基于无监督学习的智能电网入侵检测

智能电网通过引入信息和通信技术服务, 带来了传统电网的技术演变, 与此同时在安全方面也带来了严重的挑战. 本文提出了一种智能电网入侵检测系统安全架构和一种基于无监督学习的新型入侵检测系统(intrusion detection system, IDS). 我们设计了区域式训练(block-training)架构, 不仅可以减轻数据中心的计算压力, 还可以对本地流量进行特征训练. 我们还提出了一种基于交叉验证的递归特征消除的差分自编码器算法(RFECV-VAE). RFECV-VAE综合了RFECV和VAE模型, 在特征选择过程使用递归特征消除交叉验证法(recursive feature elimination cross-validation, RFECV), 异常检测采用差分自编码器(variational autoencoders, VAE), 它可以对大规模高维数据进行高精度异常检测. 最后, 本文选择深度自编码器、深度自编码器高斯混合模型、单类支持向量机、隔离森林、差分自编码器作为对比算法, 采用准确率、ROC_AUC、F1_score和训练时间等指标来进行性能评估. 实验结果表明, RFECV-VAE算法结果优于其他比较算法.     

基于EKM-AE模型的无监督主机入侵检测方法

针对深度学习方法运用于入侵检测时需要大量标注数据集和难以实时检测的缺陷,利用网络流量中正常数据多于异常数据的一般规律,提出一种结合集成K-means聚类和自编码器的EKM-AE(ensemble K-means and autoencoder)入侵检测方法.首先通过集成K-means聚类从实时抓取的网络流量中得出正常样例,用于训练自编码器,然后由完成训练的自编码器执行入侵检测.在虚拟局域网主机环境下进行了入侵检测实验,结果表明,在绝大多数实际应用场景(正常流量多于异常流量)下该方法具有良好的检测性能,且具有全过程无监督、可实时在线检测的优点,对主机网络安全有良好的提升作用.     

代价约束算法对入侵检测特征提取的优化研究

入侵检测系统的防御性能经常受到类不平衡数据的影响,为了自动提取稀缺类别的数据特征,提高入侵检测系统识别未知网络攻击的精度,提出一种代价约束算法.首先,基于栈式自动编码器构建深度神经网络,在隐藏层的神经元上添加稀疏约束;其次,通过生成代价矩阵优化代价目标函数,对类不平衡数据特征分配代价;最后,利用反向传播微调神经网络模型...     

基于自编码器的网络异常检测研究综述

网络入侵检测技术是指对危害计算机系统安全的行为进行检测的方法,它是计算机网络安全领域中的必不可少的防御机制。目前,基于有监督学习的网络异常入侵检测技术具有较高的效率和准确率,该类方法获得了广泛关注,取得了大量的研究成果。但是这类方法需要借助大量标注样本进行模型训练。为减少对标注样本依赖,基于无监督学习或半监督学习的网络入侵检测技术被提出,并逐渐成为该领域的研究热点。其中,基于自编码器的网络异常检测技术是这方面技术的典型代表。该文首先介绍了各类自编码器的基本原理、模型结构、损失函数和训练方法。然后在此基础上将其分为基于阈值和基于分类的方法。其中,基于阈值的方法用又可分为基于重构误差和基于重构概率两类。合适的阈值对异常检测技术的成败至关重要,该文介绍了三种阈值的计算方法。接着对比分析了多个代表性研究工作的方法、性能及创新点,最后对该研究中存在的问题做了介绍,并对未来的研究方向做了展望。     

Detecting structural anomalies of quadcopter UAVs based on LSTM autoencoder

Detecting a structural anomaly, such as a damaged propeller or motor, is crucial for mission-critical operation of unmanned aerial vehicles (UAVs). The existing solutions often fail to detect structural anomalies because the pre-defined parameters required for the solution are limited in reflecting the flight pattern or the external environment, such as wind conditions. In this paper, we propose a method for detecting structural anomalies in quadcopter UAVs, using only regular data and specifically considering flight patterns and runtime flight conditions. To this end, we employ a long short-term memory (LSTM) autoencoder model to learn complex features of regular flight data. While flying the UAV, the trained model estimates the degree of outlierness of the incoming data and assesses abnormal behavior of UAV by adaptively considering its movement. This way, the proposed method accurately detects structural anomalies in UAVs regardless of the runtime environment or flight mission. Our experiment results with an off-the-shelf UAV show that the proposed approach detects diverse structural anomalies by an average of 98.6% specificity and 90.3% sensitivity.     

基于混合变分自编码器回归模型的软测量建模方法EI北大核心CSCD

近年来,变分自编码器(Variational auto-encoder,VAE)模型由于在概率数据描述和特征提取能力等方面的优越性,受到了学术界和工业界的广泛关注,并被引入到工业过程监测、诊断和软测量建模等应用中.然而,传统基于VAE的软测量方法使用高斯分布作为潜在变量的分布,限制了其对复杂工业过程数据,尤其是多模态数据的建模能力.为了解决这一问题,本论文提出了一种混合变分自编码器回归模型(Mixture variational autoencoder regression,MVAER),并将其应用于复杂多模态工业过程的软测量建模.具体来说,该方法采用高斯混合模型来描述VAE的潜在变量分布,通过非线性映射将复杂多模态数据映射到潜在空间,学习各模态下的潜在变量,获取原始数据的有效特征表示.同时,建立潜在特征表示与关键质量变量之间的回归模型,实现软测量应用.通过一个数值例子和一个实际工业案例,对所提模型的性能进行了评估,验证了该模型的有效性和优越性.     

基于深度自动编码器的托攻击集成检测方法

在采用协同过滤技术的推荐系统中,恶意用户通过注入大量虚假概貌使系统的推荐结果产生偏离,达到其攻击目的。为了检测托攻击,根据用户的评分值或基于攻击时间的集中性假设,从不同视角提取攻击概貌的特征。但是,这些基于人工特征的检测方法严重依赖于特征工程的质量,而且人工提取的检测特征多限于特定类型的攻击,提取特征也需要较高的知识成本。针对这些问题,从用户评分项目的时间偏好信息入手,提出一种利用深度稀疏自动编码器自动提取检测特征的托攻击集成检测方法。利用小波变换将项目在不同时间间隔内的流行度设定为多个等级,对用户的评分数据预处理得到用户-项目时间流行度等级矩阵。然后,采用深度稀疏自动编码器对用户-项目时间流行度等级矩阵自动进行特征提取,得到用户评分模式的低层特征表达,消除了传统的人工特征工程。以SVM作为基分类器,在深度稀疏自动编码器的每层提取特征并进行攻击检测,生成最终的集成检测结果。在Netflix数据集上的实验表明,提出的检测方法对均值攻击、AoP攻击、偏移攻击、高级项目攻击、高级用户攻击具有较好的检测效果。     

基于改进的稀疏去噪自编码器的入侵检测

针对传统浅层的入侵检测方法无法有效解决高维网络入侵数据的问题,提出了一种基于堆叠稀疏去噪自编码器（SSDA）的入侵检测方法。首先,利用SSDA对入侵数据进行降维操作;然后,将高度抽象后的低维数据作为输入,利用softmax分类器进行入侵检测;最后,又在SSDA方法的基础之上提出了一种改进模型（ISSDA）,即在传统稀疏去噪自编码器的基础上增加新的约束条件,以此来提高深度网络对原始入侵数据的解码能力以及模型的入侵检测性能。实验结果证明,ISSDA方法与SSDA方法相比,对4种类型的攻击的检测准确率提高了将近5%,也有效地降低了误报率。     

基于改进双重深度Q网络的入侵检测模型

入侵检测技术作为网络安全有效的防御手段,是网络安全体系中的重要组成部分。随着互联网的快速发展,网络数据量快速增加,网络攻击更加趋于复杂化和多元化,目前主流的入侵检测技术无法有效识别各种攻击。针对实际网络环境中正常流量和攻击流量数据不平衡,且对攻击类流量检测率低的问题,基于深度强化学习提出一种基于改进双重深度Q网络的CBL_DDQN网络入侵检测模型。该模型将一维卷积神经网络和双向长短期记忆网络的混合网络模型引入深度强化学习的DDQN框架,并使用深度强化学习中的反馈学习和策略生成机制训练智能体来对不同类别的攻击样本进行分类,在一定程度上减弱了训练模型过程中对数据标签的依赖性。采用Borderline-SMOTE算法降低数据的不平衡度,从而提高稀有攻击的检测率。通过NSL_KDD和UNSW_NB15数据集对模型的性能进行评估,结果表明：该模型在准确率、精确率、召回率这三项指标上均取得了良好的结果,检测效果远优于Adam-BNDNN、KNN、SVM等检测方法,是一种高效的网络入侵检测模型。     

面向推荐系统中有偏和无偏一元反馈建模的三任务变分自编码器

一元反馈建模在推荐系统中的应用非常广泛,例如点击预测和购买预测等。然而,推荐系统作为一个闭环的反馈系统,在用户与系统的交互过程中可能存在着多种偏置问题,例如位置偏置、流行偏置等,进而导致用户的反馈数据存在有偏性。现有的大部分推荐模型都只基于这样的有偏数据进行构建,忽略了偏置的影响,进而导致推荐结果是次优的。目前已有的偏置消除方法大致可以分为基于反事实学习的方法、基于启发式的方法和基于无偏数据增强的方法。其中,基于无偏数据增强的方法通常被认为在稳定性和准确性方面表现较好。
本文重点研究了推荐系统中一元反馈的偏置问题,通过引入由一种特定策略收集的无偏数据,结合有偏数据进行联合建模,从而得到更准确和无偏的推荐模型。具体而言,本文从多任务学习的角度对问题进行建模,将有偏数据、无偏数据以及它们的并集当作三种相互关联的信号,并设计了三个不同但相关的学习任务。变分自编码器是目前最先进的一元反馈建模方法之一,有着独特的建模方式,从而使得它在很多问题中取得了优越的推荐效果。本文基于变分自编码器提出了一种新的推荐模型,即三任务变分自编码器（Tri-VAE）。该模型包含三个变分自编码器,分别对三种信号进行重构。三个变分自编码器之间共享同一个编码器和同一个解码器。此外,本文还设计了特征校正模块和标签增强模块以加强任务之间的关联。其中,特征校正模块用来校正用户的潜在特征,得到更无偏的潜在特征,进而从潜在特征的角度缓解偏置的影响。标签增强模块用于生成可靠性较高的伪标签并加以利用,进而更有效地利用无偏数据中的信息。
在Yahoo!R3和Coat Shopping两个公开数据集上的实验结果表明,所提出的模型相比于目前最新的基线模型在绝大多数情况下取得了显著的效果提升。为了进一步研究所提出的模型,本文进行了消融实验、超参数敏感性分析和收敛性分析,还对特征校正模块的有效性进行了探讨。     

Towards physical interaction-based sequential mobility assistance using latent generative model of movement state

ABSTRACT

In this paper, we address sequential mobility assistance for daily elderly care through physical human–robot interaction. The goal of this work is to develop a robotic assistive system to provide physical support in daily life such as movement transition, e.g. sit-to-stand and walking. Using a mobile human support robotic platform, we propose an unsupervised learning-based approach to providing desirable physical support through an adaptive impedance parameter selection strategy according to the recognized user's movement state in an online manner. Using a latent generative model with a long short-term memory-based variational autoencoder, we first estimate the probability of the user's current movement state based on the sensory information in a low dimensional latent space. Then, the desired impedance parameters are selected adaptively according to the estimated movement state. One of the benefits of such an unsupervised learning approach is that no labeling is necessary in the training phase. Furthermore, our proposed framework is capable of detecting possible novel states such as falling over based on the obtained latent space. In order to demonstrate the proof of concept of our proposed approach, we present the experimental results of performance evaluations of online movement state recognition as well as novel movement detection.     

面向异质变分超图自动编码器的超边链接预测模型

如何采用超边建模网络数据中的多元关联关系,实现潜在超边链接关系的预测具有重要的现实意义。现有方法主要集中于研究具有成对关系的网络数据,然而,直接将现有的链接预测方法用于超图网络中的超边链接预测具有一定的局限性。因此,提出基于异质变分超图自动编码器的超边链接预测模型(heterogeneous variational hypergraph autoencoder,HVGAE)。首先,利用超图卷积实现变分超图自动编码器,将超图网络数据转换成一种低维空间表示;其次,加入节点近邻度函数,最大程度地保留其结构信息,从而构建异质超图网络超边链接预测模型。针对三种不同类型的超图网络进行实验,结果表明相比其他的基准方法,HVGAE模型获得了较好的预测结果,说明其能够较好地解决超图网络中的超边链接预测问题。     

A Lightweight Deep Autoencoder Scheme for Cyberattack Detection in the Internet of Things

The Internet of things (IoT) is an emerging paradigm that integrates devices and services to collect real-time data from surroundings and process the information at a very high speed to make a decision. Despite several advantages, the resource-constrained and heterogeneous nature of IoT networks makes them a favorite target for cybercriminals. A single successful attempt of network intrusion can compromise the complete IoT network which can lead to unauthorized access to the valuable information of consumers and industries. To overcome the security challenges of IoT networks, this article proposes a lightweight deep autoencoder (DAE) based cyberattack detection framework. The proposed approach learns the normal and anomalous data patterns to identify the various types of network intrusions. The most significant feature of the proposed technique is its lower complexity which is attained by reducing the number of operations. To optimally train the proposed DAE, a range of hyperparameters was determined through extensive experiments that ensure higher attack detection accuracy. The efficacy of the suggested framework is evaluated via two standard and open-source datasets. The proposed DAE achieved the accuracies of 98.86%, and 98.26% for NSL-KDD, 99.32%, and 98.79% for the UNSW-NB15 dataset in binary class and multi-class scenarios. The performance of the suggested attack detection framework is also compared with several state-of-the-art intrusion detection schemes. Experimental outcomes proved the promising performance of the proposed scheme for cyberattack detection in IoT networks.     

基于频域特征变分自编码器的轴承故障诊断研究

针对深度学习故障诊断模型泛化能力差、网络复杂的问题,提出一种通用的特征提取网络,在此基础上应用轴承故障诊断的方法。首次提出频域特征变分自编码器,增强了信号特征提取的鲁棒性。然后,采用局部异常因子算法剔除离群点,防止分类器过拟合,提高分类器泛化性能。最后,构建分类器进行故障诊断。实验验证表明在不同损伤程度下特征提取的界限清晰,故障分类效果好,并且模型表现出良好的可迁移性。     

基于双通道变分自编码器的高光谱图像分类

针对现有高光谱图像变分自编码器（variational autoencoder,VAE）分类算法存在空间和光谱特征利用效率低的问题,提出一种基于双通道变分自编码器的高光谱图像深度学习分类算法。通过构建一维条件变分自编码器（conditional variational autoencoder,CVAE）特征提取框架和二维循环通道条件变分自编码（channel-recurrent conditional variational autoencoders,CRCVAE）特征提取框架分别提取高光谱图像的光谱特征和空间特征,将光谱特征向量和空间特征向量叠加形成空谱联合特征向量,将联合特征送入Softmax分类器中进行分类。在Indian pines和Pavia University两种高光谱数据集上进行了分析验证,实验结果显示,与其他算法相比,提出的算法在总分类精度、平均分类精度和Kappa系数等评价指标上至少提高了3.40、2.75和3.57个百分点,结果显示提出的算法得到了最高的分类精度和更好的可视化效果。     

基于深度学习的网络流时空特征自动提取方法

流量异常检测是网络入侵检测的主要途径之一,也是网络安全领域的一个热门研究方向。通过对网络流量进行实时监控,可及时有效地对网络异常进行预警。目前,网络流量异常检测方法主要分为基于规则和基于特征工程的方法,但现有方法需针对网络流量特征的变化需重新人工收集规则或 构造特征,工作量大且繁杂。为解决上述问题,该文提出一种基于卷积神经网络和循环神经网络的深度学习方法来自动提取网络流量的时空特征,可同时提取不同数据包之间的时序特征和同一数据包内字节流的空间特征,并减少了大量的人工工作。在 MAWILab 网络轨迹数据集上进行的验证分析结果表明,该文所提出的网络流时空特征提取方法优于已有的深度表示学习方法。     

基于外观和动作特征双预测模型的视频异常行为检测

为了在视频异常行为检测中更加充分地运用外观和动作信息,设计出了一种能同时捕捉外观和动作信息的孪生网络模型。该网络的两个分支采用相同的自编码器结构,其中的外观子网络以连续几帧RGB图作为输入来预测下一帧,而动作子网络则输入RGB帧差图来预测未来帧差图。此外,考虑到影响基于预测的方法的检测效果的原因之一,即正常样本的多样性以及自编码器网络强大的“生成”能力,即对部分异常样本也有很好的预测效果,因此在编码器与解码器之间加入一个学习并存储正常样本的“原型”特征的记忆增强模块,从而使异常样本能获得更大的预测误差。在Avenue、UCSD-ped2和ShanghaiTech三个公共的异常数据集上进行了广泛的实验。实验结果表明,相较于其他基于重建或预测的视频异常行为检测方法,所提方法取得了更优异的表现。具体来说,该方法在Avenue、UCSD-ped2和ShanghaiTech数据集上的平均曲线下面积（AUC）分别达到了88.2%、97.5%和73.0%。     

Detection of Abnormal Network Traffic Using Bidirectional Long Short-Term Memory

Nowadays, web systems and servers are constantly at great risk from cyberattacks. This paper proposes a novel approach to detecting abnormal network traffic using a bidirectional long short-term memory (LSTM) network in combination with the ensemble learning technique. First, the binary classification module was used to detect the current abnormal flow. Then, the abnormal flows were fed into the multilayer classification module to identify the specific type of flow. In this research, a deep learning bidirectional LSTM model, in combination with the convolutional neural network and attention technique, was deployed to identify a specific attack. To solve the real-time intrusion-detecting problem, a stacking ensemble-learning model was deployed to detect abnormal intrusion before being transferred to the attack classification module. The class-weight technique was applied to overcome the data imbalance between the attack layers. The results showed that our approach gained good performance and the F1 accuracy on the CICIDS2017 data set reached 99.97%, which is higher than the results obtained in other research.     

Unsupervised Electric Motor Fault Detection by Using Deep Autoencoders

Fault diagnosis of electric motors is a fundamental task for production line testing, and it is usually performed by experienced human operators. In the recent years, several methods have been proposed in the literature for detecting faults automatically. Deep neural networks have been successfully employed for this task, but, up to the authors' knowledge, they have never been used in an unsupervised scenario. This paper proposes an unsupervised method for diagnosing faults of electric motors by using a novelty detection approach based on deep autoencoders. In the proposed method, vibration signals are acquired by using accelerometers and processed to extract Log-Mel coefficients as features. Autoencoders are trained by using normal data only, i.e., data that do not contain faults. Three different autoencoders architectures have been evaluated: the multi-layer perceptron (MLP) autoencoder, the convolutional neural network autoencoder, and the recurrent autoencoder composed of long short-term memory (LSTM) units. The experiments have been conducted by using a dataset created by the authors, and the proposed approaches have been compared to the one-class support vector machine (OC-SVM) algorithm. The performance has been evaluated in terms area under curve (AUC) of the receiver operating characteristic curve, and the results showed that all the autoencoder-based approaches outperform the OC-SVM algorithm. Moreover, the MLP autoencoder is the most performing architecture, achieving an AUC equal to 99.11%      

Multi-Modal Domain Adaptation Variational Autoencoder for EEG-Based Emotion Recognition

Traditional electroencephalograph (EEG)-based emotion recognition requires a large number of calibration samples to build a model for a specific subject, which restricts the application of the affective brain computer interface (BCI) in practice. We attempt to use the multi-modal data from the past session to realize emotion recognition in the case of a small amount of calibration samples. To solve this problem, we propose a multi-modal domain adaptive variational autoencoder (MMDA-VAE) method, which learns shared cross-domain latent representations of the multi-modal data. Our method builds a multi-modal variational autoencoder (MVAE) to project the data of multiple modalities into a common space. Through adversarial learning and cycle-consistency regularization, our method can reduce the distribution difference of each domain on the shared latent representation layer and realize the transfer of knowledge. Extensive experiments are conducted on two public datasets, SEED and SEED-IV, and the results show the superiority of our proposed method. Our work can effectively improve the performance of emotion recognition with a small amount of labelled multi-modal data.