkage control problem based on attack detection is solved with the analyses of the security model including firewall, intrusion detection system （IDS） and vulnerability scan by game theory. The Nash equilibrium for two portfolios of only deploying IDS and vulnerability scan and deploying all the technologies is investigated by backward induction. The results show that when the detection rates of IDS and vulnerability scan are low, the firm will not only inspect every user who raises an alarm, but also a fraction of users that do not raise an alarm; when the detection rates of IDS and vulnerability scan are sufficiently high, the firm will not inspect any user who does not raise an alarm, but only inspect a fraction of users that raise an alarm. Adding firewall into the information system impacts on the benefits of firms and hackers, but does not change the optimal strategies of hackers, and the optimal investigation strategies of IDS are only changed in certain cases. Moreover, the interactions between IDS ＆ vulnerability scan and firewall ＆ IDS are discussed in detail.

The Application of Weighted Association Rules in Host-Based Intrusion Detection System

Association rules are useful for determining correlations between items. Applying association rules to intrusion detection system (IDS) can improve the detection rate, but false positive rate is also increased. Weighted association rules are used in this paper to mine intrustion models, which can increase the detection rate and decrease the false positive rate by some extent. Based on this, the structure of host-based IDS using weighted association rules is proposed.

An analysis method of topological relations between Snort rules

It is difficult to knowall the relations between Snort rules. To deal with this problem, the topological relations between Snort rules are classified based on the set theory, and a method for calculating the topological relations between Snort rules is proposed. In the existing methods for analyzing the relations of Snort rules, the relations are usually determined only according to the header information of the Snort rules. Without considering the actions of Snort rules, the proposed method improves upon the existing methods and it can classify and calculate the topological relations between Snort rules according to both headers and options information of Snort rules. In addition, the proposed method is implemented by the functional language Haskell. The experimental results showthat the topological relations between Snort rules can be calculated rapidly and effectively. The proposed method also provides an important basis for conflict detection in the succeeding Snort rules.

人员与管理方法-信息安全的关键因素

几乎所有的企业都通过互联网联系供货商、股东和客户,他们寄希望于技术手段来保护自己的数据。许多公司常常认为防火墙、虚拟专用网(VDN)和入侵检测系统(IDS)等技术可以解决安全问题,但是,要让这些技术发挥作用,达到保护信息的目的,还需要专业人员和明确的管理办法。安全的挑战随着Web变得越来越重要。

Anomaly-based model for detecting HTTP-tunnel traffic using network behavior analysis

Increasing time-spent online has amplified users＇ exposure to tile tilreat oI miormanon leakage. Although existing security systems （such as firewalls and intrusion detection systems） can satisfy most of the security requirements of network administrators, they are not suitable for detecting the activities of applying the HTTP-tunnel technique to steal users＇ private information. This paper focuses on a network behavior-based method to address the limitations of the existing protection systems. At first, it analyzes the normal network behavior pattern over HTI＇P traffic and select four features. Then, it pres- ents an anomaly-based detection model that applies a hierarchical clustering technique and a scoring mechanism. It also uses real-world data to validate that the selected features are useful. The experiments have demonstrated that the model could achieve over 93% hit-rate with only about 3% false- positive rate. It is regarded confidently that the approach is a complementary technique to the existing security systems.

AN INTRUSION DETECTION SYSTEM BASED ON EVIDENCE THEORY AND ROUGH SET THEORY

In this paper,we propose a novel Intrusion Detection System (IDS) architecture utilizing both the evidence theory and Rough Set Theory (RST). Evidence theory is an effective tool in dealing with uncertainty question. It relies on the expert knowledge to provide evidences,needing the evidences to be independent,and this make it difficult in application. To solve this problem,a hybrid system of rough sets and evidence theory is proposed. Firstly,simplification are made based on Variable Precision Rough Set (VPRS) conditional entropy. Thus,the Basic Belief Assignment (BBA) for all evidences can be calculated. Secondly,Dempster’s rule of combination is used,and a decision-making is given. In the proposed approach,the difficulties in acquiring the BBAs are solved,the correlativity among the evidences is reduced and the subjectivity of evidences is weakened. An illustrative example in an intrusion detection shows that the two theories combination is feasible and effective.

Real-valued multi-area self set optimization in immunity-based network intrusion detection system

The real-valued self set in immunity-based network intrusion detection system （INIDS） has some defects： multi-area and overlapping, which are ignored before. The detectors generated by this kind of self set may have the problem of boundary holes between self and nonself regions, and the generation efficiency is low, so that, the self set needs to be optimized before generation stage. This paper proposes a self set optimization algorithm which uses the modified clustering algorithm and Gaussian distribution theory. The clustering deals with multi-area and the Gaussian distribution deals with the overlapping. The algorithm was tested by Iris data and real network data, and the results show that the optimized self set can solve the problem of boundary holes, increase the efficiency of detector generation effectively, and improve the system＇s detection rate.

The analysis of application of data mining technology in the system of intrusion detection

With the economic development and the popularity of application of electronic computer, electronic commerce has rapid development. More and more commerce and key business has been carried on the lnternet because Internet has the features of interaction, openness, sharing and so on. However, during the daily commerce, people worry about the security of the network system. So a new technology which can detect the unusual behavior in time has been invented in order to protect the security of network system. The system of intrusion detection needs a lot of new technology to protect the data of the network system. The application of data mining technology in the system of intrusion detection can provide a better assistant to the users to analyze the data and improve the accuracy of the checking system.

AN IMMUNITY-BASED SECURITY ARCHITECTURE FOR MOBILE AD HOC NETWORKS

This paper focuses on investigating immunological principles in designing a multi-agent security architecture for intrusion detection and response in mobile ad hoc networks. In this approach, the immunity-based agents monitor the situation in the network. These agents can take appropriate actions according to the underlying security policies. Specifically, their activities are coordinated in a hierarchical fashion while sensing, communicating, decision and generating responses. Such an agent can learn and adapt to its environment dynamically and can detect both known and unknown intrusions. The proposed intrusion detection architecture is designed to be flexible, extendible, and adaptable that can perform real-time monitoring. This paper provides the conceptual view and a general framework of the proposed system. In the end, the architecture is illustrated by an example to show it can prevent the attack efficiently.

An immunity-based technique to detect network intrusions

This paper briefly reviews other people’s works on negative selection algorithm and their shortcomings. With a view to the real problem to be solved, authors bring forward two assumptions, based on which a new immune algorithm, multi-level negative selection algorithm, is developed. In essence, compared with Forrest’s negative selection algorithm, it enhances detector generation efficiency. This algorithm integrates clonal selection process into negative selection process for the first time. After careful analyses, this algorithm was applied to network intrusion detection and achieved good results.

Personalized Trust Management for Open and Flat P2P Communities

A personalized trust management scheme is proposed to help peers build up trust between each other in open and flat P2P communities. This scheme totally abandons the attempt to achieve a global view. It evaluates trust from a subjective point of view and gives personalized decision support to each peer. Simulation experiments prove its three advantages: free of central control, stronger immunity to misleading recommendations, and limited traffic overload.

Hybrid Optimization of Support Vector Machine for Intrusion Detection

Support vector machine (SVM) technique has recently become a research focus in intrusion detection field for its better generalization performance when given less priori knowledge than other soft-computing techniques. But the randomicity of parameter selection in its implement often prevents it achieving expected performance. By utilizing genetic algorithm (GA) to optimize the parameters in data preprocessing and the training model of SVM simultaneously, a hybrid optimization algorithm is proposed in the paper to address this problem. The experimental results demonstrate that it’s an effective method and can improve the performance of SVM-based intrusion detection system further.

A Simulation Environment for Intrusion Detection System in IEC 61850 Based Substation Automation System

Greater complexity and interconnectivity across systems embracing electrical power technologies has meant that cyber-security issues have attracted significant attention. In this paper a simulation environment for intrusion detection system in IEC 61850 standard-based substation automation system is provided to test simulated attacks on IEDs （intelligent electronic devices）. Intrusion detection is the process of detecting malicious attacker, so it is an effective and mature security mechanism to protect electrical facility. However, it is not harnessed when securing IEC 61850 automated substation. To prove the detection capability of the system testing environment was developed to analyze and test attacks simulated with different test cases. It shows that the simulation environment works accordingly to various network traffic scenarios and eventually proves the functionality of intrusion detection system to be later deployed in the real IEC 61850 based substation automation system site.

A virtual machine-based invasion detection system for the virtual computing environment

Under virtualization idea based on large-scale dismantling and sharing, the implementing of network interconnection of calculation components and storage components by loose coupling, which are tightly coupling in traditional server, achieves computing capacity, storage capacity and service capacity distri- bution according to need in application-level. Under the new server model, the segregation and protection of user space and system space as well as the security monitoring of virtual resources are the important factors of ultimate security guarantee. This article presents a large-scale and expansible distributed invasion detection system of virtual computing environment based on virtual machine. The system supports security monitoring management of global resources and provides uniform view of security attacks under virtual computing environment, thereby protecting the user applications and system security under capacity services domain.

Research on the Computer Network Protocol Test Model based on Genetic and Random Walk Algorithm

In this paper, we conduct research on the computer network protocol test model based on genetic and random walk algorithm.Network protocol is the abstract concept, is important in the process of the development of network system. Fully understand and grasp of thenetwork protocols for managers is there is a big diffi cult. Network covert channel is the evaluation of intrusion detection system and fi rewallsecurity performance of an important means, the paper will start from the angle of the attacker, the fl aws of the research, and use this kind ofdefect to realize network covert channel, the random walk algorithm will be feasible for dealing with this issue. For achieving this, we integratethe genetic and random walk algorithm for systematic optimization.

Research on the Network Intrusion Detection System based on Modified Particle Swarm Optimization Algorithm

In this paper, we conduct research on the network intrusion detection system based on the modified particle swarm optimization algorithm. Computer interconnection ability put forward the higher requirements for the system reliability design, the need to ensure that the system can support various communication protocols to guarantee the reliability and security of the network. At the same time also require network system, the server or products have strong ability of fault tolerance and redundancy, better meet the needs of users, to ensure the safety of the information data and the good operation of the network system. For this target, we propose the novel paradigm for the enhancement of the modern computer network that is innovative.

云环境下金融信息系统安全框架研究

随着计算机的迅猛发展和科学技术的不断进步,使得经济金融产业化的发展呈现出服务化趋势,云,云计算出现促使金融信息系统更好地向服务化趋势迈进。本文认真研究了云环境下的金融信息系统,指出存于其中的一些安全隐患,并就云安全框架的构建问题进行了说明。

提升信息交易安全平台技术 提高电子商务企业经济效益

电子商务交易模式诞生于上个世纪九零年代,它的发展历程并不很长,但是和传统的商务相对,其发展速度惊人,在发展迅猛的同时商务交易安全问题也成为阻碍它发展的主要瓶颈,如何保证解除交易信用和安全度降低的困局,就是本文要说明的重点。对此,本人结合自身的工作经验阐述了几点电子商务安全技术。