NETWORK SECURITY THROUGH INTRUSION DETECTION SYSTEMS USING ARTIFICIAL INTELLIGENCE

                         NETWORK SECURITY THROUGH INTRUSION DETECTION SYSTEMS USING

                                                                        ARTIFICIAL INTELLIGENCE

                                                      

ABSTRACT

Intrusion detection systems have previously been built by hand. These systems have difficulty successfully classifying intruders, and require a significant amount of computational overhead making it difficult to create a robust real-time IDS system. Artificial intelligence techniques can reduce the human effort required to build these systems and can improve their performance. Learning and induction are used to improve the performance of search problems, while clustering has been used for data analysis and reduction. AI has recently been used in intrusion detection (ID) for anomaly detection, data reduction and induction, or discovery, of rules explaining audit data. We survey uses of artificial intelligence methods in ID and feature selection to improve the classification of network connections. The network connection classification problem is related to ID since intruders can create “private” communication services undetectable by normal means. We also explore some areas where AI techniques may further improve IDSs.

Introduction to network security:

                    A network is two or more machines interconnected for communications. When business is conducted, sensitive data is stored and transferred, and sensitive communications occur. Some opportunistic people might attempt to disrupt that business, steal or destroy the data, or exploit the communications.

   The goals of security must be confidentiality, integrity and availability.

.Who is attacking? An attacker can be either a hacker, or a cracker or a novice.

    The security mechanisms of a system are designed so as to prevent unauthorized access to system resources and data. Completely preventing breaches of security appear unrealistic at present. We can, however, try to detect these intrusion attempts so that the action may be taken to repair the damage later. This field of research is called intrusion detection.

 Introduction to intrusion detection

Intrusion detection is the process of monitoring and evaluating computer events and network traffic for signs of intrusions. It is a hardware device with software that is used to detect unauthorized activity on your network. They are burglar alarms of the computer security systems. IDS implementation can log and alert you to unauthorized activity on your network. IDS software can be implemented on individual hosts, servers, at the network perimeter or throughout the entire network.

    The aim is to defend a system by using a combination of an alarm that sounds whenever the site’s security has been compromised and an entity- most often a site security officer (SSO) - that can respond to the alarm and take the appropriate action. 

Need for IDS (INTRUSION DETECTION SYSTEMS):

1. In practice, it is not possible to build a completely secure system.

2. The vast installed base of systems world wide guarantees that any transition to a secure system will be long in coming.

3. Cryptographic methods have their own problems. Passwords can be cracked, lost and entire crypto-systems can be broken.

4. A truly secure system is vulnerable to abuse by insiders who abuse their privileges.

5. It has been that the relationship between the level of access control and user efficiency is an inverse one, which means that the stricter the mechanisms, the lower the efficiency becomes.

    An IDS does not usually take preventive measures when an attack is detected; it is a           reactive rather than pro-active agent.

    The most popular way to detect intrusions has been by using the audit data generated by Operating System. An audit trail is a record of activities on a system that are logged to file in chronologically sorted order. Audit trails are particularly useful because they can be used to establish guilt of attackers and they are often the only way to detect unauthorized but subversive user activity. This is a good substitute for manual analysis.

    Intruders can be classified as internal and external. External intruders are unauthorized users of machines they attack. Internal intruders masquerade as another user, those with legitimate access to sensitive data, or the clandestine intruders who have the power to turn off audit control for themselves.

Problems in intrusion detection: 

Issues in intrusion detection include data collection, data reduction, behaviour classification, reporting and response. Data reduction reduces processing time, communications overhead and storage requirements. Classification is the process of identifying attackers and intruders. Artificial intelligence techniques have been used in many Intrusion Detection Systems to perform these important tasks in a more efficient manner.

Classification of IDS

Techniques of intrusion detection are of two main types-anomaly detection and misuse detection. 

Anomaly detection: 

These techniques assume that all intrusive activities are necessarily anomalous. There are two problems here.

1) anomalous activities that are not intrusive are flagged as intrusive.

2) Intrusive activities that are not anomalous result in false negatives.

    So, the main issues in the anomaly detection system become the selection of threshold levels so that neither of the two problems is unreasonably magnified and the selection of features to monitor. These systems are also computationally expensive 

because of the overhead of keeping track of and updating several system profile metrics.

Misuse detection: 

The concept here is that there are ways to represent attacks in the form of a pattern or signature so that even variations of same attack can be detected i.e. they can detect many or all known attack patterns but are of little use for as yet unknown attack methods.                      

           

Anomaly detection systems

Statistical approaches: 

Behaviour profiles for subjects are generated. As system runs, anomaly detector constantly generates the variance of present profile from the original one. The main advantage to statistical systems is that they adaptively learn the behaviour of users; they are thus potentially more sensitive than human experts. However, there are a few problems. They can be gradually trained by intruders so that eventually intrusive events are considered normal, false positives and false negatives are generated depending on whether the threshold is set too low or too high and relationships between events are missed because of statistical measures to order of events. 

    An open issue here is the selection of measures to monitor. A static and dynamic determination of the set of measures should be done. Some problems associated with this technique have been remedied by other methods, including the method of involving ‘Predictive Pattern Generation’ which takes part events into account while analysing the data.

2.3.3 Attacks captured by software

IGMP KOD

Predictive pattern generation: 

This method tries to predict future events based on the events that have already occurred. Therefore, there can be a rule

      E1 - E2   - -> (E3 =80%,  E4  =15%,   E5  =5%)

 This would mean that given that events E1 and E2 have occurred, with E2 occurring after E1 there is an 80% probability that event E3 will follow, a 15% chance that event E4 will follow and a 5% probability that event E5 will follow. The problem with this is that some intrusion scenarios that are not described by the rules will not be flagged intrusive Thus, if an event sequence A –B –C exists that is intrusive, but not listed in the rule base, it will be classified as unrecognised. This problem can be partially solved by flagging any unknown events as intrusions (increasing the probability of false positives), or by flagging them as non-intrusive (thus increasing the probability of false negatives). In the normal case, however, an event is flagged intrusive if the left hand side of a rule is matched, but the right hand side is statistically very deviant from the prediction.

    There are several advantages here. Rule based sequential patterns can detect anomalous activities that were difficult with traditional methods. Systems built using this model are highly adaptive to changes. It is easier to detect users who try to train system during its learning period. Anomalous activities can be detected and reported within seconds of receiving audit events.

Neural networks: 

The idea used here is to train the neural network to predict a user’s next action or command given the window of n previous actions or commands. The network is trained on a set of representative user commands. Some advantages of using neural networks are they cope well with noisy data, their success does not depend on any statistical assumption about the nature of the underlying data and they are easier to modify for new user communities. There are also some problems. A small window results in false positives while a large window results in irrelevant data as well as increase of false negatives. The net topology is only determined after considerable trial and error. The intruder can train the net during its learning phase.

Misuse detection systems: 

Expert systems are modelled in such a way as to separate the rule matching phase from the action phase. The matching is done according to audit trail events. Next Generation Intrusion Detection Expert Systems (NIDES) follows a hybrid intrusion detection technique consisting of misuse detection component as well as an anomaly detection component, the anomaly detectors based on statistical approach. The misuse detection component encodes known intrusion scenarios and attack patterns. One advantage is it has a statistical component as well as an expert system component. So, the chances of one system catching intrusions missed by the other increase. Another advantage is problem’s control reasoning is clearly separated from the formulation of the solution.

    Some drawbacks for the expert systems are the expert system has to be formulated by a security professional and thus the system is only as strong as the security personnel who programs it. So, there is a chance that expert systems can fail to flag intrusions.

    The NIDES system runs on a machine different from the machine(s) to be monitored which could be unreasonable overhead. Additions and deletions of rules from rule-base must take into account the inter-dependencies between different rules in the rule-base and there is no recognition of sequential ordering of data, because the various conditions that makeup a rule are not recognised to be ordered.

Keystroke monitoring: 

It is a technique that monitors keystrokes for attacks. Here, there are several defects—features of shells like bash, ksh, and tcsh in which user definable aliases are present defeat the technique unless alias expansion and semantic analysis of the commands is taken up. This method does not analyse running of a program, only keystrokes. So, malicious programs cannot be flagged for intrusive activities. Operating System does not offer much support for keystroke capturing, so keystroke monitor should have a hook that analyses keystrokes before sending them to intended receiver. Also, system calls should be monitored by application programs as well so that an analysis of the program’s execution is possible.

Model based intrusion detection: 

 It states that certain scenarios are inferred by certain other observable activities. If these activities are monitored, it is possible to find intrusion attempts by looking at activities that infer a certain intrusion scenario.

    The model based scheme consists of three important modules. The anticipator uses active modules and scenario modules (knowledge base of intrusion scenario specification) try to predict next step in the scenario that is expected to occur. Planner then translates this hypothesis into a format that shows behaviour as it would occur in audit trail. It uses predicted information to plan what to search for next. The interpreter then searches for this data in the audit trail. The system proceeds this way accumulating more and more evidence for an intrusion attempt until a threshold is crossed, at this point signals an intrusion attempt.

    Large amounts of noise present in audit data can be filtered. System can predict attacker’s next move based on intrusion model. These predictions can be used to verify an intrusion hypothesis to take preventive measures or determine what data to look for next.

    Some critical issues are:  patterns for intrusion scenarios must be easily recognised. Patterns must always occur in the behaviour being looked for. The patterns must be distinguishing; they must not be associated with any other normal behaviour.

 State transition analysis:

 In this technique, the monitored system is represented as state transition diagram. As data is analysed, the system makes transitions from one state to another. A transition takes place on some Boolean condition being true. The approach is to have state transitions from safe to unsafe states based on known attack patterns. 

    Advantages are it can detect co-operation attacks, it can detect attacks that span across multiple user sessions, and it can foresee impending compromise situations based on present system state and take pre-emptive measures.

    Problems are attack patterns can specify only a sequence of events rather than more complex forms. There are no general purpose methods to prune the search except through assertion primitives. They cannot detect denial of service attacks, failed logins, variations from normal usage and passive listening because these items are either not recorded by the audit trail mechanism or they cannot be represented by state transition diagrams. It should be used with anomaly detector so that more intrusion attempts may be detected by their combination.

Pattern matching: 

This model encodes known intrusion signatures as patterns that are then matched against audit data. It makes transitions on certain events, called labels and Boolean variables called guards can be placed at each transition.

    Important advantages are declarative specification, portability, excellent real time capabilities, detects some attack signatures that state transition model cannot, multiple event streams can be used together to match against patterns for each stream without the need to combine streams.

    Problems are it can only detect attacks based on vulnerabilities. It is not useful for ill-defined patterns. It cannot detect wire-tapping intrusions nor can it detect spoofing attacks where a machine pretends to be another machine by using its IP address.

ARTIFICIAL INTELLIGENCE AND INTRUSION DETECTION:                          

Artificial intelligence is concerned with improving algorithms by employing problem solving techniques used by human beings. 

Data reduction for intrusion detection: 

Due to the massive amount of audit data available, classification by hand is impossible. Also, complex relationships exist between the features that are difficult for humans to discover. So, the amount of data to be processed should be reduced. Data that is not considered useful can be filtered. Data can be grouped or clustered to reveal hidden patterns; by storing the characteristics of the clusters instead of data, overhead can be reduced. Feature selection can also be used to eliminate some data sources.

Data filtering: 

The purpose is to reduce the amount of data directly handled by Intrusion Detection Systems. This decreases storage requirements and reduces processing time. Data filtering is done using heuristic or ad hoc methods, which can be viewed as expert rules for filtering.

Feature selection: 

Some data hinders classification process. Features may contain false correlations which hinder the process of detecting intrusions. Some of the features may be redundant since their information is contained in others. Feature selection improves classification by searching for the subset of features which best classifies the training data. It is used to find features most indicative of misuse, or can be used to distinguish between types of misuse. 

Data clustering: 

This is used to find hidden patterns in data and significant features for use in detection and can also be used as a reduction technique by storing the characteristics of clusters. There is a close relationship between learning and clustering. Hence this is used by AI. 

Behaviour classification in intrusion detection:

  Classification has drawbacks like false positives and false negatives. AI techniques can be used to improve this.      

Expert systems: 

In this system, a set of rules encoding knowledge of an expert are used to make conclusions about matter gathered by IDS. The expert determines the most appropriate rule to select. This can be implemented with a neural network which reports anomalies to the expert system and also employs data not used by the net.

Using feature selection in network based intrusion detection: 

Computer systems are increasingly network dependent. Hence, it is imperative to protect both local and regional networks. An intruder can hide network connections by strategically placing the servers that receive the connections on different ports. The mapping of ports to services is internal to a single machine; an intruder could also change the port map. Thus, identification of type of connection made without referring to port numbers is mandatory. 

    We can improve classification of n/w connections by minimizing classification error rate and by reducing the number of features required to classify connections by using feature selection algorithms.

Search algorithms

1. Backward sequential search begins with a full set of features. At each stage of search, each feature in the remaining set is removed. The best feature to be eliminated is determined by comparing the error rates of the classifiers created using the resulting feature sets.

2. Beam search is a type of best first search which uses a bounded queue and the best state is placed in the front of the queue. The algorithm operates by taking the first state in the queue and extending the search as in backward sequential search. Each new state visited is placed in the queue in the order of goodness of its state.

3. In random generation plus sequential selection several sequential selections from different places in the search space are performed. To do so, we generate a random feature set, then perform backward and forward sequential selection of the state. This is the best search algorithm among the three.

Future uses of AI in intrusion detection: 

Many IDS’s employ AI methods in their systems for improvement. Some of the AI techniques are:

• Feature selection in intrusion detection systems

• Reconfiguration and customization of IDS’s

• Clustering in intrusion detection

IDS’s make extensive use of AI techniques to improve their ability to detect attacks on computer systems.

CONCLUSION:

Intrusion detection is still a fledging field of research. However, it is beginning to assume enormous importance in today’s computing environment. The combination of facts such as the unbridled growth of the internet, the vast financial possibilities opening up in electronic trade, and the lack of truly secure systems make it an important and pertinent field of research. Future research trends seem to be converging towards a model that is a hybrid of the anomaly and misuse detection models; it is slowly acknowledged that neither of the models can detect all intrusion attempts on their own.

    We have proved the need for IDS and discussed its classification. The major classification is into anomaly and misuse detections, we have gone briefly into the different techniques used in anomaly detection systems. Some of them are statistical approaches, predictive pattern generation and usage of neural networks. We have also discussed about the misuse detection systems like keystroke monitoring, model based intrusion detection, state transition analysis and pattern matching.

    we have provided a brief survey of AI methods used in a variety of IDSs. We dealt with the need of data reduction for intrusion detection and the methods of data filtering, types of data filtering like feature selection and data clustering. We described the behaviour classification in intrusion detection using expert systems and rule based induction. We have also shown how one technique, feature selection, can be used to reduce overhead and improve classification of network connections. 

                                                            MOBILE COMPUTING                                                              

ABSTRACT:-

            

      Technology has developed rapidly over the last twenty years. This development in technology resulted in the development of communication. For example, Internet, email, Voicemail, etc. This development has still not given the user the freedom to access data anywhere or anytime he wants because of the limitations like the change in location resulted in either routing problems or connection breaks.

            The advent of MOBILE COMPUTING has given birth to hopes of overcoming the above limitations. These mobile networks have facilitated communication anywhere in the world at any time. The word MOBILE itself illustrated what it does. These mobile networks provide communication even when the source and destination are constantly changing their location.

                               

 INTRODUCTION:-

 

           Don Ring of Bell Labs, USA in 1947, invented the cellular concept. The first commercial mobile communications were in the form of radio paging networks. Advanced Mobile Phone System (AMPS) is a major cellular networks established in America using analog cellular technology. Total Access Communication System (TACS) is a major system use in Europe. Recently a number of digital communications are also introduced. The present trend is to cover communications anywhere in the world and at any time of the day. Cellular concept based on the concept of network of cells, which covers a large geographical area to communicate over the world.

  Mobile Computing is a program that allows user to access wireless network. This is done by using Radio Frequency (RF) technology to transmit data through the air without wired cabling. Mobile Computing provides all the same features and benefits of the existing campus network, but without the limitations of being tethered to a cable.

The goals of this service are to provide expanded wireless coverage for the campus, provide access to wireless monitor usage and solicit feedback in order to determine scope and scale of future expansion.

 IMPORTANCE OF MOBILE COMPUTERS:-

Mobile Computing is becoming increasingly important due to the rise in the number of portable computers and the desire to have continuous network connectivity to the Internet irrespective of the physical location of the node. The Internet infrastructure is built on top of a collection of protocols, called the TCP/IP protocol suite. The Mobile Internet Protocol (Mobile IP) is an extension to the Internet Protocol proposed by the Internet Engineering Task Force (IETF) . It enables mobile computers to stay connected to the Internet regardless of their location and without changing their IP address. More precisely, Mobile IP is a standard protocol that builds on the Internet Protocol by making mobility transparent to applications and higher level protocols like TCP. 

     

 

 

 

 

HOW MOBILE IP WORKS:-

IP routes packets from a source endpoint to a destination by allowing routers to forward packets from incoming network interfaces to outbound interfaces according to routing tables. The routing tables typically maintain the next-hop (outbound interface) information for each destination IP address, according to the number of networks to which that IP address is connected. The network number is derived from the IP address by masking off some of the low-order bits. Thus, the IP address typically carries with it information that specifies the IP node's point of attachment.

To maintain existing transport-layer connections as the mobile node moves from place to place, it must keep its IP address the same. In TCP (which accounts for the overwhelming majority of Internet connections), connections are indexed by a quadruplet that contains the IP addresses and port numbers of both connection endpoints. Changing any of these four numbers will cause the connection to be disrupted and lost. On the other hand, correct delivery of packets to the mobile node's current point of attachment depends on the network number contained within the mobile node's IP address, which changes at new points of attachment. To change the routing requires a new IP address associated with the new point of attachment.

Mobile IP has been designed to solve this problem by allowing the mobile node to use two IP addresses (see the sidebar "Mobile Networking Terminology" for definitions of italicized terms). In Mobile IP, the home address is static and is used, for instance, to identify TCP connections. The care-of addresses changes at each new point of attachment and can be thought of as the mobile node's topologically significant address; it indicates the network number and thus identifies the mobile node's point of attachment with respect to the network topology. The home address makes it appear that the mobile node is continually able to receive data on its home network, where Mobile IP requires the existence of a network node known as the home agent. Whenever the mobile node is not attached to its home network (and is therefore attached to what is termed a foreign network), the home agent gets all the packets destined for the mobile node and arranges to deliver them to the mobile node's current point of attachment.

Whenever the mobile node moves, it registers its new care-of address with its home agent. To get a packet to a mobile node from its home network, the home agent delivers the packet from the home network to the care-of address. The further delivery requires that the packet be modified so that the care-of address appears as the destination IP address. This modification can be understood as a packet transformation or, more specifically, a redirection. When the packet arrives at the care-of address, the reverse transformation is applied so that the packet once again appears to have the mobile node's home address as the destination IP address. When the packet arrives at the mobile node, addressed to the home address, it will be processed properly by TCP or whatever higher level protocol logically receives it from the mobile node's IP (that is, layer 3) processing layer.

DIFFERENT TYPES OF MOBILE SYSTEMS:-

                In many ways mobile computing has several characteristics of distributed systems. Here we explain the different types of distributed systems ranging from the traditional type to nomadic, ad-hoc and finally ubiquitous ones.

TRADITIONAL DISTRIBUTED SYSTEMS

            Traditional distributed systems consists of a collection of fixed hosts that are themselves attached to a network- if hosts are disconnected from the network this is considered to be abnormal whereas in a mobile system this is quite the norm. These hosts are fixed. The bandwidth in traditional systems is very high too.

            The execution context is said to be static as opposed to a dynamic context whereby host joined and leave the network frequently. in a traditional system ,location rarely changes as well and hosts are much less likely to be added or deleted from the network

   Traditional distributed systems also need to guarantee non-functional requirements such as scalability, openness, heterogeneity, fault tolerance and finally resource sharing.

NOMADIC DISTRIBUTED SYSTEM

This kind of system is composed of a set of mobile devices and a core infrastructure with fixed and wired nodes. Mobile devices move from location to location while maintaining a connection to the fixed network. There are problems that arise from such shifts in location. The mobile host has a home IP address and thus any packets sent to mobile host will be delivered to the home network and not the foreign network where the mobile host is currently located. Such problem can be solved by forwarding packets to the foreign network with the help of mobile IP.

            These systems are susceptible to the uncertainty of location, a repeated lack of connections and the migration into different physical and logical environments while operating. However, compared to ad-hoc networks, nomadic systems still have comparatively reliable connections and services since most of these are actually supported by the fixed infrastructure of the network.

AD-HOC MOBILE DISTRIBUTED SYSTEM

Ad-hoc distributed systems are possibly the only type of network that comes close to mobile networks in the sense that every node is literally mobile.  It is these networks 0that are very much seen as the systems of the future, whereby hosts are connected to the network through high-variable quality links) e/g/ from GPS to broadband connection) and executed in an extremely dynamic environment

Ad-hoc systems do not have any fixed infrastructure which differs them both from traditional and nomadic distributed systems.  In fact, ad-hoc networks may come together as needed, not necessarily with any assistance from the existing (e.g. Internet) infrastructure.  When nodes are detached from the fixed/mobile network they may evolve independently and groups of hosts opportunistically from “clusters” of mini-networks.  The speed and ease of deployment make ad-hoc networks highly desirable.

THEORY IN MOBILE COMPUTERS:-

The trends of two fields related to mobile computing are

* MODELS

            Models permit the precise description of existing languages and system semantics.  In fact, they enable the formal reasoning about the correctness of such semantics.  Models are very much used to emphasize parallels and distinctions among various forms of mobility (logical and physical) and are concerned with the formulation of appropriate abstractions useful in specification and evaluation of such mobile systems

Models are mainly concerned with the characteristics of mobile units such as the unit of mobility (who is allowed to move), its location (where a mobile unit is positioned in space) and its context (determined by the current location of mobile units).  There are many existing models are many more are still in research.

·         Random mobility models(s)

·         Markovian model

·         Exponential Correlated Random Model

·         Nomadic Community Model.

*ALGORITHMS

       The current algorithms applied reflect the assumptions that are made about the underlying system.  Unfortunately, many of these assumptions are not suited for current algorithms for mobile systems.  Mobile algorithms are obliged to treat in much detail space and coordination of mobile systems.  In particular, algorithms have to carefully take into consideration location changes, the frequency of disconnection, power limitations and the dynamic changes in the connectivity pattern of mobile systems.  This field of theory is in fact spread among a vast spectrum of research due to the large diversity of mobile systems.

 

APPLICATIONS:-

   

The application areas of mobile technology include

• Consumer Goods
• Delivery and Route Sales
• Government
• Healthcare
• Market Research
• Pharmaceuticals
• Transportation and
• Utilities

 BENEFITS:-

         The benefits of automating data collection applications with mobile computing are the reduction of hard and soft costs, enhancement of revenue potential, and a distinct competitive advantage through:

• improving the data collection process
• improving data accuracy
• facilitating collection of more useful information
• eliminating redundant data entry
• improving information flow
• providing access to previously unavailable information

• Reduced radio congestion. 
• Improved supervision and resource management. 
• Less time in data transformation.   

                             

LIMITATIONS:-

           Range & Bandwidth: Mobile Internet access is generally slower than direct cable connections, using technologies such as GPRS and EDGE, and more recently HSDPA and HSUPA 3G and 4G networks. These networks are usually available within range of commercial cell phone towers. Higher speed wireless LANs are inexpensive but have very limited range.

• Security standards: When working mobile, one is dependent on public networks, requiring careful use of VPN. Security is a major concern while concerning the mobile computing standards on the fleet. One can easily attack the VPN through a huge number of networks interconnected through the line.
• Power consumption: When a power outlet or portable generator is not available, mobile computers must rely entirely on battery power. Combined with the compact size of many mobile devices, this often means unusually expensive batteries must be used to obtain the necessary battery life.
• Transmission interferences: Weather, terrain, and the range from the nearest signal point can all interfere with signal reception. Reception in tunnels, some buildings, and rural areas is often poor.
• Potential health hazards: People who use mobile devices while driving are often distracted from driving and are thus assumed more likely to be involved in traffic accidents.^[3] (While this may seem obvious, there is considerable discussion about whether banning mobile device use while driving reduces accidents or not.^[4][5]) Cell phones may interfere with sensitive medical devices. Questions concerning mobile phone radiation and health have been raised.
• Human interface with device: Screens and keyboards tend to be small, which may make them hard to use. Alternate input methods such as speech or handwriting recognition require training.

In-vehicle computing and fleet computing:-

Many commercial and government field forces deploy a ruggedized portable computer with their fleet of vehicles. This requires the units to be anchored to the vehicle for driver safety, device security, and ergonomics. Rugged computers are rated for severe vibration associated with large service vehicles and off-road driving and the harsh environmental conditions of constant professional use such as in emergency medical services, fire, and public safety.

 Typical fan-based cooling has stated limits of 95F-100F of ambient temperature, and temperatures below freezing require localized heaters to bring Several specialized manufacturers such as First Mobile Technologies, National Products Inc (Ram Mounts), Gamber Johnson and LedCo build mounts for vehicle mounting of computer equipment for a wide range of vehicles. The mounts are built to withstand the harsh conditions and maintain ergonomics.

Specialized installation companies design the mount design, assembling the parts, and installing them in a safe and consistent manner away from airbags, vehicle HVAC controls, and driver controls. Frequently installations will include a WWAN modem, power conditioning equipment, transceiver antennae mounted external to the vehicle, and WWAN/WLAN/GPS/etc.

 

 

SECURITY ISSUES:-

Mobile security or mobile phone security has become increasingly important in mobile computing. It is of particular concern as it relates to the security of personal information now stored on the smartphone.

More and more users and businesses use smartphones as communication tools but also as a means of planning and organizing their work and private life. Within companies, these technologies are causing profound changes in the organization of information systems and therefore they have become the source of new risks. Indeed, smartphones collect and compile an increasing amount of sensitive information to which access must be controlled to protect the privacy of the user and the intellectual property of the company.

All smartphones, as computers, are preferred targets of attacks. These attacks exploit weaknesses related to smartphones that can come from means of communication like SMS, MMS, wifi networks, and GSM. There are also attacks that exploit software vulnerabilities from both the web browser and operating system. Finally, there are forms of malicious software that rely on the weak knowledge of average users.

Different security counter-measures are being developed and applied to smartphones, from security in different layers of software to the dissemination of information to end users. There are good practices to be observed at all levels, from design to use, through the development of operating systems, software layers, and downloadable apps.

CONCLUSION:

This paper discusses every aspect for designing the mobile device in detail and I would like to draw attention of these issues while designing a mobile device or the device that going to be part of mobile computing domain.

At this stage we are facing different types of problems and threats to the mobile industry, the two major aspects are the security and the usability issue.

NETWORK SECURITY

“REAL WORLD” or in the “CYBER WORLD” .in this world as opposed to the cyber world an attack is often preceded by information gathering. Network security is a complicated subject, historically only tackled by well-trained and experienced experts. However, as more and more people become”wired'', an increasing number of people need to understand the basics of security in a networked world. Our paper covers different kinds of threats & firewalls in the network by implementation of different security services using various security mechanisms.

Introduction:

A basic understanding of computer networks is requisite in order to understand the principles of network security. In this section, we'll cover some of the foundations of computer networking, then move on to an overview of some popular networks. The impressive development of computer networks has reached the point, where security becomes essential. Users want to exchange data in a secure way. The problem of network security is a complex issue. Network security means a protection of the network assets. What do we need to protect? Data,Resources&

Reputation

Popular networks:

UUCP: (Unix-to-Unix Copy) was originally developed to connect UNIX (surprise!) hosts together.

Internet:  The Internet is the world's largest network of networks.

Services for security:

The services are intended to counter security attacks, and they make use of one or more security mechanisms to provide the service.

Confidentiality: Ensure that the information in a computer system and transmitted information are accessible only for reading by authorized parties. This type of access includes printing displaying and other forms of disclosure, including simply revealing the existence of an object.

1. Authentication: Ensure that the origin of a message or electronic document is correctly              with an assurance that the identity is not false;
2. Integrity: Ensures that only authorized parties are able to modify computer systems assets and transmitted information. Modification includes writing, changing, changing status, deleting, creating and delaying or replaying of transmitted messages.
3. Non-repudiation: Requires that neither the sender nor the receiver of a message is able to deny the transmission.
4. Access control: Require that access to information resources may be controlled by or for the target system.

Availability: Require that computer systems assets be available to authorized parties when needed.      

Security threats    

  Categorization of these attacks is passive attacks and active attacks.

Passive attacks: In this the goal of the attacker is to obtain information that is being transmitted. Two types of passive attacks are release of message contents and traffic analysis.

Active attacks:. These attacks involve some modification of the data stream or the creation of false stream and can be sub divided into 4 categories: Masquerade, Replay, Modification of messages, and denial of service.

 Denial of service: DoS (Denial-of-Service) attacks are probably the nastiest, and most difficult to address. Such attacks were fairly common in late 1996 and early 1997, but are now becoming less popular. Some things that can be done to reduce the risk of being stung by a denial of service attack include

Not running your visible-to-the-world servers at a level too close to capacity

Using packet filtering to prevent obviously forged packets from entering into your network address space.

Keeping up-to-date on security-related patches for your hosts' operating systems.

Unauthorized Access :

``Unauthorized access'' is a very high-level term that can refer to a number of different sorts of attacks. The goal of these attacks is to access some resource that your machine should not provide the attacker. These can take the form of a virus, worm, or Trojan horse. One of the most publicized threats to security is intruder. Generally referred to as a hacker or cracker, and some other threats are executing commands illicitly, confidential breaches, destructive behavior.

Where do the attacks come from? How, though, does an attacker gain access to your equipment? Through any connection that you have to the outside world. This includes Internet connections, dial-up modems, and even physical access.

Preventing security disasters:

·          Hope you have backups                                 

·          Stay current with relevant operating system patches

Don't put data where it doesn't need to be       

Avoid systems with single points of failure

Watch for relevant security advisories

Firewalls:

Firewalls can be an effective means of protecting a local system or network of systems from network based security threats while at the same time, a firewall is simply a group of components that collectively form a barrier between two networks.

Types of firewalls:

·         Application Gateways

·         Packet Filtering

·         Hybrid systems

Best for me: Lots of options are available, and it makes sense to spend some time with an expert, either in-house, or an experienced consultant who can take the time to understand your organization's security policy, and can design and build a firewall architecture that best implements that policy.

Points of Failure: Any time there is only one component paying attention to what's going on between the internal and external networks, an attacker has only one thing to break (or fool!) in order to gain complete access to your internal networks.

Security Mechanisms: A mechanism that is designed to detect, prevent, or recover from a security attack. Cryptography and Steganographic are such two techniques. Hence we focus on development, use and management of Cryptographic techniques.

Security mechanisms:

Web Security,

Cryptographic techniques&

Internet Firewalls

What is Cryptography?

The word “cryptography” is derived from Greek and when literally translated, means “secret writing.” The study of enciphering and encoding (on the sending end), and decoding (on the receiving end) is called cryptography. Although the distinction is fuzzy, ciphers are different from codes. When you mix up or substitute existing letters, you are using a cipher.

Encryption refers to the transformation of data in “plain text” form into a form called “cipher text,” .The recovery of plain text requires the key, and this process is known as decryption. This key is meant to be secret information and the privacy of the text depends on the cryptographic strength of the key. Ciphers are broken into two main categories, substitution ciphers and transposition ciphers. Substitution ciphers replace letters in the plaintext with other letters or symbols, keeping the order in which the symbols fall the same. Transposition ciphers keep all of the original letters intact, but mix up their order.

Substitution cipher:

            Plaintext letter             A B C D E F G H I J K L M N O P Q R S T U V W X Y Z

Cipher text letter         Q W E R T Y U I O P A S D F G H J K L Z X C V B N M

You can construct a secret message from the above table. Relative substitutions can be done. So, the message “ Meet me after school behind the gym,” would read

                        “DTTZ DT QYZTK LEIGGS WTIOFR ZIT UND.”

Five letters are customary in the spy biz, so your message comes out like this:

            DTTZD TQYZT KLEIG GSWTI OFRZI TUNDM

Transposition cipher: Text chosen in one form can be enciphered choosing a different route. To decipher, you fill the in box following the zigzag route and read the message using the spiral route. The cipher text becomes:

           

             EAMTN FTDIE EHOTE RHMEM BYESC GLOHO

Types of Cryptography:

There are three types of cryptographic algorithms:

1.                              Secret Key Cryptography.

2.                               Public Key Cryptography.

3.                              Hash Algorithms.

 Secret Key Cryptography:

            Secret key cryptography involves the use of single key. Given a message (Plain text) and the key, encryption produces cipher text, which is about the same length as the plain text was. Decryption is the reverse of encryption, and uses the same key as encryption.

                                             Encryption

                         Plain text   ------------------> cipher text

                                                  Key

 

                         Cipher text------------------> plain text

                                              Decryption

Secret key cryptography is sometimes referred to as symmetric cryptography or conventional cryptography. If sender and receiver agree on a shared secret key, then by using secret key cryptography we can send messages to one another on a medium that can be tapped, without worrying about eavesdroppers. All we need to do is have the sender encrypt the messages and the receiver decrypt them using the key. An eavesdropper will only see unintelligible data. Some of the secret key cryptography algorithms are - DES, 3-DES, blowfish, IDEA, AES, RC2, RC4, RC5, ECB etc.

Advantages of Secret Key Cryptography:

   o Very fast relative to public key cryptography.

   o Considered secure, provided the key is relatively strong.

   o The cipher text is compact (i.e., encryption does not add excess “Baggage” to the cipher text).

   o Widely used and very popular.

Disadvantages of Secret Key Cryptography:

   

   o The administration of the keys can become extremely complicated.

   o A large number of keys are needed to communicate securely with a large group of People.

   o The key is subject to interception by hackers.

 

Public Key Cryptography:

Public key cryptography sometimes also referred to as asymmetric cryptography. The public key need not be kept secret, and, in fact, may be widely available, only its authenticity is required to guarantee that A is indeed the only party who knows the co-responding private key. A primary advantage of such systems is that providing authentic public keys is generally easier than distributing secret keys securely, as required in symmetric key systems. The main objective of public-key encryption is to provide privacy or confidentiality. Public-key encryption schemes are typically substantially slower than symmetric-key encryption algorithms such as DES.

The private key and the public key are mathematically linked.

                                     Encryption

      Plain text   ---------------------------------> cipher text

                                      Public key

          

                                       Private key

           Cipherkey   --------------------------------> plain text                                  

                                           Decryption

Public key cryptography can do anything secret key cryptography can do like-  transmitting the data over an insecure channel, secure storage on insecure media, authentication purposes and digital signatures. Some Public key cryptography algorithms are RSA, Elliptic Curve Cryptography (ECC), ElGamal, DH, DSA/DSS etc.

Advantages of Public key Cryptography:

   o Considered very secure, and easy to configure these systems.

   o No form of secret sharing is required, thus reducing key administration to a Minimum.

   o Supports non-repudiation.

   o The number of keys managed by each user is much less compared to secret key

             Cryptography.

 Disadvantages of Public key Cryptography:

   o Much slower compared to secret key cryptography.

   o The ciphertext is much larger than the plaintext, relative to secret key Cryptography.

Hash Algorithms:

            Hash algorithms are also known as message digests or one-way transformations. A cryptographic hash function is a mathematical transformation that takes a message of arbitrary length and computes from it a fixed length number.

The following things can be done using hash algorithms.

Password Hashing: When a user types a password, the system must store the password encrypted because someone else can use it. To avoid this problem hashing is used. When a password is supplied, it computes the password hash and compares it with the stored value if they match; the password is taken to be correct.

Message Integrity: Cryptographic hash functions can be used to protect the integrity of a message transmitted over insecure media.

Message fingerprint:  We can know whether some data stored has been modified from one day to the next, if we save that data structure with a hash function. We can compare the hash function data structure with the message on the message data. If the message digest has not changed, you can be sure that none of the data is changed.

Digital Signatures: can be efficiently implemented using hash functions.

Implementation Issues

Key Size:

This has major role for amount of security. If the algorithm is inherently strong, then it can be assumed that the larger the key size for the ciphers, the harder it is for a hacker to perform an attack on the cipher text. But, larger keys lead to lower levels of performance. Thus there are, trade-offs, which are traditionally made between the level of security and other factors, like performance.

Hybrid Systems:

            Just one crypto-system will not solve every problem. Most systems in use today employ a hybrid system.

Conclusion:

            Everyone has a different idea of what ``security'' is, and what levels of risk are acceptable. It's important to build systems and networks in such a way that the user is not constantly reminded of the security system around him. As and when new security methods are developed, breaking of these methods has increased. So measures have to be taken to fill the loopholes, of which cryptography has and is playing a major role. Cryptography is evergreen and developments in this area are a better option.

References:

• William Stallings: Cryptography and Network security: principles and practice: 2nd edition.
• J.P. Holbrook, J.K. Reynolds. ``Site Security Handbook.''
• Douglas R.Stinson. Cryptography: theory and practice: 2nd edition
• A.Menezes, P.van Oorschot and S.Vanstone:  Handbook of Applied Cryptography.
• Smith, Laurence Dwight. Cryptography, the Science of Secret Writing.
• Speciner, M. Perlman, R: Network security, Englewood Cliffs, NJ