随着工业控制系统(industrial control systems,ICS)的逐渐开放,暴露出严重的脆弱性问题.入侵检测作为重要的安全防御措施,根据误用和行为检测,可及时发现可能或潜在的入侵行为.首先,介绍了ICS的系统架构及特性,并对ICS的安全理念进行阐...随着工业控制系统(industrial control systems,ICS)的逐渐开放,暴露出严重的脆弱性问题.入侵检测作为重要的安全防御措施,根据误用和行为检测,可及时发现可能或潜在的入侵行为.首先,介绍了ICS的系统架构及特性,并对ICS的安全理念进行阐释;其次,依据ICS的特性,给出了对工业控制入侵检测系统(intrusion detection system,IDS)(简写为ICS IDS)的需求和解释;再次,基于检测对象角度,从流量检测、协议检测、设备状态检测3个方面,对现有的ICS IDS技术、算法进行了分类及详细的分析;最后,从检测性能指标、检测技术、检测架构3个方面,对整个ICS IDS的研究趋势进行了展望.展开更多
In order to transmit the secure message, a deterministic secure quantum direct communication protocol which was called ＂Ping-pong＂ protocol was proposed by Bostrrm and Felbinger [Bostrom K, et al. Phys Rev Lett, 200...In order to transmit the secure message, a deterministic secure quantum direct communication protocol which was called ＂Ping-pong＂ protocol was proposed by Bostrrm and Felbinger [Bostrom K, et al. Phys Rev Lett, 2002, 89： 187902]. But the protocol was proved very vulnerable, and can be attacked by an eavesdropper. An improved ＂Ping-pong＂ protocol is presented to overcome the problem. The GHZ state particles are used to detect eavesdroppers, and the classical XOR operation which serves as a one-time-pad is used to ensure the security of the protocol. During the security analysis, the method of the entropy theory is introduced, and three detection strategies are compared quantitatively by using the constraint between the information which an eavesdropper can obtain and the interference introduced. If the eavesdropper gets the full information, the detection rate of the original ＂Ping-pong＂ protocol is 50%; the detection rate of the second protocol which used two particles of EPR pair as detection particles is also 50%; and the detection rate of the presented protocol is 75%. In the end, the security of the pro-posed protocol is discussed. The analysis results show that the improved ＂Ping-pong＂ protocol in this paper is more secure than the other two.展开更多
Mobile ad hoc networking （MANET） has become an exciting and important technology in recent years, because of the rapid proliferation of wireless devices. Mobile ad hoc networks is highly vulnerable to attacks due to...Mobile ad hoc networking （MANET） has become an exciting and important technology in recent years, because of the rapid proliferation of wireless devices. Mobile ad hoc networks is highly vulnerable to attacks due to the open medium, dynamically changing network topology, cooperative algorithms, and lack of centralized monitoring and management point. The traditional way of protecting networks with firewalls and encryption software is no longer sufficient and effective for those features. A distributed intrusion detection approach based on timed automata is given. A cluster-based detection scheme is presented, where periodically a node is elected as the monitor node for a cluster. These monitor nodes can not only make local intrusion detection decisions, but also cooperatively take part in global intrusion detection. And then the timed automata is constructed by the way of manually abstracting the correct behaviours of the node according to the routing protocol of dynamic source routing （DSR）. The monitor nodes can verify the behaviour of every nodes by timed automata, and validly detect real-time attacks without signatures of intrusion or trained data. Compared with the architecture where each node is its own IDS agent, the approach is much more efficient while maintaining the same level of effectiveness. Finally, the intrusion detection method is evaluated through simulation experiments.展开更多
In order to transmit the secure messages,a deterministic secure quantum direct communication protocol,called the "Ping-pong"protocol was proposed by Bostrm and Felbinger [Phys.Rev.Lett.89,187902(2002) ].But ...In order to transmit the secure messages,a deterministic secure quantum direct communication protocol,called the "Ping-pong"protocol was proposed by Bostrm and Felbinger [Phys.Rev.Lett.89,187902(2002) ].But the protocol was proved to have many vulnerabilities,and can be attacked by eavesdroppers.To overcome the problem,an improved security detection strategy which inserts the | 0〉,| 1〉,|+〉and |-〉particles into the messages as the decoy particles randomly in the"Ping-pong"protocol is presented.During the security analysis,the method of the entropy theory is introduced,and three detection strategies are compared quantitatively by using the constraint between the information which eavesdroppers can obtain and the interference introduced.Because of the presence of the trap particles |+〉and |-〉,the detection rate will be no less than 25% when Eve attacks the communication.The security analysis result shows that the efficiency of eavesdropping detection in the presented protocol is higher than the other two,so the detection strategy in the protocol can ensure that the "Ping-pong"protocol is more secure.展开更多
基金supported by the Specialized Research Fund for the Doctoral Program of Higher Education of China (Grant No. 20060013007)the Natural Science Foundation of Beijing (Grant No. 4092029)the National Natural Science Foundation of China (Grant No. 60873001)
文摘In order to transmit the secure message, a deterministic secure quantum direct communication protocol which was called ＂Ping-pong＂ protocol was proposed by Bostrrm and Felbinger [Bostrom K, et al. Phys Rev Lett, 2002, 89： 187902]. But the protocol was proved very vulnerable, and can be attacked by an eavesdropper. An improved ＂Ping-pong＂ protocol is presented to overcome the problem. The GHZ state particles are used to detect eavesdroppers, and the classical XOR operation which serves as a one-time-pad is used to ensure the security of the protocol. During the security analysis, the method of the entropy theory is introduced, and three detection strategies are compared quantitatively by using the constraint between the information which an eavesdropper can obtain and the interference introduced. If the eavesdropper gets the full information, the detection rate of the original ＂Ping-pong＂ protocol is 50%; the detection rate of the second protocol which used two particles of EPR pair as detection particles is also 50%; and the detection rate of the presented protocol is 75%. In the end, the security of the pro-posed protocol is discussed. The analysis results show that the improved ＂Ping-pong＂ protocol in this paper is more secure than the other two.
基金the National High Technology Development "863" Program of China (2006AA01Z436, 2007AA01Z452)the National Natural Science Foundation of China(60702042).
文摘Mobile ad hoc networking （MANET） has become an exciting and important technology in recent years, because of the rapid proliferation of wireless devices. Mobile ad hoc networks is highly vulnerable to attacks due to the open medium, dynamically changing network topology, cooperative algorithms, and lack of centralized monitoring and management point. The traditional way of protecting networks with firewalls and encryption software is no longer sufficient and effective for those features. A distributed intrusion detection approach based on timed automata is given. A cluster-based detection scheme is presented, where periodically a node is elected as the monitor node for a cluster. These monitor nodes can not only make local intrusion detection decisions, but also cooperatively take part in global intrusion detection. And then the timed automata is constructed by the way of manually abstracting the correct behaviours of the node according to the routing protocol of dynamic source routing （DSR）. The monitor nodes can verify the behaviour of every nodes by timed automata, and validly detect real-time attacks without signatures of intrusion or trained data. Compared with the architecture where each node is its own IDS agent, the approach is much more efficient while maintaining the same level of effectiveness. Finally, the intrusion detection method is evaluated through simulation experiments.
基金supported by Specialized Research Fund for the Doctoral Program of Higher Education of China under Grant No.20060013007National Natural Science Foundation of Beijing under Grant No.4092029National Natural Science Foundation of China under Grant No.60873001
文摘In order to transmit the secure messages,a deterministic secure quantum direct communication protocol,called the "Ping-pong"protocol was proposed by Bostrm and Felbinger [Phys.Rev.Lett.89,187902(2002) ].But the protocol was proved to have many vulnerabilities,and can be attacked by eavesdroppers.To overcome the problem,an improved security detection strategy which inserts the | 0〉,| 1〉,|+〉and |-〉particles into the messages as the decoy particles randomly in the"Ping-pong"protocol is presented.During the security analysis,the method of the entropy theory is introduced,and three detection strategies are compared quantitatively by using the constraint between the information which eavesdroppers can obtain and the interference introduced.Because of the presence of the trap particles |+〉and |-〉,the detection rate will be no less than 25% when Eve attacks the communication.The security analysis result shows that the efficiency of eavesdropping detection in the presented protocol is higher than the other two,so the detection strategy in the protocol can ensure that the "Ping-pong"protocol is more secure.
