Light gradient boosting machine with optimized hyperparameters for identification of malicious access in IoT network

In this paper, an advanced and optimized Light Gradient Boosting Machine (LGBM) technique is proposed to identify the intrusive activities in the Internet of Things (IoT) network. The followings are the major contributions: i) An optimized LGBM model has been developed for the identification of malicious IoT activities in the IoT network; ii) An efficient evolutionary optimization approach has been adopted for finding the optimal set of hyper-parameters of LGBM for the projected problem. Here, a Genetic Algorithm (GA) with k-way tournament selection and uniform crossover operation is used for efficient exploration of hyper-parameter search space; iii) Finally, the performance of the proposed model is evaluated using state-of-the-art ensemble learning and machine learning-based model to achieve overall generalized performance and efficiency. Simulation outcomes reveal that the proposed approach is superior to other considered methods and proves to be a robust approach to intrusion detection in an IoT environment.     

基于时间自动机的Ad hoc网络入侵检测

该文提出一种基于时间自动机分布式合作的入侵检测算法。首先,将整个网络分为子区域,每一区域随机选出簇头担任监视节点,负责本区域的入侵检测。其次,按照路由协议构筑节点正常行为和入侵行为的时间自动机,监视节点收集其邻居节点的行为信息,利用时间自动机分析节点的行为,识别入侵者。该算法不需要事先进行数据训练并能够实时检测入侵行为。最后,通过模拟实验证实了算法的有效性。     

入侵检测代理消息机制的研究

在网络中系统之间消息的交换十分重要.文中研究了在入侵检测代理之间消息传输的相关机制,采用层次编码方式对消息类编码,在消息传输时使用消息的编码和相应的参数,确保语义的惟一性.     

NETWORK INTRUSION DETECTION METHOD BASED ON RS-MSVM

A new method called RS-MSVM （Rough Set and Multi-class Support Vector Machine） is proposed for network intrusion detection. This method is based on rough set followed by MSVM for attribute reduction and classification respectively, The number of attributes of the network data used in this paper is reduced from 41 to 30 using rough set theory. The kernel function of HVDM-RBF （Heterogeneous Value Difference Metric Radial Basis Function）, based on the heterogeneous value difference metric of heterogeneous datasets, is constructed for the heterogeneous network data. HVDM-RBF and one-against-one method are applied to build MSVM. DARPA （Defense Advanced Research Projects Agency） intrusion detection evaluating data were used in the experiment. The testing results show that our method outperforms other methods mentioned in this paper on six aspects： detection accuracy, number of support vectors, false positive rate, falsc negative rate, training time and testing time.     

Detecting unauthorized and compromised nodes in mobile ad hoc networks

Security of mobile ad hoc networks (MANET) has become a more sophisticated problem than security in other networks, due to the open nature and the lack of infrastructure of such networks. In this paper, the security challenges in intrusion detection and authentication are identified and the different types of attacks are discussed. We propose a two-phase detection procedure of nodes that are not authorized for specific services and nodes that have been compromised during their operation in MANET. The detection framework is enabled with the main operations of ad hoc networking, which are found at the link and network layers. The proposed framework is based on zero knowledge techniques, which are presented through proofs.     

入侵检测技术分析概述

入侵检测是计算机网络安全防御体系的重要内容之一 ,作为一种新的动态安全防御技术 ,它是继防火墙之后的第二道安全防线。综述入侵检测技术的主要方面性 ,为进一步研究提供参考。     

基于虚拟机技术的入侵检测系统攻击仿真平台的研究和实现

攻击仿真平台是入侵检测系统(Intrusion Detectoin System,IDS)测试平台的核心组成部分。该文从攻击测试的角度,提出了一种基于虚拟机技术的IDS攻击仿真平台。首先介绍攻击仿真的测试目标和内容,并提出了攻击仿真系统和仿真平台的设计和实现的详细方案;同时,在此基础上,对该平台的设计和实现的3个关键技术：测试数据的选择、攻击技术的分类研究、攻击测试域及其划分等进行了进一步的分析,最后给出并分析了实验测试结果。     

基于簇的移动Ad hoc网多层分布式入侵检测

动Ad hoc网络的独特网络特性导致其安全性特别脆弱，所以为其提供高安全的入侵检测系统势在必行。通过考虑在移动Ad hoc网络中入侵检测系统的分布式和协同工作的需要，提出了一种基于簇的多层分布式入侵检测技术，并给出模型。此模型采用统计学方法的异常检测技术结合数据挖据技术和簇技术对入侵进行检测．有效提高了移动Ad hoc网络的安全性和对分布式攻击的协同检测能力，并降低了网络的通信负荷。     

入侵检测系统:原理、入侵隐藏与对策

入侵行为给基于网络的计算机信息系统的安全带来巨大威胁，入侵检测系统（IDS，Intrusion Detection System）作为重要的安全工具而成为研究的热点。文章首先介绍IDS的基本概念和组成，研究各类IDS的工作原理及其优缺点，然后分析当前难以对付的几种隐藏入侵迹象，逃避IDS检测的方法，并进一步探讨相应的对策，对IDS今后的发展方向提出了看法。     

基于Linux环境下的IPS实现算法研究及性能测试

入侵防御系统（IPS）是继入侵检测系统（IDS）之后网络安全领域的一个新的研究方向，它既可以用来检测，又可以用来防御和阻止攻击。文中首先讨论了在Linux操作系统下的入侵防御系统，然后给出了建立入侵防御系统的3种算法，并对其性能做了测试、比较和分析，最后讨论了进一步需要研究的问题。