Gastaldo / Zunino / Corchado Computational Intelligence in Security for Information Systems

CISIS'09, 2nd International Workshop Burgos, Spain, September 2009 Proceedings
1. Auflage 2009
ISBN: 978-3-642-04091-7
Verlag: Springer
Format: PDF
Kopierschutz: 1 - PDF Watermark

E-Book, Englisch, Band 63, 216 Seiten

Reihe: Advances in Intelligent and Soft Computing

The Second International Workshop on Computational Intelligence for Security in Information Systems (CISIS'09) presented the most recent developments in the - namically expanding realm of several fields such as Data Mining and Intelligence, Infrastructure Protection, Network Security, Biometry and Industrial Perspectives. The International Workshop on Computational Intelligence for Security in Infor- tion Systems (CISIS) proposes a forum to the different communities related to the field of intelligent systems for security. The global purpose of CISIS conferences has been to form a broad and interdisciplinary meeting ground offering the opportunity to interact with the leading industries actively involved in the critical area of security, and have a picture of the current solutions adopted in practical domains. This volume of Advances in Intelligent and Soft Computing contains accepted - rd th pers presented at CISIS'09, which was held in Burgos, Spain, on September 23 -26 , 2009. After a through peer-review process, the International Program Committee selected 25 papers which are published in this workshop proceedings. This allowed the Scientific Committee to verify the vital and crucial nature of the topics involved in the event, and resulted in an acceptance rate close to 50% of the originally submitted manuscripts.

Autoren/Hrsg.

Gastaldo, Paolo

Zunino, Rodolfo

Corchado, Emilio

Inhaltsverzeichnis

1;Title Page;2
2;Preface;6
3;Organization;7
4;Table of Contents;12
5;Data Mining and Intelligence;15
5.1;A Data Mining Based Analysis of Nmap Operating System Fingerprint Database;15
5.1.1;Introduction;15
5.1.2;OS Fingerprinting and Nmap;16
5.1.3;Self-organizing Maps;17
5.1.4;Growing Neural Gas;18
5.1.5;K-Means;19
5.1.6;Applications;20
5.1.7;Conclusions;21
5.1.8;References;22
5.2;Knowledge System for Application of Computer Security Rules;23
5.2.1;Introduction;23
5.2.2;Models for L;25
5.2.3;Validity of the Formulas in the Knowledge System;30
5.2.4;Conclusions;30
5.2.5;References;30
5.3;Clustering of Windows Security Events by Means of Frequent Pattern Mining;32
5.3.1;Introduction;32
5.3.2;Related Work;33
5.3.3;Analysis of Windows Security Event Logs;34
5.3.4;Clustering Event Sources;35
5.3.4.1;Learning the Application Domain;35
5.3.4.2;Feature Selection;36
5.3.4.3;Application of Clustering Techniques;36
5.3.5;Conclusions and Ongoing Challenges;39
5.3.6;References;39
5.4;Text Clustering for Digital Forensics Analysis;41
5.4.1;Introduction;41
5.4.2;Textual Data Extraction;42
5.4.3;Text Clustering;43
5.4.3.1;Knowledge Base Representation;43
5.4.3.2;Clustering Framework;43
5.4.4;Forensic Analysis on Enron Dataset;45
5.4.5;References;48
6;Infrastructure Protection;49
6.1;A Preliminary Study on SVM Based Analysis of Underwater Magnetic Signals for Port Protection;49
6.1.1;Introduction;49
6.1.2;The “MACmag” Magnetic Subsystem;50
6.1.3;Support Vector Machines for Classification;52
6.1.4;Experimental Results;53
6.1.5;Conclusions;55
6.1.6;References;56
6.2;Fuzzy Rule Based Intelligent Security and Fire Detector System;57
6.2.1;Introduction;57
6.2.2;Mechanism of Fire Occurred;58
6.2.3;Design of Intelligent Multi-sensor Fire Detector;58
6.2.3.1;Work Principle of Temperature Sensor;58
6.2.3.2;Hardware Design of the Fire Detector;59
6.2.3.3;Software Design of the Fire Detector;60
6.2.4;Experiments and Results;61
6.2.5;Conclusions;62
6.2.6;References;63
6.3;A Scaled Test Bench for Vanets with RFID Signalling;64
6.3.1;Introduction;64
6.3.2;Signalling Using RFID;65
6.3.3;Behavioural Model;66
6.3.4;Scaled Vehicle Architecture;67
6.3.4.1;System Board (Main Board);68
6.3.4.2;Sensor Processing Board (Coprocessor Board);69
6.3.5;Conclusions;69
6.3.6;References;70
6.4;A SVM-Based Behavior Monitoring Algorithm towards Detection of Un-desired Events in Critical Infrastructures;71
6.4.1;Introduction;71
6.4.2;The Proposed Algorithm Design;72
6.4.3;Experimental Results and Concluding Remarks;75
6.4.4;References;77
7;Network Security;79
7.1;Design and Implementation of High Performance Viterbi Decoder for Mobile Communication Data Security;79
7.1.1;Introduction;79
7.1.1.1;An Overview;79
7.1.2;Viterbi Decoding Algorithm;80
7.1.3;Our Design;81
7.1.3.1;Branch Selection Unit;82
7.1.3.2;Trace-Back Unit;83
7.1.4;Experimental Approach;84
7.1.5;Conclusion;86
7.1.6;References;86
7.2;An Adaptive Multi-agent Solution to Detect DoS Attack in SOAP Messages;87
7.2.1;Introduction;87
7.2.2;DoS Attacks Description;88
7.2.3;An Agent Based Architecture;89
7.2.4;Results and Conclusions;92
7.2.5;References;93
7.3;A Self-learning Anomaly-BasedWeb Application Firewall;95
7.3.1;Introduction;95
7.3.2;SystemOverview;96
7.3.2.1;Architecture;96
7.3.2.2;Normal Behavior Description;97
7.3.2.3;Detection Process;98
7.3.3;Experiments;99
7.3.3.1;Case Study:Web Shopping;99
7.3.3.2;XML File Generation;99
7.3.3.3;Artificial Traffic Generation;99
7.3.3.4;Training Phase;100
7.3.3.5;Test Phase;100
7.3.3.6;Results;100
7.3.4;Limitations and Future Work;101
7.3.5;Conclusions;102
7.3.6;References;102
7.4;An Investigation of Multi-objective Genetic Algorithms for Encrypted Traffic Identification;103
7.4.1;Introduction;103
7.4.2;Previous Work;104
7.4.3;Methodology;104
7.4.4;Results;107
7.4.5;Conclusions;109
7.4.6;References;110
7.5;A Multi-objective Optimisation Approach to IDS Sensor Placement;111
7.5.1;Introduction;111
7.5.2;Related Work;112
7.5.3;Experimental Setup and Evaluation;113
7.5.3.1;Network Simulation;113
7.5.3.2;Fitness Measurement;114
7.5.3.3;Sensor Placement Representation;115
7.5.3.4;Parameters for the Search;115
7.5.3.5;Experiment Results;116
7.5.4;Conclusions and Further Work;117
7.5.5;References;118
7.6;Towards Ontology-Based Intelligent Model for Intrusion Detection and Prevention;119
7.6.1;Introduction;119
7.6.2;Previous Work;120
7.6.3;Ontology and Semantic Model;120
7.6.4;Classifier and Pattern Recognition Model;122
7.6.5;Conclusions and Future Work;125
7.6.6;References;125
7.7;Ontology-Based Policy Translation;127
7.7.1;Introduction;127
7.7.2;Background and RelatedWork;128
7.7.3;Case Study;129
7.7.4;Our Approach;129
7.7.4.1;The Security Ontology;131
7.7.4.2;An Example of Policy Translation;134
7.7.5;Implementation;134
7.7.6;Conclusion and Future Work;135
7.7.7;References;135
7.8;Automatic Rule Generation Based on Genetic Programming for Event Correlation;137
7.8.1;Introduction;137
7.8.2;Related Work;138
7.8.2.1;Intrusion Detection;138
7.8.2.2;Event Correlation Techniques;138
7.8.2.3;OSSIM Correlation;139
7.8.2.4;Evolutionary Computation;139
7.8.3;Applying Genetic Programming to Event Correlation;140
7.8.3.1;Experimental Environment;140
7.8.3.2;Preliminary Format Definition;140
7.8.3.3;Representation of the Individual;141
7.8.3.4;Genetic Operators;142
7.8.3.5;Training and Fitness Function;142
7.8.4;Conclusions and Research Directions;143
7.8.5;References;143
7.9;Learning Program Behavior for Run-Time Software Assurance;145
7.9.1;Introduction;145
7.9.2;Edit Distance Based Clustering;146
7.9.3;Leveraging State Information;148
7.9.4;A Hybrid Approach;149
7.9.5;Related Work;150
7.9.6;Conclusions;151
7.9.7;References;152
7.10;Multiagent Systems for Network Intrusion Detection: A Review;153
7.10.1;Introduction;153
7.10.2;IDSs Based on Agents;155
7.10.3;Mobile Agents;158
7.10.4;Conclusions;161
7.10.5;References;161
8;Biometry;165
8.1;Multimodal Biometrics: Topics in Score Fusion;165
8.1.1;Introduction;165
8.1.2;Taxonomy of Biometric Systems;166
8.1.2.1;Unimodal Systems;166
8.1.2.2;Multimodal Systems;166
8.1.3;Score Fusion;167
8.1.4;Score Normalization;168
8.1.5;Experimental Methodology and Results;169
8.1.6;Conclusions;171
8.1.7;References;171
8.2;Security Efficiency Analysis of a Biometric Fuzzy Extractor for Iris Templates;173
8.2.1;Introduction;173
8.2.2;Review of a Biometric Fuzzy Extractor for Iris Templates;174
8.2.2.1;Enrollment Phase;175
8.2.2.2;Verification Phase;175
8.2.3;Security Efficiency Analysis;176
8.2.3.1;Intra-user Variability: FRR;177
8.2.3.2;Inter-user Variability: FAR;178
8.2.4;Conclusions and Future Work;179
8.2.5;References;180
8.3;Behavioural Biometrics Hardware Based on Bioinformatics Matching;181
8.3.1;Introduction;181
8.3.2;Behavioural Bioinformatics Detection of Masquerading Attack;182
8.3.3;Bioinformatics Appliance to Intrusion Detection;183
8.3.4;Software and Hardware Implementation;184
8.3.5;Results and Discussion;186
8.3.6;Conclusion;187
8.3.7;References;188
9;Industrial Perspectives;189
9.1;Robust Real-Time Face Tracking Using an Active Camera;189
9.1.1;Introduction;189
9.1.2;Related Work;190
9.1.3;Notations Used;190
9.1.4;Main Procedure;191
9.1.4.1;Active Camera Module;192
9.1.4.2;Detection and Tracking Module;194
9.1.5;Results;195
9.1.6;Conclusion and Future Work;195
9.1.7;References;196
9.2;An Approach to Centralized Control Systems Based on Cellular Automata;197
9.2.1;Introduction;197
9.2.2;Cellular Automaton, Rule 184 and Traffic Flow;198
9.2.3;Defining the Centralized Control System;199
9.2.4;Conclusions;200
9.2.5;References;200
9.3;Intelligent Methods and Models in Transportation;202
9.3.1;Introduction;202
9.3.2;Models and Algorithms in Optimization of Bus Routes and Frequencies;203
9.3.3;Minimizing the Total Time for Transfer Passengers and Fleet Size Required;204
9.3.3.1;First Proposal;205
9.3.3.2;Second Proposal;205
9.3.3.3;Third Proposal;206
9.3.3.4;Fourth Proposal;206
9.3.4;Proposal for Multi-objective Optimization Problem;206
9.3.5;Other Proposals;207
9.3.6;Proposal in this Paper: Multi-objective Function. Optimizer in Two Levels. Genetic Algorithms;207
9.3.7;Conclusions;209
9.3.8;References;209
9.4;Knowledge Based Expert System for PID Controller Tuning under Hazardous Operating Conditions;211
9.4.1;Introduction;211
9.4.2;PID Controller Conceptual Modeling;212
9.4.3;Deduction of the Rules;213
9.4.4;Knowledge Schema for PID Tuning;215
9.4.5;Conclusions;217
9.4.6;References;218
10;Author Index;219