Browsing by Author "Lin, Shun-Chieh"

Now showing 1 - 3 of 3

A decision support system for constructing an alert classification model
(2009-10-01)
Jan, Nien-Yi
;
Lin, Shun-Chieh
;
Tseng, Shian-Shyong
;
Lin, Nancy P.
;
資訊工程學系
As the rapid growth of network attacking tools, patterns of network intrusion events change gradually. Although many researches had been proposed to analyze network intrusion behaviors in accordance with low-level network data, they still suffer a large mount of false alerts and result in difficulties for network administrators to discover useful information from these alerts. To reduce the load of administrators, by collecting and analyzing unknown attack sequences systematically, administrators can do the duty of fixing the root causes. Due to the different characteristics of each intrusion, none of analysis methods can correlate IDS alerts precisely and discover all kinds of real intrusion patterns. Therefore, an alert-based decision support system is proposed in this paper to construct an alert classification model for on-line network behavior monitoring. The architecture of decision support system consists of three phases: Alert Preprocessing Phase, Model Constructing Phase and Rule Refining Phase. The Alert Processing Phase is used to transform IDS alerts into alert transactions with specific data format as alert subsequences, where an alert sequence is a kind of well-aggregated alert transaction format to discover intrusion behaviors. Besides, the Model Constructing Phase is used to construct three kinds of rule classes: normal rule classes, intrusion rule classes and suspicious rule classes, to filter false alert patterns and analyze each existing or unknown alert patterns; each rule class represents a set of classification rules. Normal rule class, a set of false alert classification rules, can be trained by using sequential pattern mining approach in an attack-free environment. Intrusion rule classes, a set of known intrusion classification rules, and suspicious rule classes, a set of novel intrusion classification rules, can be trained in a simulated attacking environment using several well-known rootkits and labeling by experts. Finally, the Rule Refining Phase is used to change the classification flags of alert sequence across different time intervals. According to the urgent situations of different levels, Network administrators can do event protecting or vulnerability repairing, even or cause tracing of attacks. Therefore, the decision support system can prevent attacks effectively, find novel attack patterns exactly and reduce the load of administrators efficiently. Crown Copyright (C) 2009 Published by Elsevier Ltd. All rights reserved.
Dynamic EMCUD for knowledge acquisition
(2008-02-01)
Lin, Shun-Chieh
;
Tseng, Shian-Shyong
;
Teng, Chia-Wen
;
資訊工程學系
;
Department of Computer Science
Due to the knowledge explosion, the new objects will be evolved in a dynamic environment. Hence, the knowledge can be classified into static knowledge and dynamic knowledge. Although many knowledge acquisition methodologies, based upon the Repertory Grid technique, have been proposed to systematically elicit useful rules from static grid from domain experts, they lack the ability of grid evolution to incrementally acquire the dynamic knowledge of new evolved objects. In this paper, we propose dynamic EMCUD, a new Repertory Grid-based knowledge acquisition methodology to elicit the embedded meanings of knowledge (embedded rules bearing on m objects and k object attributes), to enhance the ability of original EMCUD to iteratively integrate new evolved objects and new added attributes into the original Acquisition Table (AT) and original Attribute Ordering Table (AOT). The AOT records the relative importance of each attribute to each object in EMCUD to capture the embedded meanings with acceptable certainty factor value by relaxing or ignoring some minor attributes. In order to discover the new evolved objects, a collaborative framework including local knowledge based systems (KBSs) and a collaborative KBS is proposed to analyze the correlations of inference behaviors of embedded rules between multiple KBSs in a dynamic environment. Each KBS monitors the frequent inference behaviors of interesting embedded rules to construct a small AT increment to facilitate the acquisition of dynamic knowledge after experts confirming the new evolved objects. Moreover, the significance of knowledge may change after a period of time, a trend of all attributes to each evolved object is used to construct a new AOT increment to help experts automatically adjust the relative importance of each attribute to each object using time series analysis approach. Besides, three cases are considered to assist experts in adjusting the certainty factor values of the dynamic knowledge of the new evolved objects from the collection of inference logs in the collaborative KBS. To evaluate the performance of dynamic EMCUD in incrementally integrating new knowledge into the knowledge base, a worm detection prototype system is implemented. (c) 2006 Elsevier Ltd. All rights reserved.
VODKA: Variant objects discovering knowledge acquisition
(2009-03-01)
Tseng, Shlan-Shyong
;
Lin, Shun-Chieh
;
資訊工程學系
;
Department of Computer Science
Many knowledge acquisition methodologies have been proposed to elicit rules systematically with embedded meaning from domain experts. But. none of these methods discusses the issue of discovering new modified objects in it traditional classification knowledge based system. For experts to sense the occurrence of new variants and revise the original rule base, to collect sufficient relevant information becomes increasingly important in the knowledge acquisition field. In this paper, the method variant objects discovering knowledge acquisition (VODKA) we proposed includes three stages (log collecting stage, knowledge learning stage, and knowledge polishing stage) to facilitate the acquisition of new inference rules for a classification knowledge based system. The originality of VODKA is to identify these new modified objects, the variants, from the way that the existing knowledge based system fails in applying sonic rules with low certainly degree. In this method, we try to classify the current new evolving object identified according to its attributes and their corresponding values. According to the analysis of the collected inference logs, one of the three recommendations (including adding it new attribute-value of ail attribute, modifying the data type of an attribute, Or adding it new attribute) will be suggested to help experts observe and characterize the new confirmed variants. VODKA requires E-EMCUD (extended embedded meaning capturing and uncertainty deciding). EMCUD is it knowledge acquisition system which relics oil the repertory grids technique to manage objcet/attribute-values tables and to produce inferences rules from these tables. The E-EMCUD We Used here is a new version of EMCUD to update existing tables by adding new objects or new attributes and to adapt the original embedded rules. Here, a computer worm detection prototype is implemented to evaluate the effectiveness of VODKA. The experimental results show that new worm variants could be discovered from inference logs to customize the corresponding detection rules for computer worms. Moreover, VODKA can be applied to the e-learning area to learn the variant learning behaviors of Students and to reconstruct the teaching materials in improving the performance of e-learners. (C) 2007 Elsevier Ltd. All rights reserved.