FEW-NNN: A Fuzzy Entropy Weighted Natural Nearest Neighbor Method for Flow-Based Network Traffic Attack Detection

Attacks such as APT usually hide communication data in massive legitimate network traffic, and mining structurally complex and latent relationships among flow-based network traffic to detect attacks has become the focus of many initiatives. Effectively analyzing massive network security data with high dimensions for suspicious flow diagnosis is a huge challenge. In addition, the uneven distribution of network traffic does not fully reflect the differences of class sample features, resulting in the low accuracy of attack detection. To solve these problems, a novel approach called the fuzzy entropy weighted natural nearest neighbor(FEW-NNN) method is proposed to enhance the accuracy and efficiency of flowbased network traffic attack detection. First, the FEW-NNN method uses the Fisher score and deep graph feature learning algorithm to remove unimportant features and reduce the data dimension. Then, according to the proposed natural nearest neighbor searching algorithm(NNN_Searching), the density of data points, each class center and the smallest enclosing sphere radius are determined correspondingly. Finally, a fuzzy entropy weighted KNN classification method based on affinity is proposed, which mainly includes the following three steps: 1、 the feature weights of samples are calculated based on fuzzy entropy values, 2、 the fuzzy memberships of samples are determined based on affinity among samples, and 3、 K-neighbors are selected according to the class-conditional weighted Euclidean distance, the fuzzy membership value of the testing sample is calculated based on the membership of k-neighbors, and then all testing samples are classified according to the fuzzy membership value of the samples belonging to each class;that is, the attack type is determined. The method has been applied to the problem of attack detection and validated based on the famous KDD99 and CICIDS-2017 datasets. From the experimental results shown in this paper, it is observed that the FEW-NNN method improves the accuracy and efficiency of flow-based network traffic attack detection.

基于不规则区域划分方法的k-Nearest Neighbor查询算法

随着越来越多的数据累积,对数据处理能力和分析能力的要求也越来越高.传统k-Nearest Neighbor(k NN)查询算法由于其容易导致计算负载整体不均衡的规则区域划分方法及其单个进程或单台计算机运行环境的较低数据处理能力.本文提出并详细介绍了一种基于不规则区域划分方法的改进型k NN查询算法,并利用对大规模数据集进行分布式并行计算的模型Map Reduce对该算法加以实现.实验结果与分析表明,Map Reduce框架下基于不规则区域划分方法的k NN查询算法可以获得较高的数据处理效率,并可以较好的支持大数据环境下数据的高效查询.

基于密文KNN检索的室内定位隐私保护算法

在定位请求服务中,如何保护用户的位置隐私和位置服务提供商(Localization service provider,LSP)的数据隐私是关系到WiFi指纹定位应用的一个具有挑战性的问题。基于密文域的K-近邻(K-nearest neighbors,KNN)检索,本文提出了一种适用于三方的定位隐私保护算法,能有效提升对LSP指纹信息隐私的保护强度并降低计算开销。服务器和用户分别完成对指纹信息和定位请求的加密,而第三方则基于加密指纹库和加密定位请求,在隐私状态下完成对用户的位置估计。所提算法把各参考点的位置信息随机嵌入指纹,可避免恶意用户获取各参考点的具体位置;进一步利用布隆滤波器在隐藏接入点信息的情况下,第三方可完成参考点的在线匹配,实现对用户隐私状态下的粗定位,可与定位算法结合降低计算开销。在公共数据集和实验室数据集中,对两种算法的安全、开销和定位性能进行了全面的评估。与同类加密算法比较,在不降低定位精度的情况下,进一步增强了对数据隐私的保护。

The k Nearest Neighbors Estimator of the M-Regression in Functional Statistics

It is well known that the nonparametric estimation of the regression function is highly sensitive to the presence of even a small proportion of outliers in the data.To solve the problem of typical observations when the covariates of the nonparametric component are functional,the robust estimates for the regression parameter and regression operator are introduced.The main propose of the paper is to consider data-driven methods of selecting the number of neighbors in order to make the proposed processes fully automatic.We use thek Nearest Neighbors procedure(kNN)to construct the kernel estimator of the proposed robust model.Under some regularity conditions,we state consistency results for kNN functional estimators,which are uniform in the number of neighbors(UINN).Furthermore,a simulation study and an empirical application to a real data analysis of octane gasoline predictions are carried out to illustrate the higher predictive performances and the usefulness of the kNN approach.

Diagnosis of Disc Space Variation Fault Degree of Transformer Winding Based on K-Nearest Neighbor Algorithm

Winding is one of themost important components in power transformers.Ensuring the health state of the winding is of great importance to the stable operation of the power system.To efficiently and accurately diagnose the disc space variation(DSV)fault degree of transformer winding,this paper presents a diagnostic method of winding fault based on the K-Nearest Neighbor(KNN)algorithmand the frequency response analysis(FRA)method.First,a laboratory winding model is used,and DSV faults with four different degrees are achieved by changing disc space of the discs in the winding.Then,a series of FRA tests are conducted to obtain the FRA results and set up the FRA dataset.Second,ten different numerical indices are utilized to obtain features of FRA curves of faulted winding.Third,the 10-fold cross-validation method is employed to determine the optimal k-value of KNN.In addition,to improve the accuracy of the KNN model,a comparative analysis is made between the accuracy of the KNN algorithm and k-value under four distance functions.After getting the most appropriate distance metric and kvalue,the fault classificationmodel based on theKNN and FRA is constructed and it is used to classify the degrees of DSV faults.The identification accuracy rate of the proposed model is up to 98.30%.Finally,the performance of the model is presented by comparing with the support vector machine(SVM),SVM optimized by the particle swarmoptimization(PSO-SVM)method,and randomforest(RF).The results show that the diagnosis accuracy of the proposed model is the highest and the model can be used to accurately diagnose the DSV fault degrees of the winding.

基于KNN算法的教学质量评价模型建立

针对当前教学质量评价存在主观性较强的不足,基于K-最近邻(K-nearest neighbor,KNN)算法,提出教学质量评价模型.确立教学质量评价体系;以教学督导的评价数据为样本数据,通过交叉验证求解最近邻算法参数K的最佳值,从而建立教学质量评价模型.模型以专家数据为样本,评价精度高,评价结果具有较高的可靠性,能根据相关指标快速产生评价等级,提高了教学质量评价效率,使教学质量评价更加客观全面.

基于PCA-BOA-KNN模型的水下爆炸舰船结构破损评估

[目的]为解决水下爆炸作用下舰船结构破口损伤评估问题,建立一种基于PCA-BOA-KNN模型的破口预报方法。[方法]首先,分别建立五舱段和七舱段有限元模型,对21组水下爆炸工况进行爆炸仿真分析;然后,基于主成分分析(PCA)法,对加速度峰值、速度峰值、位移峰值、应力峰值和超压峰值进行降维处理,得到2个本征特征量;最后,将由主成分分析法得到的结果代入贝叶斯网络优化(BOA)的KNN模型,通过建立的破口预报模型,预测一组工况下舰船不同剖面处的破口情况。[结果]结果显示,通过主成分分析法提取的前2个因子的累计贡献率为85.165%,这2个因子可代表5个特征量的主要信息;基于PCA-BOAKNN模型的破口预报结果与仿真结果基本一致。[结论]所提的预报模型方法对舰船结构破口预报有效,对于不同主尺度船体结构破口预报有一定的参考价值。

基于KNN和多特征融合的苹果叶部病害识别检测

准确识别与防治苹果叶部病害,能够有效提高苹果的产量与品质。以常见的苹果叶部病害(锈病、黑腐病、黑星病)为研究对象,构建基于KNN和多特征融合的无损检测模型。使用K-means聚类算法分割苹果叶部图像,通过颜色矩、灰度共生矩阵、Hu距分别提取图像的颜色、纹理和形状特征,利用KNN对特征参数进行分类模型训练,能够实现绿色准确识别苹果叶部病害的目的。实验结果表明,以颜色、纹理、形状为单特征检测的苹果叶部病害识别精确率分别为75%、57%、45%,其中颜色特征更加直观,有9个特征量识别率较高,形状特征在进行图像分割时很难确定K点导致识别率低。该研究基于颜色、纹理、形状等多特征融合提取13个特征量,能够准确识别苹果叶部病害,其识别率达84%,为实现绿色农业果园病虫害防治提供技术支持。

EDGEWORTH EXPANSION FOR NEAREST NEIGHBOR- KERNEL ESTIMATE AND RANDOM WEIGHTING APPROXIMATION OF CONDITIONAL DENSITY

In this paper,Edgeworth expansion for the nearest neighbor\|kernel estimate and random weighting approximation of conditional density are given and the consistency and convergence rate are proved.

A Study of EM Algorithm as an Imputation Method: A Model-Based Simulation Study with Application to a Synthetic Compositional Data

Compositional data, such as relative information, is a crucial aspect of machine learning and other related fields. It is typically recorded as closed data or sums to a constant, like 100%. The statistical linear model is the most used technique for identifying hidden relationships between underlying random variables of interest. However, data quality is a significant challenge in machine learning, especially when missing data is present. The linear regression model is a commonly used statistical modeling technique used in various applications to find relationships between variables of interest. When estimating linear regression parameters which are useful for things like future prediction and partial effects analysis of independent variables, maximum likelihood estimation (MLE) is the method of choice. However, many datasets contain missing observations, which can lead to costly and time-consuming data recovery. To address this issue, the expectation-maximization (EM) algorithm has been suggested as a solution for situations including missing data. The EM algorithm repeatedly finds the best estimates of parameters in statistical models that depend on variables or data that have not been observed. This is called maximum likelihood or maximum a posteriori (MAP). Using the present estimate as input, the expectation (E) step constructs a log-likelihood function. Finding the parameters that maximize the anticipated log-likelihood, as determined in the E step, is the job of the maximization (M) phase. This study looked at how well the EM algorithm worked on a made-up compositional dataset with missing observations. It used both the robust least square version and ordinary least square regression techniques. The efficacy of the EM algorithm was compared with two alternative imputation techniques, k-Nearest Neighbor (k-NN) and mean imputation (), in terms of Aitchison distances and covariance.

Kernel-kNN:基于信息能度量的核k-最近邻算法

提出一种核k最近邻算法.首先给出用于最近邻学习的信息能度量方法,该方法克服了高维数据不便于用传统距离度量表示的困难,提高了数据间类别相似性和距离的一致性.在此基础上,将传统的kNN扩展为非线性形式,并采用半正定规划学习全局最优的度量矩阵.算法主要特点是:能较好地适用于高维数据,并有效提升kNN的分类性能.多个数据集的实验和分析表明,本文的Kernel-kNN算法与传统的kNN算法比较,在低维数据上,分类准确率相当;在高维数据上,分类性能有明显提高.

KNN数据挖掘算法在北京地区霾等级预报中的应用

利用北京地区2013年气象数据以及PM_(2.5)浓度数据与能见度数据进行对比分析,结果发现气温、气压、相对湿度、露点温度、地面U风、地面V风以及PM_(2.5)小时浓度这7个要素是影响北京地区霾等级的关键因素。利用气温、地面气压、相对湿度、露点温度、U风、V风分量以及PM_(2.5)浓度作为7个属性特征,以霾等级做为标志量构建训练样本集,结合KNN(KNearest Neighbor)数据挖掘算法构建疆等级预报分类器,并开展霾等级客观识别实验。结果表明K=3时该分类器的分类预报效果最佳,其13个站点的分类准确率高达88.2%。基于该算法构建的KNN模型预报无霾时的漏报概率很小,准确率高达91.8%;预报有轻度霾、中度霾以及重度霾时,空报的概率仅分别为4.7%、1.4%和2.6%。2014年8月29日至9月2日北京地区一次霾天气过程的预报结果表明:南郊观象台、密云和延庆3站的预报准确率分别达到74%、64%和84%,但霾等级的精度方面还有待于进一步提高。

基于粗糙集的快速KNN文本分类算法

传统K最近邻一个明显缺陷是样本相似度的计算量很大,在具有大量高维样本的文本分类中,由于复杂度太高而缺乏实用性。为此,将粗糙集理论引入到文本分类中,利用上下近似概念刻画各类训练样本的分布,并在训练过程中计算出各类上下近似的范围。在分类过程中根据待分类文本向量在样本空间中的分布位置,改进算法可以直接判定一些文本的归属,缩小K最近邻搜索范围。实验表明,该算法可以在保持K最近邻分类性能基本不变的情况下,显著提高分类效率。

基于Spark框架的高效KNN中文文本分类算法

针对K-最近邻（KNN）分类算法时间复杂度与训练样本数量成正比而导致的计算量大的问题以及当前大数据背景下面临的传统架构处理速度慢的问题，提出了一种基于Spark框架与聚类优化的高效KNN分类算法。该算法首先利用引入收缩因子的优化K-medoids聚类算法对训练集进行两次裁剪；然后在分类过程中迭代K值获得分类结果，并在计算过程中结合Spark计算框架对数据进行分区迭代实现并行化。实验结果表明，在不同数据集中传统尽最近邻算法、基于K-medoids的群最近邻算法所耗费时间是所提Spark框架下的B最近邻算法的3．92-31．90倍，所提算法具有较高的计算效率，相较于Hadoop平台有较好的加速比，可有效地对大数据进行分类处理。

改进型加权KNN算法的不平衡数据集分类

K最邻近(KNN)算法对不平衡数据集进行分类时分类判决总会倾向于多数类。为此,提出一种加权KNN算法GAK-KNN。定义新的权重分配模型,综合考虑类间分布不平衡及类内分布不均匀的不良影响,采用基于遗传算法的K-means算法对训练样本集进行聚类,按照权重分配模型计算各训练样本的权重,通过改进的KNN算法对测试样本进行分类。基于UCI数据集的大量实验结果表明,GAK-KNN算法的识别率和整体性能都优于传统KNN算法及其他改进算法。

大数据下的快速KNN分类算法

针对K最近邻算法测试复杂度至少为线性,导致其在大数据样本情况下的效率很低的问题,提出了一种应用于大数据下的快速KNN分类算法。该算法创新性地在K最近邻算法中引入训练过程,即通过线性复杂度聚类方法对大数据样本进行分块,然后在测试过程中找出与待测样本距离最近的块,并将其作为新的训练样本进行K最近邻分类。这样的过程大幅度地减少了K最近邻算法的测试开销,使其能在大数据集中得以应用。实验表明,该算法在与经典KNN分类准确率保持近似的情况下,分类的速度明显快于经典KNN算法。

基于K-Medoids聚类的改进KNN文本分类算法

为有效提高传统KNN算法(K最近邻算法)在海量数据的分类效率,分析传统KNN算法的分类过程,提出基于K-Medoids聚类的改进KNN算法。利用K-Medoids算法对文本训练集进行聚类,把文本训练集分成相似度较高的簇;根据待分类文本与簇的相对位置,对文本训练集进行裁剪,解决传统KNN算法在文本训练集过大时速度慢的问题。分析与实验结果表明,该裁剪方法能够合理有效地裁剪文本训练集,提高了KNN算法的运行效率和分类能力。

基于等距映射与加权KNN的旋转机械故障诊断

针对旋转机械高维复杂故障特征数据难以快速准确辨识的问题,提出一种基于等距映射非线性流形学习与加权KNN(K-nearest neighbor)分类器相结合的旋转机械故障诊断方法。在由时域统计指标和内禀模态分量能量构造的原始特征空间中,首先利用等距映射非线性流形学习算法提取旋转机械故障状态变化的本质特征,随后将提取的低维本质特征输入给加权KNN进行旋转机械的故障模式辨识。通过对齿轮箱的实验数据分析表明,该方法不仅对高维复杂的非线性故障特征具有良好的降维性能,而且故障识别率较之传统方法也明显提高,能够有效识别出高维特征空间的非线性故障特征。

基于KNN的特征自适应加权自然图像分类研究

针对自然图像类型广泛、结构复杂、分类精度不高的实际问题,提出了一种为自然图像不同特征自动加权值的K-近邻(K-nearest neighbors,KNN)分类方法。通过分析自然图像的不同特征对于分类结果的影响,采用基因遗传算法求得一组最优分类权值向量解,利用该最优权值对自然图像纹理和颜色两个特征分别进行加权,最后用自适应加权K-近邻算法实现对自然图像的分类。实验结果表明,在用户给定分类精度需求和低时间复杂度的约束下,算法能快速、高精度地进行自然图像分类。提出的自适应加权K-近邻分类方法对于门类繁多的自然图像具有普遍适用性,可以有效地提高自然图像的分类性能。

基于主动学习和TCM-KNN方法的有指导入侵检测技术

有指导网络入侵检测技术是网络安全领域研究的热点和难点内容,但目前仍然存在着对建立检测模型的数据要求过高、训练数据的标记需要依赖领域专家以及因此而导致的工作量及难度过大和实用性不强等问题,而当前的研究工作很少涉及到这些问题的解决办法.基于TCM-KNN数据挖掘算法,提出了一种有指导入侵检测的新方法,并且采用主动学习的方法,选择使用少量高质量的训练样本进行建模从而高效地完成入侵检测任务.实验结果表明:其相对于传统的有指导入侵检测方法,在保证较高检测率的前提下,有效地降低了误报率;在采用选择后的训练集以及进行特征选择等优化处理后,其性能没有明显的削减,因而更适用于现实的网络应用环境.