Gang Shen’s research while affiliated with Huazhong University of Science and Technology and other places

In a real-time database, correctness of transaction depends not only on the correct implementation, but also depends on the effectiveness of time. Traditional database recovery strategies are adopted to undo all malicious transactions and affected transactions, and then redo the affected transactions. This time-consuming recovery process is not acceptable for real-time databases. Sometimes a transaction may have already exceeded its implementation period, and thus lose the meaning of recovery. By assessing the repair necessity for the affected transaction, a recovery approach is proposed to decide whether to recovery, and then fuse malicious transactions and valuable affected transactions. By this way it can significantly reduce the required number of the transactions needed to undo and redo, avoid worthless recovery operations, and reduce the system I/O and log scanning. So the recovery can be finished in an efficient time.

With the application of real-time databases and the intrusion of malicious transactions, it has become increasingly important to model the ability of real-time database intrusion tolerance and effectively evaluate its survivability. Based on the features of transaction and data for real-time database system, an intrusion tolerant architecture has been proposed for real-time database system. Considering factors such as intrusion detection latency and a variety of parameters for real-time, Semi-Markov evaluation model for survival assessment is established. Based on this model, relevant quantitative criteria are made to define the important indicators of survivability, such as integrity and availability, so as to validate intrusion detection capability and the survivability of real-time database. The three important factors of false alarm, detection rate and the intensity of attack are analyzed in detail by the TPC-C benchmark. Experiments show that the model can accurately predict the behavior of real-time database. The real-time database following the model can still provide essential services when facing attacks and the basic survival characteristics will not be seriously affected.

In order to improve the detection efficiency of intrusion detection and reduce false alarm, an approach combined rough sets and data mining is proposed to enhance the traditional intrusion detection methods. First, collected data is classified and preprocessed by normalizing the value variables and discretely processing the nominal variables, an attribute reduction to the result set can be made based on Pawlak attribute weights Rough Set Algorithm with characteristics of the property up and down approximation set. According to attribute reduction, association rules can be generated which satisf\ a certain degree of confidence, then imported into the rule set. Experiments show that the detection approach combined rough sets and data mining has improved the detection efficiency above 20%. The detection rate is almost linear with the number of intrusions. Keywords-component; Intrusion Detection; Pawlak attribute weights Rough Set; attribute reduction; data mining