Tham khảo tài liệu 'petri nets applications part 2', kỹ thuật - công nghệ, cơ khí - chế tạo máy phục vụ nhu cầu học tập, nghiên cứu và làm việc hiệu quả | Particle Filter for Depth Evaluation of Networking Intrusion Detection Using Coloured Petri Nets 31 to occur its entire child events are necessary. Fault Tree nodes can be augmented with probabilities or costs so that the most likely or inexpensive attack path can be calculated. However those weightings are too specific to be applied to attack trees describing general attack scenarios. Gordon Gordon Salmond et al. 1993 first proposed an algorithm of particle filters known as a sequential importance resampling SIR filter. A key issue in SIR is the selection of the proposal distribution which determines the approximation performance. Much research ofthe particle filtering focuses on improving the proposal distribution and importance sampling strategies by utilizing the measurements such as the auxiliary particle filter Pitt and Shephard 1999 . Recently some kernel based particle filters have been introduced including Gaussian sum particle filter Kotecha and Djuric 2003 kernel particle filter Hurzeler and Kunsch 1998 and Parzen particle filter Lehn-Schioler Erdogmus et al. 2004 which enhance the ability of the particles in the posterior distribution representation by the kernel density estimators. In a traditional particle filter scheme almost applied into trace visual object. In this research we extend the particle filter function to analyze the network flows and evaluate the risk and cost of intrusion detection system work. 2. Background Intrusion Detection System Intrusion detection systems IDS detect attempted or successful misuses of computer systems. IDS can be classified according to their 1 data sources network or host audit trails 2 analysis technique misuse or anomaly detection and 3 overall architecture distributed or autonomousagents. The Host-based audit trails application and system logs file attributes system call and process monitoring kernel audit facilities. Its problems are as follows. 1 It can t trust audit trail from a compromised host 2 there
