Operational Research for Context Aware Intrusion Detection

上下文感知入侵检测的运筹学

• 批准号: EP/D071976/1
• 负责人: Uwe Aickelin
• 金额: $ 79.21万
• 依托单位: University of Nottingham
• 依托单位国家: 英国
• 项目类别: Fellowship
• 财政年份: 2007
• 资助国家: 英国
• 起止时间: 2007 至 无数据
• 项目状态: 已结题
• 来源: https://gtr.ukri.org/projects?ref=EP%2FD071976%2F1
• 关键词: Operational; Research; Context; Aware; Intrusion

Computer security and intrusion detection systems are key areas for the future growth and prosperity of the UK. The largest and most difficult problem in the computer security industry today is how to deal with the volume of information as too many false attacks are being reported.The optimisation of intrusion detection, seen through the eyes of an Operational Researcher, can be achieved through appropriate mathematical models, similar to resource allocation problems such as Set Covering. Set Covering Problems are a staple of combinatorial optimisation and scheduling research. They are both mature areas, where current research has advanced to such levels that real-world problems can be solved successfully by using the latest mathematical modelling and heuristic optimisation techniques.It is the aim of this Fellowship to fuse Operational Research and intrusion detection and then transfer the successes of the former into the latter. Through careful mathematical modelling, I intend to transform the intrusion detection problem into a quasi Set Covering problem. I will then use my theoretical results and experience from this area to optimise the central processes. In essence, this will create a context aware intrusion detection system.An important aspect of the Fellowship is the opportunity to broaden my expertise to encompass other areas, notably mathematical modelling of intrusion detection. Such expertise is currently largely absent in the computer security community. I believe that the Fellowship will leave me in an extremely well placed position to start a unique research area at the intersection between Operational Research, optimisation and computer security.The Fellowship is supported by industrial collaborators (100,000+) and the University of Nottingham (70,000+ and PhD studentship).

计算机安全和入侵检测系统是英国未来增长和繁荣的关键领域。当今计算机安全行业中最大和最困难的问题是如何处理大量的信息，因为有太多的虚假攻击被报告。通过运筹学研究人员的眼睛，可以通过适当的数学模型来实现入侵检测的优化，类似于集合覆盖等资源分配问题。集合覆盖问题是组合优化和调度研究的主要问题。它们都是成熟的领域，目前的研究已经发展到这样的水平，现实世界的问题可以通过使用最新的数学建模和启发式优化技术成功地解决。这是该奖学金的目的是融合运筹学和入侵检测，然后将前者的成功转移到后者。通过仔细的数学建模，我打算将入侵检测问题转化为一个准集合覆盖问题。然后，我将使用我的理论结果和经验，从这方面来优化中央过程。本质上，这将创建一个上下文感知入侵检测系统。奖学金的一个重要方面是有机会扩大我的专业知识，包括其他领域，特别是入侵检测的数学建模。目前，计算机安全领域基本上缺乏这种专业知识。我相信，该奖学金将让我处于一个非常有利的位置，开始在运筹学，优化和计算机安全之间的交叉点一个独特的研究领域。该奖学金是由工业合作者（100，000+）和诺丁汉大学（70，000+和博士生）支持。

项目成果

Artificial Immune Systems (2010)

人工免疫系统 (2010)

• DOI: 10.48550/arxiv.1006.4949
• 发表时间: 2010
• 作者: Greensmith J

Rule generalisation in intrusion detection systems using SNORT

• DOI: 10.1504/ijesdf.2007.013596
• 发表时间: 2007-01-01
• 期刊: INTERNATIONAL JOURNAL OF ELECTRONIC SECURITY AND DIGITAL FORENSICS
• 影响因子: 0.8
• 作者: Aickelin, Uwe;Twycross, Jamie;Hesketh-Roberts, Thomas
• 通讯作者: Hesketh-Roberts, Thomas

The Deterministic Dendritic Cell Algorithm

确定性树突状细胞算法

• DOI: 10.2139/ssrn.2831280
• 发表时间: 2008
• 期刊: SSRN Electronic Journal
• 作者: Greensmith J