Xiufen Fu

Scan attack detection based on distributed cooperative model

Researchers have done lots of work in scan attack detection. Various methods have been proposed. Although these methods can defense some scan attacks from hackers in some degree, there are lots of missing detections and false alerts. Especially current intrusion detection systems are difficult to satisfy the demand of large-scale distributed network. After we carefully research on network topological architecture and scan attack method and mechanism, we find that scan attack always happened at network layer and transport layer. Then we propose a scan detection method based on distributed cooperative model. It is composed of feature-based detection, scenario-based detection and statistic-based detection. The experiment results show that this method has obvious advantages. It can efficiently detect more scan attacks.

Cooperative Intrusion Detection Model Based on State Transition Analysis

Many intrusion behaviors can be characterized as the execution of a sequence of crucial commands that results in an unauthorized access. Lots of attack sequences can be derived by either exchanging properly orders of crucial commands or replacing crucial commands with the functionally similar commands, which have the same performance. Therefore, it is very difficult to detect such attacks. In this paper, we propose a cooperative intrusion detection model based on state transition analysis, in which the topological order and isomorphic transformation are adopted. For a given sequence of crucial commands of an intrusion, all the possible derived sequences as an intrusion scenario can be generated by means of the model. We may also use the model to detect the attacks from different cooperating attackers and the attacks from one attacker in different login sessions. Furthermore, a derived intrusion can be seen as an unknown intrusion, in this sense that the technique presented in this paper can detect some unknown intrusions.

Research on Micro-blog Sentiment Polarity Classification Based on SVM

The key problem to be solved in the analysis of micro-blog emotion is the micro-blog sentiment polarity classification. Based on the analysis of various factors affecting sentiment classification of micro-blog, we recognize word sentimental polarity, extract affective and weighted sentimental feature in the sentence level. Then support vector machine (SVM) classifier is used for emotion recognition and micro-blog classification. Finally, we perform the classification model with the micro-blog corpus data sets, and improve classification accuracy by calculating confidence. The experimental results verify the effectiveness of the micro-blog sentiment polarity classification model applied to the micro-blog.

A cooperative network intrusion detection based on heterogeneous distance function clustering

Because the network connection information contains nominal and linear attributes, and linear attributes are divided into continuous and discrete attributes, the network connection information is the heterogeneous data. The heterogeneous distance functions are used to cluster data in this paper. The cooperative network intrusion detection based on semi-supervised clustering algorithm is proposed. Firstly, the network data flows are divided into three data flows (TCP flow, UDP flow, and ICMP flow) according to network protocol and are sent to three detection agents. Then every detection agent constructs the detection model using the fuzzy c-means clustering algorithm based on the HVDM (Heterogeneous Value Difference Metric) distance. Finally, revise and verify the detection model by using test data. Simulation experiments are done by using KDD CUP 1999 data set, results show that the method presented here is feasible and efficient.

Information Hiding for pervasive trusted authentication

Pervasive computing promises rich and seamless interaction with the surrounding computing environment. However, the ubiquitous environment presents a new security challenge. Authentication is a cornerstone of security. This paper proposes a secure authentication model based on Information Hiding and implements an approach for hiding and restoring the authentication information using IP header of TCP/IP packets. The proposed model, showing Information Hiding can play for authentication in a pervasive environment, may be generalized for trustworthy authentication of security devices such as firewalls. Finally we analyze the security properties of proposed model and approach, which shows that the model is feasible.

Cooperative intrusion detection model based on scenario

When a new intrusion means is developed, many intrusion methods can be derived by exchanging the command sequences or by replacing commands with the functionally similar commands, which makes the detection of the developed intrusion very difficult. To overcome this problem, a cooperative intrusion detection model based on scenario is proposed, which is consisted of 5 layers. Topological order, isomorphic transformation and state transition analysis method are applied in the text. For an intrusion case we generate all the possible derived intrusions as an intrusion base. Based on this intrusion base, we present an efficient method to detect such intrusions by using finite automaton. Further, we apply data fusion to analysis suspicious data. A derived intrusion can be seen as an unknown intrusion, in this sense the technique presented in this paper can detect some unknown intrusions.

An Algorithm of Mining Frequent Itemsets in Pervasive Computing

Based on DHP (direct hashing and pruning) algorithm, this paper presents a kind of transaction-marked DHP algorithm (TMDHP for short) to mining frequent itemsets in pervasive computing. Each element of the itemsets and the transactions ID will be stored together in the hash-table. Using this method just need to access database once and avoids producing a deal of candidate itemsets. The experiments showed that the performance of the algorithm is better than the conventional apriori algorithm and the DHP algorithm, and has a big advantage for application in pervasive computing.

Research on CSCW-Based Workflow Management System Application

Workflow management system can offer enterprises a method to implement better management. This paper focuses on existing workflow management system bugs in the collaboration, discusses the combinability between workflow management system and CSCW, puts forward a work-strategy in the workflow collaboration and a system reference model, and designs a CSCW-based workflow management system. This system is based on a knowledge library, uses the rules and knowledge in the knowledge library to realize the workflow collaboration. This system also applies in the area of stock so as to effectively solve the problem that in the current stock system the workflows cannot work in the collaboration.

A Service-oriented Middleware for Pervasive Computing Environments

Wireless networks provide limited reliability and less bandwidth than fixed networks for mobile nodes. And all mobile nodes are highly energy dependent as they use batteries with a limited capacity. Because of their physical portability, they can be used even when they move. This may require using different wireless networks while the node is moving. In order to provide users with the best possible services within the available resources, there is a demand to develop an intelligent mechanism to manage these limited resources. In this article, a context-aware middleware architecture is proposed to provide satisfactory services to end users of mobile nodes. Each part of the middleware architecture is introduced, and a case study is presented to show that the proposed approach is feasible to provide end user satisfactory services

Cooperative Workflow Research Based On The Knowledge Library

Making the workflow work in coordination is an important method to improve the efficiency of the workflow. This article has proposed a management method based on the knowledge library to make the workflows cooperative. This management method cooperatively controls the workflow from the tripartite aspects, which are the fixed flow, the special flow and the unknown flow. It advises to improve the cooperative degree of the fix flow through the knowledge which has already existed. It also suggests the coordination plan by way of inferring the special flow and the unknown flow so as to reduce manual intervention as far as possible. It can also carry on the revision and the intelligent increases to the knowledge library and realize the flexibility of the cooperative workflow scheme, so as to satisfy the enterprises dynamic management request which brought by the business and organizations changes