Collection policy refining method for threat monitoring in complex network environment

Fenghua LI; Zifu LI; Ling LI; Ming ZHANG; Kui GENG; Yunchuan GUO

doi:10.11959/j.issn.1000-436x.2019096

您当前的位置：

首页 >

文章列表页 >

Collection policy refining method for threat monitoring in complex network environment

Papers | 更新时间：2024-06-05

- Collection policy refining method for threat monitoring in complex network environment
- Journal on Communications Vol. 40, Issue 4, Pages: 49-61(2019)
- 作者机构：
  
  1. 中国科学院信息工程研究所，北京 100093
  2. 中国科学院大学网络空间安全学院，北京 100049
  3. 通信网信息传输与分发技术重点实验室，河北石家庄 050081
  4. 西安电子科技大学网络与信息安全学院，陕西西安 710071
- 作者简介：
- 基金信息：
  
  The National Key Research and Development Program of China(2016YFB0801001);The National Natural Science Foundation of China(61672515);Innovative Practice Project of College Students in Chinese Academy of Sciences
- DOI：10.11959/j.issn.1000-436x.2019096
  CLC： TP302
- Online First：2019-04，
  
  Published：25 April 2019
- 稿件说明：
移动端阅览
Fenghua LI, Zifu LI, Ling LI, et al. Collection policy refining method for threat monitoring in complex network environment[J]. Journal on Communications, 2019, 40(4): 49-61.
DOI：

Fenghua LI, Zifu LI, Ling LI, et al. Collection policy refining method for threat monitoring in complex network environment[J]. Journal on Communications, 2019, 40(4): 49-61. DOI： 10.11959/j.issn.1000-436x.2019096.

摘要

个性化采集策略是有效监测复杂网络环境面临的威胁的必要条件之一，然而安全需求和威胁类型差异等导致难以有效生成个性化的采集策略。针对上述问题，设计了面向威胁监测的采集策略自动精化方法。首先，提出了采集策略层次模型；然后，将威胁类型到采集项的精化转化为采集收益和采集成本平衡的非线性优化问题，并利用遗传算法进行求解；最后，通过模拟实验，验证可根据高层监测需求自动生成采集方案。

Abstract

Personalized collect policy is one of the necessary conditions for effectively monitoring threats in the complex network environment.However

differences in security requirements and threat types make it difficult to effectively generate personalized collect policy.To address the above problem

a collection policy automatic refinement method was designed.Firstly

a hierarchical model of collection policy was proposed.Then

by transforming the policy refinement into a nonlinear optimization problem

a genetic algorithm was designed to balance between collection revenue and collection cost.Finally

simulation experiments verify that according to the requirements of high-level monitoring

the acquisition scheme can be automatically generated.

关键词

Keywords

references

李凤华 , 熊金波 . 复杂网络环境下访问控制技术 [M ] . 北京 : 人民邮电出版社 , 2015 .

LI F H , XIONG J B . Access control technology in complex network environment [M ] . Beijing : Posts ＆ Telecom PressPress , 2015 .

PADHY P , DASH R K , MARTINEZ K , et al . A utility-based sensing and communication model for a glacial sensor network [C ] // The 5th International Joint Conference on Autonomous Agents and Multi-agent Systems . 2016 : 1353 - 1360 .

曾文序 , 库少平 , 郑浩 . 基于旋转门算法的自适应变频数据采集策略 [J ] . 计算机应用研究 , 2018 , 35 ( 3 ): 769 - 772 .

ZENG W X , KU S P , ZHENG H . Strategy of self-adaptive frequency conversion data acquisition based on swing door trending algorithm [J ] . Application Research of Computers , 2018 , 35 ( 3 ): 769 - 772 .

张斌 , 朱建涛 , 徐曌 . 基于动态频率算法的远程监控系统数据采集优化策略 [J ] . 微电子学与计算机 , 2016 , 33 ( 8 ): 86 - 91 .

ZHANG B , ZHU J T , XU Z . Data gathering optimization strategy based on dynamic frequency algorithm for remote monitoring system [J ] . Microelectronics ＆ Computer , 2016 , 33 ( 8 ): 86 - 91 .

MAULLO M , CALO S . Policy management:an architecture and approach [C ] // The 1st International Workshop on Systems Management . 1993 : 13 - 26 .

MONT M C , BALDWIN A , GOH C . Power prototype:towards integrated policy-based management [C ] // IEEE/IFIP Network Operations and Management Symposium . 2000 : 789 - 802 .

ALBUQUERQUE J P D , KRUMM H , GEUS P L D , et al . Scalable model-based configuration management of security services in complex enterprise networks [J ] . Software:Practice and Experience , 2011 , 41 ( 3 ): 307 - 338 .

ALBUQUERQUE J P D , KRUMM H , GEUS P L D . Formal validation of automated policy refinement in the management of network security systems [J ] . International Journal of Information Security , 2010 , 9 ( 2 ): 99 - 125 .

ROMEIKAT R , BAUER B . Specification and refinement of domain-specific ECA policies [C ] // International Conference on Advanced Information Systems Engineering Workshops . 2011 : 197 - 206 .

NEISSE R , STERI G , GENEIATAKIS D , et al . A privacy enforcing framework for Android applications [J ] . Computers ＆ Security , 2016 , 62 : 257 - 277 .

RUDOLPH M , FETH D , DOERR J , et al . Requirements elicitation and derivation of security policy templates—an Industrial case study [C ] // The 24th International Requirements Engineering Conference . 2016 : 283 - 292 .

GUARDA P , RANISE S , SISWANTORO H . Security analysis and legal compliance checking for the design of privacy-friendly information systems [C ] // The 22nd ACM on Symposium on Access Control Models and Technologies . 2017 : 247 - 254 .

RUDOLPH M , MOUCHA C , FETH D . A framework for generating user and domain-tailored security policy editors [C ] // The 24th International Requirements Engineering Conference Workshops . 2016 : 56 - 61 .

BEIGI M S , CALO S , VERMA D . Policy transformation techniques in policy-based systems management [C ] // The 5th IEEE International Workshop on Policies for Distributed Systems and Networks . 2004 : 1 - 10 .

HAN W , FANG Z , YANG L T , et al . Collaborative policy administration [J ] . IEEE Transactions on Parallel and Distributed Systems , 2014 , 25 ( 2 ): 498 - 507 .

UDUPI Y B , SAHAI A , SINGHAL S . A classification-based approach to policy refinement [C ] // The 10th IFIP/IEEE International Symposium on Integrated Network Management . 2007 : 785 - 788 .

RIEKSTIN A C , JANUÁRIO G C , RODRIGUES B B , et al . Orchestration of energy efficiency capabilities in networks [J ] . Journal of Network and Computer Applications , 2016 , 59 : 74 - 87 .

SCHEID E J , MACHADO C C , FRANCO M L , et al . INSpIRE:integrated NFV-based intent refinement environment [C ] // IFIP/IEEE Symposium on Integrated Network and Service Management . 2017 : 186 - 194 .

RANA A I , JENNINGS B . Semantic aware processing of user defined inference rules to manage home networks [J ] . Journal of Network and Computer Applications , 2017 , 79 : 68 - 87 .

MACHADO C C , WICKBOLDT J A GRANVILLE L Z , et al . ARKHAM:an advanced refinement toolkit for handling service level agreements in Software-Defined Networking [J ] . Journal of Network and Computer Applications , 2017 , 90 : 1 - 16 .

RIEKSTIN A C , JANUÁRIO G C , RODRIGUES B B , et al . A survey of policy refinement methods as a support for sustainable networks [J ] . IEEE Communications Surveys and Tutorials , 2016 , 18 ( 1 ): 222 - 235 .

AZIZ B . Modelling fine-grained access control policies in grids [J ] . Journal of Grid Computing , 2016 , 14 ( 3 ): 477 - 493 .

BANDARA K , LUPU E C , RUSSO A . Using event calculus to formalise policy specification and analysis [C ] // The 4th International Workshop on Policies for Distributed Systems and Networks . 2003 : 26 - 39 .

CRAVEN R , LOBO J , LUPU E , et al . Policy refinement:decomposition and operationalization for dynamic domains [C ] // The 7th International Conference on Network and Services Management . 2011 : 115 - 123 .

RUBIO-LOYOLA J . Towards the policy refinement problem in policy-based management systems [M ] . Saarbrücken : VDM VerlagPress , 2008 .

LEIGHTON G , BARBOSA D . Access control policy translation,verification,and minimization within heterogeneous data federations [J ] . ACM Transactions on Information and System Security , 2011 , 14 ( 3 ): 1 - 28 .

JOHNSON M , KARAT J , KARAT C M , et al . Usable policy template authoring for iterative policy refinement [C ] // IEEE International Symposium on Policies for Distributed Systems and Networks . 2010 : 18 - 21 .

CHUNG L , NIXON B A , YU E , et al . Non-functional requirements in software engineering [M ] . New York : Springer Publishing CompanyPress , 2000 .

LIPPMANN R , HAINES J W , FRIED D J , et al . The 1999 DARPA off-line Intrusion Detection Evaluation [J ] . Computer Networks , 2000 , 34 ( 4 ): 579 - 595 .

AFFLECK A , KRISHNA A . Supporting quantitative reasoning of non-functional requirements:a process-oriented approach [C ] // International Conference on Software and System Process . 2012 : 88 - 92 .

KAMRAN S , ZAHID A , FARRUKH A K , et al . KDD cup 99 data sets:a perspective on the role of data sets in network intrusion detection research [J ] . Computer , 2019 , 52 ( 2 ): 41 - 51 .

窦全胜 , 陈姝颖 . 演化计算方法及应用 [M ] . 北京 : 电子工业出版社 , 2016 .

DOU Q S , CHEN S Y . Evolutionary calculation method and application [M ] . Beijing : Publishing House of Electronics IndustryPress , 2016 .

Views

1403

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Mobile sink-based data collection scheme for wireless sensor networks

Related Author

Jian GUO

Li-juan SUN

Wen-jun XU

Ru-chuan WANG

Fu XIAO

Related Institution

College of Computer, Nanjing University of Posts and Telecommunications

Jiangsu High Technology Research Key Laboratory for Wireless Sensor Networks, Nanjing University of Posts and Telecommunications

Key Lab of Broadband Wireless Communication and Sensor Network Technology,Nanjing University of Posts and Telecommunications

AI问答

⁰