Heng Zhou’s research while affiliated with Huazhong University of Science and Technology and other places

Based on the real-time features of transactions and data, an intrusion tolerant architecture is proposed for the real-time database system. Considering real-time parameters and intrusion detection latency, Semi-Markov evaluation model is established to access the survivability of real-time database. Based on this model, relevant quantitative criteria are given to define the indicators of the survivability, such as integrity and availability, so as to validate the survivability of real-time database. Because the factors such as false alarm, detection rate and the intensity of attacks have important effects on the survivability, they are analyzed by the TPC-C benchmark in detail. Experiments show that the model can accurately predict the behaviors of real-time database. The proposed real-time database with intrusion tolerance can still keep the basic survival when facing attacks.

With the application of real-time databases and the intrusion of malicious transactions, it has become increasingly important to model the ability of real-time database intrusion tolerance and effectively evaluate its survivability. Based on the features of transaction and data for real-time database system, an intrusion tolerant architecture has been proposed for real-time database system. Considering factors such as intrusion detection latency and a variety of parameters for real-time, Semi-Markov evaluation model for survival assessment is established. Based on this model, relevant quantitative criteria are made to define the important indicators of survivability, such as integrity and availability, so as to validate intrusion detection capability and the survivability of real-time database. The three important factors of false alarm, detection rate and the intensity of attack are analyzed in detail by the TPC-C benchmark. Experiments show that the model can accurately predict the behavior of real-time database. The real-time database following the model can still provide essential services when facing attacks and the basic survival characteristics will not be seriously affected.

In order to improve the detection efficiency of intrusion detection and reduce false alarm, an approach combined rough sets and data mining is proposed to enhance the traditional intrusion detection methods. First, collected data is classified and preprocessed by normalizing the value variables and discretely processing the nominal variables, an attribute reduction to the result set can be made based on Pawlak attribute weights Rough Set Algorithm with characteristics of the property up and down approximation set. According to attribute reduction, association rules can be generated which satisf\ a certain degree of confidence, then imported into the rule set. Experiments show that the detection approach combined rough sets and data mining has improved the detection efficiency above 20%. The detection rate is almost linear with the number of intrusions. Keywords-component; Intrusion Detection; Pawlak attribute weights Rough Set; attribute reduction; data mining