基于分层结构的网络入侵检测模型的研究与实现

文章介绍了一种基于分层结构的网络入侵检测模型,它包括以下三部分:一个中心控制级检测模块,多个主机级检测模块和网络代理级检测模块。它们之间通过代理协同检测网络行为,实现实时入侵检测。另外,还介绍了各部分之间的通信机制。     

A taxonomy and survey of attacks against machine learning

The majority of machine learning methodologies operate with the assumption that their environment is benign. However, this assumption does not always hold, as it is often advantageous to adversaries to maliciously modify the training (poisoning attacks) or test data (evasion attacks). Such attacks can be catastrophic given the growth and the penetration of machine learning applications in society. Therefore, there is a need to secure machine learning enabling the safe adoption of it in adversarial cases, such as spam filtering, malware detection, and biometric recognition. This paper presents a taxonomy and survey of attacks against systems that use machine learning. It organizes the body of knowledge in adversarial machine learning so as to identify the aspects where researchers from different fields can contribute to. The taxonomy identifies attacks which share key characteristics and as such can potentially be addressed by the same defence approaches. Thus, the proposed taxonomy makes it easier to understand the existing attack landscape towards developing defence mechanisms, which are not investigated in this survey. The taxonomy is also leveraged to identify open problems that can lead to new research areas within the field of adversarial machine learning.     

Privacy issues in intrusion detection systems: A taxonomy,survey and future directions

Intrusion Detection Systems (IDSs) detect potential attacks by monitoring activities in computers and networks. This monitoring is carried out by collecting and analyzing data pertaining to users and organizations. The data is collected from various sources – such as system log files or network traffic–and may contain private information. Therefore, analysis of the data by an IDS can raise multiple privacy concerns. Recently, building IDSs that consider privacy issues in their design criteria in addition to classic design objectives (such as IDS’ performance and precision) has become a priority. This article proposes a taxonomy of privacy issues in IDSs which is then utilized to identify new challenges and problems in the field. In this taxonomy, we classify privacy-sensitive IDS data as input, built-in and generated data. Research prototypes are then surveyed and compared using the taxonomy. The privacy techniques used in the surveyed systems are discussed and compared based on their effects on the performance and precision of the IDS. Finally, the taxonomy and the survey are used to point out a number of areas for future research.     

Dependable and secure computing in medical information systems

Medical information systems facilitate ambulatory patient care, and increase safer and more intelligent diagnostic and therapeutic capabilities through automated interoperability among distributed medical devices. In modern medical information systems, dependability is one of the most important factors for patient safety in the presence of delayed or lost system alarm and data streams due to the intermittent medical device network connection or failure. In addition, since the medical information need to be frequently audited by many human operators as well as the automated medical devices, secure access control is another pivotal factor for patient privacy and data confidentiality against inside or outside adversaries. In this study, we propose a dependable and secure access policy enforcement scheme for disruption-tolerant medical information systems. The proposed scheme exploits the external storage node operated by the device controller, which enables reliable communications between medical devices. Fine-grained data access control is also achieved, while the key escrow problem is resolved such that any curious device controller or key generation center cannot decrypt the private medical data of patients. The proposed scheme allows the device controller to partially decrypt the encrypted medical information for the authorized receivers with their corresponding attributes without leaking any confidential information to it. Thus, computational efficiency at the medical devices is also enhanced by enabling the medical devices to delegate most laborious tasks of decryption to the device controller.     

入侵检测技术综述

入侵检测技术是对网络入侵进行主动识别的新兴网络安全技术，具有强大的生命力。本文介绍了入侵检测技术的功能结构、分类、工作原理，分析了在信息系统中布置入侵检测技术的必要性，对未来入侵检测技术的发展做出了展望。     

A new trust-based mechanism for detecting intrusions in MANET

Providing security to Mobile Ad-hoc Networks (MANET) is a challenging and demanding task. It is important to secure the network against intrusions in MANET for assuring the development of services. For this purpose, some intrusion-detection systems (IDSs) have been developed in traditional works. However, these have some drawbacks, such as that there is no assurance for public key authentication, certificate validation between two nodes is not possible, and they require a large amount of time for processing. To overcome all these issues, a Trust-Based Authentication Routing with Bio-Inspired Intrusion Detection System (TRAB-IDS) is developed in this article. The main aim of this article is to provide security to the network against harmful intrusions. Here, the trust and deep packet inspection (DPI) concepts are integrated for improving the security. Moreover, the certificate authority generates a public and private key pair for initiating the route agent and authenticating the neighboring nodes. Based on the trust of the node, the packet is forwarded to the intermediate node by calculating a bogus key. Then, the DPI is initiated for extracting the packet features and the similarity between the features is estimated. If the packet is matched with the attacker, an error report will be forwarded to the certificate authority; otherwise, the packet will be forwarded to the other node. The experimental results evaluate the performance of the proposed TRAB-IDS in terms of delivery ratio, delay, security cost, and misdetection ratio.     

Security in Mobile IPv6: A survey

Secure mobile communication is essential for the pervasive accessibility of critical information infrastructure. Connecting control systems with the business enterprise, wireless telemetry and mobile user interaction with critical infrastructure systems are examples of services that motivate the need for secure mobile communication. Mobile IPv6 is being touted to provide communication support for such services. The security of Mobile IPv6 poses key challenges impeding its wide-scale adoption. Several security mechanisms have been proposed in the literature. This paper surveys security vulnerabilities of Mobile IPv6, provides a taxonomy for the main existing and proposed solutions, and then extends to outline some open issues.     

Taxonomy of quality metrics for assessing assurance of security correctness

Assurance is commonly considered as “something said or done to inspire confidence” (Webster dictionary). However, the level of confidence inspired from a statement or an action depends on the quality of its source. Similarly, the assurance that the deployed security mechanisms exhibit an appropriate posture depends on the quality of the verification process adopted. This paper presents a novel taxonomy of quality metrics pertinent for gaining assurance in a security verification process. Inspired by the systems security engineering capability maturity model and the common criteria, we introduce five ordinal quality levels for a verification process aimed at probing the correctness of runtime security mechanisms. In addition, we analyse the mapping between the quality levels and different capability levels of the following verification metrics families: coverage, rigour, depth and independence of verification. The quality taxonomy is part of a framework for the Security Assurance of operational systems. These metrics can also be used for gaining assurance in other areas such as legal and safety compliance. Furthermore, the resulting metrics taxonomy could, by identifying appropriate quality security requirements, assist manufacturers of information technology (IT) in developing their products or systems. Additionally, the taxonomy could also empower consumers in IT security product selection to efficaciously and effectively match their organisational needs, while IT security evaluators can use it as a reference point when forming judgments about the quality of a security product. We demonstrate the applicability of the proposed taxonomy through access control examples.     

Metaphors and Context-Aware Information Access

Metaphors are often used to provide the user with a mental model to ease the use of computers. An example of such a metaphor is the commonly used “Desktop Metaphor”. Metaphors also can be used to ease context-aware information access for the users of mobile information systems. In this paper we present a taxonomy that allows the categorisation of such metaphors. Furthermore, we give an overview of existing metaphors and their implementations. After introducing some new metaphors we conclude our considerations with a classification of new and existing metaphors using our taxonomy.     

Evaluating maintenance management information systems

The evaluation of maintenance management information systems (MMIS) in five case organizations is investigated by considering a taxonomy taken from the literature. The objectives in implementing a MMIS are assessed against factors in the taxonomy which classifies the systems in eight possible ways. These factors provide an indication of the appropriate evaluation for the IS. The study finds broad congruence between the perspectives of managers in the case organizations and the taxonomy, but emphasises that other key factors should be considered to ensure successful implementation and evaluation.     

A hybrid intrusion detection system design for computer network security

Intrusions detection systems (IDSs) are systems that try to detect attacks as they occur or after the attacks took place. IDSs collect network traffic information from some point on the network or computer system and then use this information to secure the network. Intrusion detection systems can be misuse-detection or anomaly detection based. Misuse-detection based IDSs can only detect known attacks whereas anomaly detection based IDSs can also detect new attacks by using heuristic methods. In this paper we propose a hybrid IDS by combining the two approaches in one system. The hybrid IDS is obtained by combining packet header anomaly detection (PHAD) and network traffic anomaly detection (NETAD) which are anomaly-based IDSs with the misuse-based IDS Snort which is an open-source project.The hybrid IDS obtained is evaluated using the MIT Lincoln Laboratories network traffic data (IDEVAL) as a testbed. Evaluation compares the number of attacks detected by misuse-based IDS on its own, with the hybrid IDS obtained combining anomaly-based and misuse-based IDSs and shows that the hybrid IDS is a more powerful system.     

Secure multimedia data processing scheme in medical applications

People communicate in a variety of ways via multimedia through the propagation of various techniques. Nowadays, variety of multimedia frameworks or techniques is used in various applications such as industries, software processing, vehicles and medical systems. The usage of multimedia frameworks in healthcare systems makes it possible to process, record and store huge amount of information generated by various medical records. However, the processing and management of huge records of every individual lead to overload the security risk and human efforts. The aim of this paper is to propose a secure and efficient technique that helps the medical organizations to process every record of individuals in a secure and efficient way. The proposed mechanism is validated against various security and processing metrics over conventional mechanisms such as Response Time, Message Alteration Record, Trusted Classification Accuracy and Record Accuracy. The analyzed results claim the significant improvement of proposed mechanism as compare to other schemes.

     

安全操作系统中基于安全性损害分析的可信恢复

安全操作系统可能因为内部或外部的原因发生失效或中断,进而导致其安全性损害。本文首先描述了一个通用的安全模型,然后扩展此模型以描述安全操作系统中的安全性损害,并提出依据安全策略从安全审计日志中分析计算安全性损害的方法,最后给出了安全性损害相应的可信恢复算法。在消极的安全防御外,本文的研究主动保证安全操作系统的安全性,增强了安全操作系统的可靠性和可恢复性。     

一种分布式协同入侵检测系统的设计与实现

提出了一种能够精确描述入侵检测技术的综合分类方法,针对多管理域环境设计了一个分布式协同入侵检测系统(distributedcooperativeintrusiondetectionsystem,简称DCIDS),通过不同管理域IDS(intrusiondetectionsystem)之间高效安全的通信,实现协同检测.介绍了DCIDS的系统结构和4个组成部分:传感器、分析器、管理器以及用户界面,并讨论了系统实现中的安全通信、入侵检测点的选择等关键问题.     

The security of machine learning

Machine learning’s ability to rapidly evolve to changing and complex situations has helped it become a fundamental tool for computer security. That adaptability is also a vulnerability: attackers can exploit machine learning systems. We present a taxonomy identifying and analyzing attacks against machine learning systems. We show how these classes influence the costs for the attacker and defender, and we give a formal structure defining their interaction. We use our framework to survey and analyze the literature of attacks against machine learning systems. We also illustrate our taxonomy by showing how it can guide attacks against SpamBayes, a popular statistical spam filter. Finally, we discuss how our taxonomy suggests new lines of defenses.     

Modeling security-relevant data semantics

The use of an extended data model which represents both integrity and secrecy aspects of data is demonstrated. This Semantic Data Model for Security (SDMS) provides a technique that assists domain experts, security officers, and database designers in first understanding their security requirements, and then translating them into a good database design. Identifying security requirements at this semantic level provides the basis for analyzing the security requirements and the database design for inference and signaling vulnerabilities. Another contribution is a comprehensive taxonomy of security-relevant data semantics that must be captured and understood to implement a multilevel secure automated information system     

A Practical Vulnerability Assessment Program

Firewalls, malicious-code-screening servers, and intrusion-detection systems aren't sufficiently comprehensive to ensure appropriate and ongoing information confidentiality, integrity, and availability. A practical vulnerability assessment program lets organizations identify potential security exposures and correct any deficiencies.     

Secure and reliable clustering in wireless sensor networks: A critical survey

In the past few years, research interest has been increased towards wireless sensor networks (WSNs) and their application in both the military and civil domains. To support scalability in WSNs and increase network lifetime, nodes are often grouped into disjoint clusters. However, secure and reliable clustering, which is critical in WSNs deployed in hostile environments, has gained modest attention so far or has been limited only to fault tolerance. In this paper, we review the state-of-the-art of clustering protocols in WSNs with special emphasis on security and reliability issues. First, we define a taxonomy of security and reliability for cluster head election and clustering in WSNs. Then, we describe and analyze the most relevant secure and reliable clustering protocols. Finally, we propose countermeasures against typical attacks and show how they improve the discussed protocols.     

On a pattern-oriented model for intrusion detection

Operational security problems, which are often the result of access authorization misuse, can lead to intrusion in secure computer systems. We motivate the need for pattern-oriented intrusion detection, and present a model that tracks both data and privilege flows within secure systems to detect context-dependent intrusions caused by operational security problems. The model allows the uniform representation of various types of intrusion patterns, such as those caused by unintended use of foreign programs and input data, imprudent choice of default privileges, and use of weak protection mechanisms. As with all pattern-oriented models, this model cannot be used to detect new, unanticipated intrusion patterns that could be detected by statistical models. For this reason, we expect that this model will complement, not replace, statistical models for intrusion detection     

Component survivability at runtime for mission-critical distributed systems

As information systems develop into larger and more complex implementations, the need for survivability in mission-critical systems is pressing. Furthermore, the requirement for protecting information systems becomes increasingly vital, while new threats are identified each day. It becomes more challenging to build systems that will detect such threats and recover from the damage. This is particularly critical for distributed mission-critical systems, which cannot afford a letdown in functionality even though there are internal component failures or compromises with malicious codes, especially in a downloaded component from an external source. Therefore, when using such a component, we should check to see if the source of the component is trusted and that the code has not been modified in an unauthorized manner since it was created. Furthermore, once we find failures or malicious codes in the component, we should fix those problems and continue the original functionality of the component at runtime so that we can support survivability in the mission-critical system. In this paper, we define our definition of survivability, discuss the survivability challenges in component-sharing in a large distributed system, identify the static and dynamic survivability models, and discuss their trade-offs. Consequently, we propose novel approaches for component survivability. Finally, we prove the feasibility of our ideas by implementing component recovery against internal failures and malicious codes based on the dynamic model.