Preface |
|
vii | |
1 Introduction |
|
1 | (6) |
|
|
1 | (2) |
|
|
3 | (4) |
|
|
3 | (1) |
|
1.2.2 Performance maintenance |
|
|
4 | (3) |
2 Attacks and Countermeasures in Computer Security |
|
7 | (24) |
|
2.1 General Security Objectives |
|
|
7 | (3) |
|
|
7 | (1) |
|
|
8 | (1) |
|
|
8 | (1) |
|
|
8 | (1) |
|
|
8 | (1) |
|
|
9 | (1) |
|
|
9 | (1) |
|
|
9 | (1) |
|
|
10 | (4) |
|
2.2.1 Attacks against availability |
|
|
10 | (1) |
|
2.2.2 Attacks against confidentiality |
|
|
11 | (1) |
|
2.2.3 Attacks against integrity |
|
|
12 | (1) |
|
2.2.4 Attacks against miscellaneous security objectives |
|
|
13 | (1) |
|
2.3 Countermeasures of Attacks |
|
|
14 | (17) |
|
|
15 | (1) |
|
|
16 | (4) |
|
2.3.3 Audit and intrusion detection |
|
|
20 | (2) |
|
2.3.4 Extrusion detection |
|
|
22 | (1) |
|
|
23 | (3) |
|
|
26 | (2) |
|
2.3.7 Anti-virus software |
|
|
28 | (3) |
3 Machine Learning Methods |
|
31 | (8) |
|
|
31 | (1) |
|
|
31 | (1) |
|
|
32 | (1) |
|
|
32 | (1) |
|
|
32 | (1) |
|
3.6 Genetic Algorithms and Genetic Programming |
|
|
33 | (1) |
|
3.7 Instance-Based Learning |
|
|
33 | (1) |
|
3.8 Inductive Logic Programming |
|
|
34 | (1) |
|
|
34 | (1) |
|
3.10 Inductive and Analytical Learning |
|
|
34 | (1) |
|
3.11 Reinforcement Learning |
|
|
35 | (1) |
|
|
35 | (1) |
|
3.13 Multiple Instance Learning |
|
|
36 | (1) |
|
3.14 Unsupervised Learning |
|
|
36 | (1) |
|
3.15 Semi-Supervised Learning |
|
|
36 | (1) |
|
3.16 Support Vector Machines |
|
|
37 | (2) |
4 Intrusion Detection System |
|
39 | (22) |
|
|
39 | (5) |
|
4.1.1 Security defense in depth |
|
|
39 | (2) |
|
4.1.2 A brief history of intrusion detection |
|
|
41 | (1) |
|
4.1.3 Classification of intrusion detection system |
|
|
41 | (2) |
|
4.1.4 Standardization efforts |
|
|
43 | (1) |
|
4.1.5 General model of intrusion detection system |
|
|
43 | (1) |
|
|
44 | (3) |
|
|
44 | (1) |
|
|
45 | (1) |
|
|
46 | (1) |
|
|
47 | (2) |
|
|
49 | (7) |
|
4.4.1 Statistical analysis |
|
|
49 | (2) |
|
|
51 | (1) |
|
|
51 | (1) |
|
4.4.4 State transition-based analysis |
|
|
52 | (1) |
|
4.4.5 Neural network-based system |
|
|
53 | (1) |
|
4.4.6 Data mining-based system |
|
|
54 | (2) |
|
4.5 Architecture for Network Intrusion Detection System |
|
|
56 | (5) |
Part A: Intrusion Detection for Wired Network |
|
|
5 Techniques for Intrusion Detection |
|
|
61 | (4) |
|
5.1 Available Alarm Management Solutions |
|
|
61 | (2) |
|
|
61 | (1) |
|
|
62 | (1) |
|
5.1.3 Event classification process |
|
|
63 | (1) |
|
5.2 Available Performance Maintenance Solutions |
|
|
63 | (2) |
|
|
63 | (1) |
|
|
64 | (1) |
|
6 Adaptive Automatically Tuning Intrusion Detection System |
|
|
65 | (36) |
|
|
65 | (1) |
|
6.2 SOM-Based Labeling Tool |
|
|
65 | (6) |
|
|
66 | (2) |
|
6.2.2 Pre-cluster by symbolic features |
|
|
68 | (1) |
|
|
68 | (2) |
|
6.2.4 Label data in clusters |
|
|
70 | (1) |
|
6.3 Hybrid Detection Model |
|
|
71 | (30) |
|
6.3.1 Binary SLIPPER rule learning system |
|
|
71 | (3) |
|
|
74 | (1) |
|
|
74 | (5) |
|
6.3.4 Detection model tuning |
|
|
79 | (7) |
|
6.3.5 Fuzzy prediction filter |
|
|
86 | (10) |
|
6.3.6 Fuzzy tuning controller |
|
|
96 | (5) |
|
7 System Prototype and Performance Evaluation |
|
|
101 | (40) |
|
7.1 Implementation of Prototype |
|
|
101 | (2) |
|
|
101 | (1) |
|
7.1.2 Binary prediction and model tuning thread |
|
|
101 | (1) |
|
7.1.3 Final arbiter and prediction filter thread |
|
|
102 | (1) |
|
7.1.4 User simulator thread |
|
|
102 | (1) |
|
7.1.5 Interface for fuzzy knowledge base |
|
|
103 | (1) |
|
7.2 Experimental Data set and Related Systems |
|
|
103 | (9) |
|
7.2.1 KDDCup'99 intrusion detection data set |
|
|
103 | (2) |
|
7.2.2 Performance evaluation method |
|
|
105 | (3) |
|
7.2.3 Related IDSs on KDDCup'99 ID data set |
|
|
108 | (4) |
|
7.3 Performance Evaluation |
|
|
112 | (29) |
|
7.3.1 SOM-based labeling tool performance |
|
|
112 | (2) |
|
7.3.2 Build hybrid detection model |
|
|
114 | (2) |
|
7.3.3 The MC-SLIPPER system and test performance |
|
|
116 | (9) |
|
7.3.4 The ATIDS system and test performance |
|
|
125 | (8) |
|
7.3.5 The ADAT IDS system and test performance |
|
|
133 | (8) |
Part B: Intrusion Detection for Wireless Sensor Network |
|
|
8 Attacks against Wireless Sensor Network |
|
|
141 | (6) |
|
8.1 Wireless Sensor Network |
|
|
141 | (1) |
|
8.2 Challenges on Intrusion Detection in WSNs |
|
|
142 | (1) |
|
|
143 | (4) |
|
9 Intrusion Detection System for Wireless Sensor Network |
|
|
147 | (10) |
|
9.1 Architecture of IDS for WSN |
|
|
147 | (2) |
|
|
149 | (4) |
|
9.2.1 Local features for LIDC in WSN |
|
|
150 | (2) |
|
9.2.2 Packet features for PIDC in WSN |
|
|
152 | (1) |
|
9.3 Detection Model and Optimization |
|
|
153 | (2) |
|
|
155 | (2) |
|
10 Conclusion and Future Research |
|
|
157 | (2) |
Cited Literature |
|
159 | (10) |
Index |
|
169 | |