4515160
Alert Correlation for Extracting Attack Strategies
Alert correlation is an important technique for managing large the volume of intrusion alerts that are raised by heterogenous Intrusion Detection Systems (IDSs). The recent trend of research in this area is towards extracting attack strategies from raw intrusion alerts. It is generally believed that pure intrusion detection no longer can satisfy the security needs of organizations. Intrusion response and prevention are now becoming crucially important for protecting the network and minimizing damage. Knowing the real security situation of a network and the strategies used by the attackers enables network administrators to launches appropriate response to stop attacks and prevent them from escalating. This is also the primary goal of using alert correlation technique. However, most of the current alert correlation techniques only focus on clustering inter-connected alerts into different groups without further analyzing the strategies of the attackers. Some techniques for extracting attack strategies have been proposed in recent years, but they normally require defining a larger number of rules. This paper focuses on developing a new alert correlation technique that can help to automatically extract attack strategies from a large volume of intrusion alerts, without specific prior knowledge about these alerts. The proposed approach is based on two different neural network approaches, namely, Multilayer Perceptron (MLP) and Support Vector Machine (SVM). The probabilistic output of these two methods is used to determine with which previous alerts this current alert should be correlated. This suggests the causal relationship of two alerts, which is helpful for constructing attack scenarios. One of the distinguishing feature of the proposed technique is that an Alert Correlation Matrix (ACM) is used to store correlation strengthes of any two types of alerts. ACM is updated in the training process, and the information (correlation strength) is then used for extracting high level attack strategies.
7138915
A novel visualization technique for network anomaly detection
Visualized information is a technique that can encode large amounts of complex interrelated data, being at the same time easily quantified, manipulated, and processed by a human user. Our aim is to develop a novel graphical technique for network traffic visualization that will easily highlight anomalies that can arise within the network. In our work we are exclusively concerned with all the information that can be extracted at the network layer (e.g., from the TCP/IP datagram). We choose to use the Darpa 1999 database given the fact that all the intrusions are labeled and we can easily observe the visualization behavior while the network is under attack. Although applied to a dataset, the visualization technique can work on-line in a network because it only uses data that can be extracted in a real-time manner. Experiments show our visualization technique to be a good medium when trying to identify possible anomalies of the network such as:DoS types of attacks (e.g.,Smurfand Mailbomb) as well as probing attacks (e.g.,Portsweepand IPsweep).
2946583
Visualizing a computer mediated communication (CMC) process to facilitate knowledge management
The archive of a computer-mediated communication (CMC) process contains knowledge shared and implicit information about participants' behavior patterns during discussion. However, most CMC systems focus only on organizing the content of discussions. On the other hand, the social visualization research has developed techniques to depict human behaviors during a process of CMC but has not been integrated in any organizational memory system yet. In addition, the impacts of the graphical representations created by social visualization techniques have seldom been studied. The dissertation thus proposes a two-phase research to address those issues. The first phase proposes a prototype system that integrates a social visualization technique with various information analysis technologies to graphically summarize both the content and behavior of a CMC process. The second phase proposes to adopt the "de-featuring" approach used by previous interface evaluation studies to evaluate how the graphical interface developed affects users' information acquisition and evaluation process.
12364749
A Note on the Cramer-Damgård Identification Scheme
In light of the recent work of Micali and Reyzin on showing the subtleties and complexities of the soundness notions of zero-knowledge (ZK) protocols when the verifier has his public-key, we re-investigate the Cramer-Damgard intended-verifier identification scheme and show two man-in-the-middle attacks in some reasonable settings: one simple replaying attack and one ingenious interleaving attack. Our attacks are independent of the underlying hardness assumptions assumed.
14972252
Image coding with wavelet representations, edge information and visual masking
The wavelet transform provides a multiresolution representation of images. Edges, which are visually important, produce large coefficients across several scales in the wavelet transform domain. By tracking and predicting these edge coefficients across scales in the wavelet transform domain, we can greatly improve the compressed image quality with little degradation in compression ratio. This paper proposes a novel model-based edge tracking and prediction in the wavelet domain. It separates textures from edges and codes them differently. Edges are coded via an edge tracking and prediction, while textures are coded with either ordinary wavelet based image coding techniques or a "wavelet-like" filter bank which is similar to the tuning channels in the human vision system. The coding noise is then coded with a noise modelling. Visual masking models are also used to ensure the compressed image has little or almost no perceptual distortion.
19870915
Research on Network-Based Collaborative Commodity Development
In this paper, a detailed method is proposed to make the transformation of a product model to a commodity model. A collaborative commodity development theory based on the three properties of physical, energy and information is proposed. An integrated model composed of four sub-models is analyzed: designing sub-model, supplying sub-model, managing sub-model, and profit sub-model. The key techniques in the system development are discussed, including the network-based parts application technology and the commercial model optimization and evaluation technology. For the former, a search engine using the functional agent technology for network-based parts searching is described. A prototype system has been implemented to validate the proposed approach.
17379626
Validating a geographical image retrieval system
This paper summarizes a prototype geographical image retrieval system that demonstrates how to integrate image processing and information analysis techniques to support large-scale content-based image retrieval. By using an image as its interface, the prototype system addresses a troublesome aspect of traditional retrieval models, which require users to have complete knowledge of the low-level features of an image. In addition we describe an experiment to validate the performance of this image retrieval system against that of human subjects in an effort to address the scarcity of research evaluating performance of an algorithm against that of human beings. The results of the experiment indicate that the system could do as well as human subjects in accomplishing the tasks of similarity analysis and image categorization. We also found that under some circumstances texture features of an image are insufficient to represent a geographic image. We believe, however, that our image retrieval system provides a promising approach to integrating image processing techniques and information retrieval algorithms.