由于原料性质、设备磨损、过程负荷等因素的影响,复杂工业系统会出现多个稳定操作模态,各稳态之间的过渡过程具有明显的动态特性,针对现有异常检测系统报警意义不明确等问题,将多模态数据流(Multimodal data flow,MDF)技术用于局部异常...由于原料性质、设备磨损、过程负荷等因素的影响,复杂工业系统会出现多个稳定操作模态,各稳态之间的过渡过程具有明显的动态特性,针对现有异常检测系统报警意义不明确等问题,将多模态数据流(Multimodal data flow,MDF)技术用于局部异常点检测系统。提出了一种基于多模态数据流的网络信息局部异常点检测系统。通过在此局部异常点检测系统中,使用多模态数据流技术执行异常检测,大数据流技术执行滥用检测。使用多模态数据流进行异常检测,每个节点内都有一个监视代理和一个分类器(用于检测)以及一个移动代理(用于收集信息)。异常检测和滥用检测模块的输出均由模糊检测规则应用以执行最终检测。该方法采用无状态保留的方式,采用基本特征向量来描述网络数据流实时的运行状态,并且利用基于攻击特点的数据流特征组合使报警的意义更加明确。实验结果表明:该方法提供了一个压缩比较高且能比较全面反映实际网络数据流的基础特征,这为将来的异常检测提供了一个较好的数据平台,具有比较好的可扩展性。展开更多
Security is a nonfunctional information system attribute that plays a crucial role in wide sensor network application domains. Security risk can be quantified as the combination of the probability that a sensor networ...Security is a nonfunctional information system attribute that plays a crucial role in wide sensor network application domains. Security risk can be quantified as the combination of the probability that a sensor network system may fail and the evaluation of the severity of the damage caused by the failure. In this paper, we devise a methodology of Rough Outlier Detection (ROD) for the detection of security-based risk factor, which originates from violations of attack requirements (namely, attack risks). The methodology elaborates dimension reduction method to analyze the attack risk probability from high dimensional and nonlinear data set, and combines it with rough redundancy reduction and the distance measurement of kernel function which is obtained using the ROD. In this way, it is possible to determine the risky scenarios, and the analysis feedback can be used to improve the sensor network system design. We illustrate the methodology in the DARPA case set study using step-by-step approach and then prove that the method is effective in lowering the rate of false alarm.展开更多
Increasing time-spent online has amplified users＇ exposure to tile tilreat oI miormanon leakage. Although existing security systems （such as firewalls and intrusion detection systems） can satisfy most of the securi...Increasing time-spent online has amplified users＇ exposure to tile tilreat oI miormanon leakage. Although existing security systems （such as firewalls and intrusion detection systems） can satisfy most of the security requirements of network administrators, they are not suitable for detecting the activities of applying the HTTP-tunnel technique to steal users＇ private information. This paper focuses on a network behavior-based method to address the limitations of the existing protection systems. At first, it analyzes the normal network behavior pattern over HTI＇P traffic and select four features. Then, it pres- ents an anomaly-based detection model that applies a hierarchical clustering technique and a scoring mechanism. It also uses real-world data to validate that the selected features are useful. The experiments have demonstrated that the model could achieve over 93% hit-rate with only about 3% false- positive rate. It is regarded confidently that the approach is a complementary technique to the existing security systems.展开更多
In real-life freeway transportation system, a few number of incident observation （very rare event） is available while there are large numbers of normal condition dataset. Most of researches on freeway incident detec...In real-life freeway transportation system, a few number of incident observation （very rare event） is available while there are large numbers of normal condition dataset. Most of researches on freeway incident detection have considered the incident detection problem as classification one. However, because of insufficiency of incident events, most of previous researches have utilized simulated incident events to develop freeway incident detection models. In order to overcome this drawback, this paper proposes a wavelet-based Hotelling 7a control chart for freeway incident detection, which integrates a wavelet transform into an abnormal detection method. Firstly, wavelet transform extracts useful features from noisy original traffic observations, leading to reduce the dimensionality of input vectors. Then, a Hotelling T2 control chart describes a decision boundary with only normal traffic observations with the selected features in the wavelet domain. Unlike the existing incident detection algorithms, which require lots of incident observations to construct incident detection models, the proposed approach can decide a decision boundary given only normal training observations. The proposed method is evaluated in comparison with California algorithm, Minnesota algorithm and conventional neural networks. The experimental results present that the proposed algorithm in this paper is a promising alternative for freeway automatic incident detections.展开更多
文摘由于原料性质、设备磨损、过程负荷等因素的影响,复杂工业系统会出现多个稳定操作模态,各稳态之间的过渡过程具有明显的动态特性,针对现有异常检测系统报警意义不明确等问题,将多模态数据流(Multimodal data flow,MDF)技术用于局部异常点检测系统。提出了一种基于多模态数据流的网络信息局部异常点检测系统。通过在此局部异常点检测系统中,使用多模态数据流技术执行异常检测,大数据流技术执行滥用检测。使用多模态数据流进行异常检测,每个节点内都有一个监视代理和一个分类器(用于检测)以及一个移动代理(用于收集信息)。异常检测和滥用检测模块的输出均由模糊检测规则应用以执行最终检测。该方法采用无状态保留的方式,采用基本特征向量来描述网络数据流实时的运行状态,并且利用基于攻击特点的数据流特征组合使报警的意义更加明确。实验结果表明:该方法提供了一个压缩比较高且能比较全面反映实际网络数据流的基础特征,这为将来的异常检测提供了一个较好的数据平台,具有比较好的可扩展性。
基金the Jiangsu 973 Scientific Project，the National Natural Science Foundation of China，the Jiangsu Natural Science Foundation，the Aerospace Innovation Fund，the Lianyungang Science & Technology Project
文摘Security is a nonfunctional information system attribute that plays a crucial role in wide sensor network application domains. Security risk can be quantified as the combination of the probability that a sensor network system may fail and the evaluation of the severity of the damage caused by the failure. In this paper, we devise a methodology of Rough Outlier Detection (ROD) for the detection of security-based risk factor, which originates from violations of attack requirements (namely, attack risks). The methodology elaborates dimension reduction method to analyze the attack risk probability from high dimensional and nonlinear data set, and combines it with rough redundancy reduction and the distance measurement of kernel function which is obtained using the ROD. In this way, it is possible to determine the risky scenarios, and the analysis feedback can be used to improve the sensor network system design. We illustrate the methodology in the DARPA case set study using step-by-step approach and then prove that the method is effective in lowering the rate of false alarm.
基金Supported by the National Natural Science Foundation of China(No.61070185,61003261)the Knowledge Innovation Program of the Chinese Academy of Sciences(No.XDA06030200)
文摘Increasing time-spent online has amplified users＇ exposure to tile tilreat oI miormanon leakage. Although existing security systems （such as firewalls and intrusion detection systems） can satisfy most of the security requirements of network administrators, they are not suitable for detecting the activities of applying the HTTP-tunnel technique to steal users＇ private information. This paper focuses on a network behavior-based method to address the limitations of the existing protection systems. At first, it analyzes the normal network behavior pattern over HTI＇P traffic and select four features. Then, it pres- ents an anomaly-based detection model that applies a hierarchical clustering technique and a scoring mechanism. It also uses real-world data to validate that the selected features are useful. The experiments have demonstrated that the model could achieve over 93% hit-rate with only about 3% false- positive rate. It is regarded confidently that the approach is a complementary technique to the existing security systems.
文摘In real-life freeway transportation system, a few number of incident observation （very rare event） is available while there are large numbers of normal condition dataset. Most of researches on freeway incident detection have considered the incident detection problem as classification one. However, because of insufficiency of incident events, most of previous researches have utilized simulated incident events to develop freeway incident detection models. In order to overcome this drawback, this paper proposes a wavelet-based Hotelling 7a control chart for freeway incident detection, which integrates a wavelet transform into an abnormal detection method. Firstly, wavelet transform extracts useful features from noisy original traffic observations, leading to reduce the dimensionality of input vectors. Then, a Hotelling T2 control chart describes a decision boundary with only normal traffic observations with the selected features in the wavelet domain. Unlike the existing incident detection algorithms, which require lots of incident observations to construct incident detection models, the proposed approach can decide a decision boundary given only normal training observations. The proposed method is evaluated in comparison with California algorithm, Minnesota algorithm and conventional neural networks. The experimental results present that the proposed algorithm in this paper is a promising alternative for freeway automatic incident detections.
