1. A processor-readable medium storing code representing instructions that when executed at a processor cause the processor to:
identify a host and a domain associated with a security alert generated in response to a communication between the host and the domain;
access a security state associated with the host and a security state associated with the domain; and
compute a priority of the security alert based on the security state associated with the host and the security state associated with the domain.
2. The processor-readable medium of claim 1, further comprising instructions that when executed at the processor cause the processor to:
provide the security alert and the priority to a security monitor.
3. The processor-readable medium of claim 1, wherein the security state associated with the host and the security state associated with the domain are defined by belief propagation.
4. The processor-readable medium of claim 1, further comprising instructions that when executed at the processor cause the processor to:
generate a host-domain access map having a plurality of nodes, the plurality of nodes including a node associated with the host and a node associated with the domain, the host-domain access map having an edge between the node associated with the host and the node associated with the domain;
assign an initial security state to each node in a subset of the plurality of nodes; and
define a security state for each node from the plurality of nodes using belief propagation, the security state for the node associated with the host is the security state associated with the host, the security state for the node associated with the domain is the security state associated with the domain.
5. The processor-readable medium of claim 1, further comprising instructions that when executed at the processor cause the processor to:
generate a host-domain access map having a plurality of nodes based on a plurality of security alerts, the plurality of nodes including a node associated with the host and a node associated with the domain, the host-domain access map having an edge between the node associated with the host and the node associated with the domain;
assign an initial security state to each node in a subset of the plurality of nodes based on confidence measures of security alerts from the plurality of security alerts; and
define a security state for each node from the plurality of nodes using belief propagation, the security state for the node associated with the host is the security state associated with the host, the security state for the node associated with the domain is the security state associated with the domain.
6. The processor-readable medium of claim 1, wherein the security state associated with the domain is a default security state if the domain is unknown.
7. The processor-readable medium of claim 1, wherein:
the security state associated with the host is a multiclass classification vector; and
the security state associated with the domain is a multiclass classification vector.
8. The processor-readable medium of claim 1, wherein:
the priority of the security alert is a first priority if the security state associated with the host indicates a severe security risk and the security state associated with the domain indicates a severe security risk; and
the priority of the security alert is a second priority different from the first priority if the security state associated with the host indicates a low security risk and the security state associated with the domain indicates a low security risk.
9. The processor-readable medium of claim 1, wherein:
the priority of the security alert is a first priority if the security state associated with the host indicates a severe security risk and the security state associated with the domain indicates a severe security risk; and
the priority of the security alert is a second priority different from the first priority if the security state associated with the host indicates a security risk different from a security risk indicated by the security state associated with the domain.
10. A security alert prioritization system, comprising:
a graph generator to generate a host-domain access map based on network activity records;
an inference module to apply belief propagation to the host-domain access map to assign a security state to each node within the host-domain access map;
an identification module to identify a host and a domain associated with a security alert; and
a priority module to assign a priority to the security alert using the security state assigned to a node within the host-domain access map associated with the host and the security state assigned to a node within the host-domain access map associated with the domain.
11. The system of claim 10, further comprising:
a reporting module to report the security alert and the priority assigned to the security alert to a security monitor.
12. The system of claim 10, wherein:
the network activity records include a plurality of security alerts generated at an intrusion detection system; and
the inference module is configured to seed the host-domain access map based on a confidence measure associated with each security alert from the plurality of security alerts.
13. The system of claim 10, wherein:
the priority module is configured to add a new node to the host-domain access map and to assign a default security state to the new node if the domain associated with the security alert is not included in the host-domain access map, the new node being associated with domain.
14. The system of claim 10, wherein the security state assigned to each node within the host-domain access map is a multiclass classification vector.
15. A system, comprising a processor-readable medium storing code representing instructions that when executed at a processor cause the processor to implement a security alert prioritization system including:
an identification module to identify a host and a domain associated with a security alert;
a priority module to assign a priority to the security alert using a security state assigned to a node within a host-domain access map associated with the host and a security state assigned to a node within the host-domain access map associated with the domain; and
a reporting module to report the security alert and the priority assigned to the security alert to a security monitor.
16. The system of claim 15, wherein the security state assigned to the node within the host-domain access map associated with the host and the security state assigned to the node within the host-domain access map associated with the domain are defined by belief propagation applied to the host-domain access map.
17. The system of claim 15, further comprising:
an inference module to seed the host-domain access map based on a confidence measure of each security alert from a plurality of security alerts and to then apply belief propagation to the host-domain access map to assign the security state to the node within the host-domain access map associated with the host and the security state assigned to the node within the host-domain access map associated with the domain.
18. The system of claim 15, wherein:
the priority module assigns a first priority to the security alert if the security state associated with the host indicates a severe security risk and the security state associated with the domain indicates a severe security risk; and
the priority module assigns a second priority different from the first priority to the security alert if the security state associated with the host indicates a low security risk and the security state associated with the domain indicates a low security risk.
19. The system of claim 15, wherein:
the security state assigned to the node within the host-domain access map associated with the host is a multiclass classification vector;
the security assigned to the node within the host-domain access map associated with the domain is a multiclass classification vector; and
the priority module determines a joint probability of each class represented in the security state assigned to the node within the host-domain access map associated with the host and in the security state assigned to the node within the host-domain access map associated with the domain to assign the priority to the security alert.
The claims below are in addition to those above.
All refrences to claim(s) which appear below refer to the numbering after this setence.
1-15. (Cancelled).
16. A method for accessing a reverse channel for communication from a fixed remote unit to a fixed base station in a fixed wireless network, the method comprising:
at the fixed remote unit, waiting a random period of time in response to determining that the reverse channel is available at a first time;
at the fixed remote unit, monitoring a forward channel after expiration of the random period of time to determine whether the reverse channel is available at a second time; and
at the fixed remote unit, transmitting to the base station a first portion of data on the reverse channel in one of multiple timeslots, the first portion of data being transmitted in response to determining that the reverse channel is available at the second time, wherein the first portion of data relates to a second portion of data transmitted on another timeslot when the first and second portions of data relate to a larger block of data to be transmitted, and wherein each of the multiple timeslots are of substantially uniform duration.
17. The method of claim 16, wherein the random period of time is a period of time between zero timeslots and an administratively selected number of timeslots.
18. The method of claim 16, further comprising:
determining whether the reverse channel is available from when the first portion of data is transmitted until a round-trip time has passed, the round trip time being the time required for a transmission on the reverse channel to be evident on the forward channel.
19. The method of claim 16, further comprising:
determining whether the reverse channel is available at a round-trip time after transmitting the first portion of data, the round-trip time being the time required for a transmission on the reverse channel to be evident on the forward channel.
20. The method of claim 16, further comprising:
determining whether the base station successfully decoded the first portion of data.
21. The method of claim 16, further comprising:
determining whether the transmission of the first portion of data has caused the remote unit to access the reverse channel.
22. The method of claim 21, further comprising:
transmitting from the remote unit to the base station a second portion of the data on the reverse channel, the second portion of the data being transmitted in response to a determination that the remote unit has accessed the reverse channel.
23. The method of claim 21, further comprising:
performing an access failure algorithm in response to determining that the remote unit has not accessed the reverse channel.
24. The method of claim 16, further comprising:
performing an access check subroutine; and
if performance of the access check subroutine indicates that access to the reverse channel is available, then transmitting a second portion of data during a second timeslot,
wherein performing the access check subroutine comprises at least determining whether the first portion of data was decoded; or
determining whether another remote unit acquired the reverse channel.
25. The method of claim 16, further comprising:
performing an access check subroutine; and
if performance of the access check subroutine indicates that access to the reverse channel is available, then transmitting a second portion of data during a second timeslot.
26. A method for accessing a reverse channel for providing communication between a remote unit and a base station, comprising:
executing a channel access method to access the reverse channel;
waiting a random period of time in response to the channel access method failing to provide access to the reverse channel; and
re-executing the channel access method in response to a determination that the reverse channel is not available after passage of the random time, wherein the random time is between an upper and lower limit, the upper limit being a function of the number of times that the channel access method fails to provide access to the reverse channel.
27. The method of claim 26, wherein the upper limit is an exponential function of the number of times that the channel access method fails to provide access to the reverse channel.