参考文献

参考文献

[1]沈昌祥.信息安全工程导论[M].北京:电子工业出版社,2003:23-28.

[2]Keith E.Strassberb,Richard J.Gondex,Gary Rollie.防火墙技术大全[M].北京:机械工业出版社,2003:162-182.

[3]李涛.网络安全概论[M].北京:电子工业出版社,2004:56-68.

[4]谢锦辉.隐Markov模型(HMM)及其在语音处理中的应用[M].武汉:华中理工大学出版社,1995:130-143.

[5]姚天任.数字信号处理[M].武汉:华中理工大学出版社,1991:316-346.

[6]谢识予.经济博弈论第2版[M].上海:复旦大学出版社,2002:20-41.

[7]哈罗德.W.库恩.博弈论经典[M].北京:中国人民大学出版社,2002:96-110.

[8]周晓俊.网络渗透测试系统研究[C].第十六届全国抗恶劣环境计算机学术年会论文集.2006:283-288.

[9]范红,吴亚非,李京春等.信息安全风险评估指南[S].北京:中国标准出版社,2007:44-45.

[10]文伟平.恶意代码机理与防范技术研究[D].北京:中国科学院软件研究所,2004:17.

[11]吴世忠.基于风险管理的信息安全保障的研究[D].成都:四川大学,2002:22.

[12]雷英杰.基于直觉模糊推理的态势与威胁评估研究[D].西安:西安电子科技大学,2005:13.

[13]方滨兴.信息安全技术发展趋势[R].2007年第二届技术创新大会,2007:101.

[14]陈秀真,郑庆华,管晓宏,林晨光.层次化网络安全威胁态势量化评估方法[J].软件学报,2006,17(4):885-897.

[15]张涛,胡铭曾,云晓春等.计算机网络安全性分析建模研究[J].通信学报,2006,26(12):100-109.

[16]张永铮,方滨兴,迟悦.用于评估网络信息系统的风险传播模型[J].软件学报,2007,18(1):137-145.

[17]肖道举,杨素娟,周开锋等.网络安全评估模型研究[J].华中科技大学学报(自然科学版),2002,30(4):37-39.

[18]冯登国,张阳,张玉清.信息安全风险评估综述[J].通信学报,2004,25(7):10-18.

[19]朱亮,王慧强,郑丽君.网络安全态势可视化研究评述[EB/OL].北京:中国科技论文在线,[2006-07-04],http://www.paper.edu.cn/releasepaper/content/200607-36.

[20]张义荣,鲜明,王国玉.一种基于网络熵的计算机网络攻击效果定量评估方法[J].通信学报,2004,25(11):159-165.

[21]李涛.基于免疫的网络安全风险检测[J].中国科学E辑,2005,35(8):798-816.

[22]梅海彬,龚俭.一种基于时间序列面向预警的警报分析方法[J].计算机科学,2007(12):72-76.

[23]蒋立新.BS7799(ISO/IEC17799)信息安全管理标准[J].世界标准化与质量管理,2004(2):46-48.

[24]陈秀真,郑庆华,管晓宏等.网络化系统安全态势评估的研究[J].西安交通大学学报,2004,38(4):404-408.

[25]姚婷婷,郑庆华,管晓宏等.一种基于主机实时流量的安全评估方法[J].西安交通大学学报,2006,40(4):415-419.

[26]张响亮,王伟,管晓宏.基于隐马尔可夫模型的程序行为异常检测[J].西安交通大学学报,30(10):1054-1059.

[27]谭小彬,王卫平,奚宏生,殷保群.计算机系统入侵检测的隐马尔可夫模型[J].计算机研究与发展,2003,40(2):245-250.

[28]李伟明,雷杰,董静,李之棠.一种优化的实时网络安全风险量化方法[J].计算机学报,2009,32(4):793-804.

[29]姜伟,方滨兴,田志宏,等.基于攻防博弈模型的网络安全测评和最优主动防御[J].计算机学报,2009(4):817-826.

[30]孙薇,孔祥维,何德全,等.基于演化博弈论的信息安全攻防问题研究[J].情报科学,2008(9):1408-1412.

[31]朱建明,Raghunathan S.基于博弈论的信息安全技术评价模型[J].计算机学报,2009(4):828-834.

[32]贾春福,钟安呜,张炜,等.网络安全不完全信息动态博弈模型[J].计算机研究与发展,2006,43(z2):530-533.

[33]曹晖,王青青,马义忠.基于动态贝叶斯博弈的攻击预测模型[J].计算机应用,2007(6):1545-1547.

[34]何宁,卢昱,王磊,网络控制论在网络攻防中的应用[J].武汉大学学报理学版,2006(5):639-643.

[35]贾焰.大规模网络安全态势感知——需求、挑战与技术[EB/OL].http://2009.cert.org.cn/PPT/jiayan.pdf,2011.

[36]Cohen F.A Short Course on Compter Viruses[M].New York:John Wiley＆Sons,1994:18-26.

[37]Symantec.Plymorphic virus detection module[M].United States Patent,2004:44.

[38]Waltz E,Llinas J.Multi-Sensor Data Fusion[M].Boston,MA:Artech House,1990:155-165.

[39]Hall D L.Mathematical Techniques in Multi-Sensor Data Fusion[M].Boston,MA:Artech House,1992:66-76.

[40]Hall D L,Llinas J.Handbook of Multi-Sensor Data Fusion[M].Washington,NY:CRC Press,2001:123-133.

[41]Gordon L A,Loeb M P,Lucyshyn W,Rchardson R.2006 CSI/FBI Computer Crime and Security Survery[R].Computer Security Institute Publications,2005.

[42]Anderson J P.Computer Security Threat Monitoring and Surveillance[R].Fort Washington,Pennsylvania,1980:9.

[43]Denning D E,Neumann P.G.Requirements and Model for IDES-A Real-Time Intrusion Detection System[R].Computer Science Laboratory,SRI International,Menlo Park,CA,1985:21.

[44]Julisch,K.Mining Alarm Clusters to Improve Alarm Handling Efficiency[C].Proceedings 17th Annual Computer Security Applications Conference.New Orleans,LA,2001:19.

[45]Llinas J,Hall D L.An Introduction to Multi-Sensor Data Fusion[C].Proceedings of the 1998 IEEE International Symposium on Circuits and Systems,Monterey,CA,USA,1998(6):537-540.

[46]Hall D L,Llinas J.A Challenge for the Data Fusion Community I:Research Imperatives for Improved Processing[C].Proceedings of the 7th National Symposium on Sensor Fusion,Albuquerque,NM,1994:159-175.

[47]Llinas J,Hall D L.A Challenge for the Data Fusion Community II:Research Imperatives for Improved Processing[C].Proceedings of the 7th National Symposium on Sensor Fusion,Albuquerque,NM,1994:361-374.

[48]Steinberg A N,Bowman C L,White F E.Revision to the JDL Data Fusion Model[C].Proceedings of SPIE Aero Sense,Orlando,Florida,1999(3719):430-441.

[49]Christopher J A,Sandara G B,Richard D P,et al.Operationally Critical Threat,Asset and Vulnerability Evaluation SM Framework[R].Pittsburgh,PA:Software Engineer Institue,Carnegie Mellon University,1999:77-79.

[50]Bass T,Roger R.Defense-in-Depth Revisited:Qualitative Risk Analysis Methdology for Complex Network-Centric Operations[C].Proceedings of IEEE Military Communications Conference,McLean,VA,USA,2001(1):64-70.

[51]Mehta,V.,Bartzis,C.,Zhu,H.,Clarke,E.,et al.Ranking Attack Graphs[C].Proceedings of the International Symposium on the Recent Advances in Intrusion Detection(RAID 2006).Springer-Verlag,2006:127-144.

[52]D′Amico A,Kocka M.Information Assurance Visualizations for Specific Stages of Situational Awareness and Intended Users:Lessons Learned[C].Visualization for Computer Security VizSEC 2005,Minneapolis,MN,USA,2005:302-312.

[53]Koike,H.,Ohno,K.SnortView:Visualization Systems of Snort Logs[C].2004 ACM Workshop on Visulization and Data Mining for Computer Security.Washington DC,USA:2004.143-147.

[54]Arnes,A.,Valeur,F.,Vigna,G.,Kemmerer,R.A.Using Hidden Markov Models to Evaluate the Risk of Intrusions[C].Proceedings of the International Symposium on the Recent Advances in Intrusion Detection(RAID 2006).Springer-Verlag,2006:145-164.

[55]Sunu Mathew,C.S.,Shambhu Upadhyaya.An Alert Fusion Framework for Situation Awareness of Coordinated Multistage Attacks[C].Proceedings of the Third IEEE International Workshop on Information Assurance(IWIA′05),College Park,MD,USA,2005:95-104.

[56]Holsopplea,J.,Yanga,S.J.,Suditb,M.TANDI:Threat Assessment of Network Data and Information[C].Proceedings of SPIE-Defense and Security Symposium,2006(6242):114-129.

[57]Chinchani,R.,Iyer,A.,Ngo,H.Q.,Upadhyaya,S.Towards a theory of insider threat assessment[C].Proceedings of the 2005 International Conference on Dependable Systems and Networks,IEEE Computer Society Press,Los Alamitos,2005:108-117.

[58]Cukier,R.M.a.M.Assessing the Attack Threat due to IRC Channels[C].Proceedings of the 2006 International Conference on Dependable Systems and Networks(DSN'06),Philadelphia,PA,2006:467-472.

[59]Wing,J.M.,Manadhata.Measuring a System's Attack Surface[C].13th USENIX Security Symposium,San Diego,CA,2004:56-63.

[60]Gehani,A.,Kedem,G.,Rheostat.Real-time Risk Management[C].Proceedings of the 7th International Symposium on Recent Advances in Intrusion Detection(RAID2004),2004:122-130.

[61]Geib,C.W.,Goldman,R.P.Plan Recognition in Intrusion Detection Systems[C].Proceedings of the DARPA Information Survivability Conference and Exposition(DISCEX II′01),2001:256-266.

[62]Kautz,H.,Allen,J.F.Generalized Plan Recognition[C].Proceedings of the Fifth National Conference on Artificial Intelligence,1986:32-38.

[63]Qin.X,Lee.W.Attack Plan Recognition and Prediction Using Causal Networks[C].Proceedings of The 20th Annual Computer Security Applications Conference(ACSAC 2004),2004:370-379.

[64]Ritchey R W,Ammann P.Using Model Checking to Analyze Network Vulnerabilities[C].Proceeding 2000 IEEE Symposium on Security and Privacy.IEEE Symposium on Security＆Privacy.IEEE,2000:156-165.

[65]Sheyner,O.,Haines,J.,Jha,S.,Lippmann,R.,et al.Automated Generation and Analysis of Attack Graphs[C].Proceedings of the 2002 IEEE Symposium on Security and Privacy,2002:273-284.

[66]Templeton,S.J.,Levitt,K.A Requires/Provides Model for Computer Attacks[C].Proceedings New Security Paradigm Workshop.Ballycotton,Ireland,ACM,2001:31-38.

[67]Cuppens,F.,Miege,A.Alert Correlation in a Cooperative Intrusion Detection Framework[C].Proceedings 2002 IEEE Symposium on Security and Privacy(SP2002).Berkeley,CA,USA:IEEE Comput.Soc,2002:202-215.

[68]Dain,O.A.C.,R..Fusing a Heterogeneous Alert Stream into Scenarios[C].Proceedings of the 2001 ACM Workshop on Data Mining for Security Applications,2001:372-380.

[69]Lee,W.,Qin,X.Statistical Causality Analysis of INFOSEC Alert Data[C].Poceedings of the 6th International Symposium on Recent Advances in Intrusion Detection(RAID2003):Springer-Verlag,2003:73-94.

[70]Yin Xiaoxin,Yurcik William,Treaster Michael.VisFfowConnect:NetFlow Visualizations of Link Relationships for Security Situational Awareness[C].Proceedings of the 2004 ACM Workshop on Visualization and Data Mining for Computer Security,Washington,DC,2004:26-34.

[71]Mica R.Endsley.Design and Evaluation for Situation Awareness Enhancement[C].Proeeedings of the Human Factors society 32nd Annual Meeting,Santa Monica,CA,1988:97-101.

[72]Guo Y J.Theory and Method of Comprehensive Evaluation[M].Beijing:Science Press,2002:21.

[73]Tim Bass.Multisensor Data Fusion for Next Generation Distributed Intrusion Detection Systems[A].1999 IRIS National Sympo2 Sium on Sensor and Data Fusion,Laurel,USA,1999:51.

[74]Hunte J.M,Matlack T,Schweer K G.Applications of Networking Capabilities to Assist in Situational Awareness[C].Systems and Information Engineering Design Symposium 2004,2004:25-32.

[75]Bass T.Multi-Sensor Data Fusion for Next Generation Distributed Intrusion Detection Systems[C].1999 IRIS National Symposium on Sensor and Data Fusion,Laurel,USA,1999(1):24-27.

[76]Steinberg A N,Bowman C L,White F E.Revision to the JDL Data Fusion Model[C].Proceedings of SPIE Aero Sense,Orlando,Florida,USA,1999(3719):430-441.

[77]Goldman R P,Heimerdinger W,Harp S A,et al.Information Modeling for Intrusion Report Aggregation[C].Proceedings of DARPA Information Survivability Conference＆Exposition II(DISCEX′01),2001(1):329-342.

[78]Yegneswaran V,Barford P,Paxson V.Using Honeynets for Internet Situational Awareness[C].Proceedings of the Fourth Workshop on Hot Topics in Networks(HotNets-IV),College Park,MD,2005(1):1-6.

[79]Lakkaraju K,Yurcik W,Lee A J.NVisionIP:NetFlow Visualizations of System State for Security Situational Awareness[C].Proceedings of the 2004 ACM Workshop on Visualization and Data Mining for Computer Security(VizSEC/DMSEC),Washington DC,USA,2004:345-352.

[80]Yin X X,Yurcik W,Treaster M,et al.VisFlowConnect:NetFlow Visualizations of Link Relations for Security Situational Awareness[C].Proceedings of the 2004 ACM Workshop on Visualization and Data Mining for Computer Security(VizSEC/DMSEC),Washington DC,USA,2004:86-92.

[81]Haslum Kjetil,Arnes Andre.Multisensor Real-Time Risk Assessment Using Continuous-Time Hidden Markov Models[C].Proceeding of the international conference on Computational Intelligence and Security,GuangZhou,China,2006:694-703.

[82]Mehta,V.,Bartzis,C.,Zhu,H.,Clarke,E.,et al.Ranking Attack Graphs[C].Proceedings of the International Symposium on the Recent Advances in Intrusion Detection(RAID 2006),Springer-Verlag,2006:127-144.

[83]Holsopplea,J.,Yanga,S.J.,Suditb,M.TANDI:Threat Assessment of Network Data and Information[C].Proceedings of the SPIE 2006,2006(6242):114-129.

[84]Huang X D,Ariki Y,Jack M A.Hiddened Markov Models for Speech Recognition[M].Edinburgh,UK:Edinburgh University Press,1990:456-467.

[85]Huang X D,Jack M A.Unified Modeling of Vector Quantization and Hidden markov Model Using Semi-Continuous Hideden Morkov models[C].Proceedings of the ICASSP 1989,1989:639-642.

[86]Keiichiro Oura,Heiga Zen,Yoshihiko Nankaku,Akinobu Lee,Keiichi Tokuda.Hidden Semi-Markov Models Based Speech Recognition System Using Weighted Finite-State Transducer[C].Proceedings in the ICASSP 2006,2006(1):33-36.

[87]Hamilton S N,MilerW L,OttA,ata1.The Role of Game Theory in Information Warfare[C].　Proceedings of　the 4th　Information　Survivability Workshop.Vancouver,Canada.2002:45-46.

[88]Syverson PE.A Different Look at Secure Distributed Computation[C].In:Proceedings　of　the　1997　IEEE　Computer　Security　Foundations Workshop.Washington,Computer Society,1997,13(2):109-115.

[89]Nash,J.F.Equilibrium Points in N-Person Games[C].Proceedings of the National Academy of Sciences of the United States of America 36,1950:48-49.

[90]Owen G.Game Theory[M].Cambridge,Massachusetts:Acadamic Press,1982:76-91.

[91]Chen L C,Carley K M.The Impact of Countermeasure Propagation,on the Prevalence of Computer Viruses[J].IEEE Transactions on Systems Man and Cybernetics Part B-Cybernetics.2004,34(2):823-833.

[92]Feng DG,Zhang Y,Zhang YQ.Survey of Information Security Risk Assessment[J].Journal of China Institute of Communications,2004,25(7):10-18.

[93]Hariri S,Qu G Z,Dharmagadda T,et al.Impact Analysis of Faults and Attacks in Large Scale Networks[J].IEEE Security＆Privacy.2003,1(5):49-54.

[94]Arnold W,Tesauro G.Automatically Generated Win32 Heuristic Virus Detection[J].Proceedings of the 2000 International Virus Bulletin Conference,2000:484-495.

[95]Goodall,J.R.,Lutters,W.G.,Komlodi,A.The Work of Intrusion Detection:Rethinking the Role of Security Analyst[J].Proceedings of the Tenth Americas Conference on Information Systems.New York,2004:492-499.

[96]Ammann,P.,Wijesekera,D.,Kaushik,S.Scalable,Graph-based Network Vulnerability Analysis[J].Proceedings of 9th ACM Conference on Computer and Communications Security.Washingtion,DC,2002:148-160.

[97]Hall D L,Llinas J.An Introduction to Multisensor Data Fusion[J].Proceedings of the IEEE,1997,85(1):6-23.

[98]Roesch,M.Snort-Lightweight Intrusion Detection for Network[J]Proceedings of the USENIX LISA′99 Conference,Seattle,Washington,1999:25-37.

[99]Kruegel,C.,Robertson,W.Alert Verification:Determining the Success of Intrusion Attempts[J].Proc.First Workshop the Detection of Intrusions and Malware and Vulnerability Assessment(DIMVA 2004),Dortmund,Germany,2004:186-195.

[100]Porras,P.A.,Fong,M.W.,Valdes,A.A Mission-Impact-based Approach to INFOSEC Alarm Correlation[J].Poceedings of the 5th International Symposium on Recent Advances in Intrusion Detection(RAID2002).Zurich,Switzerland,2002:95-101.

[101]Hariri,S.,Qu,G.,Dharmagadda,T.Impact Analysis of Faults and Attacks in Large-scale Networks[J].IEEE Security＆Privacy,2003(1):49-54.

[102]Blyth,A.Footprinting for Intrusion Detection and Threat Assessment[J].Information Security Technical Report,1999,4(3):43-53.

[103]Jonsson,E.,Olovsson,T.A Quantitative Model of the Security Intrusion Process Based on Attacker Behavior[J].IEEE Transactions on Software Engineering,1997 23(4):235-245.

[104]Schmidt,C.,Sridharan,N.,Goodson,J.The Plan Recognition Problem:an Intersection of Psychology and Artificial Intelligence[J].Artificial Intelligence,1978(11):45-83.

[105]Charniak,E.,Goldman,R.P.A Probabilistic Model of Plan Recognition[C].Proceedings of the Ninth National Conference on Artificial Intelligence,1991:160-165.

[106]Wang,L.,Liu,A.,Jajodia,S.Using Attack Graphs for Correlating,Hypothesizing,and Predicting Intrusion Alerts[J].Computer Communications,2006(29):2917-2933.

[107]Cunningham,W.H.Optimal Attack and Reinforcement of a Network[J].Journal of the ACM(JACM),1985,32(3):549-561.

[108]Hellerstein,J.L.,Ma,S.,Perng,C.-S.Discovering Actionable Patterns in Event Data[J].IBM Systems Journal,2002,41(3):475-482.

[109]Ning P,Cui Y.Techniques and Tools for Analyzing Intrusion Alerts[J].ACM Transaction on Information and System Security,2004,7(2):274-318.

[110]Miea R.Endsley.Toward a Theory of Situation Awareness in Dynamic Systems[J].Human Factors Journal,1995,37(l):32-64.

[111]Zhuang Y,Yang Y,Wu F,et al.Manifold Learning Based Cross-media Retrieval:A Solution to Media Object Complementary Nature[J].The Journal of VLSI Signal Processing,2007,46(2-3):153-164.

[112]Bass T.Intrusion Detection Systems and Multi-Sensor Data Fusion:Creating Cyberspace Situational Awareness[J].Communications of the ACM,2000,43(4):99-105.

[113]Lau S.The Spinning Cube of Potential Doom[J].Communications of the ACM.2004,47(6):25-26.

[114]L.E.Baum,Petrie,T.Statistical Inference for Probabilistic Functions of Finite State Markov Chains[J].Ann.Math.Stat,1966(37):1554-1563.

[115]Huang X D.Phoneme Classification Using Semicontinuous Hidden Markov Models[J].IEEE Trans.SP,1992,40(5):1062-1067.

[116]Shun-Zheng Yu.Hidden Semi-Markov Models[J].Artificial Intelligence,2010(174):215-243.

[117]S.E.Levinson.Continuously Variable Duration Hidden Markov Models for Automatic Speech Recognition[J].Computer Speech and Language,1986(1):29-45.

[118]Ostendorf M,Digalakis V and Kimball O.From HMMs to Segment Models[J].IEEE Transactions on Speech＆Audio Processing,1996,4(5):360-378.

[119]M.T.Johnson,Capacity and Complexity of HMM Duration Modeling Techniques[J].IEEE Signal Processing Letters,2005,12:407-410.

[120]LyeKong-wei,Jeannette M W.Game Strategies in Network Security[J].International Jounral of Information Security,2005,4(1-2):71-86.

[121]Nash,J.F.Non-Cooperative Games[J].Annals of Mathematics,1951:86-295.

[122]CERT.http://www.cert.org.2011-3-1.

[123]Symantec Corporation.Symantec Internet Security Threat Report[EB/OL].Volume IX,2006,http://eval.symantec.com/mktginfo/enterprise/white＿papers/ent＿white paper＿symantec＿internet＿security＿threat＿report＿ix.pdf.

[124]ISS.Internet Security System[EB/OL].http://www.iss.net.2011.

[125]SATAN.Security Administrator Tool for Analyzing Networks[EB/OL].http://www.procupine.org/satan.2011.

[126]Nmap[EB/OL].http://nmap.org.2011.

[127]Nessus[EB/OL].http://www.nessus.org/nessus/.2011.

[128]X-Scan[EB/OL].http://www.xfocus.net/tools/200507/1057.html.2011.

[129]CVE.Common Vulnerabilities and Exposures[EB/OL],http://www.cve.mitre.org/,2008.

[130]Bugtraq.http://www.securityfocus.com/archive/1[EB/OL],2008.

[131]CVSS.Common Vulnerability Scoring System[EB/OL].http://nvd.nist.gov/cvss.cfm,2008.

[132]Deraison,R.Nessus Vulnerability Scanner[EB/OL].http://www.nessus.org/.2008.

[133]Danyliw,R.ACID:Analysis Console for Intrusion Databases[EB/OL].http://acidlab.sourceforge.net.2001.

[134]OSSIM.Open Source Security Information Management[DB/OL].http://www.ossim.net/,2008.

[135]Small Business Innovation Research Program[DB/OL].https://www.dhs.gov/science-and-technology/sbir,2005.

[136]Advanced Research and Development Activity(ARDA)[EB/OL].Exploratory Program Call for Proposals 2006,USA,2005.

[137]Project H.Scan 17[EB/OL].http://www.honeynet.org/scans/scan17.2002.

[138]Project H.Know your enemy:Statistics[DB/OL].http://www.honeynet.org/papers.2002.

[139]Kevin P.Murphy.Hidden semi-Markov models(HSMM)[DB/OL].www.ai.mit.edu/～murphyk.2002.