A Novel Attack Graph Posterior Inference Model Based on Bayesian Network

Network attack graphs are originally used to evaluate what the worst security state is when a concerned net-work is under attack. Combined with intrusion evidence such like IDS alerts, attack graphs can be further used to perform security state posterior inference (i.e. inference based on observation experience). In this area, Bayesian network is an ideal mathematic tool, however it can not be directly applied for the following three reasons: 1) in a network attack graph, there may exist directed cycles which are never permitted in a Bayesian network, 2) there may exist temporal partial ordering relations among intrusion evidence that can-not be easily modeled in a Bayesian network, and 3) just one Bayesian network cannot be used to infer both the current and the future security state of a network. In this work, we improve an approximate Bayesian posterior inference algorithm–the likelihood-weighting algorithm to resolve the above obstacles. We give out all the pseudocodes of the algorithm and use several examples to demonstrate its benefit. Based on this, we further propose a network security assessment and enhancement method along with a small network scenario to exemplify its usage.

COMBINED ALGORITHM FOR THE ESSENTIAL GRAPH OF BAYESIAN NETWORK STRUCTURES

Learning Bayesian network structure is one of the most important branches in Bayesian network. The most popular graphical representative of a Bayesian network structure is an essential graph. This paper shows a combined algorithm according to the three rules for finding the essential graph of a given directed acyclic graph. Moreover, the complexity and advantages of this combined algorithm over others are also discussed. The aim of this paper is to present the proof of the correctness of the combined algorithm.

基于知识图谱的暴雨灾害链挖掘与预测研究

暴雨灾害不仅会引发崩滑流、内涝等次生灾害,更会造成交通中断、供电中断、市政设施损毁等一系列衍生后果,这种现象被称为暴雨灾害链。为了把握暴雨灾害链演化发展的客观规律,有效防范暴雨灾害链的风险,本文提出了一种基于知识图谱的暴雨灾害链挖掘与预测方法。首先,将承灾体影响纳入暴雨灾害链本体模型,构建了暴雨灾害链知识图谱;其次,提出了基于链路耦合的暴雨灾害链挖掘方法,构建了基于贝叶斯网络的暴雨灾害链预测模型;再次,以珠三角地区为例,挖掘暴雨灾害链,并预测某次暴雨事件的灾害链。结果表明:①构建的暴雨灾害链知识图谱能够全面展示出暴雨次生灾害链及其衍生的承灾体后果;②基于知识图谱链路耦合的暴雨灾害链挖掘方法完整地挖掘出了暴雨灾害链,主要类型包括自然灾害类、城市生命线影响类、人员伤亡类、设备和建筑事故类、生产生活潜在影响类;③提出的基于贝叶斯网络的暴雨灾害链预测模型,在暴雨灾害发生初期就能准确预测出暴雨灾害链的发生概率。

基于知识图谱与模糊贝叶斯推理的航空发动机故障诊断

针对航空发动机结构功能复杂,存在贝叶斯网络构建难、节点条件概率难以获得精确值的问题,提出基于知识图谱与模糊贝叶斯网络的故障推理诊断方法。首先,以历史故障数据为依据,构建航空发动机故障知识图谱;其次,提出“知识图谱-贝叶斯网络”的映射方法,用于快速构建贝叶斯网络;然后,引入模糊集合论,解决工程实际中概率参数的不确定性问题;最后,以航空发动机滑油系统故障进行实例验证,结果表明所提方法既能提高贝叶斯网络的构建效率,又能实现故障诊断的不确定性推理,可用于诊断策略优化和设备可靠性提升,具有较强的工程应用价值。

基于变分贝叶斯的鲁棒自适应因子图优化组合导航算法

复杂环境下的量测粗差和时变噪声严重影响了状态估计的精度和可靠性,对此提出了一种基于变分贝叶斯的鲁棒自适应因子图优化组合导航算法。首先,基于先验和后验两阶段更新将变分贝叶斯推断引入因子图优化框架中,以估计时变量测噪声协方差;其次,利用相邻帧间的平均新息构造量测协方差预测值,作为粗差判据来实现稳健估计。基于INS/GNSS组合导航的仿真和现场实验评估表明,所提方法能在粗差干扰的情况下有效估计时变量测噪声,相比M估计和滑动窗口自适应因子图优化算法的水平定位误差分别减小了26.7%和39.8%,兼顾了估计精度和抗差性能,具有较好的复杂环境适应性。

基于知识图谱与加权贝叶斯机制的刑侦推断模型

随着信息化和数字化的高速发展,各类人工智能方法在现代公共安全领域得到充分应用,其中知识图谱以其强大的知识表征能力和数学建模能力,大大提高了智能决策的可解释性,成为领域内研究和应用的热点.一直以来,基于贝叶斯机制的推断模型是公安情报与刑侦分析的重要手段.本文将公安知识图谱引入传统贝叶斯模型,在充分考虑参数耦合性的基础上,对后验概率进行加权更新,有效提高了推断的准确性.本文回避敏感的真实数据,以《红楼梦》中“绣春囊”一案为例完成实证分析,科学地揭秘了经典悬案的真相.本文提出的基于知识图谱的自适应加权方案有效提高了贝叶斯模型的效率,是人工智能助力智慧公安的一种有益尝试.

基于贝叶斯攻击图的RFID系统安全博弈分析模型

针对RFID系统缺乏综合有效的风险管理与安全评估的问题,为了实现对RFID系统安全风险的有效分析以及对目标RFID系统整体风险状况的评估,本文提出一种基于贝叶斯攻击图的RFID系统安全博弈分析方法。在贝叶斯攻击图模型的基础上结合博弈思想对RFID系统的风险状况进行分析,将攻击者入侵系统的过程抽象为攻防双方的博弈模型。首先依据目标系统的相关信息确定攻防策略,并且通过对攻击者和防御者策略收益的计算,构建相应的攻防博弈矩阵,然后得出其纳什均衡状态,确定各参与者的最优策略,最后计算双方的期望收益,确定目标RFID系统的安全状态:若是攻击者期望收益大于防御者期望收益,则系统处于风险状态,反之系统则处于安全状态。实验结果表明,本文提出的博弈模型可以良好地实现对目标RFID系统的安全状况分析。

基于知识图谱推理的热轧带钢产品质量缺陷追溯

热轧带钢生产面临多工况、机理复杂、工艺参数繁多等问题,造成专家很难及时有效给出生产中导致质量缺陷的原因。由此提出一种基于知识图谱推理的质量缺陷追溯方法。首先通过可解释方法SHAP实现对随机森林模型预测结果的解释,并通过知识图谱将数据挖掘结果与工艺机理、专家经验等知识进行融合,进一步将图谱中表示工艺参数与质量参数依赖关系的子图映射到贝叶斯网络,推断不同工艺参数导致产品质量缺陷的后验概率。实际生产数据验证表明,针对不同生产工况,该方法能有效识别各个批次中导致质量缺陷的工艺参数,表现出良好识别率。

基于知识图谱的固体推进剂质量缺陷根因变量识别方法研究

针对固体推进剂生产过程中机理复杂、工艺参数众多,导致质量缺陷频发的问题,提出了一种基于知识图谱的固体推进剂质量缺陷根因变量识别的方法。首先通过历史数据挖掘对质量缺陷进行预测,并通过SHAP模型对预测结果进行具体解释。再将数据挖掘结果、专家经验与工艺机理进行结构化表示与融合,建立固体推进剂质量缺陷领域的知识图谱。最后将图谱中包含参数信息和结构关系的子图映射到贝叶斯网络中进行参数学习,从而推断出不同特征参数导致推进剂存在质量缺陷的后验概率。最终通过实际生产数据样本进行验证,结果表明:该方法能有效识别生产过程中造成固体推剂质量缺陷的根因变量,准确识别率可达85%。

基于知识图谱和贝叶斯推理的断纸故障诊断模型

纸机断纸是制约造纸企业提高产品质量和生产效益的关键原因。造纸生产过程具有高维、非线性和多变量耦合的特点,对断纸故障的预防和诊断提出了挑战。数据驱动的方法基于断纸故障历史数据建模,对断纸故障的预防起到了一定的效果。但该方法忽略了造纸工业中隐藏的机理和经验知识,无法提供对断纸原因的追根溯源。知识图谱作为一种揭示实体间关系的语义网络,可以实现断纸故障数据与知识的集成。基于本体技术的断纸知识图谱为断纸故障诊断提供了全面、可扩展的关联知识库。在此基础上,结合贝叶斯网络开发了断纸故障诊断模型,通过对某生活用纸企业断纸故障的案例分析,验证了该模型在断纸故障推理方面的有效性,断纸预测的正确率达到了85%。

基于链图的Bayesian网结点聚集

提出了一个基于链图将Bayesian网的结点聚集算法。将Bayesian网转化为链图,将链图上等价的结点集当作一个领域并用一个新的结点来表示,修改整体结构和参数,从而完成对整个Bayesian网的修正。聚集之后的Bayesian网可以使领域之间的概率关系更清晰明显,优化Bayesian网的结构表示。

Optimal monitoring and attack detection of networks modeled by Bayesian attack graphs

Early attack detection is essential to ensure the security of complex networks,especially those in critical infrastructures.This is particularly crucial in networks with multi-stage attacks,where multiple nodes are connected to external sources,through which attacks could enter and quickly spread to other network elements.Bayesian attack graphs(BAGs)are powerful models for security risk assessment and mitigation in complex networks,which provide the probabilistic model of attackers’behavior and attack progression in the network.Most attack detection techniques developed for BAGs rely on the assumption that network compromises will be detected through routine monitoring,which is unrealistic given the ever-growing complexity of threats.This paper derives the optimal minimum mean square error(MMSE)attack detection and monitoring policy for the most general form of BAGs.By exploiting the structure of BAGs and their partial and imperfect monitoring capacity,the proposed detection policy achieves the MMSE optimality possible only for linear-Gaussian state space models using Kalman filtering.An adaptive resource monitoring policy is also introduced for monitoring nodes if the expected predictive error exceeds a user-defined value.Exact and efficient matrix-form computations of the proposed policies are provided,and their high performance is demonstrated in terms of the accuracy of attack detection and the most efficient use of available resources using synthetic Bayesian attack graphs with different topologies.

近似图引导的演化贝叶斯网络结构学习算法

贝叶斯网络结构学习是贝叶斯网络推理及应用的基础.搜索高质量的节点序是贝叶斯网络结构学习的一类重要方法.针对在节点序空间中,搜索高质量节点序存在的难以高效、准确评估解的问题,本文提出了一种近似图引导的演化贝叶斯网络结构学习算法.首先,该算法利用互信息构建无向近似图;其次,该算法通过结合节点序和无向近似图构造有向图结构,将其贝叶斯信息准则评分作为节点序的适应度来高效评估节点序,并在演化优化的框架下,使用提出的基于Kendall Tau Distance的交叉算子和基于逆度的变异算子搜索最优节点序;最后,将搜索到的最优节点序输入K2算法得到其对应的贝叶斯网络结构.在4种不同规模网络上的实验结果表明,该算法在收敛时间和准确度之间取得了较好的平衡,其评分相较于对比算法中的次优解分别提升了10.91%、12.28%、53.96%、10.87%.

基于贝叶斯攻击图的RFID系统安全评估模型

针对目前RFID(Radio Frequency Identification,射频识别技术)系统安全分析中忽略攻击事件对系统安全状态动态影响的问题,为了有效实现RFID系统的安全风险评估,文章提出了一种基于贝叶斯攻击图的RFID系统安全评估模型。该模型首先通过对RFID系统结构、所用协议进行分析确定系统的脆弱性漏洞及其依赖关系,建立攻击图。针对攻击图模型只能进行定性分析的问题,构建出相应的攻击图模型结构后可以结合贝叶斯理论对其进行量化。依据漏洞的利用难易度和影响程度建立RFID漏洞量化评价指标,计算出对应的原子攻击概率,然后以条件转移概率的形式将攻击节点与RFID系统的安全属性节点联系在一起,不仅能推断攻击者能够成功到达各个属性节点的风险概率,而且能够依据攻击者的不同行为动态展示系统风险状况的变化,实现评估不同状态下目标RFID系统的整体风险状况。实验表明,所提模型可以有效地计算出RFID系统整体的风险概率,为后续实施对应的安全策略提供理论依据。

基于认知技能图谱的智能问答系统设计与实现

针对电气专业学生获取知识烦琐、实践能力提升困难的问题,该文提出并开发基于认知技能图谱的电力电子开关电源实验智能问答系统,旨在为学生提供个性化指导.首先,引入贝叶斯心理测量模型评估学生能力达成情况;然后,利用知识图谱技术构建陈述性知识图谱和用户数字镜像,分别用于存储电源特定领域知识和用户能力信息;最后,基于问句分析、模板匹配、答案生成3个模块开发电源实验智能问答系统.该系统利用HanLP对学生输入问题进行分词处理和词性标注,使用朴素贝叶斯分类器进行问题分类,并与相应的问题模板进行匹配.根据模板和关键词,系统生成相应的Cypher查询语句,结合学生的能力信息,在知识图谱中搜索符合条件的答案.实验结果表明,该系统能够有效地识别电气专业学生的能力缺陷,并提供个性化的问答服务,实现了更高效、精准的智能辅助.

基于动态贝叶斯网络的作业现场风险精细化控制方法

为了降低作业现场风险,维护作业现场人员的生命财产安全,提出基于动态贝叶斯网络的作业现场风险精细化控制的方法。通过分析动态贝叶斯网络的基本结构,建立评估作业现场风险的动态贝叶斯网络模型;将风险精细化评估结果投射至三维空间的项目集合体中;通过垂直交叉作业双向安全控制机制调节三个方向上的风险投影,实现作业现场风险的精细化控制。实验结果表明,所提方法无论面对物理风险,还是面对人为风险,风险值均不超过15,具有较高的风险控制能力。

贝叶斯网络支持下的计算机硬件系统故障诊断分析

文章首先分析了硬件故障的特性,提出了将概率图模型作为解决方案的思路,接着详细介绍了如何构建反映系统拓扑和组件间依赖关系的贝叶斯网络模型,最终实施了包括数据采集、学习和预测在内的完整流程。服务器集群实际验证表明,该模型能够以高达89%的准确率进行故障诊断,且预测时间最多可提前1.5 h,显示出明显优于传统规则方法的智能化和动态化特点。

Structure learning on Bayesian networks by finding the optimal ordering with and without priors

Ordering based search methods have advantages over graph based search methods for structure learning of Bayesian networks in terms on the efficiency. With the aim of further increasing the accuracy of ordering based search methods, we first propose to increase the search space, which can facilitate escaping from the local optima. We present our search operators with majorizations, which are easy to implement. Experiments show that the proposed algorithm can obtain significantly more accurate results. With regard to the problem of the decrease on efficiency due to the increase of the search space, we then propose to add path priors as constraints into the swap process. We analyze the coefficient which may influence the performance of the proposed algorithm, the experiments show that the constraints can enhance the efficiency greatly, while has little effect on the accuracy. The final experiments show that, compared to other competitive methods, the proposed algorithm can find better solutions while holding high efficiency at the same time on both synthetic and real data sets.

基于贝叶斯攻击图的光网络安全态势预测研究

针对网络攻击事件难以实时准确反映,导致光网络安全态势预测效果较差的问题,提出一种基于贝叶斯攻击图的光网络安全态势预测方法。利用漏洞扫描软件对网络中的缺陷进行扫描,获得初始数据,基于相关数据建立贝叶斯攻击图对网络中的不确定参数分析,计算各个节点的先验概率和后验概率,确定各个节点的危险等级,设定遗传算法的遗传算子与迭代次数,对特征数据降维处理,采用随机森林方法选择最优特征子集,对局部条件概率计算,实现光网络安全态势预测。实验结果表明,设计方法能够在短时间内就实现光网络安全态势的准确预测,满足方法设计需求。

Construct Validation by Hierarchical Bayesian Concept Maps: An Application to the Transaction Cost Economics Theory of the Firm

A concept map is a diagram depicting relationships among concepts which is used as a knowledge representation tool in many knowledge domains. In this paper, we build on the modeling framework of Hui et al. (2008) in order to develop a concept map suitable for testing the empirical evidence of theories. We identify a theory by a set of core tenets each asserting that one set of independent variables affects one dependent variable, moreover every variable can have several operational definitions. Data consist of a selected sample of scientific articles from the empirical literature on the theory under investigation. Our “tenet map” features a number of complexities more than the original version. First the links are two-layer: first-layer links connect variables which are related in the test of the theory at issue;second-layer links represent connections which are found statistically significant. Besides, either layer matrix of link-formation probabilities is block-symmetric. In addition to a form of censoring which resembles the Hui et al. pruning step, observed maps are subject to a further censoring related to second-layer links. Still, we perform a full Bayesian analysis instead of adopting the empirical Bayes approach. Lastly, we develop a three-stage model which accounts for dependence either of data or of parameters. The investigation of the empirical support and consensus degree of new economic theories of the firm motivated the proposed methodology. In this paper, the Transaction Cost Economics view is tested by a tenet map analysis. Both the two-stage and the multilevel models identify the same tenets as the most corroborated by empirical evidence though the latter provides a more comprehensive and complex insight of relationships between constructs.