Intrusion Information Research Articles

Operation Situation Assessment of Intelligent Distribution Station Based on Internet of Things

In order to solve the problem of online monitoring and early warning evaluation of intelligent distribution station, an operation situation assessment of intelligent distribution station based on internet of things is proposed. A multi-source data information matrix is established for the distribution station, and describes the temperature information, humidity information, water intrusion information, smoke information, switch telemetry information, and switch remote control information of the intelligent distribution station within a period of time before the current time. The distribution station multi-source information matrix is quantitatively evaluated through the distribution station multi-source evaluation matrix. Then, the distribution station multi-source evaluation matrix is quantitatively integrated for each column to generate a distribution station multi-source single evaluation matrix. Finally, based on the weighted average method, the distribution station multi-source single evaluation matrix is integrated to generate the distribution station operation situation evaluation index to describe the overall operation situation assessment of intelligent distribution station. The feasibility of the proposed method is verified by the example analysis, which can meet the actual needs of the field project.

Agent based secure intrusion detection and prevention for rushing attacks in clustering MANETs

Intrusion detection is one of challenging issues in wireless networks. The inherently vulnerable characteristics of wireless mobile ad hoc networks make them susceptible to attacks in-spite of some security measures, and it may be too late before any counter action can take effect. As such, there is a need to complement security mechanisms with efficient intrusion detection and response systems. This paper proposes an agent-based model to address the aspect of intrusion detection in cluster based Mobile ad hoc network environment. The model comprises of mobile agents, which are used to detect intrusions, respond to intrusions, mainly preventing the routing attacks while securing them and distributing selected and aggregated intrusion information to all other nodes in the network in an intelligent manner to compensate the attack. The model is simulated to test its operation effectiveness by considering various performance parameters such as, packet delivery ratio, communication overhead, throughput. It implements a secure detection and prevention technique that contains the Blowfish algorithm which is a symmetric encryption and decryption algorithm having a secure standard till date against attacks to make the network transmission secure while monitoring malicious nodes and preventing them from compromising the integrity of the network. Agent based approach facilitates flexible and adaptable security services. Also, it supports component based software engineering components such as maintainability, reachability, reusability, adaptability, and flexibility.

Cluster computing data mining based on massive intrusion interference constraints in hybrid networks

To solve the problem that massive intrusion data in hybrid networks greatly interfere network intrusion detection and cause relatively great difficulty to detection due to their frequency discontinuity, a mining algorithm of massive intrusion cluster computing data in hybrid networks based on spectral feature extraction under fixed constraints of time–frequency window is proposed in this paper. The multi-component cross-detection method is used to collect massive intrusion information in hybrid networks and construct a model of massive intrusion signal in hybrid networks. Cascading notch method is used to suppress intrusion interference under constraints of fixed time–frequency window, and extract fundamental quantity and primary function with locality in massive interference information, and obtain a complete energy distribution spectrum on the time–frequency plane. The energy distribution spectrum is used as guidance function to realize cluster calculating data mining with massive intrusion interference constraints. Simulation results show that, in the intrusion detection process of signal-to-noise ratio from − 15 to − 5 dB, the detection accuracy of the method proposed in this paper is always better than that of others. When the signal-to-noise ratio is − 9 dB, the detection accuracy of this method is over 90%. When the signal-to-noise ratio is −9 dB, the detection accuracy of this method can reach 100%. About the detection time, especially after the Number of intrusion date is 2000, the detection time difference between the three methods is increased, and the detection time of other methods is 2–3 times of paper method. The method proposed can accurately locate mass intrusion distribution sources in hybrid networks under the large frequency oscillation of intrusion data in the hybrid networks, realize network intrusion detection and interference suppression and can filter interference information well, so this method improves intrusion detection probability in hybrid networks.

The Impact of Clustering Mechanism in Dense Wireless Sensor Network

A sensor is a miniature component which gauge physical parameters from the environment. A sensor measures the physical parameters and transmits them either by wired or wireless means. In wireless medium the sensor and its allied components are called as node. A wireless sensor node is self-assured by a processor, local memory, sensors, radio, battery and a base station accountable for receiving and processing data collected by the nodes. The incorporation of multiple types of sensors such as seismic, acoustic, optical, etc., in a single network platform and the evaluation of the overall coverage of the system also presents numerous interesting challenges. The sensor-based military applications involves intrusion detection, perimeter monitoring, information gathering and smart logistics support in an unknown deployed area, sensor-based personal health monitoring, location detection with sensor network and movement detection using wireless sensor network. This paper gives a detailed description about the impact of clustering mechanism in dense wireless sensor network.

An empirical study of staff compliance to information security policy in a South African municipality

Despite increasing investment in information security and its strategic role in today’s business success, effective implementation of information security strategies still remains one of the top challenges facing global organizations. This study investigated Information Security Policy compliance of staff members of a municipality in South Africa. Factors such as information security policy, security policy strategic planning, policy implementation and compliance were considered. A questionnaire was distributed to 80 staff members from different sections in this municipality and a response rate of 100% was achieved. The study findings showed that the majority of employees are largely in support of the municipality’s efforts to develop and implement a security policy framework. They also concur that compliance to security policy safeguards and prevents intrusion information, theft and "denial of service". Among other issues, it is recommended that more training and awareness campaigns should be done to all employees in order to improve security of information in this municipality. The study results can be limited by the small number of the population as indicated that the sample was equal to the population (N=n).

Distributed Honeypots System

Honeypot is a supplemented active defence system for network security. It traps attacks, records intrusion information about tools and activities of the hacking process, and prevents attacks outbound the compromised system. Integrated with other security solutions, Honeypot can solve many traditional dilemmas. It has emerged as a prominent technology that helps learn new hacking techniques from attackers and intruders. Honeypots can initiatively lure hackers to attack the internet, take the record of the ways and means of their invasion, and then analyze and study them.

The Research of Intrusion Detection System Based on ANN on Cloud Platform

Intrusion detection system (IDS) can find the intrusion information before the computer be attacked, and can hold up and response the intrusion in real time. Artificial neural network algorithms play a key role in IDS. The intrusion detection system (ANN) algorithms can analyze the captured data and judge whether the data is intrusion. In this paper we used Back Propagation (BP) network and Radical Basis Function (RBF) network to the IDS. The result of the experiment improve that The RBF neural network is better than BP neural network in the ability of approximation, classification and learning speed. During the procedure there is a large amount of computes. On cloud platform the calculation speed has been greatly increased. So that we can find the invasion more quickly and do the processing works accordingly.

Can It Really Work? Problems with Extending EINSTEIN 3 to Critical Infrastructure

In 2004 the increasing number of attacks on U.S. federal civilian agency computer systems caused the government to begin an active effort to protect federal civilian agencies against cyber intrusions. This classified program, EINSTEIN, sought to do real-time, or near real-time, automatic collection, correlation, and analysis of computer intrusion information as a first step in protecting federal civilian agency computer systems. EINSTEIN grew into a series of programs, EINSTEIN, EINSTEIN 2, and EINSTEIN 3, all based on intrusion-detection and intrusion-prevention systems (IDS and IPS). Then there was public discussion of extending the EINSTEIN system to privately held critical infrastructure.Extending an EINSTEIN-like program to the private sector raises serious technical and managerial issues. Scale matters, as do the different missions of the private sector and the public one. Expanding EINSTEIN-type technology to critical infrastructure is complicated by the complex legal and regulatory landscapes for such systems. There are simply fundamental differences between communication networks supporting the U.S. federal government and those supporting the private-sector critical infrastructures that create serious difficulties in attempting to extend EINSTEIN-type technologies beyond the federal sector. This paper examines the technology's limitations, pointing out the problems involved in expanding EINSTEIN beyond its original mandate.

Network Security Prevention Model Based-Immune

With the concepts of self, nonself, antibody, vaccine and antigen in an intrusion detection and prevention system presented in this paper, the architecture of network intrusion and prevention based on immune principle is proposed. The intrusion information gotten from current monitored network is encapsulated and sent to the neighbor network as bacterin; therefore the neighbor network can make use of the bacterin and predict the danger of network. The experimental results show that the new model not only actualizes an active prevention method but also improves the ability of intrusion detection and prevention than that of the traditional passive intrusion prevention systems.

Policy-based intrusion detection in web applications by monitoring Java information flows

This article focuses on intrusion detection in systems using Web applications and COTS. We present a solution that combines policy-based intrusion detection and information flow control. We describe JBlare, an inline Java monitor that tracks inter-method flows in Java applications. This monitor collaborates with Blare, a monitor that tracks information flow in the whole system at the OS-level. The combination of these two detectors constitutes a policy-based Intrusion Detection System that can address a wide range of attacks.

Combined Path-following and Obstacle Avoidance Control of a Wheeled Robot

This paper proposes an algorithm that drives a unicycle type robot to a desired path, including obstacle avoidance capabilities. The path-following control design relies on Lyapunov theory, backstepping techniques and deals explicitly with vehicle dynamics. Furthermore, it overcomes the initial condition constraints present in a number of path-following control strategies described in the literature. This is done by controlling explicitly the rate of progression of a “virtual target” to be tracked along the path; thus bypassing the problems that arise when the position of the path target point is simply defined as the closest point on the path. The obstacle avoidance part uses the Deformable Virtual Zone (DVZ) principle. This principle defines a safety zone around the vehicle in which the presence of an obstacle induces an “intrusion of information” that drives the vehicle reaction. The overall algorithm is combined with a guidance solution that embeds the path-following requirements in a desired intrusion information function, which steers the vehicle to the desired path while the DVZ ensures minimal contact with the obstacle, implicitly bypassing it. Simulation and experimental results illustrate the performance of the control system proposed.

An Agent Based Intrusion Detection Model for Mobile Ad Hoc Networks

Intrusion detection has over the last few years, assumed paramount importance within the broad realm of network security, more so in case of wireless mobile ad hoc networks. The inherently vulnerable characteristics of wireless mobile ad hoc networks make them susceptible to attacks in‐spite of some security measures, and it may be too late before any counter action can take effect. As such, there is a need to complement traditional security mechanisms with efficient intrusion detection and response systems. This paper proposes an agent‐based model to address the aspect of intrusion detection in cluster based mobile wireless ad hoc network environment. The model comprises of a set of static and mobile agents, which are used to detect intrusions, respond to intrusions, and distribute selected and aggregated intrusion information to all other nodes in the network in an intelligent manner. The model is simulated to test its operation effectiveness by considering the performance parameters such as, detection rate, false positives, agent overheads, and intrusion information distribution time. Agent based approach facilitates flexible and adaptable security services. Also, it supports component based software engineering components such as maintainability, reachability, reusability, adaptability, flexibility, and customization.

Risk Factors to Retrieve Anomaly Intrusion Information and Profile User Behavior

The use of network traffic audit data for retrieving anomaly intrusion information and profiling user behavior has been studied previously, but the risk factors associated with attacks remain unclear. This study aimed to identify a set of robust risk factors via the bootstrap resampling and logistic regression modeling methods based on the KDD-cup 1999 data. Of the 46 examined variables, 16 were identified as robust risk factors, and the classification showed similar performances in sensitivity, specificity, and correctly classified rate in comparison with the KDD-cup 1999 winning results that were based on a rule-based decision tree algorithm with all variables. The study emphasizes that the bootstrap simulation and logistic regression modeling techniques offer a novel approach to understanding and identifying risk factors for better information protection on network security.