Qing-Hua Li

A clustering-based method for unsupervised intrusion detections

Detection of intrusion attacks is an important issue in network security. This paper considers the outlier factor of clusters for measuring the deviation degree of a cluster. A novel method is proposed to compute the cluster radius threshold. The data classification is performed by an improved nearest neighbor (INN) method. A powerful clustering-based method is presented for the unsupervised intrusion detection (CBUID). The time complexity of CBUID is linear with the size of dataset and the number of attributes. The experiments demonstrate that our method outperforms the existing methods in terms of accuracy and detecting unknown intrusions.

Secure dynamic source routing protocol

Mobile ad hoc networks (MANETs) are a collection of wireless hosts that can be rapidly deployed as a multi-hop packet radio network without the aid of any established infrastructure or centralized administration. The routing security is a critical problem for MANETs. However, existing protocols are not sufficient for security requirements. In this paper, we analyze the weakness of some existing popular protocols. Then, a secure routing protocol SDSR is implemented based on end-to-end integrity check and hop-by-hop discovery request authentication. Unlike traditional technique, our neighbor monitor scheme does not work in promiscuous mode and we demonstrate that the existing overhearing scheme can not perform effectively without the support of authentication. Security and performance evaluation indicate that our scheme achieves a good security at the cost of acceptable overhead.

A new method for design pattern mining

Aiming at the mining of design patterns in existing systems, this paper proposes the concepts of extended graph and its transitive enclosure. The extended graph is used to describe the structures of OO systems and design patterns. Using the sub-graph isomorphism technology, the design pattern instances can be discovered. An algorithm to resolve the transitive enclosure of extended graph is given. Comparing with the existing method, this method can resolve the variant problem by using the transitive enclosure of extended graph.

A maximal frequent itemset algorithm

We present MinMax, a new algorithm for mining maximal frequent itemsets(MFI) from a transaction database. It is based on depth-first traversal and iterative. It combines a vertical tidset representation of the database with effective pruning mechanisms. MinMax removes all the non-maximal frequent itemsets to get the exact set of MFI directly, needless to enumerate all the frequent itemsets from smaller ones step by step. It backtracks to the proper ancestor directly, needless level by level . We found MinMax to be more effective than GenMax, a state-of-the-art algorithm for finding maximal frequent item-sets, to prune the search space to get the exact set of MFI.

Parallel algorithm for mining frequent itemsets

Parallel mining frequent itemsets is a key issue in data mining research. A parallel mining algorithm PMFI in distributed database is proposed in this paper, which attempts to make each processor to do independently and decrease the number of candidate of global frequent itemsets according to the relation between local frequent itemsets and global frequent itemsets. Thus, PMFI uses far less communication overhead and fewer synchronization steps, improves efficiency of mining global frequent itemsets.

An optimal scheduling algorithm for fork-join task graphs

The task duplication based scheduling is a new approach to the scheduling problems. This is known as an NP-complete problem. Although some algorithms are able to find an optimal schedule under certain conditions, they ignored to economize processors and minimize the total completion time. We present a task duplication based balance scheduling (TDBS) algorithm which can schedule a class of fork-join task graph with a complexity of O(|V|/sup 2/), where |V| is the number of tasks. The proposed algorithm generates an optimal schedule with high speedup and efficiency. Simulation results showed that our algorithm has better scheduling length, less completion time and less number of processors than any of compared algorithms.

A supervised intrusion detection method

A supervised intrusion detection method with new distance definition is proposed in this paper. This method based on constrained clustering, uses the produced clusters as classification model to predict which cluster the current data belongs to. The time complexity of the method is nearly linear with the size of dataset, the number of attributes and the final number of clusters. It is difference from existing supervised methods that our method can detect unknown intrusions. The experiment results on dataset KDDCUP99 demonstrate that the method has promising performance with high detection rate and low false alarm rate.

An efficient scheduling algorithm for dependent tasks

Scheduling for dependent tasks is NP-hard. In this paper, we propose a greedy algorithm that can generate a shorter schedule than other major algorithms. The time complexity of our algorithm is O(dv/sup 2/ logv), where v represents the number of tasks and d represents the maximum in degree of tasks. Simulation results show that the proposed algorithm achieves considerable performance improvement over other important algorithms.

An efficient mining algorithm for dependent patterns

Since many current IDSs are constructed by manual encoding of expert knowledge, updating of IDSs are expensive and slow. It is very clear that the frequent patterns mined from audit data can be used as reliable intrusion detection models. We propose efficiently parallel methods to extract an extensive set of features that describe each network connection and learn frequent patterns that accurately capture the behavior of intrusions and normal activities, which are employed to facilitate model construction and incremental updates.

An efficient recovery scheme for mobile computing system

It is very necessary for the mobile computing system to be equipped with the checkpointing recovery facility because of the fact that the MHs are vulnerable to the failures. Previous recovery schemes based on message logging are under the condition that exchanged messages among mobile hosts are forwarded by MSSs(m-MSS-m communication). A new recovery protocol is presented for mobile host direct to mobile host(m-m) communication wireless network in this paper. The m-m communication contributes to a less contention on the wireless network and a lower latency for message transmission than m-MSS-m. Theoretical analyses and simulation results show that the proposed approach provides higher performance in terms of fail-free overhead and recovery overhead than traditional schemes.