Huiqiang Wang

Network security situation awareness based on heterogeneous multi-sensor data fusion and neural network

Network Security Situation Awareness (NSSA) is a hot research realm in the area of network security, which helps security analysts to solve the challenges they encounter. This paper mainly focuses on a NSSA which is based on heterogeneous multi-sensor data fusion using neural network. We designed a NSSA model and discussed it in detail. We adopted Snort and NetFlow as sensors to gather real network traffic and fused them using a multi-layer feed-forward neural network that can solve a multi-class problem. We presented an effective and simple feature reduction approach to decrease the input vector and improve the real-time characteristic of fusion engine. In addition, we described a situation generation mechanism in order to provide the real security situation of the monitored networks. Our model is proved to be feasible and effective through a series of experiments, using real network traffic.

WNN-based network security situation quantitative prediction method and its optimization

The accurate and real-time prediction of network security situation is the premise and basis of preventing intrusions and attacks in a large-scale network. In order to predict the security situation more accurately, a quantitative prediction method of network security situation based on Wavelet Neural Network with Genetic Algorithm (GAWNN) is proposed. After analyzing the past and the current network security situation in detail, we build a network security situation prediction model based on wavelet neural network that is optimized by the improved genetic algorithm and then adopt GAWNN to predict the non-linear time series of network security situation. Simulation experiments prove that the proposed method has advantages over Wavelet Neural Network (WNN) method and Back Propagation Neural Network (BPNN) method with the same architecture in convergence speed, functional approximation and prediction accuracy. What is more, system security tendency and laws by which security analyzers and administrators can adjust security policies in near real-time are revealed from the prediction results as early as possible.

Intrusion detection based on hidden Markov model

The intrusion detection technologies of the network security are researched, and the technologies of pattern recognition are used to intrusion detection. Intrusion detection rely on a wide variety of observable data to distinguish between legitimate and illegitimate activities. Hidden Markov Model (HMM) has been successfully used in speech recognition and some classification areas. Since Anomaly Intrusion Detection can be treated as a classification problem, some basic ideas have been proposed on using HMM to model normal behavior. The experiments have showed that the method based on HMM is effective to detect anomalistic behaviors.

A new automatic intrusion response taxonomy and its application

The response taxonomy is a key to realizing automatic an intrusion response system as it provides theoretical framework for responding coherently to attacks. This paper presents a new taxonomy called 5W2H on the basis of analyzing the taxonomies, and the application prototype running over IBM Aglet is given.

Multiclass Support Vector Machines Theory and Its Data Fusion Application in Network Security Situation Awareness

Network security situation awareness (NSSA) is an emerging technique in the field of network security and helps administrators to monitor the actual security situation of their networks. This paper mainly focuses on NSSA based on heterogeneous multisensor data fusion. We presented a model which adopted Snort and NetFlow as sensors to gather data from real network traffic. We employed Support Vector Machines as the fusion engine of our model and used efficient feature reduction approach to fuse the gathered data from heterogeneous sensors. Furthermore, we discussed the alert aggregation and security awareness generation techniques detailedly. Our model is proved to be feasible and effective through a series of experiments.

Quantification of Network Security Situational Awareness Based on Evolutionary Neural Network

The proposal of network security situational awareness (NSSA) research means a breakthrough and an innovation to the traditional network security technologies, and it has become a new hot research topic in network security field. Combined with evolutionary strategy and neural network, a quantitative method of network security situational awareness is proposed in this paper. Evolutionary strategy is used to optimize the parameters of neural network, and then the evolutionary neural network model is established to extract the network security situational factors, so the quantification of network security situation is achieved. Finally simulated experiment is done to validate that the evolutionary neural network model can extract situational factors and the model has better generalization ability, which supports the network security technical technologies greatly.

ERAS - an Emergency Response Algorithm for Survivability of Critical Services

Survivability has emerged as a new phase for the development of network security technique, and how to improve the system survivability using effective technique is an important problem. This paper takes the requirement of emergency response as its research background, and a new algorithm is proposed based on resource reconfiguration. The algorithm focuses on the time of emergency response and the number of preempted non-critical service. By establishing a model based on the two limiting conditions and exploring the solution, we find the feasible scheme. An instance is given to show that the algorithm can ensure the durative running of critical services, and it is a valid technique for survivability

Speech enhancement in short-wave channel based on ICA in empirical mode decomposition domain

It is well known that the non-stationary noise is the most difficult to be removed in speech enhancement. In this paper a novel speech enhancement algorithm based on the empirical mode decomposition (EMD) and then ICA is proposed to suppress the non-stationary noise. The noisy speech is decomposed into components by the EMD and ICA-based vector space, and the components are processed and reconstructed, respectively, by distinguishing between voiced speech and unvoiced speech. There are no requirements of noise whitening and SNR pre-calculating. Experiments show that the proposed method performs well suppressing of the non-stationary noise in short-wave channel for speech enhancement.

Autonomic failure prediction based on manifold learning for large-scale distributed systems

Abstract This article investigates autonomic failure prediction in large-scale distributed systems with nonlinear dimensionality reduction to automatically extract failure features. Most existing methods for failure prediction focus on building prediction models or heuristic rules by discovering failure patterns, but the process of feature extraction before failure patterns recognition is rarely considered due to the increasing complexity of modern distributed systems. In this work, a novel performance-centric approach to automate failure prediction is proposed based on manifold learning (ML). In addition, the ML algorithm named supervised locally linear embedding (SLLE) is applied to achieve feature extraction. To generalize the dimensionality reduction mapping, the nonlinear mapping approximation and optimization solution is also proposed. In experimental work a file transfer test bed with fault injection is developed which can gather multilevel performance metrics transparently. Based on the runtime monitoring of these metrics, the SLLE method can automatically predict more than 50% of the central processing unit (CPU) and memory failures, and around 70% of the network failure.

Heterogeneous Multi-Sensor Data Fusion with Multi-Class Support Vector Machines: Creating Network Security Situation Awareness

Multi-sensor data fusion and network situation awareness are emerging technique in the field of network security and they help administrators to be aware of the actual security situation of their networks. This paper mainly focuses on heterogeneous multi-sensor data fusion and situation awareness. We adopted Snort and NetFlow collector as two sensors to gather real network traffic and fused them use multi-class support vector machines that could solve a multi class problem. In order to avoid dimension disaster, we employed an effective feature reduction approach to decrease the dimension of input vector and the computation time of support vector machines that improved fusion performance and real time characteristic. Our framework is proved to be feasible and effective and has better performance than neural network through a series of experiments that using real network traffic.