Proceedings from the Sixth Annual IEEE SMC Information Assurance Workshop最新文献_第5页

Incorporating vendor-based training into security courses 将基于供应商的培训纳入安全课程

Proceedings from the Sixth Annual IEEE SMC Information Assurance Workshop Pub Date : 2005-06-15 DOI: 10.1109/IAW.2005.1495949

H. Armstrong, I. Murray

引用次数: 4

Multispectral fingerprint biometrics 多光谱指纹生物识别

Proceedings from the Sixth Annual IEEE SMC Information Assurance Workshop Pub Date : 2005-06-15 DOI: 10.1109/IAW.2005.1495928

R. K. Rowe, K. A. Nixon, S. P. Corcoran

{"title":"Multispectral fingerprint biometrics","authors":"R. K. Rowe, K. A. Nixon, S. P. Corcoran","doi":"10.1109/IAW.2005.1495928","DOIUrl":"https://doi.org/10.1109/IAW.2005.1495928","url":null,"abstract":"A novel fingerprint sensor is described that combines a multispectral imager (MSI) with a conventional optical fingerprint sensor. The goal of this combination is a fingerprint sensor with improved usability and security relative to standard technology. The conventional sensor that was used in this research is a commercially available system based on total internal reflectance (TIR). It was modified to accommodate an MSI sensor in such a way that both MSI and TIR images are able to be collected when a user places his/her finger on the sensor platen. The MSI data were preprocessed to enhance fingerprint features. Both the preprocessed MSI images and the TIR images were then passed to a commercial fingerprint software package for minutiae detection and matching. A multiperson study was conducted to test the relative performance characteristics of the two types of finger data under typical office conditions. Results demonstrated that the TIR sensor performance was degraded by a large number of poor quality fingerprint images, likely due to a large percentage of samples taken on people with notably dry skin. The corresponding MSI data showed no such degradation and produced significantly better results. A selective combination of both modalities is shown to offer the potential of further performance improvements.","PeriodicalId":252208,"journal":{"name":"Proceedings from the Sixth Annual IEEE SMC Information Assurance Workshop","volume":"9 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2005-06-15","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128200661","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 54

Molehunt: near-line semantic activity tracing Molehunt:近行语义活动跟踪

Proceedings from the Sixth Annual IEEE SMC Information Assurance Workshop Pub Date : 2005-06-15 DOI: 10.1109/IAW.2005.1495981

S. Wolthusen

引用次数: 2

Net force maneuver - a JTF-GNO construct 净兵力机动，JTF-GNO结构

Proceedings from the Sixth Annual IEEE SMC Information Assurance Workshop Pub Date : 2005-06-15 DOI: 10.1109/IAW.2005.1495982

C. Hunt, J. R. Bowes, D. Gardner

引用次数: 1

Security risk metrics: fusing enterprise objectives and vulnerabilities 安全风险度量:融合企业目标和漏洞

Proceedings from the Sixth Annual IEEE SMC Information Assurance Workshop Pub Date : 2005-06-15 DOI: 10.1109/IAW.2005.1495978

K. Clark, J. Dawkins, John Hale

引用次数: 15

Theoretical basis for intrusion detection 入侵检测的理论基础

Proceedings from the Sixth Annual IEEE SMC Information Assurance Workshop Pub Date : 2005-06-15 DOI: 10.1109/IAW.2005.1495951

Zhuowei Li, A. Das, Jianying Zhou

引用次数: 64

A policy based architecture for NSA RAdAC model NSA RAdAC模型的基于策略的体系结构

Proceedings from the Sixth Annual IEEE SMC Information Assurance Workshop Pub Date : 2005-06-15 DOI: 10.1109/IAW.2005.1495966

Rahim Choudhary

引用次数: 21

Real-time identification of anomalous packet payloads for network intrusion detection 实时识别网络入侵检测中的异常数据包载荷

Proceedings from the Sixth Annual IEEE SMC Information Assurance Workshop Pub Date : 2005-06-15 DOI: 10.1109/IAW.2005.1495995

N. Nwanze, D. Summerville, V. Skormin

引用次数: 4

A comparison of system call feature representations for insider threat detection 内部威胁检测系统调用特征表示的比较

Proceedings from the Sixth Annual IEEE SMC Information Assurance Workshop Pub Date : 2005-06-15 DOI: 10.1109/IAW.2005.1495972

Alexander Liu, Cheryl E. Martin, Tom Hetherington, Sara Matzner

{"title":"A comparison of system call feature representations for insider threat detection","authors":"Alexander Liu, Cheryl E. Martin, Tom Hetherington, Sara Matzner","doi":"10.1109/IAW.2005.1495972","DOIUrl":"https://doi.org/10.1109/IAW.2005.1495972","url":null,"abstract":"This paper investigates anomaly detection techniques that have been successful for detecting external threats and applies them to the insider threat problem. The \"insider threat\" involves the actions of a trusted and privileged user who is inappropriately accessing or disseminating sensitive information or otherwise compromising information systems. In contrast, the \"external threat\" involves the actions of an outsider attempting to compromise or gain access to the information systems. Although approaches for automatically detecting external threat instances have been quite successful (i.e., intrusion detection systems), there is very little similar work for the insider threat. In the past, anomaly detection systems have proven useful for detecting external threat. Anomaly detection at the system call level offers a high degree of information assurance in terms of tamper-resistance and system activity coverage. Therefore, we investigate three system-call-based feature representations: n-grams of system call names, histograms of system call names, and individual system calls with associated parameters. We find that none of these representations consistently performs as well when dealing with the internal threat as previous results show for external threat detection. However, parameter-based features for certain system calls do show some sensitivity to detecting the insider threat, and we plan to explore and enhance this sensitivity in future work.","PeriodicalId":252208,"journal":{"name":"Proceedings from the Sixth Annual IEEE SMC Information Assurance Workshop","volume":"50 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2005-06-15","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130935017","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 93

Heavy tails and temporal correlations of processing times in network intrusion detection: characterization and consequences 网络入侵检测中处理时间的重尾和时间相关性:表征和后果

Proceedings from the Sixth Annual IEEE SMC Information Assurance Workshop Pub Date : 2005-06-15 DOI: 10.1109/IAW.2005.1495941

Joiio B. D. Cabrera, Wenke Lee, ykumar Gasar, R. Mehra

{"title":"Heavy tails and temporal correlations of processing times in network intrusion detection: characterization and consequences","authors":"Joiio B. D. Cabrera, Wenke Lee, ykumar Gasar, R. Mehra","doi":"10.1109/IAW.2005.1495941","DOIUrl":"https://doi.org/10.1109/IAW.2005.1495941","url":null,"abstract":"This paper examines two aspects of network intrusion detection which have critical relevance for the configuration (understood as allocation of memory and CPU) of intrusion detection systems (IDSs) hosts and for their operational performance: the presence of heavy tails in the service times for the preprocessing stage, and the presence of substantial temporal correlations in the service times for the content matching stage. Concerning heavy tails in preprocessing, our study reveals that snort preprocessing times give rise to a cumulative distribution function which is extremely heavy-tailed. Concerning temporal correlations, our analysis reveals that payload processing times evolve in two time scales: a fast time scale and a slow time scale. The fast, packet-to-packet time scale corresponds to 40-100 contiguous packets (a packet group), within which the content matching times are independent. In the slow, packet group-to-packet group time scale the mean values of the successive packet groups are heavily correlated and can be predicted. The consequences of the two phenomena are examined in the paper.","PeriodicalId":252208,"journal":{"name":"Proceedings from the Sixth Annual IEEE SMC Information Assurance Workshop","volume":"15 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2005-06-15","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126111899","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0