12614266
SVision: A Network Host-Centered Anomaly Visualization Technique
We proposed a technique merged from a combination of both anomaly and graphical methods, for intrusion detection. The network is pictured as a community of hosts that exchange messages among themselves. Our aim is to graphically highlight those hosts that represent a possible threat for the network, so that a network administrator will be able to further explore the anomaly and decide upon the responses that are appropriate. We choose to test our view against the DARPA 99 intrusion detection and evaluation dataset since it provides labels which we can use to monitor our system. Experiments show our visualization technique as a possible alternative for detection of network intrusions, in particular Denial of Service (DoS) and Distributed-DoS attacks such as Ping Of Death, UDP storm, SSH Process Table, and Smurf, to name a few.
4515160
Alert Correlation for Extracting Attack Strategies
Alert correlation is an important technique for managing large the volume of intrusion alerts that are raised by heterogenous Intrusion Detection Systems (IDSs). The recent trend of research in this area is towards extracting attack strategies from raw intrusion alerts. It is generally believed that pure intrusion detection no longer can satisfy the security needs of organizations. Intrusion response and prevention are now becoming crucially important for protecting the network and minimizing damage. Knowing the real security situation of a network and the strategies used by the attackers enables network administrators to launches appropriate response to stop attacks and prevent them from escalating. This is also the primary goal of using alert correlation technique. However, most of the current alert correlation techniques only focus on clustering inter-connected alerts into different groups without further analyzing the strategies of the attackers. Some techniques for extracting attack strategies have been proposed in recent years, but they normally require defining a larger number of rules. This paper focuses on developing a new alert correlation technique that can help to automatically extract attack strategies from a large volume of intrusion alerts, without specific prior knowledge about these alerts. The proposed approach is based on two different neural network approaches, namely, Multilayer Perceptron (MLP) and Support Vector Machine (SVM). The probabilistic output of these two methods is used to determine with which previous alerts this current alert should be correlated. This suggests the causal relationship of two alerts, which is helpful for constructing attack scenarios. One of the distinguishing feature of the proposed technique is that an Alert Correlation Matrix (ACM) is used to store correlation strengthes of any two types of alerts. ACM is updated in the training process, and the information (correlation strength) is then used for extracting high level attack strategies.
7138915
A novel visualization technique for network anomaly detection
Visualized information is a technique that can encode large amounts of complex interrelated data, being at the same time easily quantified, manipulated, and processed by a human user. Our aim is to develop a novel graphical technique for network traffic visualization that will easily highlight anomalies that can arise within the network. In our work we are exclusively concerned with all the information that can be extracted at the network layer (e.g., from the TCP/IP datagram). We choose to use the Darpa 1999 database given the fact that all the intrusions are labeled and we can easily observe the visualization behavior while the network is under attack. Although applied to a dataset, the visualization technique can work on-line in a network because it only uses data that can be extracted in a real-time manner. Experiments show our visualization technique to be a good medium when trying to identify possible anomalies of the network such as:DoS types of attacks (e.g.,Smurfand Mailbomb) as well as probing attacks (e.g.,Portsweepand IPsweep).
770502
Visualizing the archive of a computer mediated communication process
The archive of computer-mediated communication (CMC) process contains knowledge shared and information about participants' behavior patterns. However, most CMC systems focus only on organizing the content of discussions. We propose to demo a prototype system that integrates a social visualization technique with existing information analysis technologies to graphically summarize both the content and behavior of a CMC process.
2946583
Visualizing a computer mediated communication (CMC) process to facilitate knowledge management
The archive of a computer-mediated communication (CMC) process contains knowledge shared and implicit information about participants' behavior patterns during discussion. However, most CMC systems focus only on organizing the content of discussions. On the other hand, the social visualization research has developed techniques to depict human behaviors during a process of CMC but has not been integrated in any organizational memory system yet. In addition, the impacts of the graphical representations created by social visualization techniques have seldom been studied. The dissertation thus proposes a two-phase research to address those issues. The first phase proposes a prototype system that integrates a social visualization technique with various information analysis technologies to graphically summarize both the content and behavior of a CMC process. The second phase proposes to adopt the "de-featuring" approach used by previous interface evaluation studies to evaluate how the graphical interface developed affects users' information acquisition and evaluation process.
14599346
Generating Test Case from Functional Requirement of Web Applications
E-commerce has been developing rapidly around the world. We run Web application to support e-commerce. Quality of Web applications influences the functionalities and security of e-commerce. Modeling and testing are important to Quality of Web applications. Many researchers are still to find effective ways to model and test Web applications. Formal methods can improve the quality of Web applications. This paper suggests utilizing a formal language (object-z to) describe functional requirement of Web applications. An approach to generating test sequence is introduced in this paper. We analyze formal specification to find out atomic operations and then identify the environment precondition of the operation (EPRE) for each atomic operation. We use EPREs to build an environment Transition Graph (ETG). The steps of transforming an ETG into environment transition sequences are also addressed. Two test adequacy criteria are defined as a guideline for the selection of the test sequences.
16961887
Newsmap: a knowledge map for online news
Information technology has made possible the capture and accessing of a large number of data and knowledge bases, which in turn has brought about the problem of information overload. Text mining to turn textual information into knowledge has become a very active research area, but much of the research remains restricted to the English language. Due to the differences in linguistic characteristics and methods of natural language processing, many existing text analysis approaches have yet to be shown to be useful for the Chinese language. This research focuses on the automatic generation of a hierarchical knowledge map NewsMap, based on online Chinese news, particularly the finance and health sections. Whether in print or online, news still represents one important knowledge source that people produce and consume on a daily basis. The hierarchical knowledge map can be used as a tool for browsing business intelligence and medical knowledge hidden in news articles. In order to assess the quality of the map, an empirical study was conducted which shows that the categories of the hierarchical knowledge map generated by NewsMap are better than those generated by regular news readers, both in terms of recall and precision, on the sub-level categories but not on the top-level categories. NewsMap employs an improved interface combining a ID alphabetical hierarchical list and a 2D Self-Organizing Map (SOM) island display. Another empirical study compared the two visualization displays and found that users' performances can be improved by taking advantage of the visual cues of the 2D SOM display.
27551113
Creating a Large-Scale Digital Library for Georeferenced Information