A Data Intrusion Tolerance Model Based on an Improved Evolutionary Game Theory for the Energy Internet

Malicious attacks against data are unavoidable in the interconnected,open and shared Energy Internet(EI),Intrusion tolerant techniques are critical to the data security of EI.Existing intrusion tolerant techniques suffered from problems such as low adaptability,policy lag,and difficulty in determining the degree of tolerance.To address these issues,we propose a novel adaptive intrusion tolerance model based on game theory that enjoys two-fold ideas:(1)it constructs an improved replica of the intrusion tolerance model of the dynamic equation evolution game to induce incentive weights;and (2)it combines a tournament competition model with incentive weights to obtain optimal strategies for each stage of the game process.Extensive experiments are conducted in the IEEE 39-bus system,whose results demonstrate the feasibility of the incentive weights,confirm the proposed strategy strengthens the system’s ability to tolerate aggression,and improves the dynamic adaptability and response efficiency of the aggression-tolerant system in the case of limited resources.

Grey-theory based intrusion detection model

To solve the problem that current intrusion detection model needs large-scale data in formulating the model in real-time use, an intrusion detection system model based on grey theory （GTIDS） is presented. Grey theory has merits of fewer requirements on original data scale, less limitation of the distribution pattern and simpler algorithm in modeling. With these merits GTIDS constructs model according to partial time sequence for rapid detect on intrusive act in secure system. In this detection model rate of false drop and false retrieval are effectively reduced through twice modeling and repeated detect on target data. Furthermore, GTIDS framework and specific process of modeling algorithm are presented. The affectivity of GTIDS is proved through emulated experiments comparing snort and next-generation intrusion detection expert system （NIDES） in SRI international.

AN INTRUSION DETECTION SYSTEM BASED ON EVIDENCE THEORY AND ROUGH SET THEORY

In this paper,we propose a novel Intrusion Detection System (IDS) architecture utilizing both the evidence theory and Rough Set Theory (RST). Evidence theory is an effective tool in dealing with uncertainty question. It relies on the expert knowledge to provide evidences,needing the evidences to be independent,and this make it difficult in application. To solve this problem,a hybrid system of rough sets and evidence theory is proposed. Firstly,simplification are made based on Variable Precision Rough Set (VPRS) conditional entropy. Thus,the Basic Belief Assignment (BBA) for all evidences can be calculated. Secondly,Dempster’s rule of combination is used,and a decision-making is given. In the proposed approach,the difficulties in acquiring the BBAs are solved,the correlativity among the evidences is reduced and the subjectivity of evidences is weakened. An illustrative example in an intrusion detection shows that the two theories combination is feasible and effective.

EARLY WARNING MODEL OF NETWORK INTRUSION BASED ON D-S EVIDENCE THEORY

Application of data fusion technique in intrusion detection is the trend of next- generation Intrusion Detection System (IDS). In network security, adopting security early warn- ing technique is feasible to effectively defend against attacks and attackers. To do this, correlative information provided by IDS must be gathered and the current intrusion characteristics and sit- uation must be analyzed and estimated. This paper applies D-S evidence theory to distributed intrusion detection system for fusing information from detection centers, making clear intrusion situation, and improving the early warning capability and detection efficiency of the IDS accord- ingly.

Two Hybrid Methods Based on Rough Set Theory for Network Intrusion Detection

In this paper,we propose two intrusion detection methods which combine rough set theory and Fuzzy C-Means for network intrusion detection.The first step consists of feature selection which is based on rough set theory.The next phase is clustering by using Fuzzy C-Means.Rough set theory is an efficient tool for further reducing redundancy.Fuzzy C-Means allows the objects to belong to several clusters simultaneously,with different degrees of membership.To evaluate the performance of the introduced approaches,we apply them to the international Knowledge Discovery and Data mining intrusion detection dataset.In the experimentations,we compare the performance of two rough set theory based hybrid methods for network intrusion detection.Experimental results illustrate that our algorithms are accurate models for handling complex attack patterns in large network.And these two methods can increase the efficiency and reduce the dataset by looking for overlapping categories.

Multi-VMs Intrusion Detection for Cloud Security Using Dempster-shafer Theory

Cloud computing provides easy and on-demand access to computing resources in a configurable pool.The flexibility of the cloud environment attracts more and more network services to be deployed on the cloud using groups of virtual machines(VMs),instead of being restricted on a single physical server.When more and more network services are deployed on the cloud,the detection of the intrusion likes Distributed Denialof-Service(DDoS)attack becomes much more challenging than that on the traditional servers because even a single network service now is possibly provided by groups of VMs across the cloud system.In this paper,we propose a cloud-based intrusion detection system(IDS)which inspects the features of data flow between neighboring VMs,analyzes the probability of being attacked on each pair of VMs and then regards it as independent evidence using Dempster-Shafer theory,and eventually combines the evidence among all pairs of VMs using the method of evidence fusion.Unlike the traditional IDS that focus on analyzing the entire network service externally,our proposed algorithm makes full use of the internal interactions between VMs,and the experiment proved that it can provide more accurate results than the traditional algorithm.

Intrusion Detection Model Based on Incomplete Information Ga me in Wireless Mesh Networks

Wireless Mesh Networks （WMNs） have many applications in homes, schools, enterprises, and public places because of their useful characteristics, such as high bandwidth, high speed, and wide coverage. However, the security of wireless mesh networks is a precondition for practical use. Intrusion detection is pivotal for increasing network security. Considering the energy limitations in wireless mesh networks, we adopt two types of nodes： Heavy Intrusion Detection Node （HIDN） and Light Intrusion Detection Node （LIDN）. To conserve energy, the LIDN detects abnorrml behavior according to probability, while the HIDN, which has sufficient energy, is always operational. In practice, it is very difficult to acquire accurate information regarding attackers. We propose an intrusion detection model based on the incomplete inforrmtion game （ID-IIG）. The ID-IIG utilizes the Harsanyi transformation and Bayesian Nash equilibrium to select the best strategies of defenders, although the exact attack probability is unknown. Thus, it can effectively direct the deployment of defenders. Through experiments, we analyze the perforrmnce of ID-IIG and verify the existence and attainability of the Bayesian Nash equilibrium.

Software Intrusion Detection Evaluation System: A Cost-Based Evaluation of Intrusion Detection Capability

In this paper, we consider a cost-based extension of intrusion detection capability (CID). An objective metric motivated by information theory is presented and based on this formulation;a package for computing the intrusion detection capability of intrusion detection system (IDS), given certain input parameters is developed using Java. In order to determine the expected cost at each IDS operating point, the decision tree method of analysis is employed, and plots of expected cost and intrusion detection capability against false positive rate were generated. The point of intersection between the maximum intrusion detection capability and the expected cost is selected as the optimal operating point. Considering an IDS in the context of its intrinsic ability to detect intrusions at the least expected cost, findings revealed that the optimal operating point is the most suitable for the given IDS. The cost-based extension is used to select optimal operating point, calculate expected cost, and compare two actual intrusion detectors. The proposed cost-based extension of intrusion detection capability will be very useful to information technology (IT), telecommunication firms, and financial institutions, for making proper decisions in evaluating the suitability of an IDS for a specific operational environment.

Using Bayesian Game Model for Intrusion Detection in Wireless Ad Hoc Networks

Wireless ad ho network is becoming a new research fronter, in which security is an important issue. Usually some nodes act maliciously and they are able to do different kinds of Denial of Service (Dos). Because of the limited resource, intrusion detection system (IDS) runs all the time to detect intrusion of the attacker which is a costly overhead. In our model, we use game theory to model the interactions between the intrusion detection system and the attacker, and a realistic model is given by using Bayesian game. We solve the game by finding the Bayesian Nash equilibrium. The results of our analysis show that the IDS could work intermittently without compromising on its effectiveness. At the end of this paper, we provide an experiment to verify the rationality and effectiveness of the proposed model.

基于博弈论的入侵检测与响应优化综述

当前网络规模急剧增加,各类入侵过程也逐渐向复杂化、多样化的趋势发展。网络攻击带来的损失越来越严重,针对各类安全事件的检测发现以及查处响应也变得日益困难。为了快速识别各类网络安全事件并做出相应的响应,入侵检测与响应技术变得越来越重要。入侵检测系统(IDS)能否识别复杂的攻击模式以及分析大量的网络流量主要取决于其精度和配置,这使得入侵检测与响应的优化问题成为网络与系统安全的重要需求,并且成为一个活跃的研究主题。现有的研究成果已经提出了很多可以优化入侵检测和响应效率的方法,其中,将博弈论应用在入侵检测与响应的研究日益增多。博弈论提供了一种框架去捕获攻击者和防御者的交互,采用了一种定量的方法评估系统的安全性。本文在分析了入侵检测与响应系统和博弈论的基本原理的基础上,介绍了当前基于博弈论的入侵检测与响应优化问题的现有解决方案,并且讨论了这些解决方案的局限性以及给出了未来的研究方向。首先,详细介绍了入侵检测与博弈论的背景知识,回顾了常用的入侵检测系统基本原理,评估方法,常用的数据集以及经典的安全领域中的博弈论模型。其次,按照基于博弈论的入侵检测与响应优化问题的类型进行了分类介绍,根据攻击的先后顺序对网络安全架构优化、IDS配置与效率优化、IDS的自动化响应优化以及分布式入侵检测架构优化等技术的研究现状进行归纳、分析、总结,并分析了现有方案的优缺点,进而分析可能的解决方案。然后针对将博弈论应用于入侵检测与响应中面临的挑战进行了分析与讨论。最后展望了未来的研究方向以及发展趋势。

小岩体叠加成矿作用在新一轮找矿突破战略行动中的应用:以勉略宁矿集区为例

小岩体成(大)矿理论是汤中立院士在多年找矿实践工作过程中总结出来的重要成果。该理论以岩浆铜镍硫化物矿床为研究起点,逐渐延伸至与中酸性岩浆活动有关的热液型矿床,发展成为基性-超基性与中酸性两类岩浆并行的完整成矿理论体系。研究发现,以勉-略-宁矿集区为代表的成矿区带分布有众多两类岩浆活动的叠加区,并且两类岩浆活动导致的叠加成矿作用在该区显著。其中,煎茶岭镍钴金多金属矿床形成过程经历了早期初步的超镁铁质岩浆熔离作用使成矿元素预富集,后期花岗斑岩岩浆流体成矿作用叠加之上,最终使钴镍矿和金矿均达到了大型规模。此外,该区在白雀寺基性杂岩体中新发现的何家垭镍钴矿同样具有两类岩浆叠加成矿的特征,这为小岩体成(大)矿理论提供了新的研究方向。目前,中国新一轮找矿突破战略行动已全面开启,以Ni、Co为代表的战略性关键金属矿产仍是本轮找矿工作的重中之重,两类岩浆的小岩体叠加成(大)矿作用是Ni、Co矿形成的重要地质过程。笔者通过介绍小岩体成(大)矿理论的发展过程,并以勉-略-宁矿集区为代表,提出了两类岩浆叠加成(大)矿作用的基本内涵。在此基础上,对其找矿应用和理论研究两方面做了展望,以期助力中国新一轮找矿突破战略行动。

基于复杂网络演化博弈的无线传感器网络入侵检测方法

针对无线传感器网络资源受限和入侵检测系统策略优化问题,本文提出一种基于复杂网络演化博弈的无线传感器网络入侵检测方法。结合小世界模型理论,模拟网络节点之间的连接关系,在不改变节点原有关系的前提下增强网络连通性并降低传输能耗;构建关于簇头节点和恶意节点的无线传感器网络攻防博弈模型,通过收益矩阵计算节点收益,利用奖惩机制描述节点在博弈过程中选择不同策略的收益变化;引入经验加权吸引力学习算法改进传统博弈的策略更新规则并将该算法应用于入侵检测系统,使得簇头节点能够动态更新策略选择,得到不同条件下的入侵检测最优策略。实验结果表明,与传统方法相比,所提算法的簇头节点检测策略扩散深度可以达到79%,该算法下簇头节点在保障自身检测收益的同时尽可能选择检测传感器网络中出现的攻击,保证网络检测率并减少网络各类资源的消耗。

基于入侵诱骗的网络拓扑污染攻击防御研究

以目标为中心的攻击防御手段检测到攻击后才有所响应,攻击防御不及时,为了提升网络拓扑污染攻击防御能力,提出一种基于入侵诱骗的网络拓扑污染攻击防御方法。通过入侵诱骗系统模拟网络脆弱性,采集攻击模式,并添加到知识库中;通过多个和子空间正交的向量判断知识库内污染信息类型,完成网络拓扑污染攻击类型分类;通过分类结果量化分析网络攻击与防御的成本收益,构建成本收益量化模型;基于攻击图、防御图和博弈论构建攻击防御模型,获取最佳网络拓扑污染攻击防御策略。实验结果表明,所提方法可以有效检测主机位置劫持攻击和链路伪造攻击,提升网络拓扑污染攻击防御效果,且提升了攻击防御的及时性。

基于分布式协同免疫的电力负荷管理终端安全防护策略

电力负荷管理终端点多面广,应用场景复杂,控制策略迥异,不同信息安全分区防护边界模糊。现有新型电力负荷管理终端通信面临交互协议陈旧、通信带宽受限、组网可靠性不足等问题,采用4G/5G公网、无线自组网等开放网络通信将导致其面临更高的安全风险。为解决上述问题,文章首先分析免疫学理论与电力负荷管理终端安全防护需求的适配度;其次,提出基于分布式协同免疫的电力负荷管理终端安全防护策略;最后,通过算例验证了所提策略的有效性。

基于讨价还价博弈的流域生态补偿标准——以西江压咸补淡为例

针对单一生态补偿标准核算方法存在片面性的问题,提出基于博弈的流域生态补偿方法,以西江压咸补淡调度为例,分别采用能反映压咸调水价值的水资源价值法和能反映流域上游因调水而造成发电损失的损失成本法计算生态补偿上下限,并通过讨价还价博弈模型确定最终的生态补偿标准值。西江流域上游愿意接受的补偿下限是发电损失成本,多年平均为53.93亿元/a;流域下游愿意支付的补偿上限是获得的水资源价值,多年平均为183.17亿元/a。根据讨价还价博弈模型确定多年平均情况下的最终生态补偿标准为112.61亿元/a。研究方法兼顾补偿主客体的利益诉求,为跨界流域生态补偿机制的建立提供借鉴。

基于贝叶斯决策的交互式网络恶意入侵主动防御模型构建

为降低网络的恶意入侵风险,提出基于贝叶斯决策的交互式网络恶意入侵主动防御模型。采用K-聚类算法识别交互式网络中恶意入侵跳频数据,构建交互式网络恶意入侵节点分布模型;采用基于能量熵增量频域互相关系系数的敏感IMF分量选取算法,保留有效的恶意入侵特征分量。利用贝叶斯决策理念,构建恶意入侵防御模型,最终结果显示:该方法的抗干扰系数和冗余度结果分别在0.10和0.22以下;能够准确分类识别交互式网络中恶意入侵跳频数据;特征分量判定精度均在0.946以上;交互式网络的安全系数均在0.936;网络威胁等级均在2级以下,有效提升了网络的安全性。

基于KM算法投切事件匹配的负荷辨识方法

负荷投切事件是关联负荷分类、辨识的一个重要依据,为了能够准确地实现非侵入式负荷投切过程的辨识,提出一种基于KM算法投切事件匹配的非侵入式负荷辨识方法。该方法采用一种功率曲线拟合逼近的方式进行负荷事件检测,并利用投切稳态特征建立用电设备投入和切除特征的概率分布模型。同时,考虑到负荷投入事件和切除事件数量不对等情况,将负荷事件与数据库负荷进行匹配,并采用加权优化的KM算法寻找最佳解,从而实现负荷投入和切除的正确匹配辨识。在真实的测试场景并结合REDD数据集进行实验,结果表明,文中方法可对负荷投切事件进行有效匹配辨识,为实现能耗细分奠定了基础。

基于多项式混沌方法对C-J爆轰参数不确定度的分析

Chapman-Jougeut理论是预测波后爆轰物理量状态的有力工具,但以往的研究未考虑模型中的不确定因素及其影响。事实上,不确定度会影响数值模拟的预测能力和可靠性。首先,通过剖析爆轰机理,深入挖掘爆轰建模与模拟中的不确定因素。假设PBX-9502的初始密度和爆速服从对数正态分布,结合真实的试验数据,通过参数估计和Anderson-Darling假设检验法标定初始密度和爆速的概率密度函数。Beta分布用以定量刻画没有物理意义的、唯象参数的不确定度,形状参数和支集源于工程经验。Rosenblatt变换将相关的、非Gauss随机变量转化成相互独立的标准正态分布。然后,使用非嵌入多项式混沌研究高维爆轰不确定度传播。具体而言,针对一元多项式混沌,正交多项式通过Gauss-Hilbert空间中的Gram-Schmidt方法导出,六点Gauss求积方法用以计算多项式混沌的系数。使用权重和Gauss求积点的全张量积计算多元多项式混沌。最后,通过多元多项式混沌得到感兴趣量的概率密度函数以及对应的期望、标准差和置信区间等Gauss统计量。研究结果表明:波后压力波动较大,置信区间较宽,与孙承纬的“爆轰压力测量值分散性较大”的结论相吻合。同时感兴趣量的试验结果落入模拟结果的置信区间内,研究结果能增强模型的可靠性和鲁棒性。所用方法可扩展到更加复杂状态方程的爆轰系统。

基于WLA优化混合核LSSVM的网络入侵检测模型

针对网络数据维度高、分布差异较大等引起的网络入侵检测时间开销大,精度低、泛化性差的问题,提出混合入侵检测模型(Hybrid intrusion detection model,简称HIDM)。首先通过对比检测效果选择互信息理论作为HIDM模型的特征选择模块,用来实现特征降维和节省开销;接着利用非线性递减因子、自适应权值策略结合鲸鱼优化算法提出鲸鱼提升算法(Whale Lifting Algorithm,简称WLA),最后利用WLA优化混合核最小二乘支持向量机的参数构建了HIDM模型,有效检测网络入侵。基于NSL-KDD数据集的仿真结果表明HIDM模型针对网络攻击的检测率、准确率和误报率分别达到了99.63%,99.4%和0.86%;同部分已有研究相比检测率有所提升;同时利用CICIDS2018数据集验证了HIDM模型的泛化性。

电子探针技术在岩石学中的应用——以沙峪口岩体为例

以沙峪口岩体的花岗闪长岩样品单矿物地球化学数据为例,揭示了电子探针在岩石学研究方面的应用,包括矿物种类鉴定、矿物环带结构研究、厘定岩浆过程等。电子探针数据显示:磷灰石的MgO含量由核到边先减小后增加随后又减小,呈震荡变化规律;黑云母的MgO含量为9.07%-9.33%,FeO含量为21.56%-22.06%,Na_(2)O含量为0.1%-0.18%,全碱(Na_(2)O+K_(2)O)含量为7.57%-9.48%,Fe^(2+)/(Fe^(2+)+Mg)的比值为0.75,应归类为铁质黑云母;斜长石的An含量变化为13.78%-28.39%,变化范围较小,与典型岩浆混合过程中结晶的斜长石特征不一致。磷灰石的元素含量变化和矿物学特征指示其形成于岩浆演化过程早期;黑云母属于再平衡原生黑云母,且具有壳幔混合源区属性,指示其形成于岩浆混合作用过程中,与沙峪口花岗闪长岩体中暗色微粒包体和中基性同深成岩墙广泛出露的现象相符合;斜长石由核到边的An含量整体较为均一,指示岩浆演化晚期的均一化过程。