Intrusion detection based on system calls and homogeneous Markov chains

A novel method for detecting anomalous program behavior is presented, which is applicable to host-based intrusion detection systems that monitor system call activities. The method constructs a homogeneous Markov chain model to characterize the normal behavior of a privileged program, and associates the states of the Markov chain with the unique system calls in the training data. At the detection stage, the probabilities that the Markov chain model supports the system call sequences generated by the program are computed. A low probability indicates an anomalous sequence that may result from intrusive activities. Then a decision rule based on the number of anomalous sequences in a locality frame is adopted to classify the program's behavior. The method gives attention to both computational effciency and detection accuracy, and is especially suitable for on-line detection. It has been applied to practical host-based intrusion detection systems.

钻孔监测在乌达煤田火区治理中的应用

介绍了一种钻孔温度和标志性气体监测方法,可以获得煤田火区不同区域的燃烧状态信息,用于煤田火区治理效果评估。在乌达煤田Ⅱ、Ⅲ、Ⅳ、Ⅴ、Ⅸ号火区布置测温钻孔1 296个进行为期1年的连续监测,采集及化验标志性CO气体气样1 296组;单孔完成测温24次,单组完成气体化验24次,完成地面调查79.962万m^2。监测结果表明,Ⅱ、Ⅲ、Ⅳ、Ⅴ号火区内煤火均处于熄灭状态,仅Ⅸ号火区煤火尚未完全熄灭,但有熄灭趋势。该方法可广泛用于采取回填覆盖、灌浆填充方法治理的火区开展治理效果评价。

Detecting network intrusions by data mining and variable-length sequence pattern matching

Anomaly detection has been an active research topic in the field of network intrusion detection for many years. A novel method is presented for anomaly detection based on system calls into the kernels of Unix or Linux systems. The method uses the data mining technique to model the normal behavior of a privileged program and uses a variable-length pattern matching algorithm to perform the comparison of the current behavior and historic normal behavior, which is more suitable for this problem than the fixed-length pattern matching algorithm proposed by Forrest et al. At the detection stage, the particularity of the audit data is taken into account, and two alternative schemes could be used to distinguish between normalities and intrusions. The method gives attention to both computational efficiency and detection accuracy and is especially applicable for on-line detection. The performance of the method is evaluated using the typical testing data set, and the results show that it is significantly better than the anomaly detection method based on hidden Markov models proposed by Yan et al. and the method based on fixed-length patterns proposed by Forrest and Hofmeyr. The novel method has been applied to practical hosted-based intrusion detection systems and achieved high detection performance.

IMPROVING THE FREQUENCY RESOLUTION OF DIGITALLY SYNTHESIZED PERIODIC SIGNALS BY A SEQUENTIAL ADDRESSING SCHEME

In the digital synthesis of wideband periodic signals using an Arbitrary Waveform Gen-erator(AWG),the frequency resolution and spectral complexity of the synthesized signals are com-monly limited by the memory capacity and clock frequency of the AWG.This paper proposes a novel sequential addressing scheme and then presents several sequences to improve the frequency resolution of the synthesized periodic signals without changing their spectral envelopes and basic time-domain characteristics under the condition of a fixed memory capacity and a fixed clock fre-quency.The main idea of the scheme is using the address generator in an AWG to program and produce addresses to read fixed waveform data in variable order,and thus to generate waveforms of various periods and profiles.The scheme is applied in simulating signal scenarios for military com-munication countermeasure experiments,and achieves high performance.

AN ITERATIVE ALGORITHM FOR OPTIMAL DESIGN OF NON-FREQUENCY-SELECTIVE FIR DIGITAL FILTERS

This paper proposes a novel iterative algorithm for optimal design of non-frequency-selective Finite Impulse Response(FIR) digital filters based on the windowing method.Different from the traditional optimization concept of adjusting the window or the filter order in the windowing design of an FIR digital filter,the key idea of the algorithm is minimizing the approximation error by succes-sively modifying the design result through an iterative procedure under the condition of a fixed window length.In the iterative procedure,the known deviation of the designed frequency response in each iteration from the ideal frequency response is used as a reference for the next iteration.Because the approximation error can be specified variably,the algorithm is applicable for the design of FIR digital filters with different technical requirements in the frequency domain.A design example is employed to illustrate the efficiency of the algorithm.

DDFS spurious signals due to amplitude quantization in absence of phase-accumulator truncation

Spurious signals in direct digital frequency synthesizers(DDFSs)are partly caused by amplitude quantization and phase truncation,which affect their application to many wireless telecommunication systems. These signals are deterministic and periodic in the time domain,so they appear as line spectra in the frequency domain.Two types of spurious signals due to amplitude quantization are exactly formulated and compared in the time and frequency domains respectively.Then the frequency spectra and power levels of the spurious signals due to amplitude quantization in the absence of phase-accumulator truncation are emphatically analyzed,and the effects of the DDFS parameter variations on the spurious signals are thoroughly studied by computer simulation.And several important conclusions are derived which can provide theoretical support for parameter choice and spurious performance evaluation in the application of DDFSs.

EXACT ANALYSIS OF SPURIOUS SIGNALS IN DIRECT DIGITAL FREQUENCY SYNTHESIZERS DUE TO AMPLITUDE QUANTIZATION

Amplitude quantization is one of the main sources of spurious noise frequencies in Direct Digital Frequency Synthesizers (DDFSs), which affect their application to many wireless telecommu- nication systems. In this paper, two different kinds of spurious signals due to amplitude quantization in DDFSs are exactly formulated in the time domain and detailedly compared in the frequency do- main, and the effects of the DDFS parameter variations on the spurious performance are thoroughly studied. Then the spectral properties and power levels of the amplitude-quantization spurs in the absence of phase-accumulator truncation are emphatically analyzed by waveform estimation and computer simulation, and several important conclusions are derived which can provide theoretical support for parameter choice and spurious performance evaluation in the application of DDFSs.

无人机倾斜摄影测量在铁路地理空间数据采集中的应用

针对铁路工程普遍缺乏高精度、现势性、完整的地理空间数据等问题,该文将无人机倾斜摄影测量与三维实景建模技术应用于铁路工程地理空间数据采集中,阐述了无人机倾斜摄影测量系统的组成、原理以及倾斜影像的数据采集与处理流程。以神朔铁路工程项目为例,通过快速获取的实景倾斜影像,制作了神朔铁路4D产品及其精细化三维模型。结果表明,无人机倾斜摄影测量技术为铁路地理空间数据获取提供了高效服务,降低了铁路勘测的作业成本,可为类似工程提供参考。