A Digital Evidence Fusion Method in Network Forensics Systems with Dempster-Shafer Theory

Network intrusion forensics is an important extension to present security infrastructure,and is becoming the focus of forensics research field.However,comparison with sophisticated multi-stage attacks and volume of sensor data,current practices in network forensic analysis are to manually examine,an error prone,labor-intensive and time consuming process.To solve these problems,in this paper we propose a digital evidence fusion method for network forensics with Dempster-Shafer theory that can detect efficiently computer crime in networked environments,and fuse digital evidence from different sources such as hosts and sub-networks automatically.In the end,we evaluate the method on well-known KDD Cup1999 dataset.The results prove our method is very effective for real-time network forensics,and can provide comprehensible messages for a forensic investigators.

SAR images classification method based on Dempster-Shafer theory and kernel estimate

To study the scene classification in the Synthetic Aperture Radar （SAR） image, a novel method based on kernel estimate, with the Maxkov context and Dempster-Shafer evidence theory is proposed. Initially, a nonpaxametric Probability Density Function （PDF） estimate method is introduced, to describe the scene of SAR images. And then under the Maxkov context, both the determinate PDF and the kernel estimate method axe adopted respectively, to form a primary classification. Next, the primary classification results are fused using the evidence theory in an unsupervised way to get the scene classification. Finally, a regularization step is used, in which an iterated maximum selecting approach is introduced to control the fragments and modify the errors of the classification. Use of the kernel estimate and evidence theory can describe the complicated scenes with little prior knowledge and eliminate the ambiguities of the primary classification results. Experimental results on real SAR images illustrate a rather impressive performance.

THE COMBINATION PREDICTION OF TRANSMEMBRANE REGIONS BASED ON DEMPSTER-SHAFER THEORY OF EVIDENCE

Transmembrane proteins are some special and important proteins in cells. Because of their importance and specificity, the prediction of the transmembrane regions has very important theoretical and practical significance. At present, the prediction methods are mainly based on the physicochemical property and statistic analysis of amino acids. However, these methods are suitable for some environments but inapplicable for other environments. In this paper, the multi-sources information fusion theory has been introduced to predict the transmembrane regions. The proposed method is test on a data set of transmembrane proteins. The results show that the proposed method has the ability of predicting the transmembrane regions as a good performance and powerful tool.

Multi-VMs Intrusion Detection for Cloud Security Using Dempster-shafer Theory

Cloud computing provides easy and on-demand access to computing resources in a configurable pool.The flexibility of the cloud environment attracts more and more network services to be deployed on the cloud using groups of virtual machines(VMs),instead of being restricted on a single physical server.When more and more network services are deployed on the cloud,the detection of the intrusion likes Distributed Denialof-Service(DDoS)attack becomes much more challenging than that on the traditional servers because even a single network service now is possibly provided by groups of VMs across the cloud system.In this paper,we propose a cloud-based intrusion detection system(IDS)which inspects the features of data flow between neighboring VMs,analyzes the probability of being attacked on each pair of VMs and then regards it as independent evidence using Dempster-Shafer theory,and eventually combines the evidence among all pairs of VMs using the method of evidence fusion.Unlike the traditional IDS that focus on analyzing the entire network service externally,our proposed algorithm makes full use of the internal interactions between VMs,and the experiment proved that it can provide more accurate results than the traditional algorithm.

Application of Dempster-Shafer theory in mineral resource potential mapping

The Dempster-Shafer theory has been successfully applied to mineral resource potential mapping in GIS environmental. In this applied form, basic probability assignment and combined basic probability assignment are applied to measuring map pattem and map pattem combination, respectively; and the environment composed of the only two singleton sets （deposit set and non-deposit set）, is used for expressing the entire map area. For a subarea in which the certain map pattern combination exists, the combined basic probability assignment corresponding to the map pattern combination existing in this subarea, expresses the belief of inferring the subarea belonging to the deposit set from the evidence that the corresponding map pattern combination existing in the subarea. Thus, it may be served as a statistical index measuring the relative mineral resource potentials of the subarea. And it may be determined like 1） dividing the map area into a series of small equal-sized grid cells and then select the training sample set composed of the well-known grid cells or the entire grid cells; 2） estimating the basic probability assignments corresponding to each map pattern fromthe training sample set; 3） determining the map pattern combination existing in each cell, and then appling the Dempster＇s Rule of Combination to integrating the all basic probability assignments corresponding to the map patterns existing in the cell into the combined basic probability assignment. Mineral resource potential mapping with the Dempster-Shafer theory is demonstrated on a case study to select mineral resource targets. The experimental results manifest that the model can be compared with the weights of evidence model in the effectiveness of mineral resource target selection.

Full Diversity Reception Based on Dempster-Shafer Theory for Network Coding with Multiple-Antennas Relay

In this paper,a two-way relay system which achieves bi-directional communication via a multiple-antenna relay in two time slots is studied.In the multiple access(MA) phase,the novel receive schemes based on Dempster-Shafer(D-S) evidence theory are proposed at the relay node.Instead of traditional linear detection,the first proposed MIMO-DS NC scheme adopts D-S evidence theory to detect the signals of each source node before mapping them into network-coded signal.Moreover,different from traditional physical-layer network coding(PNC) based on virtual MIMO model,the further proposed MIMO-DS PNC comes from the vector space perspective and combines PNC mapping with D-S theory to obtain network-coded signal without estimating each source node signal.D-S theory can appropriately characterize uncertainty and make full use of multiple evidence source information by Dempster's combination rule to obtain reliable decisions.In the broadcast(BC) phase,the space-time coding(STC) and antenna selection(AS) schemes are adopted to achieve transmit diversity.Simulation results reveal that the STC and AS schemes both achieve full transmit diversity in the BC phase and the proposed MIMO-DS NC/PNC schemes obtain better end-to-end BER performance and throughputs compared with traditional schemes with a little complexity increasing and no matter which scheme is adopted in the BC phase,MIMO-DS PNC always achieves full end-to-end diversity gain as MIMO-ML NC but with a lower complexity and its throughput approaches the throughput of MIMO-ML NC in high SNR regime.

Triggered Asynchronous Cooperative Spectrum Sensing Scheme Based on Dempster-Shafer Theory

Aiming at solving the problems such as time consuming and application limiting presented in the existing synchronous cooperative spectrum sensing schemes,a triggered asynchronous scheme based on Dempster-Shafer(D-S) theory was proposed.Sensing asynchronously,each cognitive user calculated the confidence measure functions with double threshold spectrum sensing method.When the useful report was received by the fusion center,a fusion process would be triggered.Then the sensing results were fused together based on D-S theory.The analysis and simulation results show that the proposed scheme can improve the spectrum sensing efficiency and reduce the calculation amount of the fusion center compared with the existing schemes.

Application of the Dempster-Shafer Theory to the Classification of Pixels from Aster Satellite Images and Spectral Indices

In this paper, it is proposed to apply the Dempster-Shafer Theory (DST) or the theory of evidence to map vegetation, aquatic and mineral surfaces with a view to detecting potential areas of observation of outcrops of geological formations (rocks, breastplates, regolith, etc.). The proposed approach consists in aggregating information by using the DST. From pretreated Aster satellite images (geo-referencing, geometric correction and resampling at 15 m), new channels were produced by determining the spectral indices NDVI, MNDWI and NDBaI. Then, the DST formalism was modeled and generated under the MATLAB software, an image segmented into six classes including three absolute classes (E,V,M) and three classes of confusion ({E,V}, {M,V}, {E,M}). The control on the land, based on geographic coordinates of pixels of different classes on said image, has made it possible to make a concordant interpretation thereof. Our contribution lies in taking into account imperfections (inaccuracies and uncertainties) related to source information by using mass functions based on a simple support model (two focal elements: the discernment framework and the potential set of belonging of the pixel to be classified) with a normal law for the good management of these.

Comparison of Layer-stacking and Dempster-Shafer Theory-based Methods Using Sentinel-1 and Sentinel-2 Data Fusion in Urban Land Cover Mapping

Data fusion has shown potential to improve the accuracy of land cover mapping,and selection of the optimal fusion technique remains a challenge.This study investigated the performance of fusing Sentinel-1(S-1)and Sentinel-2(S-2)data,using layer-stacking method at the pixel level and Dempster-Shafer(D-S)theory-based approach at the decision level,for mapping six land cover classes in Thu Dau Mot City,Vietnam.At the pixel level,S-1 and S-2 bands and their extracted textures and indices were stacked into the different single-sensor and multi-sensor datasets(i.e.fused datasets).The datasets were categorized into two groups.One group included the datasets containing only spectral and backscattering bands,and the other group included the datasets consisting of these bands and their extracted features.The random forest(RF)classifier was then applied to the datasets within each group.At the decision level,the RF classification outputs of the single-sensor datasets within each group were fused together based on D-S theory.Finally,the accuracy of the mapping results at both levels within each group was compared.The results showed that fusion at the decision level provided the best mapping accuracy compared to the results from other products within each group.The highest overall accuracy(OA)and Kappa coefficient of the map using D-S theory were 92.67%and 0.91,respectively.The decision-level fusion helped increase the OA of the map by 0.75%to 2.07%compared to that of corresponding S-2 products in the groups.Meanwhile,the data fusion at the pixel level delivered the mapping results,which yielded an OA of 4.88%to 6.58%lower than that of corresponding S-2 products in the groups.

Using the Dempster-Shafer Theory of Evidence to Rank Documents

Multi-source information can be utilized collaboratively to improve the performance of information retrieval. To make full use of the document and collection information, this paper introduces a new informa- tion retrieval model that relies on the Dempster-Shafer theory of evidence. Each query-document pair is taken as a piece of evidence for the relevance between a document and a query. The evidence is combined using Dempster＇s rule of combination, and the belief committed to the relevance is obtained. Retrieved documents are then ranked according to the belief committed to the relevance. Several basic probability as- signments are also proposed. Extensive experiments over the Text REtrieval Conference （TREC） test col- lection ClueWeb09 show that the proposed model provides performance similar to that of the Vector Space Model （VSM）. Under certain probability assignments, the proposed model outperforms the VSM by 63% in terms of mean average precision,

Brain tissue segmentation based on spatial information fusion by Dempster-Shafer theory

As a result of noise and intensity non-uniformity,automatic segmentation of brain tissue in magnetic resonance imaging (MRI) is a challenging task.In this study a novel brain MRI segmentation approach is presented which employs Dempster-Shafer theory (DST) to perform information fusion.In the proposed method,fuzzy c-mean (FCM) is applied to separate features and then the outputs of FCM are interpreted as basic belief structures.The salient aspect of this paper is the interpretation of each FCM output as a belief structure with particular focal elements.The results of the proposed method are evaluated using Dice similarity and Accuracy indices.Qualitative and quantitative comparisons show that our method performs better and is more robust than the existing method.

Improvement method for the combining rule of Dempster-Shaferevidence theory based on reliability

An improvement method for the combining rule of Dempster evidence theory is proposed. Different from Dempster theory, the reliability of evidences isn't identical; and varies with the event. By weight evidence according to their reliability, the effect of unreliable evidence is reduced, and then get the fusion result that is closer to the truth. An example to expand the advantage of this method is given. The example proves that this method is helpful to find a correct result.

A new oil spill detection algorithm based on Dempster-Shafer evidence theory

Features of oil spills and look-alikes in polarimetric synthetic aperture radar(SAR)images always play an important role in oil spill detection.Many oil spill detection algorithms have been implemented based on these features.Although environmental factors such as wind speed are important to distinguish oil spills and look-alikes,some oil spill detection algorithms do not consider the environmental factors.To distinguish oil spills and look-alikes more accurately based on environmental factors and image features,a new oil spill detection algorithm based on Dempster-Shafer evidence theory was proposed.The process of oil spill detection taking account of environmental factors was modeled using the subjective Bayesian model.The Faster-region convolutional neural networks(RCNN)model was used for oil spill detection based on the convolution features.The detection results of the two models were fused at decision level using Dempster-Shafer evidence theory.The establishment and test of the proposed algorithm were completed based on our oil spill and look-alike sample database that contains 1798 image samples and environmental information records related to the image samples.The analysis and evaluation of the proposed algorithm shows a good ability to detect oil spills at a higher detection rate,with an identifi cation rate greater than 75%and a false alarm rate lower than 19%from experiments.A total of 12 oil spill SAR images were collected for the validation and evaluation of the proposed algorithm.The evaluation result shows that the proposed algorithm has a good performance on detecting oil spills with an overall detection rate greater than 70%.

改进Dempster-Shafer证据与概率模型集成的变压器故障诊断

针对单个变压器故障诊断模型准确率有限的问题,提出基于kappa系数改进Dempster-Shafer(D-S)证据理论与概率模型集成的变压器故障诊断方法。首先,分别构建基于概率输出的支持向量机、贝叶斯神经网络、深度信念网络的变压器故障诊断概率模型,拟合诊断模型在样本上的基本概率分配函数。然后,建立D-S证据理论信息集成框架,提出基于kappa系数与准确率权重的证据修正方法,从子模型与故障类型两个角度对证据进行修正,进而融合概率模型诊断结果。最后,通过仿真验证本文所提方法的有效性。

A novel adaptive temporal-spatial information fusion model based on Dempster-Shafer evidence theory

In the field of target recognition based on the temporal-spatial information fusion,evidence the-ory has received extensive attention.To achieve accurate and efficient target recognition by the evi-dence theory,an adaptive temporal-spatial information fusion model is proposed.Firstly,an adaptive evaluation correction mechanism is constructed by the evidence distance and Deng entropy,which realizes the credibility discrimination and adaptive correction of the spatial evidence.Secondly,the credibility decay operator is introduced to obtain the dynamic credibility of temporal evidence.Finally,the sequential combination of temporal-spatial evidences is achieved by Shafer’s discount criterion and Dempster’s combination rule.The simulation results show that the proposed method not only considers the dynamic and sequential characteristics of the temporal-spatial evidences com-bination,but also has a strong conflict information processing capability,which provides a new refer-ence for the field of temporal-spatial information fusion.

基于Dempster-Shafer证据理论的信息融合在设备故障诊断中应用

给出了一种基于神经网络的基本概率分配构造方法和诊断决策规则,提出了一种基于Dempster-Shafer证据理论的多故障特征信息融合的故障诊断方法,并以旋转机械故障诊断为例,详细说明了该方法的具体实现步骤.结果表明,经过多故障特征信息融合,诊断结论的可信度明显提高,不确定性明显减小,因此充分显示了该诊断方法的有效性.

数据融合中的Dempster-Shafer证据理论

虽然 D- S方法已广泛地应用于各种数据融合系统中 ,但在实际应用中依然存在着许多困难。总结了数据融合应用中的 Dempster- Shafer证据理论研究概况 ,从四个方面阐述和对比分析了一些有代表性的研究成果 ;

基于Dempster-Shafer证据理论的端口扫描检测方法

端口扫描是通过对目标系统端口试探性的访问来判断端口是否开放的行为.它往往是攻击者入侵行为的第一步.端口扫描检测是入侵监测系统不可缺少的一部分,而当前端口扫描的检测方法不多,并且准确性不高.为提高扫描检测的准确性,本文使用Dempster-Shafer证据理论对两种扫描检测方法产生的数据进行融合:一种是基于端口分布特征的扫描检测方法,该方法简单且具有较高的检测率;另一种是基于序列假设测试的扫描检测方法,该方法充分利用了端口扫描的本质特征.实验结果表明,同单独使用基于端口分布特征或序列假设测试的方法相比,这种基于Dempster-Shafer证据理论的扫描检测方法对端口扫描的检测准确得多.

基于Dempster-Shafer证据理论的数据融合技术研究

系统地研究了 Dempster- Shafer(D- S)证据推理的数据融合技术 ,分析了传感器基本概率分配函数 (basic probability assignment- BPA)的构造方法 ,分别对双传感器随参数分布的几种情况进行了检测融合 ,利用红外场景生成器生成的 3～ 5μm和 8～ 1 2 μm双通道的红外背景及目标的序列图像 ,仿真了融合对探测操作特性 (receiver operatingcharacter- ROC)曲线的性能改进 ,对 AGEMA THV90 0型双通道红外热像仪的小目标图像也开展了实验处理 。

基于Dempster-Shafer理论的GHSOM入侵检测方法

结合证据推理DS理论,提出了基于Dempster-Shafer理论的GHSOM神经网络入侵检测方法,一方面处理数据不确定性中的随机性和模糊性问题,可以在噪音环境下保持良好的检测率,此外通过证据融合理论缩小数据集,有效控制网络的动态增长。实验结果表明,基于Dempster-Shafer理论的GHSOM入侵检测方法实现了对子网拓展规模在检测中的动态控制,提升了在网络规模不断扩展时的动态适应性,在噪音环境下具有良好的检测准确率,提升了GHSOM入侵检测方法的扩展性。