Attack Behavior Extraction Based on Heterogeneous Cyberthreat Intelligence and Graph Convolutional Networks

The continuous improvement of the cyber threat intelligence sharing mechanism provides new ideas to deal with Advanced Persistent Threats(APT).Extracting attack behaviors,i.e.,Tactics,Techniques,Procedures(TTP)from Cyber Threat Intelligence(CTI)can facilitate APT actors’profiling for an immediate response.However,it is difficult for traditional manual methods to analyze attack behaviors from cyber threat intelligence due to its heterogeneous nature.Based on the Adversarial Tactics,Techniques and Common Knowledge(ATT&CK)of threat behavior description,this paper proposes a threat behavioral knowledge extraction framework that integrates Heterogeneous Text Network(HTN)and Graph Convolutional Network(GCN)to solve this issue.It leverages the hierarchical correlation relationships of attack techniques and tactics in the ATT&CK to construct a text network of heterogeneous cyber threat intelligence.With the help of the Bidirectional EncoderRepresentation fromTransformers(BERT)pretraining model to analyze the contextual semantics of cyber threat intelligence,the task of threat behavior identification is transformed into a text classification task,which automatically extracts attack behavior in CTI,then identifies the malware and advanced threat actors.The experimental results show that F1 achieve 94.86%and 92.15%for the multi-label classification tasks of tactics and techniques.Extend the experiment to verify the method’s effectiveness in identifying the malware and threat actors in APT attacks.The F1 for malware and advanced threat actors identification task reached 98.45%and 99.48%,which are better than the benchmark model in the experiment and achieve state of the art.The model can effectivelymodel threat intelligence text data and acquire knowledge and experience migration by correlating implied features with a priori knowledge to compensate for insufficient sample data and improve the classification performance and recognition ability of threat behavior in text.

Driving rule extraction based on cognitive behavior analysis

In order to make full use of the driver’s long-term driving experience in the process of perception, interaction and vehicle control of road traffic information, a driving behavior rule extraction algorithm based on artificial neural network interface(ANNI) and its integration is proposed. Firstly, based on the cognitive learning theory, the cognitive driving behavior model is established, and then the cognitive driving behavior is described and analyzed. Next, based on ANNI, the model and the rule extraction algorithm(ANNI-REA) are designed to explain not only the driving behavior but also the non-sequence. Rules have high fidelity and safety during driving without discretizing continuous input variables. The experimental results on the UCI standard data set and on the self-built driving behavior data set, show that the method is about 0.4% more accurate and about 10% less complex than the common C4.5-REA, Neuro-Rule and REFNE. Further, simulation experiments verify the correctness of the extracted driving rules and the effectiveness of the extraction based on cognitive driving behavior rules. In general, the several driving rules extracted fully reflect the execution mechanism of sequential activity of driving comprehensive cognition, which is of great significance for the traffic of mixed traffic flow under the network of vehicles and future research on unmanned driving.

Dynamic Behavior and Its Consideration of EHD Liquid Extraction Phenomenon Causing under DC or Low-Frequency AC Voltage

This paper describes an experimental and theoretical study on an extraction phenomenon of liquids occurring at an air gap between the liquid surface and the electrode by applying a direct current (DC) or low-frequency alternating current (AC) voltage. Three liquids with a different physical property;2,3-dihydrodecafluoropenten, palm fatty acid ester oil and crude rapeseed oil are used as working liquids. The electrode configuration is the sphere or plane (high voltage electrode) to grounded plane electrode. The grounded plane electrode is fixed to the bottom of the test vessel with working liquid and the high voltage electrode is installed in an air above the liquid surface against the grounded plane electrode. The liquid surface swells towards the high voltage electrode by the increase of voltage and the liquid is extracted in a short time, thereafter the air gap between the liquid surface and the high voltage electrode is bridged at a thick liquid column. Such the liquid behavior displays unique features with voltage polarity effect for each working liquid. The relationship between the applied voltage, current variation, height of swollen liquid, force pulling liquid and dynamic feature of liquid is examined experimentally. The liquid behavior is considered theoretically based on experimental observations.

Effect of thermodynamic parameters on prediction of phase behavior and process design of extractive distillation

Extractive distillation was investigated for separation of the minimum azeotrope of n-propanol/water, via the Aspen Plus simulation platform. Experimental data of n-propanol/water, which could pass the thermodynamic consistency test, were regressed to get suitable binary interaction parameters(BIPs) by the UNIQUAC thermodynamic model. The azeotrope system was heterogeneous in the simulation with built-in BIPs, which was contrary to the experimental data. The study focused on the effect of thermodynamic parameters on the prediction of phase behavior, and process design of extractive distillation. N-methyl-2-pyrrolidone(NMP) and ethylene glycol were used as solvents to implement the separation. Processes with built-in and regressed BIPs were explored,based on the minimum total annual cost(TAC). There were significant differences in the phase behavior simulation using different thermodynamic parameters, which showed the importance of BIPs in the design and optimization of extractive distillation.

Inhibitory effects of Albizia lebbeck leaf extracts on germination and growth behavior of some popular agricultural crops

An experiment was conducted to observe the inhibitory effects of the leaf extracts derived from Albizia lebbeck （L.） Benth. On germination and growth behavior of some popular agricultural crops （receptor） of Bangladesh. Experiments were set on sterilized petridishes with a photoperiod of 24 h at room temperature of 27-30℃. The effects of the different concentrations of aqueous extracts were compared to distil water （control.）. The aqueous extracts of leaf caused significant inhibitory effect on germination, root and shoot elongation and development of lateral roots of receptor plants. Bioassays indicated that the inhibitory effect was proportional to the concentrations of the extracts and higher concentration （50%-100%） had the stronger inhibitory effect whereas the lower concentration （10%-25%） showed stimulatory effect in some cases. The study also revealed that, inhibitory effect was much pronounced in root and lateral root development rather than germination and shoot growth.

Ionic liquid-based salting-out extraction of bio-chemicals

Ionic liquids(ILs)are known as green solvents,and have been widely used in the dissolution and transformation of biopolymers,the extraction of bioactive compounds and metal ions,and the capture of SO2 or CO2.However,less attention was given to the separation of bio-based chemicals,such as diols and organic acids.Bio-based chemicals can be efficiently separated by organic solvent-based salting-out extraction(SOE)from fermentation broths,while organic solvents are normally unfriendly to environment and process safety in commercialized production due to their toxicity or/and flammability.In recent years,the IL-based SOE system has been explored in the separation of bio-based chemicals as an alternative of organic solvent-based SOE system.In this review,the progress of IL-based SOE of biobased chemicals has been summarized,including the effect of ILs structure on the formation of aqueous two phases,and the influences of ILs structure and concentration,temperature and pH on the partition behaviors of target products and ILs as well as removal of impurities.Most of bio-based chemicals could be distributed into the IL-rich phase with high recovery,while the partition behaviors of bio-based chemicals are sometimes different from that in organic solvent-based SOE systems.Although the results of ILbased SOE are promising,further studies are still required in the increased selectivity of target products over by-products,recovery and recycling of ILs,and the separation between ILs and bio-based chemicals.Additionally,three kinds of integrated bioprocesses would be developed on basis of utilization of ILs as extractant for SOE,catalyst for condensation reaction and solvent for pretreatment of lignocellulose.

Synthesis of amorphous manganese borohydride in the(NaBH_4–MnCl_2) system, its hydrogen generation properties and crystalline transformation during solvent extraction

The mixture of(2NaBH4+ MnCl2) was ball milled in a magneto-mill. No gas release was detected. The XRD patterns of the ball milled mixture exhibit only the Bragg diffraction peaks of the Na Cl-type salt which on the basis of the present X-ray diffraction results and the literature is likely to be a solid solution Na(Cl)x(BH4)(1-x), possessing a cubic Na Cl-type crystalline structure. No presence of any crystalline hydride was detected by powder X-ray diffraction which clearly shows that NaBH4in the initial mixture must have reacted with MnCl2forming a Na Cl-type by-product and another hydride that does not exhibit X-ray Bragg diffraction peaks. Mass spectrometry(MS) of gas released from the ball milled mixture during combined MS/thermogravimetric analysis(TGA)/differential scanning calorimetry(DSC) experiments, confirms mainly hydrogen(H2) with a small quantity of diborane gas, B2H6. The Fourier transform infra-red(FT-IR) spectrum of the ball milled(2NaBH4+ MnCl2) is quite similar to the FT-IR spectrum of crystalline manganese borohydride, c-Mn(BH4)2, synthesized by ball milling, which strongly suggests that the amorphous hydride mechano-chemically synthesized during ball milling could be an amorphous manganese borohydride. Remarkably, the process of solvent filtration and extraction at 42 °C, resulted in the transformation of mechano-chemically synthesized amorphous manganese borohydride to a nanostructured,crystalline, c-Mn(BH4)2hydride.

Influence of Modifier in Supercritical CO₂on Qualitative and Quantitative Extraction Results of <i>Eucalyptus</i>Ecential Oil

A supercritical CO2 extraction behavior of Eucalyptus oil was investigated under different conditions of pressure, temperature and time with or without cosolvent. The pressure range was from 8 to 25 MPa, temperature from 35 to 55&deg;C and CO2 flow rate from 10 to 26 g/min. For 1,8-cineole the appropriate extracting pressure was 15 MPa and temperature was 45&deg;C. When CO2 flow rate was 18 g/min, it was benefit to extract the other three substances (limonene, p-cymene and γ-terpinene, respectively) except 1,8-cineole. Prolonging extraction time could not obviously increase the extract concentration, but the extract yield would increase. The results also indicated that ethanol as a modifier could improve extraction velocity and extraction concentration.

Swelling/extraction test of Russian reservoir heavy oil by liquid carbon dioxide

The mass transfer between heavy oil and liquid carbon dioxide and the changes of the heavy phase(mixture of heavy oil and CO_2) and light phase(pure CO_2) in the mixture were tested in lab with heavy oil samples from Russia. The experimental results showed that the heavy oil hardly expanded when the concentration of carbon dioxide in the mixture was 10%. When the concentration of carbon dioxide was higher than 26%, the volume of the heavy phase decreased, and the viscosity of the heavy phase increased exponentially as the light components extracted from the heavy oil exceeded the carbon dioxide saturated in the heavy oil. When the concentration of carbon dioxide in the mixture was 26%, the effect of viscosity reducing to the heavy phase was the strongest. The density of the light and heavy phases, volume factor, and solubility of gas and flash viscosity of heavy phase all increased with the rise of carbon dioxide concentration in the mixture. The best concentration of carbon dioxide in the mixture was 26%, when the heavy oil expanded the most and the viscosity of the heavy phase was the lowest. When the concentration of carbon dioxide in the mixture was between 10% and 26%, the volume of the light phase was the smallest and the oil displacement effect was the best.

A red pomegranate fruit extract-based formula ameliorates anxiety/depression-like behaviors via enhancing serotonin (5-HT) synthesis in C57BL/6 male mice

This study investigated the anti-anxiety/anti-depression potential of a formula containing red pomegranate fruit extract(RPFE;40%,m/m),Lactobacillus rhamnosus(JB-1)(34%,m/m),magnesium gluconate(25%,m/m)and vanillin(1%,m/m).The RPFE formula(dose:2.0,1.5 or 1.0 mg/g·day)reversed behavioral dysfunctions and body weight gain induced by chronic restraint stress combined with corticosterone injection in C57BL/6 male mice.The RPFE formula exhibited the abilities to normalize the levels of serum infl ammatory cytokines(NF-κB,TNF-α,IL-6,IL-1βand IFN-γ)and malondialdehyde(MDA),and activities of superoxide dismutase(SOD),catalase(CAT)and nitric oxide synthase(NOS),as well as relieve the injury of hippocampal neurons.The serotonin(5-HT)levels in hippocampus were increasingly enhanced,which might be mediated by reducing the activity of indoleamine-2,3-dioxygenase(IDO)and increasing the activity of tryptophan hydroxylase(TPH).Thus,the neuroprotective and ameliorating effects on anxiety/depression-like behaviors resulting from the RPFE formula ingestion were possibly related to serotonergic activation,which might be mediated via anti-infl ammatory and anti-oxidant actions.

基于演化博弈的移动通信数据拟态防御方法

通信数据在拟态防御时,若未能及时处理数据中的噪声,会直接影响数据的拟态防御效果,给数据传输带来安全威胁。为提升数据的拟态防御效果,提出基于演化博弈的移动通信数据拟态防御方法。针对数据中的噪声问题,使用阈值去噪方法对数据实施去噪处理,并根据去噪结果提取数据的通信行为特征;以上述操作为基础,结合演化博弈理论建立移动通信数据拟态防御模型,通过获取模型动态调度值制定出最佳调度策略;将提取的数据行为特征输入到构建的模型内,利用调度策略实现移动通信数据的拟态防御。实验结果表明,使用上述方法开展数据拟态防御时,防御效果较好。

基于多模态神经网络流量特征的网络应用层DDoS攻击检测方法

农业设备、传感器和监控系统与网络的连接日益紧密,给农村配电网带来了新的网络安全挑战。其中,分布式拒绝服务(DDoS)攻击是一种常见的网络威胁,对农村配电网的安全性构成了严重威胁。针对农村配电网的特殊需求,提出一种基于多模态神经网络流量特征的网络应用层DDoS攻击检测方法。通过制定网络应用层流量数据包捕获流程并构建多模态神经网络模型,成功提取并分析了网络应用层DDoS攻击流量的特征。在加载DDoS攻击背景下的异常流量特征后,计算相关系数并设计相应的DDoS攻击检测规则,以实现对DDoS攻击的有效检测。经试验分析,所提出的方法在提取DDoS攻击相关特征上表现出色,最大提取完整度可达95%,效果明显优于对比试验中基于EEMD-LSTM的检测方法和基于条件熵与决策树的检测方法。

有限维空间下运动行为传感数据特征提取

维度的升高会加剧运动行为传感数据的复杂度,导致其分布特征空间被无限放大,因此提出基于有限维空间的运动行为传感数据特征提取方法。采用关联规则项挖掘分析方法计算数据模糊度,确定运动行为的有限空间区域。在有限维空间下,通过自适应寻优方法,计算传感数据的特征量化参数。检测运动行为传感数据的特征属性,计算数据分布融合映射输出结果,构建运动行为特征提取模型。实验结果表明,所提方法的运动数据空间聚类效果较好,能够把数据固定在有限维空间,数据特征提取精度始终保持在95%以上。

高含CO_(2)凝析气藏成藏过程中的流体相行为及油环体积预测

成藏后期的CO_(2)充注导致里贝拉区块高含CO_(2)次生凝析气藏的流体相行为十分复杂,油环体积预测难度很大。本文通过流体相平衡模拟、组分梯度分布计算及CO_(2)充注可视化实验,刻画了CO_(2)充注过程中的油气相行为,揭示了油环体积的动态变化规律,建立了基于气顶气组分拟合的高含CO_(2)次生凝析气藏油环体积预测新方法。研究结果表明:1)CO_(2)充注下的油环体积变化分为4个阶段:充注初期,油环以溶胀为主;充注前期,CO_(2)不断置换并萃取油相中的轻质组分,油环体积迅速降低;充注中期,CO_(2)持续萃取油相的轻、中质组分,油环体积缓慢减小;充注后期,CO_(2)-原油组分传质作用明显减弱,压缩效应导致油环体积进一步减小。2)轻质组分的强流动性使气顶气组成均一,重力分异作用使纵向上油环组分呈梯度变化。3)油环体积与气顶气组成和气油比密切相关。4)基于气顶气拟合新方法和不同井深现场勘探预测的油环体积占比分别为19.21%和22.30%,与CO_(2)充注可视化实验获得的油环体积占比(20.60%)较为吻合。

多功能相控阵雷达行为辨识综述

多功能相控阵雷达是指具备相位控制阵列,能同时实现搜索、跟踪、制导等多种功能的雷达。随着雷达对抗的不断升级以及各国对于电子战的日益重视,作为获取多功能相控阵雷达信息的重要手段,其行为辨识技术的研究得到了进一步发展。结合目前多功能相控阵雷达行为辨识的背景与意义,对已有的不同多功能相控阵雷达信号模型进行梳理,对高密度、大噪声信号环境下的波形单元提取算法和基于深度学习的工作模式识别算法进行识别性能、适用场景等方面的系统性对比,并归纳了不同仿真数据集的实际应用情况,最后总结了该技术存在的问题并提出了未来展望。

基于小鼠急性醉酒评价的茶酒饮后行为研究

为开展茶酒饮后行为的研究,挖掘茶酒的健康属性,本研究分别按0.15 mL/10 g剂量蒸馏水、40.8%vol造模用酒、40.8%vol茶酒基酒(不含茶叶提取物)、40.8%vol茶酒灌胃4组小鼠,并监测小鼠急性醉酒行为。结果表明,茶酒基酒组的醉酒率(67.67%)低于造模用酒组(83.33%),饮后自主活动次数(99.20次)、转角转向次数(2.40次)显著高于造模用酒组;茶酒组的醉酒率(67.67%)低于造模用酒组,饮后自主活动次数(106.60次)、转角转向次数(4.80次)、前肢放置次数(1.50次)显著高于造模用酒组,同时高于基酒组,角落转向次数显著高于基酒组。综上,相对造模用酒,茶酒急性醉酒行为失调最轻微,基酒次之,表明茶酒及其基酒品质较好,饮后舒适度高。茶酒中茶叶提取物发挥显著的正向调节作用,是茶酒健康属性的物质基础之一。

拓扑信息引导的视频异常行为检测方法

在视频异常检测任务中,良好的特征提取能力在多帧预测方法中十分重要。然而当面对复杂的环境时,传统的基于空间特征的提取方法往往在多层卷积的过程中忽略了底层特征之间的全局依赖关系。为了更好地进行特征提取,提出一种依托拓扑强相关信息引导的视频异常检测方法。该方法针对底层特征序列进行全局相关性信息的提取,并以此初步增强特征中强关联的信息。将底层特征作为节点,裁剪后的相关性信息作为邻里矩阵,构建关键特征之间的拓扑结构关系图,有效地利用了关键特征的拓扑结构信息。将初步增强的特征与拓扑结构特征进行特征融合,帮助模型更深入更全面地筛选关键特征,提高了特征表达能力。该方法在Ped2、Avenue和ShanghaiTech三个公开数据集上取得了良好的视频帧预测效果,提高了模型的检测精度。

基于用户行为分析的APP用户知识图谱构建

为了更好地帮助开发者理解用户需求,从而优化APP功能和体验,提高用户满意度,文中提出一种基于用户行为分析的APP用户知识图谱构建方法。首先从用户行为分析出发,通过APP用户评论细化用户行为;接着,通过APP用户行为与用户关系属性的映射抽取用户关系属性;最后,基于关系抽取结果构建APP用户知识图谱。通过相关算法进行APP用户知识图谱的构建,结果证明了该算法的有效性,能够创建出信息更为丰富的APP用户知识图谱。

基于改进注意力机制与VGG-BiLSTM的暴力行为检测

为解决单一深度卷积神经网络VGG特征提取的局限性,以及单一循环神经网络RNN在记忆历史信息方面的困难,提出改进注意力机制与深度时空网络的深度学习模型VBA-net的暴力行为检测方法。首先,通过VGG的深层神经网络提取关键局部特征;其次,运用改进后的注意力机制捕捉和优化最显著的特征;最后,利用双向长短期记忆网络处理过去和未来的时序数据。仿真实验结果表明,VBA-net在规模较小的HockeyFight和Movies数据集上的准确率分别达到了97.42%和98.06%,在具有多样化内容和复杂环境数据集RWF-2000和RLVS上准确率分别达到89.00%和95.50%,因此其在复杂环境的综合鲁棒性优于同类算法,可有效提升暴力行为检测任务中的准确率。

基于集成学习的入侵检测模型

入侵检测系统通过对网络上的恶意行为检测,来保证网络安全和计算机系统的稳定,随着人工智能技术的发展,机器学习与深度学习算法被广泛应用在入侵检测系统中。以入侵检测模型为研究目标,针对网络异常行为检测中的不平衡数据多分类问题,对现有的网络异常行为检测多分类模型进行优化,提出了一种基于卷积神经网络、LSTM(Long Short-Term Memory)神经网络与XGBoost(eXtreme Gradient Boosting)算法集成的检测模型(CNN+LSTM-In-XGBoost)。该模型包括数据预处理、长短期神经网络模型训练、数据降维、采样后XGBoost模型训练3个部分,通过对UNSW-NB15数据集进行实验分析,发现其准确率和分类平均f1-score均高于基准算法,特别少数类样本的分类准确率相比基准机器学习算法与神经网络模型有较大提升。