基于DCA的数据融合方法研究

树突状细胞算法（Dendritic Cell Algorithm, DCA）是一种受固有免疫系统细胞启发所提出的人工免疫系统算法,通常用于入侵检测和异常检测。DCA在计算机网络、无线传感器网络、实时嵌入式系统和机器人等方面展开应用,取得较高的检测率,具有良好应用前景。本文提出了基于DCA的数据融合 (DCA based Data Fusion,DCADF) 模型,描述了模型的系统结构,给出了利用模型解决实际问题的一般过程,并将DCADF模型与数据融合系统一般模型进行比较,从系统结构和功能以及系统特性等方面比较了两种模型的共性和差别,分析了DCADF模型的特征,指出了DCADF模型的独特特性以及可能的使用场景。通过内网SYN Flood攻击主机检测实验对模型进行仿真验证,仿真结果表明DCADF模型具有可行性,为数据融合研究提供了一种新的方法和思路。      

基于Dempster-Shafer证据理论的端口扫描检测方法

端口扫描是通过对目标系统端口试探性的访问来判断端口是否开放的行为.它往往是攻击者入侵行为的第一步.端口扫描检测是入侵监测系统不可缺少的一部分,而当前端口扫描的检测方法不多,并且准确性不高.为提高扫描检测的准确性,本文使用Dempster-Shafer证据理论对两种扫描检测方法产生的数据进行融合:一种是基于端口分布特征的扫描检测方法,该方法简单且具有较高的检测率;另一种是基于序列假设测试的扫描检测方法,该方法充分利用了端口扫描的本质特征.实验结果表明,同单独使用基于端口分布特征或序列假设测试的方法相比,这种基于Dempster-Shafer证据理论的扫描检测方法对端口扫描的检测准确得多.     

基于数值微分的树突状细胞故障检测方法

针对现有树突状细胞算法（dendritic cell algorithm,DCA）在不同类型设备的故障检测中严重依赖人工经验定义输入信号,缺乏适应性和完备性,提出了一种基于数值微分的树突状细胞故障检测模型——NDDC-FD.首先,引入变化是系统危险发生的征兆和外在表现的思想,提出了一种基于变化危险感知的信号自适应提取方法,采用数值微分描述数据的变化,再从变化中提取输入信号.其次,原DC模型中异常抗原的评价方式对突变性故障能有效检测,却无法及时发现渐变性故障,提出了采用T细胞浓度作为故障评价指标.最后,在DAMADICS和TE两个基准平台上,将本文方法与原DCA算法和传统主元分析法（principal component analysis,PCA）进行比较测试.实验结果表明NDDC-FD方法不仅提高了原DCA算法的适应性,且和DCA、PCA相比具有较高检测率的同时,更能较早地检测到渐变性故障.因此,本文提出的故障检测方法NDDC-FD具有一般性,且性能良好.     

Impact of Packet Sampling on Portscan Detection

Packet sampling is commonly deployed in high-speed backbone routers to minimize resources used for network monitoring. It is known that packet sampling distorts traffic statistics and its impact has been extensively studied for traffic engineering metrics such as flow size and mean rate. However, it is unclear how packet sampling impacts anomaly detection, which has become increasingly critical to network providers. This paper is the first attempt to address this question by focusing on one common class of nonvolume-based anomalies, portscans, which are associated with worm/virus propagation. Existing portscan detection algorithms fall into two general approaches: target-specific and traffic profiling. We evaluated representative algorithms for each class, namely: 1) TRWSYN that performs stateful traffic analysis; 2) TAPS that tracks connection pattern of scanners; and 3) entropy-based traffic profiling. We applied these algorithms to detect portscans in both the original and sampled packet traces from a Tier-1 provider's backbone network. Our results demonstrate that sampling introduces fundamental bias that degrades the effectiveness of these detection algorithms and dramatically increases false positives. Through both experiments and analysis, we identify the traffic features critical for anomaly detection that are affected by sampling. Finally, using insight gained from this study, we show how portscan algorithms can be enhanced to be more robust to sampling     

Location-based QoS enhanced dynamic carrier allocation over multi-cell environments

It is well known that high multi-user and multi-carrier diversity gains can be achieved via the use of DCA (Dynamic Channel Allocation). However, there is no framework for analyzing the system performance of DCA algorithms over multi-cell environments. This paper presents a numerical analysis for measuring the performance gain for various DCA algorithms. Based on the analysis, an LQE (Location-based QoS Enhanced) DCA algorithm is proposed, in which a higher priority is assigned to users in the outer region for fairness by exploiting multi-carrier diversity. In the inner region, each carrier is allocated to a user with the best channel gain for higher throughput by exploiting multi-user diversity. In the simulation, we demonstrate that the proposed DCA algorithm is very effective from the perspective of fairness and throughput.     

第三代移动通信系统的容量分析

介绍一种提供数据业务的慢速DCA算法,分析该算法的模型,最后通过对模型的求解得到了系统的容量。流容量由系统所能够提供的最大数据速率(集合数据速率ADR)来定义。     

面向入侵检测的集成人工免疫系统

结合入侵检测的实际需求,提出了一种集成人工免疫系统(IAIS)。该系统结合了树突状细胞算法(DCA)和否定选择算法(NSA),DCA用于检测行为特征,NSA用于检测结构特征。通过KDD99数据集实验对该系统进行验证,并与其他方法进行了比较。实验结果表明,IAIS检测性能与经典分类算法相当。IAIS具有不依赖明确标识的数据来训练检测器,可结合行为特征和结构特征进行实时入侵检测的特点。     

Delay-based congestion avoidance for TCP

The set of TCP congestion control algorithms associated with TCP-Reno (e.g., slow-start and congestion avoidance) have been crucial to ensuring the stability of the Internet. Algorithms such as TCP-NewReno (which has been deployed) and TCP-Vegas (which has not been deployed) represent incrementally deployable enhancements to TCP as they have been shown to improve a TCP connection's throughput without degrading performance to competing flows. Our research focuses on delay-based congestion avoidance algorithms (DCA), like TCP-Vegas, which attempt to utilize the congestion information contained in packet round-trip time (RTT) samples. Through measurement and simulation, we show evidence suggesting that a single deployment of DCA (i.e., a TCP connection enhanced with a DCA algorithm) is not a viable enhancement to TCP over high-speed paths. We define several performance metrics that quantify the level of correlation between packet loss and RTT. Based on our measurement analysis, we find that, although there is useful congestion information contained within RTT samples, the level of correlation between an increase in RTT and packet loss is not strong enough to allow a TCP-sender to improve throughput reliably. While DCA is able to reduce the packet loss rate experienced by a connection, in its attempts to avoid packet loss, the algorithm reacts unnecessarily to RTT variation that is not associated with packet loss. The result is degraded throughput as compared to a similar flow that does not support DCA.     

Effective adaptive transmit power allocation algorithm considering dynamic channel allocation in reuse partitioning-based OFDMA system

This paper introduces an transmit power allocation (TPA) algorithm considering dynamic channel allocation (DCA) for a reuse-partitioning- based Orthogonal frequency division multiple access (OFDMA)/FDD cellular system. The proposed reuse partitioning-based DCA algorithm guarantees quality of service (QoS) by considering fairness among mobile stations in an OFDMA/FDD system. However, to improve the SINR values for users around the cell edge and increase the overall system throughput compared with the conventional OFDMA/FDD system of frequency reuse factor (FRF) 1, an effective TPA algorithm is also combined with the proposed DCA to adjust the transmit power per user according to the average received SINR value. Simulation results show that the proposed DCA algorithm increases the sector throughput by about 25% when compared with the conventional case that do not apply the proposed DCA algorithm. When the proposed TPA is combined with the proposed DCA algorithm, a further increase in the sector throughput of about 6% is achieved than when using just the proposed DCA algorithm.     

Performance of autonomous dynamic channel assignment and powercontrol for TDMA/FDMA wireless access

We combine autonomous algorithms for dynamic channel assignment (DCA) and power control in a TDMA/FDMA wireless system as a medium access control (MAC) protocol. The DCA algorithm determines paired radio channels that experience the least interference and are least likely to cause interference. The power control algorithm uses local estimations of signal to interference ratio (SIR) at a receiver to iteratively command power adjustment on the desired transmitter. A common control frequency, which is frame-synchronized among base stations, provides all necessary information for DCA without blind slots. Computer simulations are used to evaluate system performance. Results from computer simulations demonstrate good spectrum efficiency and robustness. Although studied under a specific set of parameters, this type of MAC protocol can be applied in different wireless communications environments