基于因果关系的分层报警关联研究

入侵检测系统产生海量报警数据,造成报警关联时间长,关联结果结构复杂,难以理解。针对上述问题,提出一种基于因果关系的分层报警关联模型。该模型先根据攻击目标聚类报警,在因果关系的指导下以单步攻击作为节点构建主机层攻击路径,定义单步攻击相似度和攻击模式相似度,通过拓扑排序合并主机层攻击路径的相似节点得到攻击模式,计算攻击模式相似度实现预警,并以受害主机作为节点从空间上构建更高层面的网络层攻击场景。实验表明,分层关联结果结构简洁,有助于识别攻击策略、指导安全响应,而且先聚类后关联的方法能够有效提高报警关联效率。     

基于攻击规划图的实时报警关联方法

针对报警因果关联分析方法存在无法及时处理大规模报警且攻击场景图分裂的不足,提出一种基于攻击规划图(APG)的实时报警关联方法。该方法首先给出APG和攻击规划树(APT)的定义;其次,根据先验知识构建APG模型,并提出基于APG的实时报警关联方法,重建攻击场景;最后,结合报警推断完善攻击场景和预测攻击。实验结果表明,该方法能够有效地处理大规模报警和重建攻击场景,具有较好的实时性,可应用于分析入侵攻击意图和指导入侵响应。     

基于目标图的入侵检测报警关联算法

针对入侵检测系统响应能力差以及误报率高的问题,提出了基于目标图的入侵检测报警关联算法.该算法在动作节点之间实现报警信息的前因后果链关系,并根据报警信息显式地跟踪系统状态变化以及攻击者的主观状态,监视状态的变化,推断攻击者的意图以及攻击策略.实验表明,该方法产生的关联结果能够很好地发现攻击者意图以及攻击策略,并且能够有效地降低入侵检测系统的误报率.     

一种新的入侵检测报警关联分析方法

报警聚合和关联是入侵检测领域很重要的发展方向,报警聚合是将相同或相近特征的报警信息关联起来,报警关联是根据攻击之间的因果依赖关系关联报警。采用模糊C-均值（FCM）算法剔除误报或无关报警,然后用因果关联分析发现攻击场景,恢复攻击场景。实验表明,该方法能够恢复攻击场景。     

基于攻击图与报警相似性的混合报警关联模型

为了揭示入侵检测系统所生成的报警数据之间的关联关系和重构入侵攻击场景,提出了一种基于攻击图与报警数据相似性分析的混合报警关联模型。该模型结合攻击图和报警数据分析的优点,首先根据入侵攻击的先验知识定义初始攻击图,描述报警数据间的因果关联关系,再利用报警数据的相似性分析修正初始攻击图的部分缺陷,进而实现报警关联。实验结果表明,混合关联模型能够较好地恢复攻击场景,并能够完全修复攻击图中单个攻击步骤的缺失。     

基于攻击图与报警相似性的混合报警关联模型

为了揭示入侵检测系统所生成的报警数据之间的关联关系和重构入侵攻击场景,提出了一种基于攻击图与报警数据相似性分析的混合报警关联模型。该模型结合攻击图和报警数据分析的优点,首先根据入侵攻击的先验知识定义初始攻击图,描述报警数据间的因果关联关系,再利用报警数据的相似性分析修正初始攻击图的部分缺陷,进而实现报警关联。实验结果表明,混合关联模型能够较好地恢复攻击场景,并能够完全修复攻击图中单个攻击步骤的缺失。     

基于报警序列的入侵场景自动构建

传统的入侵检测系统(IDS)由于其规则的抽象程度较低,导致一次攻击行为会产生大量重复和相关报警.研究表明,入侵场景可提供较高层次的抽象来表示攻击过程,但是已有研究方法均无法在线生成入侵场景.提出一种自动构建入侵场景的方法,将原始报警按照(源,目标)IP对和优先级分类成不同超报警序列集合,从中挖掘频繁闭序列作为入侵场景.在Darpa数据集上的实验表明,该方法可以满足在线运行,并可有效发现攻击过程.     

基于场景重构与报警聚合的网络取证分析技术

提出一种包含报警标准化、去冗余、场景重构和报警聚合的网络取证分析方法. 通过去除失败攻击的报警, 减少了对证据分析的干扰. 在场景重构中, 通过反向关联, 减少了不必要的证据, 同时通过对孤立报警的补充, 保证了证据链的完整性. 在报警聚合中, 提出了聚合同一攻击步骤的不同报警的方法, 以抽象层和具体层两个层次重构入侵场景. 最后通过实验验证了所提出方法的有效性.     

基于不确定性知识发现的入侵报警关联方法

针对入侵检测系统报警信息量大、琐碎和分散的问题,提出了一种基于不确定性知识发现的入侵报警关联方法。该方法的知识发现部分采用提出的不确定性序列模式发现算法—CWINEPI对报警数据进行序列模式发现,并将经过筛选后获得的入侵报警序列模式转化成入侵报警精简规则;再对入侵报警序列模式进行关联以获取攻击模式,并转化为入侵场景重建规则。入侵报警关联部分利用获取的入侵报警精简规则和入侵场景重建规则,以模式匹配方法构造报警关联引擎,对多个入侵检测系统上报的入侵报警进行关联。美国国防部高级研究计划局2000年入侵评测数据（DARPA2000）的报警数据验证了知识发现部分的良好性能;测试环境中的入侵报警的关联结果表明了该方法是高效、可行的。     

信息安全报警多级融合模型

报警融合是精简冗余报警,识别复杂攻击场景的有效方法,当前的报警融合方法大都局限于融合的特定方面。多级融合模型通过报警的标准化、验证、聚合与关联等环节,可以层层精简报警,从低层报警中抽象出高层攻击场景。实验结果证明该模型是可行的,且具有较高性能。     

Only connect: teaching, technology and telesis

Abstract This paper describes an approach to the design of interactive multimedia materials being developed in a European Community project. The developmental process is seen as a dialogue between technologists and teachers. This dialogue is often problematic because of the differences in training, experience and culture between them. Conditions needed for fruitful dialogue are described and the generic model for learning design used in the project is explained.     

European Community policy and the market

Abstract This paper starts with some reflections on the policy considerations and priorities which are shaping European Commission (EC) research programmes. Then it attempts to position the current projects which seek to capitalise on information and communications technologies for learning in relation to these priorities and the apparent realities of the marketplace. It concludes that while there are grounds to be optimistic about the contribution EC programmes can make to the efficiency and standard of education and training, they are still too technology driven.     

一种自适应子融合集成多分类器方法

融合集成方法已经广泛应用在模式识别领域,然而一些基分类器实时性能稳定性较差,导致多分类器融合性能差,针对上述问题本文提出了一种新的基于多分类器的子融合集成分类器系统。该方法考虑在度量层融合层次之上通过对各类基多分类器进行动态选择,票数最多的类别作为融合系统中对特征向量识别的类别,构成一种新的自适应子融合集成分类器方法。实验表明,该方法比传统的分类器以及分类融合方法识别准确率明显更高,具有更好的鲁棒性。     

Avoiding semantic and temporal gaps in developing software intensive systems

Development of software intensive systems (systems) in practice involves a series of self-contained phases for the lifecycle of a system. Semantic and temporal gaps, which occur among phases and among developer disciplines within and across phases, hinder the ongoing development of a system because of the interdependencies among phases and among disciplines. Such gaps are magnified among systems that are developed at different times by different development teams, which may limit reuse of artifacts of systems development and interoperability among the systems. This article discusses such gaps and a systems development process for avoiding them.     

Designing economic np control charts: A programmed simulation approach

This paper presents control charts models and the necessary simulation software for the location of economic values of the control parameters. The simulation program is written in FORTRAN, requires only 10K of main storage, and can run on most mini and micro computers. Two models are presented - one describes the process when it is operating at full capacity and the other when the process is operating under capacity. The models allow the product quality to deteriorate to a further level before an existing out-of-control state is detected, and they can also be used in situations where no prior knowledge exists of the out-of-control causes and the resulting proportion defectives.     

The development of robot art

Going through a few examples of robot artists who are recognized worldwide, we try to analyze the deepest meaning of what is called “robot art” and the related art field definition. We also try to highlight its well-marked borders, such as kinetic sculptures, kinetic art, cyber art, and cyberpunk. A brief excursion into the importance of the context, the message, and its semiotics is also provided, case by case, together with a few hints on the history of this discipline in the light of an artistic perspective. Therefore, the aim of this article is to try to summarize the main characteristics that might classify robot art as a unique and innovative discipline, and to track down some of the principles by which a robotic artifact can or cannot be considered an art piece in terms of social, cultural, and strictly artistic interest. This work was presented in part at the 13th International Symposium on Artificial Life and Robotics, Oita, Japan, January 31–February 2, 2008     

Explanation and prediction: an architecture for default and abductive reasoning

Although there are many arguments that logic is an appropriate tool for artificial intelligence, there has been a perceived problem with the monotonicity of classical logic. This paper elaborates on the idea that reasoning should be viewed as theory formation where logic tells us the consequences of our assumptions. The two activities of predicting what is expected to be true and explaining observations are considered in a simple theory formation framework. Properties of each activity are discussed, along with a number of proposals as to what should be predicted or accepted as reasonable explanations. An architecture is proposed to combine explanation and prediction into one coherent framework. Algorithms used to implement the system as well as examples from a running implementation are given.     

Three Process Perspectives: Organizations, Teams, and People

This paper provides the author's personal views and perspectives on software process improvement. Starting with his first work on technology assessment in IBM over 20 years ago, Watts Humphrey describes the process improvement work he has been directly involved in. This includes the development of the early process assessment methods, the original design of the CMM, and the introduction of the Personal Software Process (PSP)^SM and Team Software Process (TSP){^SM}. In addition to describing the original motivation for this work, the author also reviews many of the problems he and his associates encountered and why they solved them the way they did. He also comments on the outstanding issues and likely directions for future work. Finally, this work has built on the experiences and contributions of many people. Mr. Humphrey only describes work that he was personally involved in and he names many of the key contributors. However, so many people have been involved in this work that a full list of the important participants would be impractical.     

基于复小波噪声方差显著修正的SAR图像去噪

提出了一种基于复小波域统计建模与噪声方差估计显著性修正相结合的合成孔径雷达(Synthetic Aperture Radar,SAR)图像斑点噪声滤波方法。该方法首先通过对数变换将乘性噪声模型转化为加性噪声模型,然后对变换后的图像进行双树复小波变换(Dualtree Complex Wavelet Transform,DCWT),并对复数小波系数的统计分布进行建模。在此先验分布的基础上,通过运用贝叶斯估计方法从含噪系数中恢复原始系数,达到滤除噪声的目的。实验结果表明该方法在去除噪声的同时保留了图像的细节信息,取得了很好的降噪效果。     

How do children do mathematics with LOGO?

Abstract  This paper considers some results of a study designed to investigate the kinds of mathematical activity undertaken by children (aged between 8 and 11) as they learned to program in LOGO. A model of learning modes is proposed, which attempts to describe the ways in which children used and acquired understanding of the programming/mathematical concepts involved. The remainder of the paper is concerned with discussing the validity and limitations of the model, and its implications for further research and curriculum development.