The research of worm distributed detection technology based on network security

At present there are some worm intrusion detection systems, primarily for a single LAN or with hardware router environment, which are not applicable for large-scale network detection or have high false alarm rate by using only worm propagation characteristics for detection. This paper analyzed worm non-linear propagation models and drew out the worm transmission curves. Then a distributed worm detection technology is designed. The novel distributed worm detection system consists of two parts, client end and console end programs. The system uses rule-based detection method to monitor network worms, and the console side manages and coordinates detection work of the client sides. Experimental results show that the technology is a good solution to worm detection in multiple network environments which can give an alarm with high detection rate and low false alarm rate when the known worm appears.

In the early 1960's the first ideas were developed by leading companies in Germany (Siemens, Wachtel, etc) to design an intrusion detection system following a capacitance measurement principle. The first detection electronics and set-ups were designed for indoor use (jewellery shops, museums, etc..) but in 1964 the first capacitive detectors for outdoor use i.e. perimeter security systems appeared on the market with very poor performance results. During the 1970's and 80's and sometimes over very long periods, several world wide electronic companies tried to create good working solutions using simple and inexpensive hardware for outdoor use. Sometimes excellent ideas were integrated in the electronic design but generally any investment in a innovative hardware design such as (Insulators, wiring, etc...) were poorly supported. In 1982 Siemens AG was the first company in this market which analysed all outdoor influences and who recognised the essential problems which cause any classic capacitive or electrostatic detector suffering from high unwanted false alarm rates. This was even if the newest sophisticated digital electronics and algorithms were used. The result was that already in 1984 a complete new peripheral hardware design, with a very high electrical and capacitive stability, was created and patented by Siemens AG which remains state of the art even now and which is making capacitive detectors work under most of all environmental conditions. Nevertheless even if this high-grade material is installed, it can happen in certain cases that apparently invisible peripheral influences are the cause of important electrical effects. These effects change the field, periodically generating very high false alarm rates which are extremely difficult to detect and to measure. The reason is that the false alarm rate is specific to a site and as such is difficult to identify. It is a fact that even well trained system engineers have difficulty in solving such problems. This paper describes a practical case experienced in 1999 where a coincidental combination of seaside conditions and a local desert wind strongly interfered in the physics of a capacitive i.e. electrostatic field detector and where trivial (but expensive) measures needed to be taken to finally solve the problem.

The amount of data in the field of computer networking is growing rapidly and this urges new challenges in the field of an intrusion detection system (IDS). To handle such increasing volume of data, a new hybrid approach has to be developed to overcome the problems such as high detection rate and low false alarm rate. An intrusion detection system plays a vital role in the detection of malicious attacks. Data mining and machine learning techniques are important and play a vital role in the detection of attacks. This paper mainly focuses on detection rate and false alarm rate and so to resolve these problems a hybrid method, ensemble clustering, has been proposed. This method tries to increase detection rate with lowering false alarm rate. The method has been tested on KDDCup'99 network intrusion dataset and performs well as compared with other algorithms in terms of detection rate and false alarm rate.

Traditional anomaly detection methods lack adaptive captivity in complex and heterogeneous network. Especially while facing high noise environments or the situation of updating profiles not in time, intrusion detection systems will have high false alarm rate. In this paper, a new anomaly detection algorithm based on hierarchical clustering, called ADBHC, is proposed. ADBHC generates clusters using density-based partitioning method which has less computational cost. It uses the improved hierarchical clustering tree to implement fast scalable and adaptive anomaly detection. The improved hierarchical clustering tree supports updating profiles at any time. We extend the clustering algorithm and apply branch and bound mechanism for filtering noise. With the help of two advantages: filtering noise and updating profiles at any time, our algorithm is effective enough to meet adaptive requirements. A series of experiment results on well known KDD Cup 1999 dataset indicate that ADBHC has low false alarm rate, high detection rate and a certain adaptive captivity in the progress of self-updating.

This paper proposes a novel anomaly detection method of network worms. The algorithm detects unknown worms by multidimensional worm abnormal detection technology, extracts its feature string via analyzing worm data with leap-style and creates new rules to detect the corresponding worm in case that the unknown worm attacks again. The paper has realized the automatic detection of unknown worms. Experiment data has showed that the method has high success detection rate and low false alarm rate.

Recently, network security has become an extremely vital issue that beckons the development of accurate and efficient solutions capable of effectively defending our network systems and the valuable information journeying through them. In this article, a distributed multiagent intrusion detection system (IDS) architecture is proposed, which attempts to provide an accurate and lightweight solution to network intrusion detection by tackling issues associated with the design of a distributed multiagent system, such as poor system scalability and the requirements of excessive processing power and memory storage. The proposed IDS architecture consists of (i) the Host layer with lightweight host agents that perform anomaly detection in network connections to their respective hosts, and (ii) the Classification layer whose main functions are to perform misuse detection for the host agents, detect distributed attacks, and disseminate network security status information to the whole network. The intrusion detection task is achieved through the employment of the lightweight Adaptive Sub-Eigenspace Modeling (ASEM)-based anomaly and misuse detection schemes. Promising experimental results indicate that ASEM-based schemes outperform the KNN and LOF algorithms, with high detection rates and low false alarm rates in the anomaly detection task, and outperform several well-known supervised classification methods such as C4.5 Decision Tree, SVM, NN, KNN, Logistic, and Decision Table (DT) in the misuse detection task. To assess the performance in a real-world scenario, the Relative Assumption Model, feature extraction techniques, and common network attack generation tools are employed to generate normal and anomalous traffic in a private LAN testbed. Furthermore, the scalability performance of the proposed IDS architecture is investigated through the simulation of the proposed agent communication scheme, and satisfactory linear relationships for both degradation of system response time and agent communication generated network traffic overhead are achieved.

To investigate the limits of building detection from very high-resolution (VHR) synthetic aperture radar (SAR) images, a new method, based on statistical and structural information fusion, is proposed in this paper. The proposed method contains two stages: First, using order statistics constant false alarm rate (OS-CFAR) and power ratio (PR) detectors, a set of detections are made. These detections have different statistical properties, compared to the other objects, and these properties are selected for discriminating buildings from clutters. Second, the morphological analysis is used for increasing the precision of the detection. In this stage, segments, which have the most similarities to buildings in terms of shape and size, are extracted via various structural elements (SEs). The final result is obtained by fusing the two sets of detections. The experimental results on the four real VHR SAR images show that the proposed method has a high detection rate (DR) and low false alarm rate (FAR).

It is always a difficult challenge to detect small infrared targets under complex background and ensure high detection rate and low false alarm rate. In this paper, a detection method based on morphological Top-hat filtering and local energy difference is proposed. This method utilizes the advantage that morphological Top-hat filter can suppress the backgTround, and then segmented the image based on local energy difference to identify small targets. In this paper, the specific detection process of this method is given, and a number of small infrared target grayscale images under complex background are selected for the simulation experiment. The experimental results show that this method has a high detection rate and a low false alarm rate, and is of certain reference value for the detection of small infrared targets under complex background.

Computer network defense (CND) protects organizations and individuals against cyber threats by monitoring, identifying, analyzing, and defending network infrastructure from infiltration. Network defenders must maintain high levels of cyber situation awareness (CSA) in order to correctly identify and act on threats to the network. Intrusion detection systems (IDSs) are automated systems designed to assist network defenders in building CSA by sifting through network traffic and flagging potential threats. These systems are plagued by high false alarm rates that inhibit the ability of network defenders to build CSA. More capable IDSs have been developed that are capable of increasing the hit rate and lowering the false alarm rate by analyzing gathered network information. The influence of these IDS technologies on CSA has yet to be explored. 172 San Jose State University psychology students performed a signal detection task for intrusion detection to examine whether integrated automation with a multilayered analysis incorporating both liberal and conservative response criteria leads to better CSA than less-integrated, yet liberally responding automation (high hit rates and high false alarm rates) or conservatively responding automation (with low hit rates and low false alarm rates). The IDS condition was manipulated at three levels (liberal, conservative, both). The reliability of the IDSs was manipulated at three levels (60%, 80%, 95%). This study was unable to observe any differences in task performance or CSA for any of the conditions.

SummaryIntrusion detection system (IDS) represents an unavoidable tool to secure our network. It is considered as a second defense line against the different form of attacks. The principal limits of the current IDSs are their inability to combine the detection of the new form of attacks with high detection rate and low false alarm rate. In this paper, we propose an intrusion detection system based on the combination of the probability predictions of a tree of classifiers. Specifically, our model is composed of 2 layers. The first one is a tree of classifiers. The second layer is a classifier that combines the probability predictions of the tree. The built tree contains 4 levels where each node of this tree represents a classifier. The first node classifies the connections in 2 clusters: Denial of Service attacks and Cluster 2. Then, the second node classifies the connections of the Cluster 2 in Probing attacks and Cluster 3. The third node classifies the connections of the Cluster 3 in Remote‐to‐Local attacks and Cluster 4. Finally, the last node classifies the connections of the Cluster 4 in User‐to‐Root attacks and Normal connections. The second layer contains the last classifier that combines the probability predictions of the first layer and take the final decision. The experiments on KDD'99 and NSL‐KDD show that our model gives a low false alarm rate and the highest detection rate. Furthermore, our model is more precise than the recent intrusion detection system models with accuracy equal to 96.27% for KDD'99 and 89.75% for NSL‐KDD.

Networks have the problem of security attacks like denial of service attacks and others. The firewalls and encrypted software’s does not provide a complete security solution for those attacks. Network intrusion detection aims at distinguishing the attacks on the Internet from normal use of the Internet. It is an indispensable part of the information security system. Due to the variety of network behaviors and the rapid development of attack fashions, it is necessary to develop fast machine-learning-based intrusion detection algorithms with high detection rates and low false-alarm rates. In this paper, we have proposed an effective Intrusion Detection System in which local agent collects data from its own system and it classifies anomaly behaviors using SVM classifier. Each local agent is capable of removing the host system from the network on successful detection of attacks. The mobile agent gathers information from the local agent before it allows the system to send data. Our system identifies successful attacks from the anomaly behaviors. Experimental results show that the proposed system has high detection rate and low false alarm rate which encourages the proposed system.

Neuropsychologists need more sensitive methods to detect and measure recreational drug use in both research and clinical settings. In a study comparing the sensitivity of information processing tasks and neuropsychological instruments to detect early HIV-related cognitive decrements, 18 of 129 subjects tested positive for recreational drugs. Sixteen of these 18 subjects had elevated false alarm rates on one of the information processing tasks, the vigilance task. Another 45 subjects who tested negative for recreational drugs also had elevated false alarm rates. Neuropsychological measures of premorbid functioning, attention, speed of information processing, and manual dexterity were lower in the high false alarm subjects than in the remaining 66 drug-negative, low false alarm subjects. These results suggest that a high false alarm rate may reflect long-standing cognitive disturbances and the effects of drug use. The vigilance task may be a sensitive and efficient screening tool for recreational drug use.

We introduce a social network analysis method as a new approach to build an Intrusion Detection System (SN-IDS) in ad hoc networks. The SN-IDS utilizes social relations as metrics-of-interest for anomaly detections, which is different from most traditional IDS approaches. To construct proper social networks, we first investigate ad hoc MAC and network layer data attributes and select relevant social feature sets; then we build up a set of socio-matrices based on these features. Social analysis methods are applied to these matrices to detect suspicious behaviors of mobile nodes. NS-2 simulation results show that this SN-IDS system can effectively detect common attacks with high detection rates and low false positive alarm rates. Furthermore, it has clear advantages over the conventional association rule based data mining IDS in terms of computation and system complexity.

Intrusions in computer networks have driven the development of various techniques for intrusion detection systems (IDSs). In general, the existing approaches seek two goals: high detection rate and low false alarm rate. The problem with such proposed solutions is that they are usually processing intensive due to the large size of the training set in place. We propose a technique that combines a fuzzy ARTMAP neural network with the well-known Kappa coefficient to perform feature selection. By adding the Kappa coefficient to the feature selection process, we managed to reduce the training set substantially. The evaluation results show that our proposal is capable of detecting intrusions with high accuracy rates while keeping the computational cost low.

If an intruder uses a stolen account, the authentication sub-system will regard the intruder as a legitimate user. In order to filter out such illegal users, the storage system should be capable of the user activity diagnosis. This paper presents a novel anomaly detection scheme to monitor the user access activities using the artificial immune technique. When an access request violates the access control rule, it is regarded as Non-self, so as to provide some early warning tips to the storage security sub-system. Compared with the NIDS, the proposed scheme targets the anomaly detection at storage level and focuses on the read/write data requests. In the prophase of simulation, a set of optimal parameters of algorithm are fitted according to the mean convergence speed and detection efficiency. The simulation shows the proposed scheme can reach rather high detection rate and low false alarm rate, further validating its feasibility. Thus the storage anomaly detection would strengthen the storage early warning and improve the storage security.