NFHP-RN:AMethod of Few-Shot Network Attack Detection Based on the Network Flow Holographic Picture-ResNet

Due to the rapid evolution of Advanced Persistent Threats(APTs)attacks,the emergence of new and rare attack samples,and even those never seen before,make it challenging for traditional rule-based detection methods to extract universal rules for effective detection.With the progress in techniques such as transfer learning and meta-learning,few-shot network attack detection has progressed.However,challenges in few-shot network attack detection arise from the inability of time sequence flow features to adapt to the fixed length input requirement of deep learning,difficulties in capturing rich information from original flow in the case of insufficient samples,and the challenge of high-level abstract representation.To address these challenges,a few-shot network attack detection based on NFHP(Network Flow Holographic Picture)-RN(ResNet)is proposed.Specifically,leveraging inherent properties of images such as translation invariance,rotation invariance,scale invariance,and illumination invariance,network attack traffic features and contextual relationships are intuitively represented in NFHP.In addition,an improved RN network model is employed for high-level abstract feature extraction,ensuring that the extracted high-level abstract features maintain the detailed characteristics of the original traffic behavior,regardless of changes in background traffic.Finally,a meta-learning model based on the self-attention mechanism is constructed,achieving the detection of novel APT few-shot network attacks through the empirical generalization of high-level abstract feature representations of known-class network attack behaviors.Experimental results demonstrate that the proposed method can learn high-level abstract features of network attacks across different traffic detail granularities.Comparedwith state-of-the-artmethods,it achieves favorable accuracy,precision,recall,and F1 scores for the identification of unknown-class network attacks through cross-validation onmultiple datasets.

User Churn Prediction Hierarchical Model Based on Graph Attention Convolutional Neural Networks

The telecommunications industry is becoming increasingly aware of potential subscriber churn as a result of the growing popularity of smartphones in the mobile Internet era,the quick development of telecommunications services,the implementation of the number portability policy,and the intensifying competition among operators.At the same time,users'consumption preferences and choices are evolving.Excellent churn prediction models must be created in order to accurately predict the churn tendency,since keeping existing customers is far less expensive than acquiring new ones.But conventional or learning-based algorithms can only go so far into a single subscriber's data;they cannot take into consideration changes in a subscriber's subscription and ignore the coupling and correlation between various features.Additionally,the current churn prediction models have a high computational burden,a fuzzy weight distribution,and significant resource economic costs.The prediction algorithms involving network models currently in use primarily take into account the private information shared between users with text and pictures,ignoring the reference value supplied by other users with the same package.This work suggests a user churn prediction model based on Graph Attention Convolutional Neural Network(GAT-CNN)to address the aforementioned issues.The main contributions of this paper are as follows:Firstly,we present a three-tiered hierarchical cloud-edge cooperative framework that increases the volume of user feature input by means of two aggregations at the device,edge,and cloud layers.Second,we extend the use of users'own data by introducing self-attention and graph convolution models to track the relative changes of both users and packages simultaneously.Lastly,we build an integrated offline-online system for churn prediction based on the strengths of the two models,and we experimentally validate the efficacy of cloudside collaborative training and inference.In summary,the churn prediction model based on Graph Attention Convolutional Neural Network presented in this paper can effectively address the drawbacks of conventional algorithms and offer telecom operators crucial decision support in developing subscriber retention strategies and cutting operational expenses.

基于改进图注意力网络的油井产量预测模型

针对图注意力网络处理噪声和时序数据较弱,并且在堆叠多层后出现梯度爆炸、过平滑等问题,提出一种改进图注意力网络模型.首先,使用Squeeze-and-Excitation模块对样本输入数据的特征信息进行不同程度关注,增强模型处理噪声的能力;其次,使用多头注意力机制,将序列数据中每个序列相对其他序列进行加权求和,提取数据的时序性;再次,将图注意力网络提取的节点特征与节点的度中心性拼接,获取节点的局部特征,并用全局平均池化的方式提取节点的全局特征;最后,将两者进行融合得到节点的最终特征表示,增强模型的表征能力.为验证改进图注意力网络的有效性,将改进图注意力网络模型与LSTM,GRU和GGNN模型进行对比,实验结果表明,该模型预测效果得到有效提升,具有更高的预测精度.

基于知识图谱多集池化的健康状态智能评估方法

为了从装备传感器监测数据和其他关联数据中提取更全面的时间域和空间域特征信息,提出一种基于知识图谱多集池化的健康状态评估方法。构建了带时间标签的健康知识图谱,以建模装备一段时间内监测数据、部件组成数据和先验知识间的时空依赖关系。在此基础上,设计了图多集池化网络模型,该模型通过节点特征学习、第一级图池化、自注意力特征学习和第二级图池化能够生成图谱的整体向量表示,将健康状态评估转换为基于表示学习的图谱分类任务。在公开的发动机数据集上对所提方法进行了实验评价,结果表明,该方法能够获得较高的评估准确度,在小样本情况下也表现出良好的优势。

基于自适应图卷积和注意力池化的点云分类与分割

针对现有点云分类与分割方法使用最大池化聚合局部邻域特征,导致最大值以外的重要信息丢失的缺陷,提出一种结合自适应图卷积AdaptConv和注意力池化AP的点云分类与分割网络。首先,采用K近邻算法构建点云局部图结构,根据点的特征生成自适应卷积核,灵活精确地捕获点云的局部邻域特征;其次,为有效提高特征聚合能力,采用注意力池化定义能量函数得到权重值,加权并聚合出更具代表性的点云局部特征;最后,堆叠自适应图卷积和注意力池化逐层提取全局特征,提高网络的分类和分割精度。实验结果表明,相较基准方法,点云分类的平均类别精度提升0.9%,部件分割和语义分割的平均交并比分别提升0.8%和0.3%,证明所提方法可有效提升点云分类与分割的准确率,具有较高的鲁棒性。

融合时序门控图神经网络的兴趣点推荐方法

现有的大多数兴趣点(point of interest,POI)推荐系统由于忽略了用户签到序列中的顺序行为模式,以及用户的个性化偏好对于POI推荐的影响,导致POI推荐系统性能较低,推荐结果不可靠,进而影响用户体验。为了解决上述问题,提出一种融合时序门控图神经网络的兴趣点推荐方法。运用时序门控图神经网络(temporal gated graph neural network,TGGNN)学习POI embedding;采用注意力机制捕获用户的长期偏好;通过注意力机制融合用户的最新偏好和实时偏好,进而捕获用户的短期偏好。通过自适应的方式结合用户的长期和短期偏好,计算候选POI的推荐得分,并根据得分为用户进行POI推荐。实验结果表明,与现有方法相比,该方法在召回率和平均倒数排名这两项指标上均有较为明显的提升,因此可以取得很好的推荐效果,具有良好的应用前景。

基于节点采样的子结构代表层次池化图卷积网络模型

为解决目前基于节点采样的图池化方法中所存在的评估节点重要性的策略过于简单以及子结构特征信息大量丢失等问题,提出了基于节点采样的子结构代表层次池化模型(sub-structure representative hierarchical pooling model based on node sampling,SsrPool)。该模型主要包括子结构代表节点选择模块和子结构代表节点特征生成模块2个部分。首先,子结构代表节点选择模块同时考虑了节点特征信息以及结构信息,利用不同方法评估节点重要性并通过不同重要性分数协作产生鲁棒的节点排名以指导节点选择。其次,子结构代表节点特征生成模块通过特征融合保留局部子结构特征信息。通过将SsrPool与现有神经网络相结合,在不同规模公共数据集上的图分类实验结果证明了SsrPool的有效性。

基于图池化对比学习的图分类方法

在图分类任务中,现有的利用丢弃节点的图池化算法得到的图嵌入表示没有有效地利用丢弃节点蕴含的信息和图间节点信息,同时传统方法也没有针对图嵌入进行单独学习,限制了它在图分类任务上的部分性能。为克服上述传统方法的不足,提出一种有效利用丢弃节点信息的图嵌入方法——基于图池化对比学习的图分类方法(GPCL)。首先,利用图注意力机制学习每个节点相应的注意力分数,且根据注意力分数对节点进行排序并丢弃分数较低的节点;其次,将本图保留的节点作为正样本,将其他图被丢弃的部分节点作为负样本,而将图的嵌入表达作为目标节点,两两计算相似性分数,从而进行对比学习。实验结果表明:在D&D(Dobson PD-Doig AJ)、MUTAG、PROTEINS和IMDB-B数据集上,相较于仅使用注意力机制和分层池化的方法,GPCL在图分类任务上的准确率分别提升了5.79、15.54、5.42和1.75个百分点,验证了GPCL充分提高了图间信息的利用率,在图分类任务上表现良好。

基于归纳学习图卷积和自注意力池化的图分类网络

针对图神经网络在大规模图上的分类表现不佳,无法快速形成未知节点和边的嵌入,并且容易丢失图重要特征等问题。提出一种基于归纳学习和自注意力池化相结合的图分类网络模型,一方面采用改进聚合函数后的归纳式学习方法对图的节点特征形成快速地嵌入,另一方面采用自注意力池化方法保留图的重要特征,最终采用适于提取大规模图信息的层次化结构框架进行下游图分类任务。实验结果表明,该网络模型在相同的公共数据集下,对比其他图分类模型有2%~10%左右精度的提高。

基于图神经网络的SSL/TLS加密恶意流量检测算法研究

为实现SSL/TLS加密恶意流量的精准检测,针对传统机器学习方法过分依赖专家经验的问题,提出一种基于图神经网络的恶意加密流量检测模型。通过对SSL/TLS加密会话进行分析,利用图结构对流量会话交互信息进行表征,将恶意加密流量检测问题转化为图分类问题。生成的模型基于分层图池化架构,通过多层卷积池化的聚合,结合注意力机制,充分挖掘图中节点特征和图结构信息,实现了端到端的恶意加密流量检测方法。基于公开数据集CICAndMal2017进行验证,实验结果表明,所提模型在加密恶意流量二分类检测中,准确率高达97.1%,相较于其他模型,准确率、召回率、精确率、F1分数分别提升了2.1%,3.2%,1.6%,2.1%,说明所提方法对于恶意加密流量的表征能力和检测能力优于其他方法。

基于层级池化序列匹配的知识图谱复杂问答最优查询图选择方法

在处理知识图谱复杂问答任务时,传统的查询图语义解析方法需要在排序阶段对大量结构复杂的候选查询图进行语义编码,用以获得各自多维特征表示。然而,在编码过程中采用的全局最大或平均池化操作通常存在对代表性特征提取能力不足的问题。针对以上问题,提出一种基于层级池化序列匹配的最优查询图选择方法。在实现候选查询图的交互建模过程中,同时采用层级池化滑动窗口技术分层提取问句和查询图序列对的局部显著性特征与全局语义特征,使得到的特征向量更好地用于候选查询图的语义匹配打分。所提方法在两个流行的复杂问答数据集MetaQA和WebQuestionsSP上开展广泛实验。实验结果表明:引入层级池化操作能够有效提取复杂查询图序列的代表性语义特征,增强原有排序模型的交互编码能力,有助于进一步提升知识图谱复杂问答系统的性能。

基于稳态特征量输入的大电网主导失稳机组辨识

以稳态特征量为输入的数据驱动稳定评估模型在新型电力系统安全防御系统中有重要的应用前景,但需要在模型设计中解决节点数量庞大和网络结构复杂带来的关键特征聚焦难题,并提供失稳模式等更为丰富的评估信息。因此,设计了一套基于稳态信息输入实现大电网主导失稳机群预测的深度学习稳定评估模型。首先,提出了一种异构的图和节点特征的动态池化降维模型,可伴随特征聚合过程,按节点特征相似性动态归并节点,实现大规模电网拓扑、节点数量和特征的并行降维。然后,提出了一种单机扫描型主导失稳机组分类器模型,通过全局注意力聚合将全网机组的相对运动信息集成到每台发电机特征向量中,使主导失稳机组辨识模型在结构上可以应对发电机组数量变化,具有很好的泛化能力。最后,在实际大规模电网中进行模型验证,并可视化地分析了关键环节的作用效果和应用性能。

集改进图卷积和多层池化的点云分类模型

针对基于图卷积的点云分类模型在提取点云不同语义区域的特征信息以及高效利用聚合的高维特征方面存在的问题,本文提出了一种新的点云分类模型,该模型采用了动态自适应图卷积和多层池化相结合的方法。具体而言,本文采用了残差结构来构建更深层的卷积,以学习不同语义区域点对特征中不同层次的特征信息,从而生成动态自适应调整卷积核,针对不同的点对动态更新边的特征关系,从而提取更为精确的局部特征。同时,本文将聚合的高维特征输入到多层最大池化模块中,回收利用第一次最大池化后丢弃的特征信息进行多层最大池化,从而获取更为丰富的高维特征,提高分类模型的精度。实验结果表明,在ModelNet40数据集上,本文提出的分类模型的总体精度达到93.3%,平均精度为90.7%,明显优于目前主流的点云分类模型,并具有较强的鲁棒性。

Detecting APT-Exploited Processes through Semantic Fusion and Interaction Prediction

Considering the stealthiness and persistence of Advanced Persistent Threats(APTs),system audit logs are leveraged in recent studies to construct system entity interaction provenance graphs to unveil threats in a host.Rule-based provenance graph APT detection approaches require elaborate rules and cannot detect unknown attacks,and existing learning-based approaches are limited by the lack of available APT attack samples or generally only perform graph-level anomaly detection,which requires lots of manual efforts to locate attack entities.This paper proposes an APT-exploited process detection approach called ThreatSniffer,which constructs the benign provenance graph from attack-free audit logs,fits normal system entity interactions and then detects APT-exploited processes by predicting the rationality of entity interactions.Firstly,ThreatSniffer understands system entities in terms of their file paths,interaction sequences,and the number distribution of interaction types and uses the multi-head self-attention mechanism to fuse these semantics.Then,based on the insight that APT-exploited processes interact with system entities they should not invoke,ThreatSniffer performs negative sampling on the benign provenance graph to generate non-existent edges,thus characterizing irrational entity interactions without requiring APT attack samples.At last,it employs a heterogeneous graph neural network as the interaction prediction model to aggregate the contextual information of entity interactions,and locate processes exploited by attackers,thereby achieving fine-grained APT detection.Evaluation results demonstrate that anomaly-based detection enables ThreatSniffer to identify all attack activities.Compared to the node-level APT detection method APT-KGL,ThreatSniffer achieves a 6.1%precision improvement because of its comprehensive understanding of entity semantics.

An Intelligent Framework for Resilience Recovery of FANETs with Spatio-Temporal Aggregation and Multi-Head Attention Mechanism

Due to the time-varying topology and possible disturbances in a conflict environment,it is still challenging to maintain the mission performance of flying Ad hoc networks(FANET),which limits the application of Unmanned Aerial Vehicle(UAV)swarms in harsh environments.This paper proposes an intelligent framework to quickly recover the cooperative coveragemission by aggregating the historical spatio-temporal network with the attention mechanism.The mission resilience metric is introduced in conjunction with connectivity and coverage status information to simplify the optimization model.A spatio-temporal node pooling method is proposed to ensure all node location features can be updated after destruction by capturing the temporal network structure.Combined with the corresponding Laplacian matrix as the hyperparameter,a recovery algorithm based on the multi-head attention graph network is designed to achieve rapid recovery.Simulation results showed that the proposed framework can facilitate rapid recovery of the connectivity and coverage more effectively compared to the existing studies.The results demonstrate that the average connectivity and coverage results is improved by 17.92%and 16.96%,respectively compared with the state-of-the-art model.Furthermore,by the ablation study,the contributions of each different improvement are compared.The proposed model can be used to support resilient network design for real-time mission execution.

基于多级联合的图池化方法

图池化方法已经在生物信息学、化学、社交网络、推荐系统等多个领域中得到广泛应用,但关于图池化方法大多没有很好的解决节点选择问题和池化带来的节点信息丢失问题。对此提出一种新的多级联合图池化(MUPool)方法。所提方法使用多视角模块从多个视角获取节点的特征,即通过多个卷积模块提取不同的特征。同时提出多级联合模块(级联),将不同池化层的输出串联,每一层都可以融合以往所有层的信息。提出使用后端融合模块,针对每个池化层建立一个分类器,对预测结果进行融合得到最终分类结果。所提方法在多个数据集上进行实验,准确度平均提高1.62%,所提方法可以与现有的分层池化方法相结合,结合后的方法准确度平均提高2.45%。

An Affective EEG Analysis Method Without Feature Engineering

Emotional electroencephalography(EEG)signals are a primary means of recording emotional brain activity.Currently,the most effective methods for analyzing emotional EEG signals involve feature engineering and neural networks.However,neural networks possess a strong ability for automatic feature extraction.Is it possible to discard feature engineering and directly employ neural networks for end-to-end recognition?Based on the characteristics of EEG signals,this paper proposes an end-to-end feature extraction and classification method for a dynamic self-attention network(DySAT).The study reveals significant differences in brain activity patterns associated with different emotions across various experimenters and time periods.The results of this experiment can provide insights into the reasons behind these differences.

基于自注意力机制和平均池化下图卷积网络的商品新闻事件抽取

商品新闻事件抽取是对新闻非结构化语句进行归纳和表达,以提取出该语句所包含的事件以及相关信息,能够为供货需求预测、价格预测、问答系统等提供基础。现有研究工作普遍存在候选触发词与实体向量关联性利用不强以及参数角色提取准确率不够的问题,因此本文在已有研究工作的基础上,提出了一种基于自注意力机制和平均池化图卷积网络及依赖解析树的提取模型(SAT-GCN-DPT)。该模型主要分为3个模块,ComBERT预训练模块、self-attention机制下的触发分类模块、利用平均池化图卷积和依赖解析树的参数角色分类模块。模型利用self-attention机制对输入数据进行操作增强候选触发词与实体向量之间关联性,同时对图卷积结果使用平均池化函数进行信息聚合来更大程度地还原事件之间关联性和提高分类准确率。实验结果表明,在CON数据集上,本文提出的模型在触发分类以及参数角色分类的准确度以及F 1值均有了提高。

图双线性池化特征编码的细粒度目标识别方法

针对细粒度图像识别领域中经典双线性池化模型存在的视觉突发与特征冗余问题,提出了一种图双线性池化模型。该模型将图网络嵌入双线性池化模型,利用图网络的聚合能力,将差异性图像特征编码为高阶特征,改善了编码过程中的视觉突发现象。在CUB、Cars和Aircrafts 3个公共数据集上进行实验,模型的精确度分别达到87.8%、93.5%和89.6%。相较于分解双线性池化,该模型参数量仅为基线模型的25%,识别精度分别提高2.4%、1.7%和1.3%,充分验证了模型的有效性,可为军事目标细粒度识别提供方法参考。

基于图神经网络的航空数据异常检测

飞行品质监控(FOQA)数据记录了飞行状态的详细参数,对于评估飞行操作的质量和安全性至关重要。传统的“超限检测”算法通过与预先建立的阈值进行比较来识别异常行为。相比之下,深度学习方法能够更全面、灵活地分析FOQA数据,提高异常行为的检测精度。文章提出的TAGDNet是用于FOQA数据多类别异常检测的创新框架,包括时序卷积网络、图神经网络和分层图池化等关键组件。该框架首先通过时序卷积网络提取时序特征,然后通过引入图神经网络进行节点间信息传播,最后通过分层图池化获得异常检测结果。通过在公开可用的FOQA数据多类别异常检测数据集上进行大量实验证明,该方法相较于其他先进的方法表现更为优越。