Abstract ：

Matchmaking is the basis of service discovery and composition. Using ontology semantically express the capabilities of services, accurately match, discovery and composition service. Domain ontologies and Formal Concept Analysis (FCA) aim at modeling concepts, the role of FCA in ontology engineering is supporting the critical task of reusing independently developed domain ontologies. Evaluating concept similarity identifies the different concepts that are semantically close. In this paper, using concept and attribute of Web services to construct the ontology. Also, an ontology-based method for assessing similarity between FCA concepts is proposed. Such a method is intended to support the ontology engineer in difficult activities such as ontology merging and ontology mapping in the development of the Semantic Web. © 2010 IEEE.

Keyword ：

Composition services Concept Lattices Concept similarity Formal concept analyses (FCA) Matchmaking Ontology-based methods Ontology engineering Similarity

Cite：

Copy from the list or Export to your reference management。

Abstract ：

A global optimal algorithm based on particle swarm optimization (PSO) is presented to resolve services selection with quality of service (QoS) global optimal in web service composition. This method will transform a web service selection global optimal problem into an optimization problem based on web service QoS. This algorithm is utilized multi-objective particle swarm optimization intelligent optimization principle to produce a set of optimal Pareto with constraint principle by optimizing multi QoS parameters simultaneously. Experiments show the feasibility and efficiency of this algorithm.

Keyword ：

Constraint principles Intelligent optimization Multi objective particle swarm optimization Optimization problems Service compositions Web service composition Web services composition Web service selection

Cite：

Copy from the list or Export to your reference management。

Abstract ：

本文通过对计算机系统行为的分析,提出了以文件系统作为监控对象,采用改进的PAD算法CSSPAD进行异常检测的思想,设计并实现了基于文件访问监控的主机异常入侵检测系统.通过大量实验证明该系统具有检测率高、误报率低、运行负荷小、具有在线检测能力等特点.

Keyword ：

入侵检测 网络安全 文件系统 异常检测

Cite：

Copy from the list or Export to your reference management。

Abstract ：

How to evaluate network security threat quantitatively is one of key issues in the field of network security, which is vital for administrators to make decision on the security of computer networks. A novel model of security threat evaluation with a series of quantitative indices is proposed on the analysis of prevalent network intrusions. This model is based on multiple behavior information fusion and two indices of privilege validity and service availability that are proposed to evaluate the impact of prevalent network intrusions on system security, so as to provide security evolution over time, i.e., monitor security changes with respect to modification of security factors. The Markov model and the algorithm of D-S evidence reasoning are proposed to measure these two indices, respectively. Compared with other methods, this method mitigates the impact of unsuccessful intrusions on threat evaluation. It evaluates the impact of important intrusions on system security comprehensively and helps administrators to insight into intrusion steps, determine security state and identify dangerous intrusion traces. Testing in a real network environment shows that this method is reasonable and feasible in alleviating the tremendous task of data analysis and facilitating the understanding of the security evolution of the system for its administrators. (c) 2004 Elsevier Ltd. All rights reserved.

Keyword ：

evaluation index evidence reasoning information fusion Markov model network security threat evaluation

Cite：

Copy from the list or Export to your reference management。

Abstract ：

规划识别是一种根据观察数据识别和推断被观察对象目的或意图的预测理论.在计算机系统入侵检测研究中,为了提前预测出异常事件的发生,提出了一种基于规划识别理论的入侵企图预测方法.通过对主机上的系统调用序列为观察对象建立预测模型,提出了一种带参数补偿的贝叶斯网络动态更新算法,对观察对象的目的进行预测.实验结果表明动态贝叶斯网络对预测系统调用序列中的异常入侵企图有较高的精度.

Keyword ：

参数补偿 动态贝叶斯网络 规划识别 入侵预测 系统调用序列

Cite：

Copy from the list or Export to your reference management。

Abstract ：

基于主机的入侵检测是保障计算机网络信息安全的重要手段之一.该文在介绍击键特性及其识别算法的基础上,根据大量试验结果,确定将具体键的击键序列作为信息源,提出了一种改进的贝叶斯统计方法,实现了主机入侵检测.该方法既能独立于用户名和口令之外对用户进行身份认证,又能动态监控用户击键的整个过程.文中对系统实现的关键问题和检测结果进行了详细的分析和讨论.

Keyword ：

击键特性 入侵监控 入侵检测 身份认证

Cite：

Copy from the list or Export to your reference management。

Abstract ：

Forecasting intending intrusion according to intrusion preludes is vital in computer security.. One novel intrusion behavior forecast system based on interactive knowledge discovery, which consists of off-line interactive knowledge discovery and on-line forecast, is put forward. As to the former, the algorithm of sequential pattern discovery, WINEPI, is introduced to implement interactive knowledge discovery so as to mine frequent sequential patterns, of intrusion behavior from historical intrusion, event dataset. And a novel idea of correlating discovered short sequential patterns based on intrusion prerequisite and intrusion intention is proposed to build long sequential patterns. As to the on-line part of intrusion behavior forecast system, it employs inference engine developed in this paper to forecast intrusion behavior based on intrusion preludes and to discover forecast rules. This system changes passive data storage into active data usage and helps to achieve active defense. Application in the integrated network security monitor and defense system named Net-Keeper have shown that all forecast accuracies are greater than 75%, which proves this system is feasible.

Keyword ：

behavior forecast interactive knowledge discovery intrusion behavior pattern intrusion detection network security

Cite：

Copy from the list or Export to your reference management。

Abstract ：

Intrusion detection is an important technique in the defense-in-depth network security framework and a hot topic in computer security in recent years. In this paper, a new intrusion detection method based on Principle Component Analysis (PCA) with low overhead and high efficiency is presented. System call data and command sequences data are used as information sources to validate the proposed method. The frequencies of individual system calls in a trace and individual commands in a data block are computed and then data column vectors which represent the traces and blocks of the data are formed as data input. PCA is applied to reduce the high dimensional data vectors and distance between a vector and its projection onto the subspace reduced is used for anomaly detection. Experimental results show that the proposed method is promising in terms of detection accuracy, computational expense and implementation for real-time intrusion detection.

Cite：

Copy from the list or Export to your reference management。

Abstract ：

Intrusion detection is an important technique in the defense-in-depth network security framework and a hot topic in computer network security in recent years. In this paper, a new efficient intrusion detection method based on Hidden Markov Models (HMMs) is presented. HMMs are applied to model the normal program behaviors using traces of system calls issued by processes. The output probability of a sequence of system calls is calculated by the normal model built If the probability of a sequence in a trace is below a certain threshold, the sequence is flagged as a mismatch. H the ratio between the mismatches and all the sequences in a trace exceeds another threshold, the trace is then considered as a possible intrusion. The method is implemented and tested on the sendmail system call data from the University of New Mexico. Experimental results show that the performance of the proposed method in intrusion detection is better than other methods.

Keyword ：

anomaly detection computer security hidden markov models (HMMs) intrusion detection pattern recognition program behaviors system call

Cite：

Copy from the list or Export to your reference management。

Abstract ：

提出了一种高效低负荷的异常检测方法,用于监控进程的非正常行为.该方法借助于粗糙集理论从进程正常运行情况下产生的系统调用序列中提取出一个简单的预测规则模型,能有效地检测出进程的异常运行状态.同其它方法相比,用粗糙集建立正常模型要求的训练数据获取简单,而且得到的模型更适用于在线检测.实验结果表明,该方法的检测效果优于同类的其它方法.

Keyword ：

粗糙集理论 入侵检测 网络安全 系统调用 异常检测

Cite：

Copy from the list or Export to your reference management。