An automatically tuning intrusion detection system.

An intrusion detection system (IDS) is a security layer used to detect ongoing intrusive activities in information systems. Traditionally, intrusion detection relies on extensive knowledge of security experts, in particular, on their familiarity with the computer system to be protected. To reduce this dependence, various data-mining and machine learning techniques have been deployed for intrusion detection. An IDS is usually working in a dynamically changing environment, which forces continuous tuning of the intrusion detection model, in order to maintain sufficient performance. The manual tuning process required by current systems depends on the system operators in working out the tuning solution and in integrating it into the detection model. In this paper, an automatically tuning IDS (ATIDS) is presented. The proposed system will automatically tune the detection model on-the-fly according to the feedback provided by the system operator when false predictions are encountered. The system is evaluated using the KDDCup'99 intrusion detection dataset. Experimental results show that the system achieves up to 35% improvement in terms of misclassification cost when compared with a system lacking the tuning feature. If only 10% false predictions are used to tune the model, the system still achieves about 30% improvement. Moreover, when tuning is not delayed too long, the system can achieve about 20% improvement, with only 1.3% of the false predictions used to tune the model. The results of the experiments show that a practical system can be built based on ATIDS: system operators can focus on verification of predictions with low confidence, as only those predictions determined to be false will be used to tune the detection model.     

An intelligent algorithm with feature selection and decision rules applied to anomaly intrusion detection

Intrusion detection system (IDS) is to monitor the attacks occurring in the computer or networks. Anomaly intrusion detection plays an important role in IDS to detect new attacks by detecting any deviation from the normal profile. In this paper, an intelligent algorithm with feature selection and decision rules applied to anomaly intrusion detection is proposed. The key idea is to take the advantage of support vector machine (SVM), decision tree (DT), and simulated annealing (SA). In the proposed algorithm, SVM and SA can find the best selected features to elevate the accuracy of anomaly intrusion detection. By analyzing the information from using KDD’99 dataset, DT and SA can obtain decision rules for new attacks and can improve accuracy of classification. In addition, the best parameter settings for the DT and SVM are automatically adjusted by SA. The proposed algorithm outperforms other existing approaches. Simulation results demonstrate that the proposed algorithm is successful in detecting anomaly intrusion detection.     

A genetic-algorithm based neural network short-term forecasting framework for database intrusion prediction system

Information systems are one of the most rapidly changing and vulnerable systems, where security is a major issue. The number of security-breaking attempts originated inside the organizations are increasing steadily. Attacks made in this way, usually done by ``authorized' users of the system, cannot be immediately traced. As the idea of filtering the traffic at the entrance door, by using firewalls and the like, is not completely successful, the use of intrusion detection systems should be considered to increase the defense capacity of an information system. This paper presents a framework for a statistical anomaly prediction system using a neuro-genetic forecasting model, which predicts unauthorized invasions of user, based on previous observations and takes further action before intrusion occurs. In this paper, we propose an evolutionary time-series model for short-term database intrusion forecasting using genetic algorithm owing to its global search capability. The experimental results show that the combination strategy(neuro-genetic) can quicken the learning speed of the network and improve the predicting precision compared to the traditional artificial neural network. This paper also focuses on detecting significant changes of transaction intensity for intrusion prediction. The experimental study is performed using real time data provided by a major Corporate Bank. Furthermore, a comparative evaluation of the proposed neuro-genetic model with the traditional feed-forward network trained by the back-propagation with momentum and adaptive learning rate using sum square error on a prediction data set has been presented and a better prediction accuracy has been observed.     

多代理分布式入侵检测系统在校园网中的应用

近年来，入侵检测系统(IDS)作为信息系统安全的重要组成部分，得到了广泛的重视。可以看到，仅仅采用防火墙技术来构造网络的安全体系是远远不够的，很多攻击可以绕过防火墙。入侵检测技术可以在网络系统受到损害前对入侵行为做出拦截和响应。基于代理的分布式入侵检测系统实现了基于主机和基于网络检测的结合，为网络系统提供更好的安全保护。文中针对防火墙技术的不足，在对入侵检测技术及其通用架构做出分析和研究后，设计了一种基于代理的分布式入侵检测系统，并给出了在某校园网中的实现。     

协同分布式入侵检测系统模型

由于入侵行为存在相关性,单纯依靠其中独立的检测器来准确地发现和阻止入侵行为是非常困难的,同样地在整个网络系统里单纯依靠分布式入侵检测系统来准确地分析、发现和阻止入侵行为也是非常困难的,如何实现分布式入侵检测系统中的各个检测器间的协同以及将入侵检测系统与现有的或将有的安全系统协同工作是一件非常迫切和重要的任务。该文提供了一个新的解决方案,它既可以根据需要,随时实现自动高效地配置相互间具有协同能力的入侵检测器,又可以做到和网络上的其他安全系统之间的协同。从而可以极大地减轻网络管理员的安装配置压力,实现自动、高效、一致地保证整个网络系统安全。     

基于最小二乘支持向量机的Linux主机入侵检测系统

论文探讨在新的网络软硬件环境、各种新的攻击工具与方法下,建立一个实际的网络入侵异常检测系统的可行性。为此,论文建立一个基于Linux主机的入侵检测实验环境,在同时提供多种正常服务的条件下实施攻击、提取特征并应用最小二乘支持向量机(LS-SVM)检测入侵。结果表明检测系统设计合理,特征提取及检测方法有效。     

基于孤立点检测的自适应入侵检测技术研究

传统的入侵检测技术主要是从已知攻击数据中提取出每种具体攻击的特征规则模式,然后使用这些规则模式来进行匹配。然而基于规则的入侵检测的主要问题是现有的规则模式并不能有效应对持续变化的新型入侵攻击。针对这一问题,基于数据挖掘的入侵检测方法成为了入侵检测技术新的研究热点。本文提出了一种基于孤立点挖掘的自适应入侵检测框架,首先,基于相似系数寻找孤立点,然后对孤立点集合进行聚类,并使用改进的关联规则算法来从孤立点聚类结果中提取出各类入侵活动的潜在特征模式,然后生成可使用的匹配规则模式来添加到现有的规则模式中去,进而达到自适应的目的。本文使用KDD99的UCI数据集进行孤立点挖掘,然后使用IDS Snort的作为实验平台,使用IDS Informer模拟攻击工具进行测试,这两个实验结果表明了本文所提出算法的有效性。     

数据挖掘技术在入侵检测系统中的应用研究

随着以太网的快速发展,基于网络的攻击方式越来越多,传统的入侵检测系统越来越难以应付;将数据挖掘技术引入到入侵检测系统中来,分析网络中各种行为记录中潜在的攻击信息,自动辨别出网络入侵的模式,从而提高系统的检测效率;将K- MEANS算法及DBSCAN算法相综合,应用到入侵检测系统,并针对K- MEANS算法的一些不足进行了改进,提出了通过信息嫡理论的使用解决K- MEANS算法选择初始簇中心问题,然后利用其分类结果完善DBSCAN算法两个关键参数(Eps,Minpts)的设置,通过DB-SCAN算法,进一步地分析可疑的异常聚类,提高聚类的准确度.     

Trust Management and Admission Control for Host-Based Collaborative Intrusion Detection

The accuracy of detecting an intrusion within a network of intrusion detection systems (IDSes) depends on the efficiency of collaboration between member IDSes. The security itself within this network is an additional concern that needs to be addressed. In this paper, we present a trust-based framework for secure and effective collaboration within an intrusion detection network (IDN). In particular, we design a trust model that allows each IDS to evaluate the trustworthiness of other IDSes based on its personal experience. We also propose an admission control algorithm for the IDS to manage the acquaintances it approaches for advice about intrusions. We discuss the effectiveness of our approach in protecting the IDN against common attacks. Additionally, experimental results demonstrate that our system yields significant improvement in detecting intrusions. The trust model further improves the robustness of the collaborative system against malicious attacks. The experimental results also support that our admission control algorithm is effective and fair, and creates incentives for collaboration.     

基于P2P模型的网络入侵检测系统PeerIDS

由于在保护网络信息系统安全方面所起到的越来越重要的作用,入侵检测系统(IDS)近年来一直是一个研究热点。与此同时入侵检测系统的性能问题却没有能得到足够的关注。基于对对等模型(Peer-To-Peer)的应用,论文提出一种分布式网络入侵检测系统-PeerIDS。较之于其他一些常见的分布式入侵检测系统,该系统在设计上注重可靠性而没有诸如单点失效一类的问题。入侵检测工作在由多台运行PeerIDS系统的连网计算机构成的对等网中随具体环境而自动进行迁移以实现公平高效的分布式处理。同时对等模型的应用所带来的可扩展性使得该系统的性能可以通过简单地在网络中增加运行PeerIDS的计算机数目来不断提高,很好地适应了日益严峻的网络安全状况。在完成初始设置后,PeerIDS系统的运行几乎不需要任何使用者的干预,体现了很好的自治性。     

基于数据挖掘的入侵检测系统设计

现有的入侵检测系统大多都是采用手工编码构造的,检测模型的构造过程很大程度上依赖于系统构造者的知识和经验,这样构造出的模型往往存在很大的缺陷。针对传统入侵检测系统构造过程中存在的种种问题,将数据挖掘技术引入入侵检测系统,实现检测模型构造的自动化。介绍了一个运用数据挖掘技术构造入侵检测系统的框架,并考虑到实时检测过程中对检测模型效率的要求,提出了一个提高检测模型检测效率的层叠检测模块方法。应用数据挖掘算法得出的检测模型在检测效率、准确性、可扩展性和自适应性等方面都得到了很大的改进。     

Wired and wireless intrusion detection system: Classifications, good characteristics and state-of-the-art

In computer and network security, standard approaches to intrusion detection and response attempt to detect and prevent individual attacks. Intrusion Detection System (IDS) and intrusion prevention systems (IPS) are real-time software for risk assessment by monitoring for suspicious activity at the network and system layer. Software scanner allows network administrator to audit the network for vulnerabilities and thus securing potential holes before attackers take advantage of them.

In this paper we try to define the intruder, types of intruders, detection behaviors, detection approaches and detection techniques. This paper presents a structural approach to the IDS by introducing a classification of IDS. It presents important features, advantages and disadvantages of each detection approach and the corresponding detection techniques. Furthermore, this paper introduces the wireless intrusion protection systems.

The goal of this paper is to place some characteristics of good IDS and examine the positioning of intrusion prevention as part of an overall layered security strategy and a review of evaluation criteria for identifying and selecting IDS and IPS. With this, we hope to introduce a good characteristic in order to improve the capabilities for early detection of distributed attacks in the preliminary phases against infrastructure and take a full spectrum of manual and automatic response actions against the source of attacks.     

一种基于移动Agent的抗攻击性IDS模型

随着入侵检测系统(Inhusion Detection System——IDS)性能的逐步提高，攻击者往往在入侵目标网络之前攻击IDS，使其丧失保护功能。在当前常用的分布式入侵检测系统的基础上，提出了一种能够对抗拒绝服务(Denial of Service——DoS)攻击的IDS模型，并指出了将当前的分布式IDS转换成此模型的配置方法。     

A Pareto-based multi-objective evolutionary algorithm for automatic rule generation in network intrusion detection systems

Attacks against computer systems are becoming more complex, making it necessary to continually improve the security systems, such as intrusion detection systems which provide security for computer systems by distinguishing between hostile and non-hostile activity. Intrusion detection systems are usually classified into two main categories according to whether they are based on misuse (signature-based) detection or on anomaly detection. With the aim of minimizing the number of wrong decisions, a new Pareto-based multi-objective evolutionary algorithm is used to optimize the automatic rule generation of a signature-based intrusion detection system (IDS). This optimizer, included within a network IDS, has been evaluated using a benchmark dataset and real traffic of a Spanish university. The results obtained in this real application show the advantages of using this multi-objective approach.     

基于本体的Web服务攻击检测技术研究

Web服务在给基于异构平台的应用集成带来极大便利的同时,各核心组件也面临着被恶意攻击的威胁。目前,主要依靠入侵检测系统(IDS)来检测这些攻击,但是分布在网络中的IDS往往是由不同的厂商或组织开发的,没有用于交换知识的可被共同理解的词汇集,难以交互和协作,工作效率低且很难抵御多层次、分布式攻击。提出了一种基于本体和Web本体标准语言（OWL）的Web服务攻击分类和描述方法,通过构建Web服务攻击本体以提供不同IDS共同理解的词汇集。在此基础上,设计了一种基于Web服务攻击本体库的入侵检测系统(O-IDS),能有效弥补现有IDS难以交互的不足,提高对多层次、分布式攻击的检测能力。     

分布式入侵检测系统模型研究

避开入侵检测系统的核心问题——入侵检测算法的具体实现，通过对有关感应器、分析器问题的研究分析，提出了一些有利于提高入侵检测准确率、提高系统吞吐量、提高系统自主学习能力的建议。以此为基础，给出了一种不受具体入侵检测算法限制的分布式入侵 检测模型，分析了该模型的优缺点。     

一种基于数据挖掘技术的入侵检测模型研究

入侵检测系统是一种检测网络入侵行为并能够主动保护自己免受攻击的一种网络安全技术,是网络防火墙的合理补充。文中分析了入侵检测系统的通用模型,介绍了入侵检测系统的分类,给出了传统的网络检测技术,在此基础上,详细讨论了数据挖掘技术及其在入侵检测系统中的应用,提出了一个基于数据挖掘技术的入侵检测模型,该模型采用了数据挖掘中的分类算法和关联规则。经过实际测试,该模型能够使网络入侵检测更加自动化,提高检测效率和准确度。     

数据挖掘技术在入侵检测中的应用研究

随着Internet迅速发展,许多新的网络攻击不断涌现。传统的依赖手工和经验方式建立的基于专家系统的入侵检测系统,由于面临着新的攻击方式及系统升级方面的挑战,已经很难满足现有的应用要求。因此,有必要寻求一种能从大量网络数据中自动发现入侵模式的方法来有效发现入侵。这种方法的主要思想是利用数据挖掘方法,从经预处理的包含网络连接信息的审计数据中提取能够区分正常和入侵的规则。这些规则将来可以被用来检测入侵行为。文中将数据挖掘技术应用到入侵检测中,并对其中一些关键算法进行了讨论。最后提出了一个基于数据挖掘的入侵检测模型。实验证明该模型与传统系统相比,在自适应和可扩展方面具有一定的优势。     

基于网络安全知识库的入侵检测模型

在网络安全知识库系统的基础上,提出一个基于网络安全基础知识库系统的入侵检测模型,包括数据过滤、攻击企图分析和态势评估引擎。该模型采用进化型自组织映射发现同源的多目标攻击;采用时间序列分析法获取的关联规则来进行在线的报警事件的关联,以识别时间上分散的复杂攻击;最后对主机级和局域网系统级威胁分别给出相应的评估指标以及对应的量化评估方法。相比现有的IDS,该模型的结构更加完整,可利用的知识更为丰富,能够更容易地发现协同攻击并有效降低误报率。     

分布式入侵检测与信息融合方法

该文将入侵检测技术和信息融合技术相结合,针对大型异构网络提出了基于Internet的IDS即CyberIDS的概念,给出了CyberIDS的体系结构和相关融合问题,并提出了分布式检测的信息融合方法,以及设计和实现CyberIDS的相关融合算法,从而为新一代IDS的设计和开发奠定了基础。