Utilisation de la corrélation pondérée dans un processus de détection d’intrusions

Generally, an intruder must perform several actions, organized in an intrusion scenario, to achieve his or her malicious objectives. Actions are modeled by their pre and post conditions, which are a set of logical predicates or negations of predicates. Pre conditions of an action correspond to conditions the system’s state must satisfy to perform the action. Post conditions correspond to the effects of executing the action on the system’s state. When an intruder begins his intrusion, we can deduce, from the alerts generated byidss (Intrusion Detection Systems), several possible scenarios, by correlating attacks, that lead to multiple intrusion objectives. However, with no further analysis, we are not able to decide which are the most plausible ones among the possible scenarios. We propose in this paper to define an order over the possible scenarios by weighting the correlation relations between successive attacks composing the scenarios. These weights reflect to what level executing some actions are necessary to execute some action B. We will see that to be satisfactory, the comparison operator between two scenarios must satisfy some properties.     

Démarche de conception d’une plate-forme monopuce de réception de radiodiffusion numérique DRM

The newdrm standard for digital radio broadcast in theam band requires integrated devices for radio receivers at low cost and very low power. A chipset has been developed based on anarm9 dual-core architecture. This paper introduces the application itself, and then presents the development process followed to design such a chip covering the hardware/software partitioning, the architecture definition and all the validation issues. Therf part that partially drives the baseband is also briefly presented. The legal aspects are also investigated. Then as a conclusion, this paper presents the next steps of this development and the methodological gap in the system on chip design process.     

Amélioration de la sensibilité de détection et de la qualité du radargramme d’un radar pénétrant GPR par une modulation micro-onde

The primary effect of the field continuously capted by aGpr is the production of a class which limits the contrast of the reflections on the targets. The target response becomes illegible sight the influence of certain disturbances which are due to the reflections caused by certain parasitic elements which are randomly distributed in the soil and the dispersion phenomenon. We present in this paper an approach based on a μ-wave modulation which allowed stage this problem. The technique suggested makes it possible to do a classification of capted signals. It will be shown that the frequency of modulation f_m must be higher than a cut-off frequency f_c which depends on the electric parameters of the ground. In a second part of this paper, we show how to improve quality of the radargram of a systemGpr by a simple convolution between the collected signal and a wavelet with a defined parameters.     

Synthèse optimale d’un réseau de télécommunication avec contraintes de sécurité

A commonly used method for achieving a prescribed security level in a telecommunication network is to manage extra capacities all over the network. This paper describes a number of computational methods, both exact and approximate, for determining a minimum cost network of extra capacities needed to achieve security under any given trunk dimensioning, routing and grouping policy. From a mathematical point of view, it is shown that the problem reduces to the determination of a minimum cost network subject to a number of non simultaneous multicommodity flow requirements. Since real life instances of such problems commonly result in very large linear programs of many thousands of variables and constraints, the techniques of linear programming would be unacceptably time and space-consuming. Instead, it is shown how the use of Lagrangean relaxation in conjunction with sub-gradient optimization schemes can lead to efficient and easy-to-implement solution methods. The various procedures described in this paper form the heart of a general software product for long and medium term planning applications (Supersec program) which has already been used to investigate the economical implications of security requirements in telecommunication networks.     

Retour d’expérience sur différentes applications de réseau actif

Active network technologies, started by D. Tennenhouse’s work atmit in 1995 have led a lot of promises on the evolution of data networks. Active networks aim at integrating new application-level functionalities into active nodes within the network, in a flexible and extensible way. The research works on active networks have raised at the same time as the definition of new open network architectures (e.g., Tina model) and the deployment of intelligent networks merging telecom networks with distributed systems fields. This concept of “programmable networks” led to many technology-oriented projects, but has not identified relevant applications highlighting the benefits of the technology. During the three last years, our laboratory has tackled this gap and prototyped some use cases of open programmable networks. The paper gives an overview of each of these use cases and focuses on the integration with existing network elements both at transfer and management planes. Then it presents some assessments and perspectives. We show that programmable networks are optimizing globally resources to be deployed although they impose an overhead at node level, thanks to efficient integration choices. We present two scenarios of deployment of current programmable network platforms within the same network configuration than a realwan network.     

CRIM: un module de corrélation d’alertes et de réaction aux attaques

With the growing need for protection of informations systems, the intrusion detection approach is interesting but still imperfect. At the moment two main approaches exist: the behaviour based approach and the scenario detection approach. None of those two approaches is fully satisfactory. They often generate two many false positives and the generated alerts are generally too elementary and imprecise to be efficiently processed by a system administrator. An interesting approach consists in developing a cooperation module to analyze and correlate alerts, to generate a more global and synthetic diagnostic, and help the system administrator to choose the best counter-measure given a detected attack. This article presents the work we have achieved in this context to create theRim module (Cooperation and Recognition of Malevolent Intentions).     

Étude des fluctuations relatives de fréquence de deux klystrons reflex stabilisés par divers procédés

Annals of Telecommunications -     

Détermination des directions de normale d’onde de signaux variant dans le temps. Application aux émissions naturelles TBF détectées à bord de satellites

A method for studying the polarization of an electromagnetic plane wave, the characteristics of which vary rapidly in time, is described. This method is based upon the concept of the (instantaneous) complex representation of a polarized signal. It is possible in particular to yield the wave normal direction as a function of both time and frequency. The accuracy of the method is studied, as a function of both the signal-to-noise ratio and of the eccentricity of the polarization ellipse. This method is applied to the determination of wave normal directions of natural Vlf signals propagating in the whistler mode within the magneto sphere. Important variations in the propagation characteristics of the signals are evidenced.     

Réalisation d’un opérateur de traitement numérique rapide par une machine à flux de données

The authors describe a fast, parallel and static data flow architecture that is used for Fast Riccati Operator (Fro)design. This operator has a cellular, regular structure easy to integrate, and is intended to resolve with high speed execution the matrix Riccati equation for filtering purpose. To evaluate its performances, two solving algorithms, Lindquist and quasilinéarisation, are represented and simulated by data flow Petri nets, defined for this purpose. Simulation results are compared to real needs in search and tracking situations.     

Compression de données brutes et d’images de radar à synthèse d’ouverture

This paper draws a state of the art of synthetic aperture radar (sar) data compression. Both raw data and synthesized image compression have been investigated. Compression of radar raw signal and sar image are considered separately since those two cases are specific. Also, Radar raw/image compression remains different from optical image compression and has to be considered with specific strategies that are adapted to the context.     

Étude théorique et expérimentale d’une modulation simplifiée par déplacement de fréquence d’indice 1/2 à phase continue

The minimum shift keying modulation (MSK)to which a lot of recent publications have been done,presents some advantage about linear and non-linear distortions towards common 2 or 4 Phase Shift Keying (PSK)modulations. The simplified MSK modulation described in this paper is obtained by linear filtering of a coherent 2 phase shift keying modulation. Then the demodulator can be implemented with a matched filter followed by a coherent demodulator using only one carrier recovery circuit. In the first part of this paper, the modulator and the demodulator are described. After, some theorical results in the presence of noise and other impairments are given. In CCETT laboratories at Rennes, a modem has been realized at a data rate of 2,048 Mbit/s and performs at 0,8 dB of the theoretical results.