The 2012 International Conference on Computational Intelligence and Security (CIS) is the ninth one focusing on all areas of two crucial fields in information processing: computational intelligence (CI) and information security (IS). In particular, the CIS Conference provides a platform to explore the potential applications of CI models, algorithms, and technologies to IS.

/pdf/selected-papers-from-the-ninth-international-conference-on-3cn7lz3onk.pdf

Selected Papers from the Ninth International Conference on Computational Intelligence and Security.

This article presents a hybrid architecture to identify intrusive behavior among networked sensors that monitor critical systems such as environment, medical, and smart grid. Monitoring through sensors is desired for critical applications such as epilepsy seizures, pollution, power quality assessment, and transformer monitoring. Wireless sensors are being widely used in critical applications due to their advantages including low-cost, flexibility, and communication efficiency. However, when sensors are networked to monitor a critical infrastructure such as the smart grid, they become the target of different types of attackers such as intruders via the communication medium. In order to maintain sensing in a secure manner, robust architectures are needed to identify intrusive behavior of sensors in a network. In this article, we present a hybrid architecture to detect intrusive behavior of sensors for both unknown and known intruders. The former requires anomaly detection, whereas the latter requires signature detection. The proposed architecture consists of two subsystems that co-operate to detect unknown and known attacks through duty-cycling of enhanced density-based spatial clustering of applications with noise and random forest methods. Through various tests on real intrusion data, we show that the proposed architecture has a strong potential to detect both known and unknown intrusive behavior of sensor nodes as the results show 99.73% detection rate with 98.95% overall accuracy.

Detection of Known and Unknown Intrusive Sensor Behavior in Critical Applications

Recently, sequence anomaly detection has been widely used in many fields. Sequence data in these fields are usually multi-dimensional over the data stream. It is a challenge to design an anomaly detection method for a multi-dimensional sequence over the data stream to satisfy the requirements of accuracy and high speed. It is because: (1) Redundant dimensions in sequence data and large state space lead to a poor ability for sequence modeling; (2) Anomaly detection cannot adapt to the high-speed nature of the data stream, especially when concept drift occurs, and it will reduce the detection rate. On one hand, most existing methods of sequence anomaly detection focus on the single-dimension sequence. On the other hand, some studies concerning multi-dimensional sequence concentrate mainly on the static database rather than the data stream. To improve the performance of anomaly detection for a multi-dimensional sequence over the data stream, we propose a novel unsupervised fast and accurate anomaly detection (FAAD) method which includes three algorithms. First, a method called “information calculation and minimum spanning tree cluster” is adopted to reduce redundant dimensions. Second, to speed up model construction and ensure the detection rate for the sequence over the data stream, we propose a method called “random sampling and subsequence partitioning based on the index probabilistic suffix tree.” Last, the method called “anomaly buffer based on model dynamic adjustment” dramatically reduces the effects of concept drift in the data stream. FAAD is implemented on the streaming platform Storm to detect multi-dimensional log audit data. Compared with the existing anomaly detection methods, FAAD has a good performance in detection rate and speed without being affected by concept drift.

FAAD: an unsupervised fast and accurate anomaly detectionmethod for amulti-dimensional sequence over data stream

Collaborative spectrum sensing in cognitive radio network (CRN) helps in increasing the accuracy of detection of the incumbent signal. Each node in an infrastructure-based CRN sends its local sensing report to the fusion center (FC), which aggregates the reports to arrive at a final sensing decision. However, collaborative sensing is vulnerable to the Byzantine attack (also known as spectrum sensing data falsification attack) in which malicious nodes falsify sensing reports in order to adversely affect the final sensing decision. Temporal data collected at the FC in the form of the sensing reports form a rich audit data set, which can be analyzed to identify malicious nodes, if any. In this paper, we present two anomaly detection techniques based on such an analysis. First, we exploit the frequency property of such statistical data and develop a lightweight intrusion detection scheme. Second, we use the Markov chain model which is based on the ordering property of the data to develop another intrusion detection scheme. Simulation results along with theoretical analysis show the validity of the two schemes.

Detecting Byzantine Attack in Cognitive Radio Networks by Exploiting Frequency and Ordering Properties

Malware is currently a major threat to information and computer security, with the volume and growing diversity of its variants causing major problems to traditional security defenses. Software patches and upgrades to anti-viral packages are typically released only after the malware's key characteristics have been identified through infection, by which time it may be too late to protect systems. Sequence analysis is widely used in bioinformatics for revealing the genetic diversity of organisms and annotating gene functions. This paper adopts a new approach to the problem of malware recognition, which is to use multiple sequence alignment techniques from bioinformatics to align variable length computer viral and worm code so that core, invariant regions of the code occupy fixed positions in the alignment patterns. Data mining (ANNs, symbolic rule extraction) can then be used to learn the critical features that help to determine into which class the aligned patterns fall. Experimental results demonstrate the feasibility of our novel approach for identifying malware code through multiple sequence alignment followed by analysis by ANNs and symbolic rule extraction methods.

Multiple sequence alignment and artificial neural networks for malicious software detection

Intrusion detection based on system calls and homogeneous Markov chains

http://ieeexplore.ieee.org/iel5/5971804/6074639/06074672.pdf

Detecting network intrusions by data mining and variable-length sequence pattern matching

Anomaly detection acts as one of the important directions of research on intrusion detection. This paper presents a new method for anomaly detection of program behaviors,which is applicable to intrusion detection systems using system calls as audit data on Linux or Unix platform. The method uses sequence patterns in data mining technique to model the normal behavior of a privileged program,and extracts normal system call sequences according to their support and confidence in the training data. At the detection stage,system call sequences are matched to perform the comparison of the historic behaviors and current behaviors,and then two alternative schemes can be used to distinguish between normal and anomalous behaviors. The experimental results show that the method can achieve high detection performance.

Anomaly Detection of Program Behaviors Based on System Calls and Data Mining

Anomaly Detection of User Behavior Based on Shell Commands and Co-Occurrence Matrix

http://ieeexplore.ieee.org/iel5/5971804/6074677/06074689.pdf

DDFS spurious signals due to amplitude quantization in absence of phase-accumulator truncation

Handle everyday research tasks with reliable, citation-backed results

Your personal Research Agent to handle research tasks with citation-backed results

Popular Tasks used by Researchers

How can I help with your research?

Meet SciSpace

Get more enhanced response by uploading the PDFs you want me to reference.

No relevant PDFs in your library

SciSpace is the AI research assistant for academics. Run systematic literature reviews on 280M+ papers, and write papers with cited sources. Trusted by 1M+ students, PhDs & researchers.

SciSpace | AI for Research

Analyze PDFs

Code & Manuscripts

Funding & Grants

Literature & Patents

Medical & Clinical Data

Systematic Review

Visualize & Present

Web & Data

Build a Google Scholar-like website for your research.

Build a website

Create charts and images for your research

Create a Chart

Write a paper for submission to a journal

Draft a manuscript

Patent Search

Design eye-catching scientific posters in minutes.

Scientific Poster Generation

Systematic Literature Review

One task is running at the moment. Your messages will be shown right after.

Drag and drop or click here to browse

Loved by <highlight>1 million+</highlight> researchers

Extract a list of specific topics and their sources from unstructured text

Topics

Compare and analyze relevant papers that matches with your search

Papers

Get insights from PDFs and bookmarked papers from your library

My library

Recent searches

Try searching for:

Catch AI-generated content in scholarly and non-scholarly content

{ai} Detector

Ai Writer

Get PDF Summaries, highlighted text explanations 

Chat with PDF

Effortlessly create in-text citations and bibliographies in APA and 2,500 other formats

Citation generator

Get explanations, summaries, and answers on academic papers

Ease up your research workflow with {scispace}'s cohort of exciting AI tools

Elevate your academic writing skills and convey your ideas the way you want

Paraphraser

Explore our range of reading and writing tools

Your file is being prepared and should be ready in a few minutes. If it's a large file, it might take a bit longer. You can close this window, and we'll email you the file when it's done.

You have reached a maximum limit of <strong>{limit}</strong> columns in the table. Remove at least <strong>1</strong> column to add or create another one.

Duan Miyi

Author Tools

Chat about Author