确定性树突状细胞算法的异常检测系统

介绍了一种新型的确定性树突状细胞算法,该算法不仅精简了计算开销,同时最大程度地维持了树突状细胞算法的优势.加入抗原提呈同步作为输入算法,使得算法更精确,并把该算法应用于异常检测系统,以实现真正意义上的实时.     

入侵行为分析

从入侵检测的角度来看,"分析"是指对用户和系统活动数据进行有效的组织、整理及特征提取,以鉴别出我们感兴趣的行为。这种行为的鉴别可以实时进行,也可以事后分析。在很多情况下,事后的进一步分析通常是为了搜寻行为的责任人。     

IPV6下基于移动Agent的入侵检测系统研究

在分析传统入侵检测系统的基础上,将移动Agent技术融入入侵检测系统．结合IPV6协议自身的特点,提出了IPV6下基于移动Agent的入侵检测系统模型,并对系统中关键模块进行了详细描述．该系统可以通过移动Agent在主机之间自主迁移分析数据,并及时发现入侵行为．实验证明,该系统具有良好的安全防御性能．     

一种面向软件行为可信性的入侵检测方法

针对现有入侵检测方法的问题,面向软件行为可信需求,提出了一种新的静态检测方法.首先讨论并给出了软件行为可信性的定义和形式化描述,并以指令序列形式进行表示;然后,提出了检测方法和流程,通过数据挖掘方法对恶意软件和正常软件进行行为知识发现,利用发现的行为知识对未知软件进行行为可信性判定;最后,对方法进行了实现,对一些行为模式使用选定的样本进行了实验验证.实验结果表明,该方法能够依据软件行为可信策略检测未知软件中的恶意行为,检测成功率高.     

基于SOM改进的K-Means聚类算法

随着网络技术和相关学科的发展,入侵检测技术日趋成熟.对SOM算法和K-Means算法进行了具体的分析,提出了一种基于SOM和K-Means的使两类算法优点相结合并克服各自不足的聚类算法,提高了聚类信息的精确度、对攻击的识别率和系统的整体性能.     

Using an Improved Clustering Method to Detect Anomaly Activities

In this paper, an improved k-means based clustering method （IKCM） is proposed. By refining the initial cluster centers and adjusting the number of clusters by splitting and merging procedures, it can avoid the algorithm resulting in the situation of locally optimal solution and reduce the number of clusters dependency. The IKCM has been implemented and tested. We perform experiments on KDD-99 data set. The comparison experiments with H-means＋also have been conducted. The results obtained in this study are very encouraging.     

The modified method of upwind with finite difference fractional steps procedure for the numerical simulation and analysis of seawater intrusion

Numerical simulation and analysis of seawater intrusion is the mathematical basis for modern environmental science. Its mathematical model is the nonlinear coupled system of partial differential equations with initial-boundary problems. For a generic case of a three-dimensional bounded region, the modified method of upwind with finite difference fractional steps procedure is put forward. Optimal order estimates in L² norm are derived for the error in the approximation solution. The present method has been successfully used in predicting the consequences of seawater intrusion and protection projects.     

An Useful Communication Mechanism for Distributed Agents-Based Intrusion Detection System

The communication mechanism plays an important role in an intrusion detection system, while it has not been paid enough attention. Based on analyzing the actual facts and expatiating upon the requirements a communication mechanism needs to meet, a message driven communication mechanism is proposed in this paper. The protocol presented here is divided into three layers： entity level, host level, and network level. The communication processes are also designed in detail. Experiments illustrate that cooperative entities can detect distributed sophisticated attacks accurately. Furthermore, this mechanism has the advantages like high reliability, low time delay and expenses.     

一种自适应的分布式微防火墙系统

针对传统防火墙存在的不能防内部攻击、单一失效点等问题，提出了一种自适应的分布式微防火墙体系结构。在该体系结构中，基于包过滤的微防火墙运行在受保护实体上，并与微入侵检测系统一起提供双重细粒度的安全保护；分布式微入侵检测系统提供层次响应和自适应功能；移动代理系统实现了安全策略的动态更新，并提高了整个系统的可扩展性。