Izzeldin M. Osman

Alert correlation in collaborative intelligent intrusion detection systems-A survey

As complete prevention of computer attacks is not possible, intrusion detection systems (IDSs) play a very important role in minimizing the damage caused by different computer attacks. There are two intrusion detection methods: namely misuse- and anomaly-based. A collaborative, intelligent intrusion detection system (CIIDS) is proposed to include both methods, since it is concluded from recent research that the performance of an individual detection engine is rarely satisfactory. In particular, two main challenges in current collaborative intrusion detection systems (CIDSs) research are highlighted and reviewed: CIDSs system architectures and alert correlation algorithms. Different CIDSs system, architectures are explained and compared. The use of CIDSs together with other multiple security systems raise certain issues and challenges in, alert correlation. Several different techniques for alert correlation are discussed. The focus will be on correlation of CIIDS alerts. Computational, Intelligence approaches, together with their applications on IDSs, are reviewed. Methods in soft computing collectively provide understandable, and autonomous solutions to IDS problems. At the end of the review, the paper suggests fuzzy logic, soft computing and other AI techniques, to be exploited to reduce the rate of false alarms while keeping the detection rate high. In conclusion, the paper highlights opportunities for an integrated solution to large-scale CIIDS.

Reducing false positives through fuzzy alert correlation in collaborative intelligent intrusion detection systems — A review

As complete prevention of computer attacks is not possible, intrusion detection systems (IDS) play a very important role in minimizing the damage caused by different computer attacks. There are two intrusion detection methods: namely misuse- and anomaly-based. A collaborative intelligent intrusion detection system (CIIDS) is proposed to include both methods, since it is concluded from recent research that the performance of an individual detection engine is rarely satisfactory. In particular, two main challenges in current collaborative intrusion detection systems (CIDSs) research are highlighted and reviewed: CIDS architectures and alert correlation algorithms. The focus will be on correlation of CIIDS alerts. At the end of the review, the paper suggests fuzzy logic and other AI techniques to be exploited to reduce the rate of false alarms while keeping the detection rate high. In conclusion, the paper highlights opportunities for an integrated solution to large-scale CIIDS.

Intrusion Alert Correlation Framework: An Innovative Approach

Alert correlation analyzes the alerts from one or more collaborative intrusion detection systems (IDSs) to produce a concise overview of security-related activity on a network. The process consists of multiple components, each responsible for a different aspect of the overall correlation goal. The sequence order of the correlation components affects the process performance. The total time needed for the whole process depends on the number of processed alerts in each component. An innovative alert correlation framework is introduced based on a model that reduces the number of processed alerts as early as possible by discarding the irrelevant and false alerts in the first phases. A new component, shushing the alerts, is added to deal with the unrelated alerts. A modified algorithm for fusing the alerts is presented. The intruders’ intention is grouped into attack scenarios and thus used to detect future attacks. DARPA 2000 ID scenario specific datasets is used to evaluate the alert correlator model. The experimental results show that the correlation model is effective in achieving alert reduction and abstraction. The performance is improved after the attention is focused on correlating higher severity alerts.

Mathematical formulation for open shop scheduling problem

In this paper we present a mathematical formulation for solving open shop scheduling problem. We derived different classes of valid inequalities to strength the model. Exhaustive computational experiments on the well known sets of Taillards benchmarks are presented. The derived valid inequalities show a good improvement to the computational time for the proposed model.

A comparison study on children reading stories from e-books and from traditional books

This work is a contribution to the interaction of children and computers. It consists of an experiment on children of age 6–8 years. The children were allowed to read the stories; either from traditional books, or from e-books. The two groups were then observed and tested for their understanding the aims and contents of the stories. The significant results of this study is that reading stories traditionally is better understood by children than reading them electronically, although for the children, reading e-books is of more interest than reading traditional books. However, the results of the research are believed to address the interest of children, parents, educators and media producers.

On the m -clique free interval subgraphs polytope: polyhedral analysis and applications

In this paper we study the m-clique free interval subgraphs. We investigate the facial structure of the polytope defined as the convex hull of the incidence vectors associated with these subgraphs. We also present some facet-defining inequalities to strengthen the associated linear relaxation. As an application, the generalized open-shop problem with disjunctive constraints (GOSDC) is considered. Indeed, by a projection on a set of variables, the m-clique free interval subgraphs represent the solution of an integer linear program solving the GOSDC presented in this paper. Moreover, we propose exact and heuristic separation algorithms, which are exploited into a Branch-and-cut algorithm for solving the GOSDC. Finally, we present and discuss some computational results.

Using a productive distance PhD program to empower women in academia

The PhD degree is a mandatory requirement for promotion in academia. Many African countries have problems to offer serious PhD programs because they suffer a severe brain drain which led to a scarcity of qualified PhD supervisors. It is difficult for lecturers (holding Master degrees) at local universities, to find PhD programs and only some lucky ones travel abroad to be enrolled in foreign PhD programs. For women it is more difficult due to economic, social and family commitments. This paper describes a PhD program (particularly in Computer Science and Information Technology) of Sudan University of Science and Technology that is Internet mediated. It provides PhD supervisors from renowned universities all over the world to empower women in higher education. The program is now in its sixth year and nine women (and 2 men) have already graduated with PhDs in computer science and information technology.

Valid inequalities for unrelated parallel machines scheduling with precedence constraints

This paper deals with the mathematical modeling of a scheduling problem for unrelated parallel machines with precedence constraints in order to minimize the makespan (Cmax). This study was motivated by the quality of the Integer Program based on the interval graph. Three families of inequalities are proposed. The first two inequalities based on the idea of the precedence jobs and the third based on the shortest processing time(SPT). We studied the validity of the new inequalities and strength them by checking the linear combination. After an exhaustive computational and statistical analysis we can conclude that the addition of these inequalities decreases the computational requirements to obtain the optimal solution in many cases.

Unrelated Parallel Machine Scheduling Problem with Precedence Constraints: Polyhedral Analysis and Branch-and-Cut

We consider the problem of unrelated parallel machines with precedence constraints (UPMPC), with the aim of minimizing the makespan. Each task has to be assigned to a unique machine and no preemption is allowed. In this paper, we show the relation between the interval graph and the UPMSPC problem. We propose valid inequalities and study the facial structure of their polytope. Facets are presented to strength the associated integer linear program formulation to help in solving the global problem. We develop a Branch and Cut algorithm for solving the problem and present some experimental results.

An Internet mediated PhD programme in computer science and information technology

The PhD degree is a requirement for promotion in academia. The brain drain experienced by Sudan and other neighbouring countries has led to a scarcity of PhD supervisors. Thus, many young Sudanese college lecturers holding Master degrees find it difficult to do their PhD locally in Sudan. Furthermore, they cannot seek education abroad due to economic, social and family commitments. This paper describes the PhD programme of Sudan University of Science and Technology which employs the Internet to facilitate the utilization of the international human and technical resources by providing PhD supervisors from renowned universities all over the world. PhD students from all over Sudan and the neighbouring countries participate in lectures, seminars and receive research supervision through interactive software (WebEX) providing audio, video and chat facilities. Students have to come to the university once or twice a year for face to face exams, discussions with supervisors and presentations or progress seminars.