Study on security enhancement technology for disaster tolerant system

This paper proposes a security enhancement scheme for disaster tolerant system based on trusted computing technology which combines with the idea of distributed threshold storage. This scheme takes advantage of trusted computing platform with trusted computing module, which is provided with such excellent features as security storage, remote attestation, and so on. Those features effectively ensure trustworthiness of disaster tolerant point. Furthermore, distributed storage based on Erasure code not only disposes the storage problem about a great deal of data, but also preferably avoids one node invalidation, alleviates network load and deals with joint cheat and many other security problems. Consequently, those security enhancement technologies provide mass data with global security protection during the course of disaster tolerance. Foundation Items: Supported by the National High Technology Research and Development Program of China (863 Program) (2008AA01Z404), the Science and Technical Key Project of Ministry of Education (108087) and the Scientific and Technological Project of Wuhan City (200810321130)     

一种基于秘密共享的容侵CA方案

基于Feldman可验证秘密共享技术和零知识证明方法,提出了一种计算上安全的数字签名方案,并在此基础上提出了一个容忍入侵的CA方案;通过对CA系统的可用性、机密性和抗假冒服务器攻击等方面的分析,得知方案较为完善.     

基于危险理论的入侵检测系统模型

入侵检测是网络安全技术研究中热点问题之一．现有入侵检测系统模型大多报警量巨大,另外不能对系统当前所面临的攻击进行实时定量危险评估,为解决这两个问题,提出了一种基于危险理论的入侵检测系统模型DTIDS．对网络活动中自体、非自体、免疫细胞、记忆检测器、成熟检测器和未成熟检测器进行了形式化描述,建立了主机实时危险定量计算方程...     

Web服务的多层入侵容忍机制

Web服务通过互联网向公众提供各种服务,其存在的漏洞容易受到攻击.攻击会导致许多恶意操作或故障,致使Web服务器无法正常工作或发生安全事件.确保服务器的安全性,以保障系统数据和服务的私密性、完整性及可用性.Web服务的多层入侵容忍机制,结合传统安全技术和容忍技术在服务器前和在服务器结构内部署不同传感器,侦测各请求对服务器的影响.对不同安全级别的请求提供相应的服务,并一定程度上容忍非正常请求的存在.在Web服务系统上提供有效的深度防御,提高Web服务器对入侵、攻击的适应能力,即使发生严重事件也能及时恢复Web服务.不会因存在入侵、故障而停止服务,从而提高Web服务器的生存能力.     

基于危险模式免疫算法的入侵检测系统模型

阐述了危险模式的概况及运行机理,建立了一种新型的基于危险模式免疫算法的入侵检测系统模型,系统突出地显出其处理的高效性以及自适应进化更新能力,该方法的提出给安全领域提供了一种新的研究思路。     

基于流量分析的入侵检测系统研究

随着网络技术发展,信息系统的安全性日益成为政府、企业及事业部门越来越关注的重大问题,保障信息系统的安全性已经成为迫切的需要.现有的网络安全系统多采用基于规则入侵检测技术,因而误报率较高;本文根据对边检入侵检测系统测量分析的基础上提出基于流量的边检入侵检测系统,通过量化分析来预测入侵和DDOS攻击,从而保证网络的安全性.     

A trusted environment construction method for security-sensitive software

This paper presents a trusted-environment construction method based on the underlying hardware.This method aims at protecting the security-sensitive software in the aspects of software loading,running,and storing in the general operating system.It extends the trust chain of the traditional trusted computing technology to reach the target software,ensuring trusted loading.The extended memory management mechanism effectively prevents memory dumping and memory tampering for the high-sensitivity data.The file monitoring mechanism protects files from vicious operation made by attackers.Flexible-expanded storage environment provides the target software with static storing protection.Experimental system verifies that the method is suitable for general operating system and can effectively protect security-sensitive software with low overhead.     

Immune recognition method based on analogy reasoning in intrusion detection system

In this paper, we propose an analogy based immune recognition method that focuses on the implement of the clone selection process and the negative selection process by means of analogy similarity. This method is applied in an IDS （Intrusion Detection System） following several steps. Firstly, the initial abnormal behaviours sample set is optimized through the combining of the AIS （Artificial Immune System） and the genetic algorithm. Then, the abnormity probability algorithm is raised considering the two sides of abnormality and normality. Finally, an intrusion detection system model is established based on the above algorithms and models.     

An adaptive handoff management for fault tolerant mobile computing

<正> Due to the mobility of mobile hosts,checkpoints and message logs of the computing process may disperseover different mobile support stations in the checkpointing and rollback recovery protocol for mobilecomputing.Three existing checkpoint handoff schemes do not give well consideration to the efficiency offailure-free process execution and the recovery speed of the failure process at the same time.A dynamicadaptive handoff management of the checkpointing and rollback recovery protocol for mobile computing isproposed in this paper.According to the individual feature and current state of each mobile host,differentimplementations are selected dynamically to complete the handoff process upon the handoff event.Performance analyses show that the proposed handoff management incurs a low loss of performance duringfailure-free and achieves a quick recovery upon the process fault.     

基于通用入侵规范下网络入侵检测系统的研究

文章详细描述了基于通用入侵规范下网络入侵检测系统的体系结构,通过实例说明了入侵描述语言,深 入剖析通用入侵规范下的内部通信机制及其程序接口规范．     

自律式容侵安全数据库模型

针对当前入侵容忍的数据库系统缺乏自适应能力的问题,采用了将自律计算、入侵容忍与传统数据库安全相结合的方法,提出了一个自律式容侵安全数据库模型.通过对数据库运行状态集的实时监测,自主评价访问可信度并对可疑访问进行自适应分流,并将高危访问进行特征分析并施加安全策略,最终保障数据库的安全运行.实验数据表明,该模型对本地和网络攻击可以实现有效稳定抵御,对于国家机构的数据管理、大型企业的管理控制等安全级别要求较高的领域有着重要的意义和价值.     

Network intrusion detection

Nowadays, network computer systems play an increasingly important role in society and economy. They have become the targets of a wide array of malicious attacks that invariably turn into actual intrusions. This is why the computer security has become an essential concern for network administrators. Too often, intrusions wreak havoc inside LANs and the time and cost to repair the damage can grow to extreme proportions. Instead of using passive measures to fix and patch security holes once they have been exploited, it is more effective to adopt a protective approach to intrusions. In addition to the well-established intrusion prevention techniques such as data encryption and message integrity, user authentication and user authorization, as well as the avoidance of security flaws inherent to many off-the-shelf applications, intrusion detection techniques can be viewed as an addition safeguard for network computers. The paper discusses traditional and new security designs, the approach to implementing best-practice security measures and the method to trace the malicious computer attackers.     

基于移动代理的入侵响应系统研究

首先介绍了当前入侵响应机制及其不足,提出了一个基于移动代理的入侵响应系统.在此基础上,详细介绍了各实体的功能特性及系统的运作.最后讨论了系统的特点和尚待改进的方向.     

Immune Based Intrusion Detector Generating Algorithm

Immune-based intrusion detection approaches are studied. The methods of constructing self set and generating mature detectors are researched and improved. A binary encoding based self set construction method is applied. First, the traditional mature detector generating algorithm is improved to generate mature detectors and detect intrusions faster. Then, a novel mature detector generating algorithm is proposed based on the negative selection mechanism. According to the algorithm, less mature detectors are needed to detect the abnormal activities in the network. Therefore, the speed of generating mature detectors and intrusion detection is improved. By comparing with those based on existing algorithms, the intrusion detection system based on the algorithm has higher speed and accuracy.     

串匹配型入侵检测系统的改进

针对当前串匹配型入侵检测系统普遍面临的误报率漏报率高、自身的性能难以适应快速增长的网络流量需求等问题，本文以提高检测的速度和准确率为目的对串匹配型入侵检测系统进行分析，从串匹配算法、规则库结构等方面对其进行改进，并提出了具体的方案。     

一种基于移动Agent的分布式入侵检测系统

由于当前单纯基于主机和基于网络的入侵检测系统的局限性,使得基于移动Agent的分布式入侵检测技术显得日益重要。本文从讨论基于主机和基于网络的入侵检测系统的局限性出发,阐述了分布式入侵检测系统和移动Agent技术,提出了一种基于移动Agent的分布式入侵检测系统模型,并对模型进行了详细分析和设计。     

应用支持向量机实现分布式入侵检测

描述了一种应用支持向量机构建的分布式入侵检测系统模型 ,介绍了支持向量机的机器学习原理、训练过程以及在线检测流程 .仿真结果表明系统提高了对未知入侵的检测能力     

基于Mobile Agents的新型分布式入侵检测系统

在分析一般入侵检测方法的基础上 ,提出了一种新的基于MobileAgent (MA)的分布式入侵检测方法 .该方法兼顾了原有的优点 ,并在一定程度上弥补了原有方法的不足 .重点讨论了MA在入侵检测系统中的应用 ,叙述了如何通过MAs之间的协作进行入侵检测 ,并利用MA的特性对入侵检测系统本身的安全性和抗毁灭性做了具体的论述 .提出的入侵检测结构提高了系统的抗毁性和自恢复能力 ,提高了入侵检测系统自身的安全性 .说明了系统的体系结构、工作原理以及该系统的优越之处     

基于移动Agent的分布式入侵检测系统

简要介绍了入侵检测系统的作用 ,分析了传统的集中式入侵检测技术存在的问题 ,提出了一个基于移动Agent的入侵检测系统的模型 ,并着重探讨了其移动 Agent自身的安全性