Proceedings from the Fifth Annual IEEE SMC Information Assurance Workshop, 2004.最新文献

筛选
英文 中文
Fuzzy dependency and its applications in damage assessment and recovery 模糊依赖及其在损伤评估和恢复中的应用
Proceedings from the Fifth Annual IEEE SMC Information Assurance Workshop, 2004. Pub Date : 2004-06-10 DOI: 10.1109/IAW.2004.1437838
Yanjun Zuo, B. Panda
{"title":"Fuzzy dependency and its applications in damage assessment and recovery","authors":"Yanjun Zuo, B. Panda","doi":"10.1109/IAW.2004.1437838","DOIUrl":"https://doi.org/10.1109/IAW.2004.1437838","url":null,"abstract":"Fuzzy dependency in a database delineates a loose dependency relationship between two sets of attributes. It describes logical relationships among attributes in a database relation and those relationships can't be fully specified by functional dependencies, which focus on database schema and data organization. This characteristic of the database schema can be used to perform damage assessment and also to build fuzzy recovery model. In this paper, we formally define the concept of fuzzy dependency and introduce several inference rules. Then we focus on recovery from information attacks. An architecture for fuzzy value generation during recovery, based on fuzzy dependency relationships, is also presented. Fuzzy dependency can accelerate the post attack recovery process because it can generate acceptable values for damaged data quicker compared to that in traditional recovery schemes. Although the generated fuzzy values may not offer the absolute accuracy, they are acceptable for many real-time applications, which require prompt response more than the data accuracy.","PeriodicalId":141403,"journal":{"name":"Proceedings from the Fifth Annual IEEE SMC Information Assurance Workshop, 2004.","volume":"2 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2004-06-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"121834867","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 17
Developing forensic computing tools and techniques within a holistic framework: an Australian approach 在整体框架内发展法医计算工具和技术:澳大利亚方法
Proceedings from the Fifth Annual IEEE SMC Information Assurance Workshop, 2004. Pub Date : 2004-06-10 DOI: 10.1109/IAW.2004.1437844
J. Slay, M. Hannan, Vlasti Broucek, Paul Turner
{"title":"Developing forensic computing tools and techniques within a holistic framework: an Australian approach","authors":"J. Slay, M. Hannan, Vlasti Broucek, Paul Turner","doi":"10.1109/IAW.2004.1437844","DOIUrl":"https://doi.org/10.1109/IAW.2004.1437844","url":null,"abstract":"This paper details work-in-progress in the development of conceptual framework within which to position diverse approaches to forensic computing investigations. From this framework a suite of forensic computing tools and investigative procedures to aid police and intelligence investigators in the cyber-policing of e-crime and cyber-terrorism are being produced. These tools aid in the detection of online computer misuse and provide technical support in reactive and proactive investigation. The accompanying integrated procedures ensure that digital evidence is acquired methodologically and is presented in legally admissible manner.","PeriodicalId":141403,"journal":{"name":"Proceedings from the Fifth Annual IEEE SMC Information Assurance Workshop, 2004.","volume":"69 7 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2004-06-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127027220","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 5
Enhanced secure dynamic DNS update with indirect route 支持非直连路由的增强安全动态DNS更新
Proceedings from the Fifth Annual IEEE SMC Information Assurance Workshop, 2004. Pub Date : 2004-06-10 DOI: 10.1109/IAW.2004.1437836
D. Wilkinson, C. E. Chow, Y. Cai
{"title":"Enhanced secure dynamic DNS update with indirect route","authors":"D. Wilkinson, C. E. Chow, Y. Cai","doi":"10.1109/IAW.2004.1437836","DOIUrl":"https://doi.org/10.1109/IAW.2004.1437836","url":null,"abstract":"In this paper, we present the design and implementation of the enhanced secure dynamic DNS update with indirect route (the IR DNS update). The existing DNS update may experience serious performance problem when the normal Internet route is unstable or unavailable due to DDoS attacks. By setting up indirect route via a set of proxy servers from the target side DNS server to the client side DNS server, the DNS zone data can be transported over Internet via the indirect routes to foil the DDoS attack. After the IR DNS update, the end users can get the indirect routing information by querying the DNS server, and set up indirect route to the target server accordingly. The IR DNS update is an essential part of the Secure Collective Defense (SCOLD) system, and it can be utilized independently as an extension to the existing DNS update utility. This technique can also be utilized to protect the root DNS servers from DDoS attacks. The implementation of the IR DNS update on BIND 9 is presented. The experimental results show that the IR DNS update can be used to improve the network security, availability and performance.","PeriodicalId":141403,"journal":{"name":"Proceedings from the Fifth Annual IEEE SMC Information Assurance Workshop, 2004.","volume":"38 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2004-06-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127753110","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 5
Battery-based intrusion detection a first line of defense 基于电池的入侵检测是第一道防线
Proceedings from the Fifth Annual IEEE SMC Information Assurance Workshop, 2004. Pub Date : 2004-06-10 DOI: 10.1109/IAW.2004.1437827
G. A. Jacoby, R. Marchany, N.J. Davis
{"title":"Battery-based intrusion detection a first line of defense","authors":"G. A. Jacoby, R. Marchany, N.J. Davis","doi":"10.1109/IAW.2004.1437827","DOIUrl":"https://doi.org/10.1109/IAW.2004.1437827","url":null,"abstract":"This paper proposes a first line of defense early warning system via a host-based form of intrusion detection that can alert security administrators to protect their corporate network(s). This innovative technique operates through the implementation of battery-based intrusion detection (B-bid) on mobile devices by correlating attacks with their impact on device power consumption using a rule-based host intrusion detection engine (HIDE). HIDE monitors power behavior to detect potential intrusions by noting irregularities of power consumption and works in conjunction with a host analysis signature trace engine (HASTE) to provide protection to both mobile hosts and, by extension, their affiliated network.","PeriodicalId":141403,"journal":{"name":"Proceedings from the Fifth Annual IEEE SMC Information Assurance Workshop, 2004.","volume":"42 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2004-06-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"125451015","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 41
Matrix based asymmetric bulk encryption algorithm 基于矩阵的非对称块加密算法
Proceedings from the Fifth Annual IEEE SMC Information Assurance Workshop, 2004. Pub Date : 2004-06-10 DOI: 10.1109/IAW.2004.1437812
M. Singh
{"title":"Matrix based asymmetric bulk encryption algorithm","authors":"M. Singh","doi":"10.1109/IAW.2004.1437812","DOIUrl":"https://doi.org/10.1109/IAW.2004.1437812","url":null,"abstract":"This paper discusses a matrix based asymmetric bulk encryption algorithm. The security of the proposed algorithm is based on difficulty in factoring a composite integer into its component primes. We also propose a method to maintain the atomicity of the whole message to thwart all attacks based on any partial knowledge about the message. The novel part of the discussed public key encryption algorithm is that it is many times faster than the existing RSA public key algorithm for large messages. In the trivial case of 1/spl times/1 matrices it reduces to the RSA public key encryption algorithm.","PeriodicalId":141403,"journal":{"name":"Proceedings from the Fifth Annual IEEE SMC Information Assurance Workshop, 2004.","volume":"44 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2004-06-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122657628","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 5
LSB steganalysis using support vector regression 基于支持向量回归的LSB隐写分析
Proceedings from the Fifth Annual IEEE SMC Information Assurance Workshop, 2004. Pub Date : 2004-06-10 DOI: 10.1109/IAW.2004.1437803
E. Lin, E. Woertz, M. Kam
{"title":"LSB steganalysis using support vector regression","authors":"E. Lin, E. Woertz, M. Kam","doi":"10.1109/IAW.2004.1437803","DOIUrl":"https://doi.org/10.1109/IAW.2004.1437803","url":null,"abstract":"We describe a method of detecting the existence of messages, which are randomly scattered in the least significant bits (LSB) of both 24-bit RGB color and 8-bit grayscale images. The method is based on gathering and inspecting a set of image relevant features from the pixel groups of the stego-image, whose similarities and correlations change with different ratios of LSB embedding. The proposed detection scheme is based on support vector regression (SVR). It is shown that the measurement of a selected set of features forms a multidimensional feature space which allows estimation of the length of hidden messages embedded in the LSB of cover-images with high precision.","PeriodicalId":141403,"journal":{"name":"Proceedings from the Fifth Annual IEEE SMC Information Assurance Workshop, 2004.","volume":"5 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2004-06-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132649431","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 3
Designing an information security system 设计一个信息安全系统
Proceedings from the Fifth Annual IEEE SMC Information Assurance Workshop, 2004. Pub Date : 2004-06-10 DOI: 10.1109/IAW.2004.1437857
C. Resch
{"title":"Designing an information security system","authors":"C. Resch","doi":"10.1109/IAW.2004.1437857","DOIUrl":"https://doi.org/10.1109/IAW.2004.1437857","url":null,"abstract":"This paper describes a methodology for designing an information security system. The paper focuses on the initial stages of information system security engineering (ISSE), the upfront analysis and engineering necessary for designing security into the system. The methodology follows a system engineering process for designing security for a system through needs analysis and requirements generation.","PeriodicalId":141403,"journal":{"name":"Proceedings from the Fifth Annual IEEE SMC Information Assurance Workshop, 2004.","volume":"33 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2004-06-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"121771920","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Dimension reduction using feature extraction methods for real-time misuse detection systems 实时误用检测系统的特征提取降维方法
Proceedings from the Fifth Annual IEEE SMC Information Assurance Workshop, 2004. Pub Date : 2004-06-10 DOI: 10.1109/IAW.2004.1437817
G. K. Kuchimanchi, V. Phoha, K. Balagani, S. R. Gaddam
{"title":"Dimension reduction using feature extraction methods for real-time misuse detection systems","authors":"G. K. Kuchimanchi, V. Phoha, K. Balagani, S. R. Gaddam","doi":"10.1109/IAW.2004.1437817","DOIUrl":"https://doi.org/10.1109/IAW.2004.1437817","url":null,"abstract":"We present a novel signed gain in information (GI) measure for quantitative evaluation of gain or loss in information due to dimension reduction using feature extraction in misuse detection applications. GI is defined in terms of sensitivity mismatch measure (/spl Phi/) and specificity mismatch measure (/spl otimes/). '/spl Phi/' quantifies information gain or loss in feature-extracted data as the change in detection accuracy of a misuse detection system when reduced data is used instead of untransformed original data. Similarly, '/spl otimes/' quantifies information gain or loss as the change in the number of false alarms generated by a misuse detection system when feature-extracted data is used instead of original data. We present two neural network methods for feature extraction: (1) NNPCA and (2) NLCA for reducing the 41-dimensional KDD Cup 1999 data. We compare our methods with principal component analysis (PCA). Our results show that the NLCA method reduces the test data to approximately 30% of its original size while maintaining a GI comparable to that of PCA and the NNPCA method reduces the test data to approximately 50% with GI measure greater than that of PCA.","PeriodicalId":141403,"journal":{"name":"Proceedings from the Fifth Annual IEEE SMC Information Assurance Workshop, 2004.","volume":"17 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2004-06-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115365257","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 65
An investigation of a compromised host on a honeynet being used to increase the security of a large enterprise network 对蜜网上被用于增加大型企业网络安全性的受感染主机的调查
Proceedings from the Fifth Annual IEEE SMC Information Assurance Workshop, 2004. Pub Date : 2004-06-10 DOI: 10.1109/IAW.2004.1437791
Timothy R Jackson, J. Levine, J. Grizzard, Henry L Owen
{"title":"An investigation of a compromised host on a honeynet being used to increase the security of a large enterprise network","authors":"Timothy R Jackson, J. Levine, J. Grizzard, Henry L Owen","doi":"10.1109/IAW.2004.1437791","DOIUrl":"https://doi.org/10.1109/IAW.2004.1437791","url":null,"abstract":"The growth of network intrusions on large enterprise networks continues to increase, creating an epidemic of compromised hosts. The deployment of firewalls and intrusion detection systems has not slowed the growth of intrusions to an acceptable rate. Investigating the compromise of a production machine is both difficult and time-consuming due to the mixing of attack and production traffic, while similar investigations of compromised machines on honeynets are much less complex since there is no real production traffic. We discuss why these investigations are easier on a honeynet and how honeynets may be used to make investigations of compromised production machines faster and recovery easier. We include a description of an attack and the analysis that was conducted.","PeriodicalId":141403,"journal":{"name":"Proceedings from the Fifth Annual IEEE SMC Information Assurance Workshop, 2004.","volume":"41 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2004-06-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114701718","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 23
Markov chains in network intrusion detection 网络入侵检测中的马尔可夫链
Proceedings from the Fifth Annual IEEE SMC Information Assurance Workshop, 2004. Pub Date : 2004-06-10 DOI: 10.1109/IAW.2004.1437849
R. Hixon, D. Gruenbacher
{"title":"Markov chains in network intrusion detection","authors":"R. Hixon, D. Gruenbacher","doi":"10.1109/IAW.2004.1437849","DOIUrl":"https://doi.org/10.1109/IAW.2004.1437849","url":null,"abstract":"Connectivity of computers around the world has escalated the importance of computer security. Intrusion detection adds another dimension to computer security. When prevention methods fail, intrusion detection systems recognize attacks as they occur. This research concentrates on network packets and examines the data in the TCP and IP headers. Markov chains are used to describe the normal transitions that occur for different TCP and IP header values. They have previously been used in intrusion detection, mostly for host-based detection. Another work introduced the concept of Markov chains in network-based detection. The purpose of this research is to show that TCP/IP header fields can be used to flag packets that do not occur as often in training data and that those packets may potentially be attack packets.","PeriodicalId":141403,"journal":{"name":"Proceedings from the Fifth Annual IEEE SMC Information Assurance Workshop, 2004.","volume":"44 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2004-06-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133782178","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 11
0
×
引用
GB/T 7714-2015
复制
MLA
复制
APA
复制
导出至
BibTeX EndNote RefMan NoteFirst NoteExpress
×
提示
您的信息不完整,为了账户安全,请先补充。
现在去补充
×
提示
您因"违规操作"
具体请查看互助需知
我知道了
×
提示
确定
请完成安全验证×
相关产品
×
本文献相关产品
联系我们:info@booksci.cn Book学术提供免费学术资源搜索服务,方便国内外学者检索中英文文献。致力于提供最便捷和优质的服务体验。 Copyright © 2023 布克学术 All rights reserved.
京ICP备2023020795号-1
ghs 京公网安备 11010802042870号
Book学术文献互助
Book学术文献互助群
群 号:604180095
Book学术官方微信