System-Smart Intrusion Detection

系统-智能入侵检测

• 批准号: EP/E028128/1
• 负责人: John Clark
• 金额: $ 29.08万
• 依托单位: University of York
• 依托单位国家: 英国
• 项目类别: Research Grant
• 财政年份: 2007
• 资助国家: 英国
• 起止时间: 2007 至 无数据
• 项目状态: 已结题
• 来源: https://gtr.ukri.org/projects?ref=EP%2FE028128%2F1
• 关键词: System; Smart; Intrusion; Detection

Criminal use of the national network infrastructure is commonplace: blackmail, and phishing (social engineering) alone are significant in economic terms. These activities exploit network hosts that have been previously subverted, by attacks that are becoming increasingly sophisticated. Existing Intrusion Detection Systems (IDSs) are unable to detect new or subtle attacks, and deploying IDS sensors in higher volumes results in high report volumes, but little more effectiveness. This project will show that by taking a system design approach to the choice and configuration of sensors, together with network deployment strategies that allow flexible sensor placement, it is possible to substantially improve the detection of subtle attacks. This work does not focus on improvements to individual intrusion detection components; but rather exploits the synergy that can be obtained by combining the strengths of different types of sensor, in a holistic approach to intrusion management design.

利用国家网络基础设施进行犯罪活动是司空见惯的：仅勒索和网络钓鱼（社会工程）就具有重要的经济意义。这些活动利用了以前被越来越复杂的攻击破坏的网络主机。现有的入侵检测系统（IDS）无法检测到新的或微妙的攻击，并部署IDS传感器在更高的卷导致高的报告量，但没有更多的有效性。该项目将表明，通过采用系统设计方法来选择和配置传感器，以及允许灵活的传感器放置的网络部署策略，可以大大提高对微妙攻击的检测。这项工作并不侧重于改进个别入侵检测组件，而是利用协同作用，可以通过结合不同类型的传感器的优势，在一个整体的方法来入侵管理设计。

项目成果

Evolutionary computation techniques for intrusion detection in mobile ad hoc networks

• DOI: 10.1016/j.comnet.2011.07.001
• 发表时间: 2011-10
• 期刊: Comput. Networks
• 作者: Sevil Şen;John A. Clark

Accumulating Evidence of Insider Attacks

积累内部攻击的证据

• 发表时间: 2009
• 作者: N/a Chivers

Characterising intrusion detection sensors

表征入侵检测传感器

• DOI: 10.1016/s1353-4858(08)70107-7
• 发表时间: 2008
• 期刊: Network Security
• 作者: Shaikh S

A Multi-objective Optimisation Approach to IDS Sensor Placement

IDS 传感器放置的多目标优化方法

• 作者: John Andrew Clark (Author)

Knowing who to watch: Identifying attackers whose actions are hidden within false alarms and background noise

知道要监视谁：识别其行为隐藏在误报和背景噪音中的攻击者

• DOI: 10.1007/s10796-010-9268-7
• 发表时间: 2010
• 期刊: Information Systems Frontiers
• 影响因子: 5.9
• 作者: Chivers H