{"title":"Fuzzy dependency and its applications in damage assessment and recovery","authors":"Yanjun Zuo, B. Panda","doi":"10.1109/IAW.2004.1437838","DOIUrl":"https://doi.org/10.1109/IAW.2004.1437838","url":null,"abstract":"Fuzzy dependency in a database delineates a loose dependency relationship between two sets of attributes. It describes logical relationships among attributes in a database relation and those relationships can't be fully specified by functional dependencies, which focus on database schema and data organization. This characteristic of the database schema can be used to perform damage assessment and also to build fuzzy recovery model. In this paper, we formally define the concept of fuzzy dependency and introduce several inference rules. Then we focus on recovery from information attacks. An architecture for fuzzy value generation during recovery, based on fuzzy dependency relationships, is also presented. Fuzzy dependency can accelerate the post attack recovery process because it can generate acceptable values for damaged data quicker compared to that in traditional recovery schemes. Although the generated fuzzy values may not offer the absolute accuracy, they are acceptable for many real-time applications, which require prompt response more than the data accuracy.","PeriodicalId":141403,"journal":{"name":"Proceedings from the Fifth Annual IEEE SMC Information Assurance Workshop, 2004.","volume":"2 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2004-06-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"121834867","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Developing forensic computing tools and techniques within a holistic framework: an Australian approach","authors":"J. Slay, M. Hannan, Vlasti Broucek, Paul Turner","doi":"10.1109/IAW.2004.1437844","DOIUrl":"https://doi.org/10.1109/IAW.2004.1437844","url":null,"abstract":"This paper details work-in-progress in the development of conceptual framework within which to position diverse approaches to forensic computing investigations. From this framework a suite of forensic computing tools and investigative procedures to aid police and intelligence investigators in the cyber-policing of e-crime and cyber-terrorism are being produced. These tools aid in the detection of online computer misuse and provide technical support in reactive and proactive investigation. The accompanying integrated procedures ensure that digital evidence is acquired methodologically and is presented in legally admissible manner.","PeriodicalId":141403,"journal":{"name":"Proceedings from the Fifth Annual IEEE SMC Information Assurance Workshop, 2004.","volume":"69 7 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2004-06-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127027220","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Enhanced secure dynamic DNS update with indirect route","authors":"D. Wilkinson, C. E. Chow, Y. Cai","doi":"10.1109/IAW.2004.1437836","DOIUrl":"https://doi.org/10.1109/IAW.2004.1437836","url":null,"abstract":"In this paper, we present the design and implementation of the enhanced secure dynamic DNS update with indirect route (the IR DNS update). The existing DNS update may experience serious performance problem when the normal Internet route is unstable or unavailable due to DDoS attacks. By setting up indirect route via a set of proxy servers from the target side DNS server to the client side DNS server, the DNS zone data can be transported over Internet via the indirect routes to foil the DDoS attack. After the IR DNS update, the end users can get the indirect routing information by querying the DNS server, and set up indirect route to the target server accordingly. The IR DNS update is an essential part of the Secure Collective Defense (SCOLD) system, and it can be utilized independently as an extension to the existing DNS update utility. This technique can also be utilized to protect the root DNS servers from DDoS attacks. The implementation of the IR DNS update on BIND 9 is presented. The experimental results show that the IR DNS update can be used to improve the network security, availability and performance.","PeriodicalId":141403,"journal":{"name":"Proceedings from the Fifth Annual IEEE SMC Information Assurance Workshop, 2004.","volume":"38 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2004-06-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127753110","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Battery-based intrusion detection a first line of defense","authors":"G. A. Jacoby, R. Marchany, N.J. Davis","doi":"10.1109/IAW.2004.1437827","DOIUrl":"https://doi.org/10.1109/IAW.2004.1437827","url":null,"abstract":"This paper proposes a first line of defense early warning system via a host-based form of intrusion detection that can alert security administrators to protect their corporate network(s). This innovative technique operates through the implementation of battery-based intrusion detection (B-bid) on mobile devices by correlating attacks with their impact on device power consumption using a rule-based host intrusion detection engine (HIDE). HIDE monitors power behavior to detect potential intrusions by noting irregularities of power consumption and works in conjunction with a host analysis signature trace engine (HASTE) to provide protection to both mobile hosts and, by extension, their affiliated network.","PeriodicalId":141403,"journal":{"name":"Proceedings from the Fifth Annual IEEE SMC Information Assurance Workshop, 2004.","volume":"42 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2004-06-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"125451015","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Matrix based asymmetric bulk encryption algorithm","authors":"M. Singh","doi":"10.1109/IAW.2004.1437812","DOIUrl":"https://doi.org/10.1109/IAW.2004.1437812","url":null,"abstract":"This paper discusses a matrix based asymmetric bulk encryption algorithm. The security of the proposed algorithm is based on difficulty in factoring a composite integer into its component primes. We also propose a method to maintain the atomicity of the whole message to thwart all attacks based on any partial knowledge about the message. The novel part of the discussed public key encryption algorithm is that it is many times faster than the existing RSA public key algorithm for large messages. In the trivial case of 1/spl times/1 matrices it reduces to the RSA public key encryption algorithm.","PeriodicalId":141403,"journal":{"name":"Proceedings from the Fifth Annual IEEE SMC Information Assurance Workshop, 2004.","volume":"44 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2004-06-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122657628","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"LSB steganalysis using support vector regression","authors":"E. Lin, E. Woertz, M. Kam","doi":"10.1109/IAW.2004.1437803","DOIUrl":"https://doi.org/10.1109/IAW.2004.1437803","url":null,"abstract":"We describe a method of detecting the existence of messages, which are randomly scattered in the least significant bits (LSB) of both 24-bit RGB color and 8-bit grayscale images. The method is based on gathering and inspecting a set of image relevant features from the pixel groups of the stego-image, whose similarities and correlations change with different ratios of LSB embedding. The proposed detection scheme is based on support vector regression (SVR). It is shown that the measurement of a selected set of features forms a multidimensional feature space which allows estimation of the length of hidden messages embedded in the LSB of cover-images with high precision.","PeriodicalId":141403,"journal":{"name":"Proceedings from the Fifth Annual IEEE SMC Information Assurance Workshop, 2004.","volume":"5 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2004-06-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132649431","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Designing an information security system","authors":"C. Resch","doi":"10.1109/IAW.2004.1437857","DOIUrl":"https://doi.org/10.1109/IAW.2004.1437857","url":null,"abstract":"This paper describes a methodology for designing an information security system. The paper focuses on the initial stages of information system security engineering (ISSE), the upfront analysis and engineering necessary for designing security into the system. The methodology follows a system engineering process for designing security for a system through needs analysis and requirements generation.","PeriodicalId":141403,"journal":{"name":"Proceedings from the Fifth Annual IEEE SMC Information Assurance Workshop, 2004.","volume":"33 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2004-06-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"121771920","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
G. K. Kuchimanchi, V. Phoha, K. Balagani, S. R. Gaddam
{"title":"Dimension reduction using feature extraction methods for real-time misuse detection systems","authors":"G. K. Kuchimanchi, V. Phoha, K. Balagani, S. R. Gaddam","doi":"10.1109/IAW.2004.1437817","DOIUrl":"https://doi.org/10.1109/IAW.2004.1437817","url":null,"abstract":"We present a novel signed gain in information (GI) measure for quantitative evaluation of gain or loss in information due to dimension reduction using feature extraction in misuse detection applications. GI is defined in terms of sensitivity mismatch measure (/spl Phi/) and specificity mismatch measure (/spl otimes/). '/spl Phi/' quantifies information gain or loss in feature-extracted data as the change in detection accuracy of a misuse detection system when reduced data is used instead of untransformed original data. Similarly, '/spl otimes/' quantifies information gain or loss as the change in the number of false alarms generated by a misuse detection system when feature-extracted data is used instead of original data. We present two neural network methods for feature extraction: (1) NNPCA and (2) NLCA for reducing the 41-dimensional KDD Cup 1999 data. We compare our methods with principal component analysis (PCA). Our results show that the NLCA method reduces the test data to approximately 30% of its original size while maintaining a GI comparable to that of PCA and the NNPCA method reduces the test data to approximately 50% with GI measure greater than that of PCA.","PeriodicalId":141403,"journal":{"name":"Proceedings from the Fifth Annual IEEE SMC Information Assurance Workshop, 2004.","volume":"17 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2004-06-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115365257","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Timothy R Jackson, J. Levine, J. Grizzard, Henry L Owen
{"title":"An investigation of a compromised host on a honeynet being used to increase the security of a large enterprise network","authors":"Timothy R Jackson, J. Levine, J. Grizzard, Henry L Owen","doi":"10.1109/IAW.2004.1437791","DOIUrl":"https://doi.org/10.1109/IAW.2004.1437791","url":null,"abstract":"The growth of network intrusions on large enterprise networks continues to increase, creating an epidemic of compromised hosts. The deployment of firewalls and intrusion detection systems has not slowed the growth of intrusions to an acceptable rate. Investigating the compromise of a production machine is both difficult and time-consuming due to the mixing of attack and production traffic, while similar investigations of compromised machines on honeynets are much less complex since there is no real production traffic. We discuss why these investigations are easier on a honeynet and how honeynets may be used to make investigations of compromised production machines faster and recovery easier. We include a description of an attack and the analysis that was conducted.","PeriodicalId":141403,"journal":{"name":"Proceedings from the Fifth Annual IEEE SMC Information Assurance Workshop, 2004.","volume":"41 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2004-06-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114701718","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Markov chains in network intrusion detection","authors":"R. Hixon, D. Gruenbacher","doi":"10.1109/IAW.2004.1437849","DOIUrl":"https://doi.org/10.1109/IAW.2004.1437849","url":null,"abstract":"Connectivity of computers around the world has escalated the importance of computer security. Intrusion detection adds another dimension to computer security. When prevention methods fail, intrusion detection systems recognize attacks as they occur. This research concentrates on network packets and examines the data in the TCP and IP headers. Markov chains are used to describe the normal transitions that occur for different TCP and IP header values. They have previously been used in intrusion detection, mostly for host-based detection. Another work introduced the concept of Markov chains in network-based detection. The purpose of this research is to show that TCP/IP header fields can be used to flag packets that do not occur as often in training data and that those packets may potentially be attack packets.","PeriodicalId":141403,"journal":{"name":"Proceedings from the Fifth Annual IEEE SMC Information Assurance Workshop, 2004.","volume":"44 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2004-06-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133782178","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}