From the Publisher:
The book studies modern concepts of Computer Security. It is selfcontained in the sense that it introduces the basic mathematical background necessary to follow computer security concepts. Next we examine modern developments in Cryptography starting from private-key and public-key encryption, going through hashing, digital signatures, authentication, secret sharing, group-oriented cryptography, pseudorandomness, key establishment protocols, zero-knowledge protocols, identification and finishing with an introduction to modern e-business systems based on digital cash. Intrusion detection and access control provide examples of security systems implemented as a part of operating system. Database and network security is also discussed.

Fundamentals of Computer Security

We present an overview of our research in real time data mining-based intrusion detection systems (IDSs). We focus on issues related to deploying a data mining-based IDS in a real time environment. We describe our approaches to address three types of issues: accuracy, efficiency, and usability. To improve accuracy, data mining programs are used to analyze audit data and extract features that can distinguish normal activities from intrusions; we use artificial anomalies along with normal and/or intrusion data to produce more effective misuse and anomaly detection models. To improve efficiency, the computational costs of features are analyzed and a multiple-model cost-based approach is used to produce detection models with low cost and high accuracy. We also present a distributed architecture for evaluating cost-sensitive models in real-time. To improve usability, adaptive learning algorithms are used to facilitate model construction and incremental updates; unsupervised anomaly detection algorithms are used to reduce the reliance on labeled data. We also present an architecture consisting of sensors, detectors, a data warehouse, and model generation components. This architecture facilitates the sharing and storage of audit data and the distribution of new or updated models. This architecture also improves the efficiency and scalability of the IDS.

/pdf/real-time-data-mining-based-intrusion-detection-35vb6try43.pdf

Real time data mining-based intrusion detection

Security Visualization is a very young term. It expresses the idea that common visualization techniques have been designed for use cases that are not supportive of security-related data, demanding novel techniques fine tuned for the purpose of thorough analysis. Significant amount of work has been published in this area, but little work has been done to study this emerging visualization discipline. We offer a comprehensive review of network security visualization and provide a taxonomy in the form of five use-case classes encompassing nearly all recent works in this area. We outline the incorporated visualization techniques and data sources and provide an informative table to display our findings. From the analysis of these systems, we examine issues and concerns regarding network security visualization and provide guidelines and directions for future researchers and visual system developers.

A Survey of Visualization Systems for Network Security

A significant barrier to the adoption of cloud services is that users fear data leakage and loss of privacy if their sensitive data is processed in the cloud. In this paper, we describe a client-based privacy manager that helps reduce this risk, and that provides additional privacy-related benefits. We assess its usage within a variety of cloud computing scenarios. We have built a proof-of-concept demo that shows how privacy may be protected via reducing the amount of sensitive information sent to the cloud.

A client-based privacy manager for cloud computing

A real-time approach for detecting aberrant modes of system behavior induced by abnormal and unauthorized system activities that are indicative of an intrusive, undesired access of the system. This detection methodology is based on behavioral information obtained from a suitably instrumented computer program as it is executing. The theoretical foundation for the present invention is founded on a study of the internal behavior of the software system. As a software system is executing, it expresses a set of its many functionalities as sequential events. Each of these functionalities has a characteristic set of modules that is executed to implement the functionality. These module sets execute with clearly defined and measurable execution profiles, which change as the executed functionalities change. Over time, the normal behavior of the system will be defined by the boundary of the profiles. An attempt to violate the security of the system will result in behavior that is outside the normal activity of the system and thus result in a perturbation of the system in a manner outside the scope of the normal profiles. Such violations are detected by an analysis and comparison of the profiles generated from an instrumented software system against a set of known intrusion profiles and a varying criterion level of potential new intrusion events.

Dynamic software system intrusion detection

Intrusion detection systems can serve as powerful security audit analysis tools But by analysing the user activities, they are affecting the privacy of the users at the same time Pseudonymous audit can be the basis for privacy enhanced intrusion detection In this paper, the concept of pseudonymous audit for privacy enhanced intrusion detection and its prototype realisations are presented Furthermore it is discussed whether IT security evaluation criteria cover pseudonymous audit and the respective changes are suggested*

/pdf/pseudonymous-audit-for-privacy-enhanced-intrusion-detection-2lcd1t7fm7.pdf

Pseudonymous audit for privacy enhanced intrusion detection

Intrusion detection systems identify unauthorized use, misuse and abuse of computer systems. Some applications have shown that they are capable of detecting a large amount of security violations. The detection of network based attacks, however, has been solved insufficiently. In addition there are inaccessibilities concerning privacy of the monitored users. In this paper we present the intrusion detection system AID which provides new features for network and privacy oriented auditing, and a sophisticated real-time analysis using knowledge based techniques. The paper describes the objectives and the main features of the AID development.

Michael Sobirey

Papers

Pseudonymous audit for privacy enhanced intrusion detection

The Intrusion Detection System AID - Architecture, and Experiences in Automated Audit Analysis.

The intrusion detection system AID—architecture, and experiences in automated audit analysis

Host-orientiertes Netz-Audit