Current Issue

25 February 2006, Volume 27 Issue 2

Previous Issue    Next Issue

Papers

Anomaly detection of large scale network based on data streams

Jun ZHENG,Ming-zeng HU,Xiao-chun YUN,Zhong ZHENG

2006, 27(2):  1-8.  doi:1000-436X(2006)02-0001-08

Asbtract ( 0 )   HTML ( 1)   PDF (620KB) ( 561 )   Knowledge map   

Figures and Tables | References | Related Articles | Metrics

The anomaly detection algorithms of the large scale network (LSN) were required to analysis the vast network traffic of G bit level in real-time and on-the-fly.A novel monitoring mechanism of LSN anomaly detection based on the data stream approach was proposed.The main contributions included:the sketch data structure and the frequent sketch algorithm of data streams were designed for anomaly detection of LSN.Optimized query methods were designed for customizing the security monitoring and detection policy with the correlations of multi data streams.The data reduction was proposed to make it possible that the whole network traffic character could be got using a few of special data streams.The experiments of the real networking environments validate the effectivity of LSN anomaly detection methods.

Frequent items maintaining algorithms in network traffic analysis

UA-ning D,Xiao-ming CHENG

2006, 27(2):  9-15.  doi:1000-436X(2006)02-0009-07

Asbtract ( 0 )   HTML ( 1)   PDF (392KB) ( 185 )   Knowledge map   

Figures and Tables | References | Related Articles | Metrics

Maintaining frequent items in infinite data stream was to produce a list of items with their frequencies exceeding a threshold over a stream of current length n.It was quite useful in network traffic analyzing.After studying the demand of network analyzing systems,a packet stream analyzing model and a definition of frequent items maintaining problem was provided.An improved frequent items maintaining algorithm,which kept the deficient synopsis in limited memory was proposed based on analysis of existing algorithms.Experiments reveal that improved algorithm fulfill the need of high-speed TCP/IP packet stream.

Approach for topology partitioning in parallel network simulation

Xiao-feng WANG,Bin-xing FANG,Xiao-chun YUN,Hong-li ZHANG

2006, 27(2):  16-21.  doi:1000-436X(2006)02-0016-06

Asbtract ( 0 )   HTML ( 1)   PDF (278KB) ( 325 )   Knowledge map   

Figures and Tables | References | Related Articles | Metrics

To improve the usability and running efficiency of the parallel network simulation,an approach for topology partitioning based on load estimation was realized:first,the relative load values of nodes and links,estimated according to their core levels in the topology map,were treated as their weights;then,the simulation task was partitioned by the graph partitioning tool.Experiments showed that this partitioning method could improve the performance of simulation by 16.4% compared to the partitioning method with no weights.Simulation of worms based on the real topology gathered via network measurement proves that the partitioning method is suitable for real large-scale network topology and can be used to simulate large-scale network security incidents.

Constructing optimized Boolean functions

Wei CHEN,Yi-xian YANG,Xin-xin NIU

2006, 27(2):  22-28.  doi:1000-436X(2006)02-0022-07

Asbtract ( 0 )   HTML ( 1)   PDF (560KB) ( 261 )   Knowledge map   

Figures and Tables | References | Related Articles | Metrics

Considering connections of characteristics,aiming construction for the optimized Boolean functions,new method based on Bent function,discrete Walsh spectrum and characteristics matrices were presented by concatenating,breaking,and revising output sequence conditionally.This new construction can be used to construct kinds of functions satisfying different design criteria as deeds.

Study on the destination selection methods in router-level Internet topology measurement

Yu JIANG,Song HE

2006, 27(2):  29-34.  doi:1000-436X(2006)02-0029-06

Asbtract ( 48 )   HTML ( 1)   PDF (350KB) ( 256 )   Knowledge map   

Figures and Tables | References | Related Articles | Metrics

In order to improve the completeness of router level Internet topology measurement,the notion of self-contained destination set was defined first,and then existing destination selection methods were overviewed.After discussing the limitation of these existing methods,a viewpoint that the stub-network instead of the IP address should be taken as the sampling granularity was put forward,and a self-contained destination selection method that was termed all stub-networks coverage and two-step random selection was presented.Experiments show that this self-contained destination selection method guarantees the measurement completeness from the perspective of destination.

Real-time anomaly detection model for worm mails in high-speed network

Hao LUO,Bin-xing FANG,Xiao-chun YUN,Xin,XINYi WANG

2006, 27(2):  35-41.  doi:1000-436X(2006)02-0035-07

Asbtract ( 45 )   HTML ( 1)   PDF (403KB) ( 305 )   Knowledge map   

Figures and Tables | References | Related Articles | Metrics

An Email flow anomaly detection method based on leaky integrate-and-fire model was presented for detecting flow anomaly in the process of mail worm propagation.According to the day period and week period properties of the mail flow,Firstly the Hellinger distance between current mail flow and history statistic was calculated,and then integrate the Hellinger distance with Leaky integrate-and-fire method.In this way,the slice variety of flow was accumulated in the mail worm propagation slow start phase to archive the capability of the anomaly detection before the worm enter the fast spread phase.As this method only checks the mail flow information,it is suitable for high speed network mail flow anomaly detection.

Research on multi-objective grid task scheduling algorithms based on survivability and Makespan

Shu-peng WANG,Xiao-chun YUN,Xiang-zhan YU

2006, 27(2):  42-49.  doi:1000-436X(2006)02-0042-08

Asbtract ( 84 )   HTML ( 1)   PDF (459KB) ( 638 )   Knowledge map   

Figures and Tables | References | Related Articles | Metrics

In the complex and dynamic Grid system,failure of resources was very common.And the failure of Grid re-sources can halt the execution of tasks on them.To mitigate this problem,the concept of tasks survivability was pro-posed,a local objective function which can be adjusted was proposed by incorporating the makespan and survivability of tasks and maximizing the survivability of tasks was devised.The simulation results confirm that the scheduling algorithm can trade off these two objectives,and can satisfy different demand by adjusting the weight parameter in the objective function.So it can be applied in the complex Grid computing environment well.

Hierarchical AAA in mobile IPv6 networks

Wen-shu XIAO,Yu-jun ZHANG,Zhong-cheng LI

2006, 27(2):  50-55.  doi:1000-436X(2006)02-0050-06

Asbtract ( 39 )   HTML ( 4)   PDF (388KB) ( 46 )   Knowledge map   

Figures and Tables | References | Related Articles | Metrics

There are many problems of integrating AAA with mobile IPv6 in the next generation Internet.A new hierarchical AAA architecture was proposed to handle these problems.The combined authentication-registration procedure,and the local security association (SA) negotiation were performed to enhance the performance of AAA combined mobility.The proposal is proved to be no less secure and more efficient than the scheme proposed by IETF.

User-habit based early warning of worm

Ping WANG,Bin-xing FANG,Xiao-chun YUN,Da-wei PENG

2006, 27(2):  56-65.  doi:1000-436X(2006)02-0056-10

Asbtract ( 30 )   HTML ( 1)   PDF (577KB) ( 247 )   Knowledge map   

Figures and Tables | References | Related Articles | Metrics

On the burst-out of massive worm,the overwhelming flow caused by random scanning would temporarily alter the behavior representation of users.Therefore,it was consequently reasonable to conclude that statistics and classify the user habit would certainly help in the detection of worm efficiently.The behavior of user was analyzed deeply,a new approach for early warning of worms was proposed,and a user-based early warning system was realized.Because of the diversity of user habit,several application models can be derived from the model,it has strong direction signification.

Policy-adaptive capability inheritance algorithm consistent with POSIX standard

Qing-ni SHEN,Si-han QING,Ye-ping HE,Jian-jun SHEN

2006, 27(2):  66-72.  doi:1000-436X(2006)02-0066-07

Asbtract ( 45 )   HTML ( 1)   PDF (354KB) ( 141 )   Knowledge map   

Figures and Tables | References | Related Articles | Metrics

In order to support POSIX capability mechanism,many secure operating systems provided individual capability inheritable algorithms.These algorithms were only applicable to specified least privilege control policies,and had such defects as semantic conflicts and no defined security-objectives.So they couldn't flexibly support for implementing diversified privilege policies for different requirements.Based on the analysis of some existing algorithms,a new capability inheritance algorithm was proposed,which introduced the policy-relevant capability control variable and the trusted application attribution.The implementation of the algorithm in ANSHENG secure operating system demonstrates that this algorithm provides such properties as policy-adaptability and usability,the formal analysis and verification of this algorithm proves that it supports a secure operating system to meet basic security theorems of the privilege policies enforced in it.

Trust-driven job scheduling heuristics for computing grid

Wei-zhe ZHANG,Xin-ran LIU,Xiao-chun YUN,Hong-li ZHANG,Ming-zeng HU,Kai-peng LIU

2006, 27(2):  73-79.  doi:1000-436X(2006)02-0073-07

Asbtract ( 49 )   HTML ( 3)   PDF (394KB) ( 352 )   Knowledge map   

Figures and Tables | References | Related Articles | Metrics

Currently existing grid scheduling algorithms largely ignore the impact of trust mechanism,which made their applicability in a realistic environment rather doubtful.Based on the grid trust model and trust utilization functions,a trust-driven grid job scheduling problem was proposed.Trust-driven Min-min and Sufferage job scheduling heuristics were presented,which were extended based on traditional job scheduling strategies.The algorithms were evaluated with large scale simulation.Simulation result demonstrates trust-driven heuristics perform better than time-driven heuristic on average trust utility and total trust utility.

Research on penalty mechanism against selfish behaviors in anonymous communication system

Jin-qiao SHI,Xiao-ming CHENG

2006, 27(2):  80-86.  doi:1000-436X(2006)02-0080-07

Asbtract ( 78 )   HTML ( 1)   PDF (534KB) ( 234 )   Knowledge map   

Figures and Tables | References | Related Articles | Metrics

The free-riding problem caused by the selfish behaviors of the anonymous communication system participants was studied in this paper.The effect of the selfish node number on anonymity degree and efficiency of the anonymous systems was statistically analyzed and the analytical results illustrated that neither the anonymity degree nor efficiency could be guaranteed when there existing a lot of selfish nodes.A penalty mechanism based on differential service was proposed to discourage the selfish behaviors of the participants.Theoretical analysis shows that the systems with penalty mechanism can punish the selfish nodes by decreasing of their efficiency,without loss of their anonymity.

Chinese named entity identification using cascaded hidden Markov model

Hong-kui YU,Hua-ping ZHANG,Qun LIU,Xue-qiang LV,Shui-cai SHI

2006, 27(2):  87-94.  doi:1000-436X(2006)02-0087-08

Asbtract ( 179 )   HTML ( 11)   PDF (504KB) ( 2355 )   Knowledge map   

Figures and Tables | References | Related Articles | Metrics

An approach for Chinese named entity identification using cascaded hidden Markov model,which aimed to incorporate person name,location name,organization name recognition into an integrated theoretical frame was presented.Simple named entity was recognized by lower HMM model after rough segmentation and complex named entity such as person name,location name and organization name was recognized by higher HMM model using role tagging.In the test on large realistic corpus,its F-1 measure of person name,location name and organization name was 92.55%,94.53% and 86.51%.In the first international word segmentation bakeoff held by SIGHAN (the ACL Special Interest Group on Chinese Language Processing) in 2003.ICTCLAS,which name entity identification base on this model achieved excellent score.

Research on smart authentication authorization and accounting in next generation network

Hong ZHANG

2006, 27(2):  95-99.  doi:1000-436X(2006)02-0095-05

Asbtract ( 27 )   HTML ( 1)   PDF (333KB) ( 276 )   Knowledge map   

Figures and Tables | References | Related Articles | Metrics

With the fast development of Internet,there were more and more network access methods and network services.But too many accounts were inconvenient for users to perform the AAA (authentication,authorization and accounting),and many service providers hadn't appropriate AAA mechanisms.In order to solve these problems,the smart AAA was introduced.The architecture of the smart AAA was designed,and SOAP based SAML was used to exchange security information between smart AAA and other service providers.Analysis indicates the smart AAA will provide the universal and intelligent AAA services for both users and operators.

Technical Reports

Simulating method for TCP aggregated traffic of large scale network

Yu-feng CHEN,Ya-bo DONG,Dong-ming LU,Yun-he PAN

2006, 27(2):  100-106.  doi:1000-436X(2006)02-0100-07

Asbtract ( 37 )   HTML ( 3)   PDF (421KB) ( 530 )   Knowledge map   

Figures and Tables | References | Related Articles | Metrics

To obtain a trade-off between veracity and complexity when simulating TCP traffic of large-scale network,the TCP aggregated traffic of access network in the gateway was proposed as simulated object,instead of the traffic generated at the individual host or session level.Based on the self-similarity of application-level and network-level,the TCP aggregated traffic model was proposed due to the self-similarity of network traffic.The self-similar traffic at application level was generated by aggregating many ON/OFF sources following Pareto distribution.The aggregated transmission control was put on the traffic at network transmission level based on the mechanism of TCP protocol.Compared with the real data collected from a Network Exchange Center,the simulating result shows the validity of the model from the criteria of traffic load proportion,traffic self-similarity,and the packet loss ratio.

Security architecture to support multiple security policies based on access control space

Li-ping LI,Si-han QING,Ye-ping HE,Qing-ni SHEN

2006, 27(2):  107-112.  doi:1000-436X(2006)02-0107-06

Asbtract ( 31 )   HTML ( 1)   PDF (402KB) ( 57 )   Knowledge map   

Figures and Tables | References | Related Articles | Metrics

In order to solve the problems of policy reusability and policy co-existence in LSM,a new security architecture ELSM is proposed.It introduced Model Combiner as main module to implement module stack management and module decision management.Module decision is based on access control space as policy specification for general support.The design of ELSM and the analysis of its implementation in Ansheng OS prove its effectiveness.

Efficient keyword spotting system for information retrieval

Jun LUO,Zhi-jian OU

2006, 27(2):  113-118.  doi:1000-436X(2006)02-0113-06

Asbtract ( 28 )   HTML ( 2)   PDF (455KB) ( 813 )   Knowledge map   

Figures and Tables | References | Related Articles | Metrics

A new two-stage keyword spotting system was proposed based on syllable graph for audio information retrieval task,which could efficiently spot the interesting words in mass speech data,thus serve for the national security.It comprised two stages – preprocessing and searching.In the preprocessing stage,the audio data was recognized into syllable graph which included high accuracy syllable candidates,and unsupervised MLLR (maximum likelihood linear regression) adaptation was carried out iteratively to further improve the accuracy of the syllable graph.In the searching stage,to answer the frequent queries from users,searching for matched keywords was only scanned in the graph for likely syllable strings.A forward-backward algorithm based on syllable N-grammar was used to calculate confidence measures for further filtering of the searching result.Experimental results show the system achieved good performances in both recall rate and accuracy rate,and in the searching stage only 0.01 times of real time is needed,which can meet the demand for fast retrieval.

Network latency clustering for detector placement on macroscopical prewarning

Hui HE,Ming-zeng HU,Xiao-chun YUN,Hong-li ZHANG

2006, 27(2):  119-124.  doi:1000-436X(2006)02-0119-06

Asbtract ( 28 )   HTML ( 1)   PDF (407KB) ( 356 )   Knowledge map   

Figures and Tables | References | Related Articles | Metrics

Research on the network-based and distributed intrusion detection was aroused by the burst-outs of large-scale security events.How to place detection instruments was the key to the detections.The problem of detector placement was turned to that of the clustering of topology graph.A novel bidirectional hierarchical clustering algorithm was put forward,which decreased the amount of result clusters by integration of initial marker selection method based on node out-degree.The simulation results demonstrates that our clustering approaches effectively identify clusters and been employed in the measured real network of the backbone.

Network packet capture oriented INIC design and implementation

Pan-yong ZHANG,Da-wei WANG,Yu ZENG,Jun LI

2006, 27(2):  125-130.  doi:1000-436X(2006)02-0125-06

Asbtract ( 21 )   HTML ( 1)   PDF (359KB) ( 377 )   Knowledge map   

Figures and Tables | References | Related Articles | Metrics

As the rapid growth of network bandwidth,the capability of packet capture has became the bottleneck of whole network security system.To increase the capability of packet capture and decrease the system overhead,a packet capture oriented INIC was proposed.Implemented on high performance embedded system,the INIC apply techniques such as zero-copy,adaptive semi-polling,adaptive polling watchdog to ensure the system efficiency.The result of performance evaluation exposes that the INIC remarkably increases the system's packet capture performance,decreases the host CPU's utilization.

Research and implement on the intrusion tolerant system

Li-hua YIN,Song HE

2006, 27(2):  131-136.  doi:1000-436X(2006)02-0131-06

Asbtract ( 35 )   HTML ( 3)   PDF (437KB) ( 491 )   Knowledge map   

Figures and Tables | References | Related Articles | Metrics

Intrusion tolerance technologies guarantee systems provided essential services by the fullest extent when some intrusions sneak into them.Architecture of an intrusion-tolerant system was proposed and intrusion tolerance technologies in node-level and system-level were practiced.Online intrusion diagnosis and redirection technology were researched to harden the system automatically.Experiment results illuminate that system providing service continuously can be set up and applied in the condition that does not require response time strictly but demands continuous implementation.

Task domain independent speech keyword detection system

Jiang HAN,Xiao-xing LIU,Yong-hong YAN,Peng-yuan ZHANG

2006, 27(2):  137-141.  doi:1000-436X(2006)02-0137-05

Asbtract ( 33 )   HTML ( 1)   PDF (302KB) ( 607 )   Knowledge map   

Figures and Tables | References | Related Articles | Metrics

A multiple scale acoustic modeling framework for task-domain independent keyword spotting was proposed.A large-scale phoneme set was obtained automatically through decision-tree based phoneme clustering,and a large-scale phoneme acoustic context dependent background model was trained accordingly through using standard HMM training framework.The modeling accuracy for filler speech is improved.Under the framework,an efficient searching space construction through using shared HMM state was also described.Experimental results showed that in average absolute 6.9% improvement of keyword recognition accuracy could be obtained.Furthermore an acoustic context neighbor algorithm to measure acoustic confidence and a method of computing candidate keyword likelihood based on proposed multiple-scale acoustic model were proposed and a fusing method based on FLDA was adopted.The effectiveness of acoustic confidence measure is improved significantly.Experimental results showed that absolute 3.0% reduction of equal error rate could be obtained.

Research of a comprehensive IPv4/IPv6 firewall system based on network processor

Ting ZHONG,Yong LIU,Zhi-jun LI,Zhi-guang QIN

2006, 27(2):  142-146.  doi:1000-436X(2006)02-0142-05

Asbtract ( 26 )   HTML ( 3)   PDF (273KB) ( 317 )   Knowledge map   

Figures and Tables | References | Related Articles | Metrics

Research was done on security equipments in the environment of coexistence of IPv4 and IPv6.The firmware and software structure of a Comprehensive IPv4/IPv6 Firewall System was introduced.The design made full use of multithread and multiprocessor characters of Intel IXP2400.The firewall system designed has good performance and is useful in the next generation Internet.

Comprehensive Reviews

Research on DNS authoritative server's performance and security

Yao WANG,Ming-zeng HU,Xiao-chun YUN,Bin LI,Bo-ru YAN

2006, 27(2):  147-152.  doi:1000-436X(2006)02-0147-06

Asbtract ( 45 )   HTML ( 3)   PDF (334KB) ( 697 )   Knowledge map   

Figures and Tables | References | Related Articles | Metrics

Comparing with the top-level domains (TLD) such as the root servers,the local authoritative servers were more vulnerable to device failures and malicious attacks.It was described the existence of authoritative servers and presented a novel domain measurement tool named DNSAuth to collect the information of local authoritative servers automatically.Experiments to the real-life authoritative servers were conducted which highlighting three important aspects:the distribution,the geographic location and their impacts on performance and security.According to five representative attributes,the authoritative servers of China Top100 websites were evaluated and the result shows that only 32% of all the servers act better in performance and security.

Research on analysis model of information systems survivability

Xue-gang LIN,Rong-sheng XU

2006, 27(2):  153-159.  doi:1000-436X(2006)02-0153-07

Asbtract ( 28 )   HTML ( 1)   PDF (327KB) ( 225 )   Knowledge map   

Figures and Tables | References | Related Articles | Metrics

As information systems were open and complex,the entire problem of survivability analysis was divided into three aspects,i.e.environment,system and analysis process,and models of these aspects were given:system hierarchical model was provided based on the concept of workflow;event scenarios were used to describe the impact of environment on systems,and the environment was presented by grading event and adjusting distribution rate of the event set in different grade;based on FSM,system hierarchical state was provided,which converted the traditional direct survivability analysis based on system state into indirect hierarchical analysis.This analysis model can be applied in quantitative analysis of system survivability because of its event quantification.

New network attack classification architecture

Xin-ran LIU

2006, 27(2):  160-167.  doi:1000-436X(2006)02-0160-08

Asbtract ( 97 )   HTML ( 17)   PDF (475KB) ( 1419 )   Knowledge map   

Figures and Tables | References | Related Articles | Metrics

A life cycle oriented network attack classification architecture was presented,described phase characteristics of network attack from platform dependence,vulnerability relevance,attack point,attack result,damage grade,and spread ability,proposed the definition of attribution of above six aspects.Practice proved that this architecture has good suitability,scalability,and acceptability.

Concise Papers

R-Net grid monitoring and alarming system design

Yuan-zhe YAO,Cui-lan DU,Xin-ran LIU,Miao HE,Zi-juan WANG,Lu-wei ZHANG

2006, 27(2):  168-177.  doi:1000-436X(2006)02-0168-10

Asbtract ( 53 )   HTML ( 12)   PDF (464KB) ( 180 )   Knowledge map   

Figures and Tables | References | Related Articles | Metrics

By introducing the concepts,requirements,related standards and work of grid monitoring,some actual monitoring systems were analyzed;expounded the monitoring requirements and their relations,found some problems and deficiencies in grid monitoring.Based on the R-Net grid computing test platform,RNMS (R-Net monitoring system) used some technology such as adaptive sensor control,on-demand measurement,distributed directory service,node group management,mixed data format,which improved the interoperability and scalability,reduced the intrusiveness.Based on the RNMS,an alarming system was designed without more modifying.It shows the RNMS has a good scalability.

Reachability testing algorithm for parallel program in heterogeneous network environment

Wei WANG,Cui-lan DU,Hong-li ZHANG

2006, 27(2):  178-183.  doi:1000-436X(2006)02-0178-06

Asbtract ( 18 )   HTML ( 1)   PDF (461KB) ( 323 )   Knowledge map   

Figures and Tables | References | Related Articles | Metrics

Orienting to difficulty of testing nondeterministic parallel programs,the relationship between message-passing behavior and network performance constraint in grid environment was analyzed,and a new limited reachability testing algorithm was proposed,which was called reachability testing algorithm with network performance constraint,based on classic reachability algorithm.This algorithm only tested those execution paths with high happening possibility,which can reduce the number of those paths to be tested.The testing efficiency is improved,and the testing completeness is held reasonably.

Study on phase transition phenomena in network traffic anomalies

Xin WANG,Li DING

2006, 27(2):  184-188.  doi:1000-436X(2006)02-0184-05

Asbtract ( 25 )   HTML ( 1)   PDF (296KB) ( 74 )   Knowledge map   

Figures and Tables | References | Related Articles | Metrics

Based on the theory of phase transition phenomena,the hypostases of network traffic anomalies with jam were researched.A new congestion mitigating mechanism with motional feedback of Hurst parameter was presented.Technical analysis and analog simulation were used to validate the feasible of the method and advantages over classical approach.It opens up new vista of research for this research direction.