'life is../논문_논문정리'에 해당되는 글 13건

  1. IEEE, ACM, Elseiver, Computer Society, Springer 레퍼 다는법 2008/10/08
  2. Proxy Mobile IPv6 동작 과정[영어] 2008/08/18
  3. [논문정리] Implementing a New Manet Unicast Routing Protocol in NS2 2008/07/14
  4. [논문정리] Mobility Models for Vehicular Ad hoc Networks: A survey and Taxonomy 2008/07/01
  5. [논문정리] Mobility Models for Vehicluar Ad hoc Network Simulations 2008/06/04
  6. [논문_정리] Vehicular Ad Hoc Networks (VANETs): Challenges and Perspectives 2008/06/03
  7. [논문정리] Routing in Vehicular Ad Hoc Networks: A Survey (2) 2008/05/13
  8. 참고문헌의 기재 요령 (2) 2007/12/27
  9. Advice to Authors of Extended Abstracts (1) 2006/09/26
  10. [논문] AODV와 Multicast AODV에 대한 연구 (1) 2006/09/25
  11. IETF 문서 작성하기....언젠간 나도 ^^ 2006/02/28
  12. 종혁이형 추천...논문 검색 사이트 (4) 2006/02/15
  13. 한글 논문 작성시 조심할 내용 [작성중] (5) 2005/09/22
<< prev 1 next >>

An Intrusion-Detection Model

from life is../논문_논문정리 2008/12/16 18:22

An Intrusion-Detection Model



I. INTRODUCTION

THIS paper describes a model for a real-time intrusion detection expert system

The development of a real-time intrusion-detection system is motivated by four factors:
  1. Most existing systems have security flaws that render them susceptible to intrusions, penetrations, and other forms of abuse; finding and fixing all these deficiencies is not feasible for technical and economic reasons;
  2. Existing systems with known flaws are not easily replaced by systems that are more secure-mainly because the systems have attractivefeatures that are missing in the more-secure systems, or else they cannot be replaced for economic reasons;
  3. Developing systems that are absolutely secure is extremely difficult, if not generally impossible;
  4. The most secure systems are ,even, vulnerable to abuses by insiders who misuse their privileges.


The model is based on the hypothesis(추측) that exploitation of a system's vulnerabilities involves abnormal use of the system (즉, security violations could be detected from abnormal patterns of system usage.)


II. OVERVIEW OF MODEL

The model is independent of ...
  • Any particular system
  • Application environment
  • System vulnerabilitytype of intrusion

The model has six main components
  • Subjects: Initiators of activity on a target system
    • Nornally users.
  • Objects: Resources managed by' the system
    • files, commands, devices, etc.
  • Audit records: Generated by the target system in responseto actions performed or attempted by subjects on objects
    • user login, command execution, file access, etc.
  • Profiles: Structures that characterize the behavior of subjects with respect to object's in terms of statistical metricsand models of observed activity.
    • Profiles are automatically generated and initialized from templates.
  • Anomaly records: Generated when abnormal behavioris detected.
  • Activity rules: Actions taken when some condition is satisfied
    • some condition = update profiles, detect abnormal behavior,relate anomalies to suspected intrusions, and produce reports.

The model can be regarded as a rule-based pattern matching system.



III. SUBJECTS AND OBJECTS

1. Subjects

  • The initiators of actions in the target system.
    • ex) A terminal user, a process acting on behalf of users or groups of users, or might be the system itself.
  • All activity arises through commands initiated by subjects


2. Objects


  • The receptors of actions
    • ex)Files, programs, messages, records, terminals, printers, user-created structures , program-created structures.
  • When subjects can be recipients of actions, then those subjects are also considered to be objects in the model.


IV. AUDIT RECORDS


  • 6-tuples representing actions performed by subjects on objects
    • <Subject, Action, Object, Exception-Condition, Resource-Usage, Time-stamp>
    • ex) Smith, execute, <Library> COPY. EXE, 0, CPU =00002, 11058521678

  • Subject
  • Action: Operation performed by the subject on or with the object
    • e.g., login, logout, read, execute.
  • Exception-Condition: Denotes which exception condition is raised on the return.
    • This should be the actual exception condition raised by the system, not just the apparent exception condition returned to the subject.
  • Resource-Usage: List of quantitative elements, where each element gives the amount used of some resource,
    • Number of lines or pages printed, number of records read or written, CPU time or I/O units used, session elapsed time.'
  • Time-stamp: Unique time/date stamp identifying when the action took place.


  • 가정 : Each field is self-identifying, either implicitly or explicitly
    • ex) The action field either impliesthe type of the expected object field or else the object field itself specifies its type.
  • Audit Record가 여러 시스템에서 수집되었을 경우 an additional field is needed for a system identifier.
  • Our model decomposes all activity into single-object actions
    • So that each audit record references only one object.
    • ex ) File copying is decomposed into an
      • Execute operation on the copy command
      • A read operation on the source file
      • A write operation on the destination file


  • Audit records 예시
    • [COPY GAME.EXE TO <Library> GAME.EXE] <-사용자(Smith)가 권한이 없어서 실행 안됨

(Smith, execute, <Library> COPY. EXE, 0, CPU =00002, 11058521678)
(Smith, read, <Smith>GAME.EXE, 0, RECORDS=O, 11058521679)
(Smith, write, < Library> GAME. EXE, write-viol, RECORDS=O, 11058521680)


복잡한 action을 분해(Decomposing)함으로 얻는 세가지 장점
  • Since objects are the protectable entities of a system, the decomposition is consistent' with the protection mechanisms of systems.
    • Thus, IDES can potentially discover both attempted subversions of the access controls (by noting an abnormality in the number of exception conditions
      returned) and successful subversions (by noting an abnormality in the set of objects accessible to the subject).
  • Single-object audit records greatly simplify the model and its application.
  • The audit records produced by existing systems generally contain a single object, although some systems provide a way of linking together the audit records associated with a "job step" (e.g., copy or compile) so that all files accessed during execution of a program can be identified.


V. PROFILES


Structures that characterize the behavior of subjects
Observed behavior is characterized in terms of a statistical metric and model.

  • A metric (양의 측정 - 측정된 값)
    • A random variable x representing a quantitative measure accumulated over a period.
      • The period may be...
        • a fixed interval of time
          • minute, hour, day, week, etc.
        • the time between two audit-related events
          • between login and logout, program initiation and program termination, file open and file close, etc.

  • Observations ( xi of x obtained from the audit records) are used together with a statistical model to determine whether a new observation is abnormal.
Obervation 과 Statistical model 두가지를 이용하여서 새로운 observation이 abnormal이지 판별한다.
  • The statistical model makes no assumptions about the underlying distribution of x; all knowledge about x is obtained from observations. Before describing the structure,generation, and application of profiles,(????????)


1. Metrics


We define three types of metrics:
  • Event Counter (발생횟수)
    • x is the number of audit records satisfying some property occurring during a period (each audit record corresponds to an event).
      • ex) number of logins during an hour, number of times some command is executed during a login session, and number of password failures during a minute.
  • Interval Timer (두 이벤트 사이의 간격시간)
    • x is the length of time between two related events
    • 즉, the difference between the timestamps in the respective audit records.
      • ex) length of time between successive logins into an account.
  • Resource Measure (자원 소모양)
    • x is the quantity of resources consumed by some action during a period as specified in the Resource-Usage field of the audit records.
      • ex) the total number of pages printed by a user per day and total amount of CPU time consumed by some  program during a single execution.
    • resource measure는 본 논문의 침입탐지 모델에서  event counter 나 interval timer로 구현되어 있다.

2. Statistical Models


The purpose of a statistical model of x is to determine whether a new observation xn+1 is abnormal with respect to the previous observations.

2.1 Operational Model

  • 가정 : Abnormality can be decided by comparing a new observation of x against fixed limits.
  • Although the previous sample points for x are not used, presumably the limits are determined from prior observations of the same type of variable.
  • The operational model is most applicable to metrics where experience has shown that certain values are frequently linked with intrusions.
    • ex) An event counter for the number of password failures during a brief period, where more than 10, suggests an attempted break-in.

실행 값이 지정된 값을 넘는지에 따라 탐지

2.2 Mean and Standard Deviation Model


  • 가정 : All we know about x1....xn, are mean and standard deviation(표준편차) as determined from its first two moments:



10번 시행시 평균값을 넘는 것을 탐지..이때 표준편차 적용

A new observation xn+1 is defined to be abnormal if it falls outside a confidence interval that is d standard deviations from the mean for some parameter d:


췌비쉐프 부등식(Chebyshev's inequality)에 따르면,? the probability of a value falling outside this interval is at most 1 /d2
ex) for d = 4, it is at most 0.0625. Note that 0 (or null) occurrences should be included so as not to bias the data.   

  • This model is applicable to(유용한 분야)
    • Event counters-timer, interval timers, and resource measures accumulated over a fixed time interval or between two related events.
  • It has two advantages over an operational model.(오퍼레이션 모델 대비 2가지 장점)
    • First, it requires no prior knowledge about normal activity in order to set limits; instead, it learns what constitutes normal activity from its observations, and the confidence intervals automatically reflect this increased knowledge.
    • Second, because the confidence intervals depend on observed data, what is considered to be normal for one user can be considerably different from another.


2.3 Multivariate model(다 변량 모델)

  • Similar to the mean and standard deviation model except that it is based on correlations among two or more metrics.
  • 다음의 경우 이 모델이 유용하다.
    • Experimental data show that better discriminating power can be obtained from combinations of related measures rather than individually-
    • 즉, CPU time and I/O units used by a program, login frequency, and session elapsed time (which may be inversely related)

2.4 Markov Process Model


  • This model regards each distinct type of event (audit record) as a state variable, and uses a state transition matrix to characterize the transition frequencies between states
  • Applies only to event counters,
  • New observation is defined to be abnormal
    • if its probability as determined by the previous state & the transition matrix is too low
  • This model might be useful for looking at transitions between certain commands where command sequences were important.

2.5 Time Series Model

  • This model takes into account the order and interarrival times of the observations x1... , xn, as well as their values.
    • Uses an interval timer together with an event counter or resource measure,
  • A new observation is abnormal
    • If its probability of occumng at that time is too low.
  • Advantage of...
    • Measuring trends of behavior over time and detecting gradual but significant shifts in behavior
  • Disadvantage of being...
    • More costly than mean and standard deviation



3. Profile Structure


An activity profile contains
  • Identifies the statistical model and metric of a random variable
  • Set of audit events measured by the variable.



The structure of a profile contains 10 components,
<Variable-Name, Action-Pattern, Exception-Pattern, Resource-Usage-Pattern, Period, Variable-Type, Threshold, Subject-Pattern, Object-Pattern, Value>
* the first 7 are independent of the subjects and objects

  • Variable-Name: Name of variable.
  • Action-Pattern: Pattern that matches zero or more actions in the audit records
    • ex)  "login," "read," "execute."
  • Exception-Pattern: Pattern that matches on the Exception-Condition field of an audit record.
  • Resource-Usage-Pattern: Pattern that matches on the Resource-Usage field of an audit record.
  • Period: Time interval for measurement
    • ex) Day, hour, minute (expressed in terms of clock units).
    • This component is null if there is no fixed time interval
      • ex) the period is the duration of the activity.
  • Variable-Type: Name of abstract data type that defines a particular type of metric and statistical model
    • ex) event counter with mean and standard deviation model.
  • Threshold: Parameter(s) defining limit(s) used in statistical test to determine abnornality.
    • This field and its interpretation is determined by the statistical model (Variable-Type).
    • For the operational model, it is an upper (and possibly lower) bound on the value of an observation;
    • For the mean and standard deviation model, it is the number of standard deviations from the mean.
  • Subject-Pattern: Pattern that matches on the Subject field of audit records.
  • Object-Pattern: Pattern that matches on the Object field of audit records.
  • Value: Value of current (most recent) observation and parameters used by the statistical model to represent distribution of previous values.
    • For the mean and standard deviation model, these parameters are count, sum, sum-of-squares (first two moments).
    • The operational model requires no parameters.

특징
  • A profile is uniquely identified by Variable-Name, Subject-Pattern, Object-Pattern
  • All components of a profile are invariant except for Value.


Although the model leaves unspecified the exact format for patterns, we have identified the following SNOBO Llike constructs as being useful:


The following is a sample profile...
  • For measuring the quantity of output to user Smith's terminal on a session basis.
  • The variable type ResourceByActivity = a resource measure using the mean and standard deviation model.

Whenever the IDS receives an audit record that matches a variable's patterns,
  • It updates the variable's distribution and checks for abnormality.
  • The distribution of values for a variable is thus derived(=learned) as audit records matching the profile patterns are processed.


4. Profiles for Classes


Profiles can be defined...
  • For individual subject-object pairs
    • ex) Where the Subject and Object patterns match specific names,
      • e.g., Subject "Smith" and Object "Foo"
  • For aggregates of subjects and objects
    • ex) Where the Subject and Object patterns match sets of names



예) File-activity profiles could be created..
  • For pairs of individual users and files
  • For groups of users with respect to specific files
  • For individual users with respect to classes of files
  • For groups of users with respect to file classes


[ 위 그림에서 각 노드에 대한 설명]

  • Subject-Object : Actions performed by single subject on single object
    • ex) user Smith, file Foo.

  • Subject-Object Class:
    • Actions performed by single subject aggregated over all objects in the class.
    • The class of objects might be represented...
      • As a pattern match on a subfield of the Object field that specifies the object's type(class),
      • As a pattern match directly on the object's name
        • (e.g., the pattern "*.EXE" for all executable files),
      • As a pattern match that tests whether the object is in some list
        • (e.g., "IN(hit-list)")

  • Subject Class-Object: Actions performed on single object aggregated over all subjects in the class-
    • ex) privileged users-directory file < Library >, nonprivileged users-directory file < Library > .

  • Subject Class-Object Class: Actions aggregated over all subjects in the class and objects in the class-privileged users-system files, nonprivileged users-system files.

  • Subject: Actions performed.by single subject aggregated over all objects
    • ex) user session activity.

  • Object: Actions performed on a single object aggregated over all subjects
    • ex) password file activity.

  • Subject Class: Actions aggregated over all subjects in the class
    • ex) privileged user activity, nonprivileged user activity.

  • Object Class: Actions aggregated over all objects in the class
    • ex) executable file activity.

  • system: Actions aggregated over all subjects and objects.

The random variable represented by a profile for a class can aggregate activity for the class in two ways: Class-as-a-whole activity, Aggregate individual activity

  • Class-as-a-whole activity
    • The set of all subjects or objects in the class is treated as a single entity,
    • each observation of the random variable represents aggregate activity for the entity.
      • ex) a profile for the class of all users representing the average number of logins into the system per day, where all users are treated as a single
        entity.
  • Aggregate individual activity
    • The subjects or objects in the class are treated as distinct entities,
    • each observation of the random variable represents activity for some member of the class.
      • ex) a profile for the class of all users characterizing the average number of logins by any one user per day. Thus, the profile represents a "typical" member of the class.

  • Class-as-a-whole activity can be defined by an event counter, interval timer, or resource measure for the class
  • Aggregate individual activity is defined in terms of the lower-level profiles for the individual class members.
    • Aggregate individual activity requires separate metrics for each member of the class.
  • 예) For example
    • Average login frequency per day is defined as the average of the daily total frequencies in the individual user login profiles.
    • A measure for a class-as-a-whole could also be defined in terms of lower-level profiles, but this is not necessary.


The two methods of aggregation serve difference purposes with respect to intrusion detection.
  • Class-as-a-whole activity reveals whether some general pattern of behavior is normal with respect to a class.
    • A variable that gives the frequency with which the class of executable program files are updated in the system per day, For example, might be useful for detecting the injection of a virus into the system (which causes executable files to be rewritten as the virusspreads).
    • A frequency distribution of remote logins into the class of dial-up lines might be useful for detecting attempted break-ins.
  • Aggregate individual activity reveals whether the behavior of a given user (or object) is consistent with that of other users (or objects).
    • This may be useful for detecting intrusions by new users who have deviant behavior from the start.

5. Profile Templates


사용자 계정과 오브젝트가 동적으로 생성될경우에는 해로운 해당 서브젝트와 오브젝트의 Activity profiles을 생성을 위한 메커니즘이 필요하다. 현재 세가지의 방식이 사용되고 있다.
  • Manual create
    • The security officer explicitly creates all profiles.
    • 단점 : requiring manual intervention on the part of the security officer.
  • Automatic explicit create
    • All profiles for a new useror object are generated in response to a "create" record in the audit trail.
    • 장점 : "Manual create"의 단점 해결
    • 단점
      • it does not automatically deal with startup conditions, where there will be many existing subjects and objects.
      • it requires a subject-object profile to be generated for any pair that is a candidate for monitoring, even if the subject never uses the particular object.
        • cause many more profiles than necessary to be generated.
        • ex) 1000명의 사용자가, 개인당 200개의 파일을 가지고 있다면, 총 200000파일이 존재 하며. 200,000,000의 사용자-파일 연결이 가능하다. 만약 사용자가 최대 300개의 파일만 접근 할수 있다면 오직 300,000개의 프로파일만 필요하다.
  • First use
    • A profile is automatically generated when a subject (new or old) first uses an object (new or old).
    • IDEA 모델에서 책택한것
    • 장점 : "Manual create"& "Automatic explicit create"의 단점 해결
      • 해결 방법 : 템플릿을 이용하여 프로파일 생성

5.1 Profile Template


A profile template..
  • Has the same structure as the profile it generates,
  • Except the subject and object patterns define both a matching pattern & a replacement pattern
    • matching pattern = on the audit records
    • replacement pattern = to place in the generated profile


The format for the fields Subject-Pattern and Object-Pattern is thus:

matching-pattern <- replacement-pattern

The Value component of a template profile contains the initial values for the variable, as specified by its type.


When a new audit record is received, (Audit Record가지고 프로파일 만드는 과정)
  1. matches the record against both activity profiles and template profiles,
  2. obtaining existing profiles
  3. new profiles generated from the matching templates.
  4. The subject and object patterns in a generated profile contain the replacement patterns defined during the match;
  5. all other fields are copied exactly from the template.
  6. If a new profile has the same patterns as an existing activity profile,
    1. it is discarded
    2. otherwise, it is added to the set of activity profiles.
  7. The process then returns the activity profiles matching the audit record.

Separate matching and replacement patterns are needed so that a template can match a wide range of subjects and objects,

For example, consider the following patterns:

  • The subject pattern will match any user name
    • And generate a replacement pattern with that name.
  • The object pattern will match any file in the list Special-Files
    • And generate a replacement pattern with that name.


예) the list Special-Files contains the file names Password and Accounts.
 The following shows a sequence of audit records and the profiles that a template with these
matching and replacement patterns will generate:


The subject and object patterns for a template can be mutually dependent as in following patterns:


Here, the object pattern will match any file in the user's directory and generate a profile for the user's directory.

The following shows a sequence of audit records and the profiles that would be generated from a template containing these patterns:

6. New User and Objects


Introducing new users & objects into the target system potentially raises two problems.
  • The first is generating an excessive number of anomaly records.
    • 발생 원인 : the lack of profile information about the user's behavior as well as by the user's own inexperience with the system,
    • 해 결 방법 : ignoring anomalies for new users were it not for the second problem: failing to detect an intrusion by the new user. (<-문장 이상함)

We would like a solution that minimizes false alarms without overlooking actual intrusions.
  • False alarms can be controlled...
    • by an appropriate choice of statistical model for the activities causing the alarms
    • by an appropriate choice of profiles.
      • 예) With the mean and standard deviation model the confidence intervals are initially large so that more diversity is tolerated while data are being collected about a User's behavior;the intervals then shrink as the number of observations increases.
    • This reduces false alarms caused by an individual user profile, but does not protect the system against new users (or infrequent users) whose behavior is devious, or against users who establish unusual behavior from the beginning, as a cover.
    • To deal with this problem, current activity can be compared to that in aggregate individual profiles or with the set of profiles for all users or all users in some group.
    • Although the operational model does not automatically adapt to an individual user (because it uses fixed thresholds to determine abnormality), the problem can be solved by using more lenient bounds with new users, and by adjusting the bounds as the user gains experience.

7. Possible Profiles


We shall now describe candidate profiles for measuring...
  • login and session activity,
  • command and program usage,
  • file accesses.
For each profile, we suggest a metric and statistical model for measuring the activity.


7.1 Login and Session Activity

  • LoginFrequency
  • LocationFrequency
  • LastLogin
    • Interval timer measuring time since last login using the operational model.
    • This type of profile could be defined for individual users but location classes,
      since the exact location seems less relevant than the lapse of time.
    • It would be particularly useful for detecting a break-in on a "dead" account.
  • SessionElapsedTime
  • SessionOutput
  • SessionCPU; SessionlO, SessionPages, etc.
  • PasswordFails
  • LocationFails


7.2 Command or Program Execution

  • ExecutionFrequency
  • ProgramCPU, ProgramIO, etc.
  • ExecutionDenied
  • ProgramResourceExhaustion


7.3 File-Access Activity:

  • ReadFrequency, WriteFrequency, CreateFrequency, DeleteFrequency
  • RecordsRead, RecordsWritten
  • ReadFails, WriteFails, DeleteFails, CreateFails
  • FileResourceExhaustion


VI. ANOMALY RECORDS


Through its activity rules, IDES updates activity profiles and checks for anomalous behavior whenever an audit record is generated or a period terminates.

If abnormal behavior is detected, an anomaly record is generated

An anomaly record = < Event, Time-stamp, Profile>

  • Event: indicates the event giving rise to the abnormality
    • either "audit," meaning the data in an audit record was found abnormal,
    • or "period," meaning the data accumulated over' the current interval was found abnormal.
  • Time-stamp:
    • either the time-stamp in the audit record
    • or interval stop time
  • Profile: activity profile with respect to which the abnormality was detected
    • (rather than including the complete profile, IDES might include a "key" field, which identifies the profile in the database, and the current state of the Value field).

VII. ACTIVITY RULES (여기서 부터 미완성)

An activity rule specifies an action to be taken...
  • when an audit record or anomaly record is generated,
  • When a time period ends.


It consists of two parts:
  • A condition that, when satisfied, causes the rule to be "fired,"
    • The condition is specified as a pattern match on an event.
  • A body.
    • Action이라고 부르지 않는 이유 : actions monitored by IDES와의 혼돈을 피하려고


4종류의 룰들..
  • Audit-record rule
    • Condition : triggered by a match between a new audit record and an activity profile,
    • Body : updates the profile and checks for anomalous behavior.
  • Periodic-activity-update rule
    • Condition : triggered by the end of an interval matching the period component of an activityprofile
    • Body : updates the profile and checks for anomalous behavior.
  • Anomaly-record rules,
    • Condition : triggered by the generation of an anomaly record,
    • Body : brings the  anomaly to the immediate attention of the security officer.
  • Periodic-anomaly-analysis rule,
    • Condition : triggered by the end of an interval,
    • Body : generates summary reports of the anomaliesduring the current period.

Audit-Record Rules


  • triggered whenever a new audit record matches the patterns in an activity profile.
  • It updates the profile to reflect the activity reported in the record and checks for deviant behavior.
  • If an abnormality is detected, it generates an anomaly record.
  • Since the algorithm for updating the profile and checking for abnormality depends only on the type t of variable (statistical metric and model) represented by the profile, but not on the profile's other components (e.g., subject, object, action, etc.), it can be encoded in a procedure AuditProcesst.
  • Thus, all audit record rules are represented by the following generic rule:


Periodic-Activity-Update Rules


  • triggered whenever the clock implies a period of length p completes, the Period component of a profile is p, and the Variable-Type component is t.
  • The rule updates the matching profile, checks for abnormal behavior,
    • if an abnormality is detected, generates an anomaly record

Anomaly-Record Rules

  • triggered whenever a new anomaly record matches patterns given in the rule for its components Event and Profile
  • Thus, a rule may be conditioned on a particular variable, a particular subject or object, on the audit action that was found to be anomalous, and so forth.

참고 : Dorothy E. Denning, "An Intrusion-Detection Model", IEEE, 1987
정리 : 2008.12.15 by 임헌정
http://www.4ellene.net
2008/12/16 18:22 2008/12/16 18:22
트랙백은 하나, 댓글이 없습니다.

Intrusion detection_a brief history and overview

from life is../논문_논문정리 2008/11/27 18:29
Intrusion Detection: A Brief History and Overview


Richard A. Kemmerer and Giovanni Vigna
Reliable Software Group, Computer Science Department, University of California Santa Barbara




구글 Doc : http://docs.google.com/Doc?id=dgqhdkpv_310gzx45j2q

작성 : 20081126  by 임헌정
http://www.4ellene.net
2008/11/27 18:29 2008/11/27 18:29
받은 트랙백이 없고, 댓글이 없습니다.

IEEE, ACM, Elseiver, Computer Society, Springer 레퍼 다는법

from life is../논문_논문정리 2008/10/08 15:29
논문 작성할때

각 출판사 및 학회 마다 레퍼 다는 법이 조금씩 달라...모아 보았습니다..

해가 지날때 마다 포맷을 변경하는곳도 있으니 참고 하세요


IEEE : http://wwwlib.murdoch.edu.au/find/citation/ieee.html

Contents


ACM :

[1]    Bowman, M., Debray, S. K., and Peterson, L. L. 1993. Reasoning about naming systems. ACM Trans. Program. Lang. Syst. 15, 5 (Nov. 1993), 795-825. DOI= http://doi.acm.org/10.1145/161468.161471.

[2]    Ding, W. and Marchionini, G. 1997 A Study on Video Browsing Strategies. Technical Report. University of Maryland at College Park.

[3]    Fr?hlich, B. and Plate, J. 2000. The cubic mouse: a new device for three-dimensional input. In Proceedings of the SIGCHI Conference on Human Factors in Computing Systems (The Hague, The Netherlands, April 01 - 06, 2000). CHI '00. ACM Press, New York, NY, 526-531. DOI= http://doi.acm.org/10.1145/332040.332491

[4]    Tavel, P. 2007 Modeling and Simulation Design. AK Peters Ltd.

[5]    Sannella, M. J. 1994 Constraint Satisfaction and Debugging for Interactive User Interfaces. Doctoral Thesis. UMI Order Number: UMI Order No. GAX95-09398., University of Washington.

[6]    Forman, G. 2003. An extensive empirical study of feature selection metrics for text classification. J. Mach. Learn. Res. 3 (Mar. 2003), 1289-1305.

[7]    Brown, L. D., Hua, H., and Gao, C. 2003. A widget framework for augmented interaction in SCAPE. In Proceedings of the 16th Annual ACM Symposium on User interface Software and Technology (Vancouver, Canada, November 02 - 05, 2003). UIST '03. ACM Press, New York, NY, 1-10. DOI= http://doi.acm.org/10.1145/964696.964697

[8]    Y.T. Yu, M.F. Lau, "A comparison of MC/DC, MUMCUT and several other coverage criteria for logical decisions", Journal of Systems and Software, 2005, in press.

[9]    Spector, A. Z. 1989. Achieving application requirements. In Distributed Systems, S. Mullender, Ed. Acm Press Frontier Series. ACM Press, New York, NY, 19-33. DOI= http://doi.acm.org/10.1145/90417.90738



Elsevier : http://www.elsevier.com/framework_products/promis_misc/apmrformat.pdf

Standard journal article with continuous pagination throughout a volume omit the month and issue number: Vega KJ, Pina I, Krevsky B. Heart transplantation is associated with an increased risk for pancreatobiliary disease. Ann Intern Med 1996;124:980-3.


Computer Society : [링크]

A.J. Albrecht, “Measuring Application-Development Productivity,” Programmer Productivity Issues for the Eighties, 2nd ed., C. Jones, ed., IEEE CS Press, 1981, pp. 34-43.


Springer : [Sample file]
Smith, T.F., Waterman, M.S.: Identification of Common Molecular Subsequences. J. Mol. Biol. 147, 195?197 (1981)

2008/10/08 15:29 2008/10/08 15:29
받은 트랙백이 없고, 댓글이 없습니다.

Proxy Mobile IPv6 동작 과정[영어]

from life is../논문_논문정리 2008/08/18 13:59
Proxy Mobile IPv6

The existing MN based mobility support mechanism requires additional stacks and signaling for the MN. This could bring overhead such as battery power and computation resource consumption. Network based mobility support mechanism is another approach to solve the problems and support the IP mobility. This is a kind of extended version of Mobile IPv6 [10] and Hierarchal Mobile IPv6 [11]. In the network based mobility support mechanism, MN does not need to install additional stacks and exchange signals. A special mobility agent in the network performs the signaling and does the mobility management on behalf of the MN. The IETF NETLMM working Group has researching under proxy mobile IPv6. There are two main components for the proxy mobile IPv6, a Local Mobility Anchor (LMA) and a Mobile Access Gateway (MAG). The LMA performs home agent roles, as defined in Mobile IPv6 base specification [1], for the MN in the Proxy mobile IPv6 domain. LMA is the topological anchor point for the MN’s home network prefix (HNP) and it maintains MN’s binding state. The MAG performs mobility related signaling to the LMA for the MN and tracks the MN’s movements.

Figure [2] presents the operation and message flow of the PMIPv6 [12]. The PMIPv6 protocol operation consists of four phases. In the first phase, MAG retrieves the MN’s profile using its current identifier. The Binding Update (BU) is the second phase, in which the MAG will send a Proxy BU request to the LMA in order to register the current point of attachment of the MN. Accordingly, a binding cache entry and a tunnel for the MN’s home prefix will be created. The third phase will be the MAG emulating the mobile node’s home interface on the access interface. Therefore, the MN will always believe it is in the home network. Fourthly, the LMA reply Proxy Bind Acknowledge (PBA) message with the MN’s HNP. After receiving the Router Advertise (RA) message, the MN creates its IP address. For packet routing, the LMA will route all received packets over the established tunnel to the MAG. The MAG forwards these packets to the MN. Certainly, the MAG will relay all the received packets over the tunnel to the LMA and then they will be routed towards the CN.
2008/08/18 13:59 2008/08/18 13:59
받은 트랙백이 없고, 댓글이 없습니다.

[논문정리] Implementing a New Manet Unicast Routing Protocol in NS2

from life is../논문_논문정리 2008/07/14 20:00

Implementing a New Manet Unicast Routing Protocol in NS2


Francisco J. Ros
Pedro M. Ruiz
{fjrm, pedrom}@dif.um.es
Dept. of Information and Communications Engineering
University of Murcia
December, 2004


요약 : ns2-2.27을 기반으로 새로운 MANET프로토콜 구현 하는 법을 스텝-바이-스텝으로 설명하고 있다.

내용 정리 : Google Docs

작성 : 2008.07.14 by Hun-Jung Lim
http://www.4ellene.net
2008/07/14 20:00 2008/07/14 20:00
Tag //
받은 트랙백이 없고, 댓글이 없습니다.

[논문정리] Mobility Models for Vehicular Ad hoc Networks: A survey and Taxonomy

from life is../논문_논문정리 2008/07/01 21:25

Mobility Models for Vehicular Ad hoc Networks: A survey and Taxonomy



J´er?ome H¨arri, Fethi Filali and Christian Bonnet
Institut Eur´ecom
Department of Mobile Communications
2229, route des Cr?etes
B.P. 193
06904 Sophia-Antipolis
FRANCELast update March 26th, 2007

[논문] Mobility Models for Vehicular Ad Hoc Networks_A Survey.pdf

초 록 : Vehicular Ad-hoc Networks (VANETs) have been recently attracting an increasing attention from both research and industry communities. One of the challenges posed by the study of VANETs is the definition of a generic mobilitymodel providing an accurate, realistic vehicular mobility description at both macroscopic and microscopic levels. Today, most mobility models for vehicular studies only consider a limited macro-mobility, involving restricted vehicles movements, while little or no attention is paid to mi ro-mobility and its interaction with the macro-mobility counterpart. On the other hand, the research community cannot have access to realistic traffic generator which have not been designed to collaborate with network simulators. In this paper, we first introduce a classification of existing methods for the generation
of vehicular mobility models, then we describe the various approaches used by the community for realistic VANET simulations. Finally, we provide an overview and comparison of a large range of mobility models proposed for vehicular ad hoc networks.

논문 정리 : 구글Docs
영단어 참고 : FlashcardDB
작성 : 20080701 by 임헌정
http://www.4ellene.net
2008/07/01 21:25 2008/07/01 21:25
받은 트랙백이 없고, 댓글이 없습니다.

[논문정리] Mobility Models for Vehicluar Ad hoc Network Simulations

from life is../논문_논문정리 2008/06/04 15:53
Mobility Models for Vehicluar Ad hoc Network Simulations

Niranjan Potnis
KCRG, Learning Systems Institute
2000,Levy Avenue, Suite 320
Tallahassee, Florida 32310   
001-850-644-4720
npotnis@lpg.fsu.edu



Abstract


현재의 모빌리티 모델은 차량 이동의 특징인 도로 경계선, 정지 표시판, 신호등, 건물등의 장애물에 대한 고려 요소가 없다.
시뮬레이션은 성능 측정을 위한 중요 툴이다. 여러 파라미터등이 중요 하지만 이중에서도 모빌리티는 네트워크 disconnection등을 발생할수 있으므로 중요한 요소이다.
본 논문에는 실제 모빌리티 특성을 찾아 내는 방법을 제안 하였다. (Through this work, methods to capture the realistic mobility characteristics of vehicles on urban streets are proposed.)
모빌리티 모델을 이용하여 생성된 파일은 NS2에 사용될수 있다.

논문 정리 : 구글 Docs
작성 : 20080604 by 임헌정
http://www.4ellene.net

2008/06/04 15:53 2008/06/04 15:53
트랙백은 하나, 댓글이 없습니다.

[논문_정리] Vehicular Ad Hoc Networks (VANETs): Challenges and Perspectives