Evidence fusion procedure based on hybrid DSm model

Dezert-Smarandache（DSm） theory, a new information fusion theory, is widely applied in image processing, multiple targets tracking identification, and other areas for its excellent processing ability of imperfect information. However, earlier research on DSm theory mainly focused on one sort of questions. An evidence fusion procedure is proposed based on the hybrid DSm model to compensate for a lack of research on the entire information procedure of DSm theory. This paper analyzes the evidence fusion procedure, as well as correlative node input and output information. Key steps and detailed procedures of evidence fusion are also discussed. Finally, an experiment illustrates the efficiency of the proposed evidence fusion procedure.

A Digital Evidence Fusion Method in Network Forensics Systems with Dempster-Shafer Theory

Network intrusion forensics is an important extension to present security infrastructure,and is becoming the focus of forensics research field.However,comparison with sophisticated multi-stage attacks and volume of sensor data,current practices in network forensic analysis are to manually examine,an error prone,labor-intensive and time consuming process.To solve these problems,in this paper we propose a digital evidence fusion method for network forensics with Dempster-Shafer theory that can detect efficiently computer crime in networked environments,and fuse digital evidence from different sources such as hosts and sub-networks automatically.In the end,we evaluate the method on well-known KDD Cup1999 dataset.The results prove our method is very effective for real-time network forensics,and can provide comprehensible messages for a forensic investigators.

A New Fusion Method for Conflicting Evidence

A new conflicting evidence fusion method is proposed for the deficiency of Dempster's rule which can not fuse the conflicting evidence. Evidence is divided into three categories:believable evidence, non-conflicting evidence and conflicting evidence. The influences of these three categories of evidences on fusion results when discounted are analyzed respectively. On these bases, the evidence distance and the conjunctive conflict are utilized in sequence to recognize the believable evidence and non-conflicting evidence. The discounting factors of these two categories of evidences are set to one, which keeps the evidences support the true hypothesis to the greatest degree, and makes the fusion results focus onto the true hypothesis. Examples of some missile fault diagnosis show that the new method can effectively fuse the conflicting evidences, and is suited to fuse the relievable evidences. The new method improves the reliability and rationality of fusion results compared with traditional methods.

Fault diagnosis method of hydraulic system based on fusion of neural network and D-S evidence theory

According to fault type diversity and fault information uncertainty problem of the hydraulic driven rocket launcher servo system（HDRLSS） , the fault diagnosis method based on the evidence theory and neural network ensemble is proposed. In order to overcome the shortcomings of the single neural network, two improved neural network models are set up at the com-mon nodes to simplify the network structure. The initial fault diagnosis is based on the iron spectrum data and the pressure, flow and temperature（PFT） characteristic parameters as the input vectors of the two improved neural network models, and the diagnosis result is taken as the basic probability distribution of the evidence theory. Then the objectivity of assignment is real-ized. The initial diagnosis results of two improved neural networks are fused by D-S evidence theory. The experimental results show that this method can avoid the misdiagnosis of neural network recognition and improve the accuracy of the fault diagnosis of HDRLSS.

INTELLIGENT FUSION FOR AEROENGINE WEAR FAULT DIAGNOSIS

Four common oil analysis techniques, including the ferrography analysis （FA）, the spectrometric oil analysis （SOA）, the particle count analysis （PCA）, and the oil quality testing （OQT）, are used to implement the military aeroengine wear fault diagnosis during the test drive process. To improve the precision and the reliability of the diagnosis, the aeroengine wear fault fusion diagnosis method based on the neural networks （NN） and the Dempster-Shafter （D-S） evidence theory is proposed. Firstly, according to the standard value of the wear limit, original data are pre-processed into Boolean values. Secondly, sub-NNs are established to perform the single diagnosis, and their training samples are dependent on experiences from experts. After each sub-NN is trained, diagnosis results are obtained. Thirdly, the diagnosis results of each sub-NN are considered as the basic probability allocation value to faults. The improved D-S evidence theory is applied to the fusion diagnosis, and the final fusion results are obtained. Finally, the method is verified by a diagnosis example.

Early warning of rock mass instability based on multi-field coupling analysis and microseismic monitoring

In order to overcome the limitation that rock mass instability warnings are caused by a lack of deep consideration of the inherent mechanism of disaster formation, early warning signs of rock mass instability were detected and multi-field coupling was analyzed. A multi-field coupling model of a damaged rock mass was established. The relationship between microseismic activity parameters and rock mass stability was analyzed, and a multi-parameter early warning index system was established and its solution program was compiled. Based on the D-S data fusion theory,an early warning model of rock mass instability combining multi-field coupling analysis and microseismic monitoring was constructed. Taking an underground mine stope as an object, the multi-field coupling model and its solution program were used to analyze mining response characteristics. The seismic field data were used to verify the accuracy of the multi-field coupling analysis. The early warning model was used to predict the instability of stope rock mass,and the early warning result is consistent with a real-world scenario.

D-S证据理论在审计证据融合中的应用研究

古典概率难以解释审计判断的不确定性,而D-S证据理论是进行不确定性推理的有效方法,因此应用D-S证据理论进行审计证据融合的研究。针对审计证据的组合问题,提出了基于三角形模糊隶属度函数的基本概率分配函数计算方法,给出了证据组合结果的判决规则,并通过实例验证了该方法的有效性。

Multi-VMs Intrusion Detection for Cloud Security Using Dempster-shafer Theory

Cloud computing provides easy and on-demand access to computing resources in a configurable pool.The flexibility of the cloud environment attracts more and more network services to be deployed on the cloud using groups of virtual machines(VMs),instead of being restricted on a single physical server.When more and more network services are deployed on the cloud,the detection of the intrusion likes Distributed Denialof-Service(DDoS)attack becomes much more challenging than that on the traditional servers because even a single network service now is possibly provided by groups of VMs across the cloud system.In this paper,we propose a cloud-based intrusion detection system(IDS)which inspects the features of data flow between neighboring VMs,analyzes the probability of being attacked on each pair of VMs and then regards it as independent evidence using Dempster-Shafer theory,and eventually combines the evidence among all pairs of VMs using the method of evidence fusion.Unlike the traditional IDS that focus on analyzing the entire network service externally,our proposed algorithm makes full use of the internal interactions between VMs,and the experiment proved that it can provide more accurate results than the traditional algorithm.

A novel approximation of basic probability assignment based on rank-level fusion

Belief functions theory is an important tool in the field of information fusion. However, when the cardinality of the frame of discernment becomes large, the high computational cost of evidence combination will become the bottleneck of belief functions theory in real applications. The basic probability assignment （BPA） approximations, which can reduce the complexity of the BPAs, are always used to reduce the computational cost of evidence combination. In this paper, both the cardinalities and the mass assignment values of focal elements are used as the criteria of reduction. The two criteria are jointly used by using rank-level fusion. Some experiments and related analyses are provided to illustrate and justify the proposed new BPA approximation approach.