Proceedings from the Fifth Annual IEEE SMC Information Assurance Workshop, 2004.最新文献_第7页

Architecture of the reconnaissance intrusion detection system (RIDS) 侦察入侵检测系统(RIDS)体系结构

Proceedings from the Fifth Annual IEEE SMC Information Assurance Workshop, 2004. Pub Date : 2004-06-10 DOI: 10.1109/IAW.2004.1437816

Zheng Zhang, C. Manikopoulos

{"title":"Architecture of the reconnaissance intrusion detection system (RIDS)","authors":"Zheng Zhang, C. Manikopoulos","doi":"10.1109/IAW.2004.1437816","DOIUrl":"https://doi.org/10.1109/IAW.2004.1437816","url":null,"abstract":"This paper describes the architecture and provides early test results of the reconnaissance intrusion detection system (RIDS) prototype. RIDS is a session oriented, statistical tool, that relies on training to mold the parameters of its algorithms, capable of detecting even distributed stealthy reconnaissance attacks. It consists of two main functional modules or stages: the reconnaissance activity profiler (RAP), followed by the reconnaissance alert correlation (RAC), along with a security console. RAP is a session-oriented module capable of detecting stealthy scanning and probing attacks, while RAC is an alert-correlation module that fuses the RAP alerts into attack scenarios and discovers the distributed stealthy attack scenarios, RIDS has been evaluated against two data sets: (a) the DARPA'98 data, and (b) 3 weeks of experimental data generated using the CONEX testbed, running at average Ethernet speeds. RIDS has demonstrably achieved remarkable success; the false positive, false negative and misclassification rates found are low, less than 0.1%, for most reconnaissance attacks; they rise to about 6% for distributed highly stealthy attacks; the latter is a most challenging type of attack, which has been difficult to detect effectively until now. Thus, the RIDS system promises to provide an early warning by detecting the reconnaissance first phase of an impending attack, even if it is very stealthy and distributed.","PeriodicalId":141403,"journal":{"name":"Proceedings from the Fifth Annual IEEE SMC Information Assurance Workshop, 2004.","volume":"90 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2004-06-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116271169","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 1

A biometric authentication approach for high security ad-hoc networks 一种用于高安全性ad-hoc网络的生物识别认证方法

Proceedings from the Fifth Annual IEEE SMC Information Assurance Workshop, 2004. Pub Date : 2004-06-10 DOI: 10.1109/IAW.2004.1437824

Qinghan Xiao

引用次数: 40

Attack attribution in non-cooperative networks 非合作网络中的攻击归因

Proceedings from the Fifth Annual IEEE SMC Information Assurance Workshop, 2004. Pub Date : 2004-06-10 DOI: 10.1109/IAW.2004.1437851

D. Cohen, K. Narayanaswamy

引用次数: 2

Adding the fourth "R" [CERT's model for computer security strategies] 增加第四个“R”[CERT的计算机安全策略模型]

Proceedings from the Fifth Annual IEEE SMC Information Assurance Workshop, 2004. Pub Date : 2004-06-10 DOI: 10.1109/IAW.2004.1437854

B. Endicott-Popovsky, D. Frincke

引用次数: 8

Recursive data mining for masquerade detection and author identification 用于伪装检测和作者识别的递归数据挖掘

Proceedings from the Fifth Annual IEEE SMC Information Assurance Workshop, 2004. Pub Date : 2004-06-10 DOI: 10.1109/IAW.2004.1437848

B. Szymanski, Yongqiang Zhang

{"title":"Recursive data mining for masquerade detection and author identification","authors":"B. Szymanski, Yongqiang Zhang","doi":"10.1109/IAW.2004.1437848","DOIUrl":"https://doi.org/10.1109/IAW.2004.1437848","url":null,"abstract":"In this paper, a novel recursive data mining method based on the simple but powerful model of cognition called a conceptor is introduced and applied to computer security. The method recursively mines a string of symbols by finding frequent patterns, encoding them with unique symbols and rewriting the string using this new coding. We apply this technique to two related but important problems in computer security: (i) masquerade detection to prevent a security attack in which an intruder impersonates a legitimate user to gain access to the resources, and (ii) author identification, in which anonymous or disputed computer session needs to be attributed to one of a set of potential authors. Many methods based on automata theory, hidden Markov models, Bayesian models or even matching algorithms from bioinformatics have been proposed to solve the masquerading detection problem but less work has been done on the author identification. We used recursive data mining to characterize the structure and high-level symbols in user signatures and the monitored sessions. We used one-class SVM to measure the similarity of these two characterizations. We applied weighting prediction scheme to author identification. On the SEA dataset that we used in our experiments, the results were very promising.","PeriodicalId":141403,"journal":{"name":"Proceedings from the Fifth Annual IEEE SMC Information Assurance Workshop, 2004.","volume":"106 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2004-06-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124973186","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 82

Measuring IT security - a method based on common criteria's security functional requirements 度量IT安全性——一种基于通用标准的安全功能需求的方法

Proceedings from the Fifth Annual IEEE SMC Information Assurance Workshop, 2004. Pub Date : 2004-06-10 DOI: 10.1109/IAW.2004.1437821

A. Hunstad, J. Hallberg, R. Andersson

引用次数: 17

Evolution of Inline Network Encryptors toward the High Assurance Internet Protocol Interoperability Specifications (HAIPIS) 内联网络加密器向高保证互联网协议互操作性规范(HAIPIS)的演进

Proceedings from the Fifth Annual IEEE SMC Information Assurance Workshop, 2004. Pub Date : 1900-01-01 DOI: 10.1109/IAW.2004.1437813

J.B. Widby, R. Río, D. Fulton, C. Dunn

{"title":"Evolution of Inline Network Encryptors toward the High Assurance Internet Protocol Interoperability Specifications (HAIPIS)","authors":"J.B. Widby, R. Río, D. Fulton, C. Dunn","doi":"10.1109/IAW.2004.1437813","DOIUrl":"https://doi.org/10.1109/IAW.2004.1437813","url":null,"abstract":"The National Security Agency (NSA) has established new High Assurance Internet Protocol Interoperability Specifications (HAIPIS) that requires different vendor's Inline Network Encryption (INE) devices to be interoperable at a higher level of intelligence. The end result will force the standardization of different encryption algorithms produced by different vendors. The US Army Battle Command Battle Laboratory - Gordon (BCBL(G)) has been entrusted with the responsibility of ensuring that new INEs meet HAIPIS as well as function within the Army's doctrinal concepts and deployment strategies. The BCBL(G) is one of the Army's premier facilities for operational assessments and operational experimentation for new INE devices. The BCBL(G) applies a unique blend of engineers, scientists and analysts to demonstrate, validate and verify INE hardware and software functions. The BCBL(G) provides the ability to rapidly evaluate vendor proposed telecommunication technologies that must be immediately leveraged to the Warfighter in order to maintain information security and tactical information superiority. The history of Army INE development is rich with lessons to be learned. The future of Army INE development is full of new challenges. This paper documents some of the lessons learned and outlines new challenges.","PeriodicalId":141403,"journal":{"name":"Proceedings from the Fifth Annual IEEE SMC Information Assurance Workshop, 2004.","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1900-01-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133848890","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Honeypot forensics 蜜罐取证

Proceedings from the Fifth Annual IEEE SMC Information Assurance Workshop, 2004. Pub Date : 1900-01-01 DOI: 10.1109/iaw.2004.1437793

F. Raynal, Y. Berthier, P. Biondi, D. Kaminsky

引用次数: 26