商品描述
This book is designed to provide a starting point for researchers and students in the field of network security. The goal is to help them understand the problem domain, learn how to build an experimental set, and conduct experiments. This book focuses on concepts related to securing computer networks and does not cover cryptography. The book covers the areas of intrusion detection, intrusion prevention, and response systems. This includes processing data collected from network traffic and post-processing alerts generated by the intrusion detection system. Alert post-processing methods include alert aggregation and alert correlation. This book covers the theoretical concepts used in this field of work, supported by empirical examples, to show the reader how these tasks are possible. Concepts such as statistics, principal component analysis, dimensionality reduction, feature selection, classification methods, clustering methods, and expert systems are discussed in this book and used in examples. Finding and creating suitable datasets is also explained in this book. The examples provided are MS-Windows based, coded in C++, and explained in full detail. The examples are implemented in environments such as WEKA, CLIPS, and Visual Studio. The book covers methods for preventing and responding to intrusions. In addition to current methods in this field, the registry and MS-Windows Firewall are among the sections discussed in two chapters of the book. The book focuses primarily on wired networks or networks using TCP/IP-based connections, but there is also discussion of the applicability of these methods to other technologies and methods, such as Wi-Fi, Cookies, Fingerprinting, and Honeypots.
商品描述(中文翻譯)
本書旨在為網路安全領域的研究人員與學生提供入門基礎。其目標是協助讀者了解問題領域、學習如何建置實驗環境，以及進行實驗。本書聚焦於電腦網路安全相關概念，不涵蓋密碼學（cryptography）。
本書涵蓋入侵偵測（intrusion detection）、入侵防禦（intrusion prevention）與回應系統（response systems）等領域，包括處理從網路流量中收集的資料，以及對入侵偵測系統產生的警示進行後處理。警示後處理方法包括警示彙整（alert aggregation）與警示關聯（alert correlation）。
本書介紹此工作領域所使用的理論概念，並以實證範例加以佐證，讓讀者了解如何完成這些工作。書中討論統計學、主成分分析（principal component analysis）、降維（dimensionality reduction）、特徵選擇（feature selection）、分類方法（classification methods）、分群方法（clustering methods）與專家系統（expert systems）等概念，並在範例中加以應用。本書也說明如何尋找及建立適合的資料集。
書中提供的範例以 MS-Windows 為基礎，使用 C++ 撰寫，並進行完整詳細的解說。這些範例實作於 WEKA、CLIPS 與 Visual Studio 等環境中。
本書涵蓋預防及回應入侵的方法。除了介紹此領域目前採用的方法之外，書中也在其中兩章討論登錄檔（registry）與 MS-Windows Firewall。
本書主要聚焦於有線網路，或使用 TCP/IP 型連線的網路；此外，也討論這些方法應用於其他技術與方法的可行性，例如 Wi-Fi、Cookies、Fingerprinting 與 Honeypots。
作者簡介
Peyman Kabiri, PhD, received his bachelor's degree in computer hardware engineering from Iran University of Science and Technology in 1992. After receiving his master's degree in real-time systems from Nottingham Trent University in 1996, he received a bursary from Nottingham Trent University to continue his doctoral studies. He received a PhD in Computer Science from Nottingham Trent University in 2000. After receiving his PhD, he held various positions in companies and universities, including Assistant Professor in the School of Computer Engineering at the Iran University of Science and Technology, project coordinator in Faculty of Computer Science at the University of New Brunswick - Canada, Senior Lecturer in Cybersecurity in the Department of Computing at Sheffield Hallam University, and Senior Lecturer in Cybersecurity in the School of Computer Science and Informatics at De Montfort University.
Dr Kabiri has designed and taught many modules in the field of cybersecurity at undergraduate and graduate levels since 2010. His lectures are based on his research findings and were initially intended for graduate students, including Intrusion Detection and Response Methods and Systems for Computer Networks, Secure Computer Systems, and Cyber-Physical Systems Security. Later, he designed and taught undergraduate lectures and laboratory tutorials for undergraduate courses at UK universities, namely Network Intrusion Detection and Artificial Intelligence for Cybersecurity (except for the last few sessions). He has a diverse range of research and teaching experiences that enable him to contribute to multidisciplinary research and teaching areas. He has published 46 conference papers and 32 journal articles and edited one book. He has supervised the final projects of many undergraduate students, 52 master's students and 5 doctoral students to completion. He strongly believes in research-based teaching, and in his lectures, he provides his students with theoretical and practical knowledge along with examples of real-world scenarios. Having diverse research and teaching experience at the international level helps him to have a broader perspective on different research and teaching approaches and the educational needs of researchers and students.
作者簡介(中文翻譯)
Peyman Kabiri 博士於 1992 年取得伊朗科學與技術大學（Iran University of Science and Technology）電腦硬體工程學士學位。1996 年取得 Nottingham Trent University 即時系統碩士學位後，他獲得 Nottingham Trent University 提供的獎學金，繼續攻讀博士學位。2000 年，他取得 Nottingham Trent University 電腦科學博士學位。取得博士學位後，他曾任職於多家公司與大學，擔任過伊朗科學與技術大學電腦工程學院助理教授、加拿大 New Brunswick 大學電腦科學學院專案協調員、Sheffield Hallam University 計算學系網路安全資深講師，以及 De Montfort University 電腦科學與資訊學院網路安全資深講師。
自 2010 年起，Kabiri 博士在大學部與研究所層級設計並教授許多網路安全領域的課程。他的授課內容以研究成果為基礎，最初是為研究生設計，包括「電腦網路入侵偵測與回應方法及系統」、「安全電腦系統」以及「資安實體系統安全」。之後，他為英國大學的大學部課程設計並教授課堂講授與實驗教學，課程包括「網路入侵偵測」和「網路安全人工智慧」（最後幾堂課除外）。他擁有多元的研究與教學經驗，能夠在跨學科研究與教學領域中貢獻所長。他已發表 46 篇研討會論文與 32 篇期刊論文，並編輯過 1 本書。他曾指導許多大學部學生、52 位碩士生及 5 位博士生完成畢業專題或學位研究。他深信以研究為基礎的教學；在授課時，除了提供理論與實務知識，也會搭配真實世界情境的範例。國際層級的多元研究與教學經驗，使他能以更廣闊的視角理解不同的研究與教學方法，以及研究人員和學生的教育需求。
