P2P worm detection based on application identification

P2P worm exploits common vulnerabilities and spreads through peer-to-peer networks. Despite being recognized as a potential and deadly threat to the Internet recently, few relevant countermeasures are found in extant literature. Once it breaks out, a P2P worm could result in unpredictable losses. Based on propagation characteristics of the worm, this paper presents a detection method called PWD (P2P Worm Detection), which is designed based on application identification and unknown worm detection. Simulation result and LAN-environment experiment result both indicate that PWD is an effective method to detect and block P2P worms. Translated from Journal of Beijing University of Aeronautics and Astronautics, 2006, 32(8): 998–1002 [译自: 北京航空航天大学学报]     

基于贝叶斯的网络蠕虫检测技术的研究

介绍了网络蠕虫的定义和工作机制,通过分析得到了网络蠕虫的共有特性.根据蠕虫的特性,提出了一个基于贝叶斯的网络蠕虫检测方法,采用贝叶斯公式来计算首次连接失败的概率,对于不能确定的情况,用后验概率更新先验概率.设计了一个基于贝叶斯的网络蠕虫检测系统的原型系统,详细描述了该系统的结构模型,并从功能角度上介绍了该系统的两个主要组成部分.     

Recursive identification of switched ARX systems

We consider the problem of recursively identifying the parameters of a deterministic discrete-time Switched Auto-Regressive eXogenous (SARX) model, under the assumption that the number of models, the model orders and the mode sequence are unknown. The key to our approach is to view the identification of multiple ARX models as the identification of a single, though more complex, lifted dynamical model built by applying a polynomial embedding to the input/output data. We show that the dynamics of this lifted model do not depend on the value of the discrete state or the switching mechanism, and are linear on the so-called hybrid model parameters. Therefore, one can identify the parameters of the lifted model using a standard recursive identifier applied to the embedded input/output data. The estimated hybrid model parameters are then used to build a polynomial whose derivatives at a regressor give an estimate of the parameters of the ARX model generating that regressor. The estimated ARX model parameters are shown to converge exponentially to their true values under a suitable persistence of excitation condition on a projection of the embedded input/output data. Such a condition is a natural generalization of the well known result for ARX models. Although our algorithm is designed for perfect input/output data, our experiments also evaluate its performance as a function of the level of noise for different choices of the number of models and model orders. We also present an application to temporal video segmentation.     

Recursive identification for multivariate autoregressive equation-error systems with autoregressive noise

This paper considers the recursive identification problems for a class of multivariate autoregressive equation-error systems with autoregressive noise. By decomposing the system into several regressive identification subsystems, a maximum likelihood recursive generalised least squares identification algorithm is proposed to identify the parameter vectors in each subsystem. In addition, a multivariate recursive generalised least squares algorithm is derived as a comparison. The numerical simulation results indicate that the maximum likelihood recursive generalised least squares algorithm can effectively estimate the parameters of the multivariate autoregressive equation-error autoregressive systems and get more accurate parameter estimates than the multivariate recursive generalised least squares algorithm.     

Convergence of the iterative algorithm for a general Hammerstein system identification

The convergence of the iterative identification algorithm for a general Hammerstein system has been an open problem for a long time. In this paper, it is shown that the convergence can be achieved by incorporating a regularization procedure on the nonlinearity in addition to a normalization step on the parameters.     

面向对象的蠕虫仿真方法研究

本文首先分析了网络蠕虫的特征行为,从宏观和微观两个层次对蠕虫进行了研究,并指出借助仿真实验来研究蠕虫的方法的优势所在;然后通过对仿真环境的构造的分析和对仿真动力来源的介绍,详细阐述了蠕虫仿真的基本过程;最后给出面向对象的网络蠕虫仿真的基本思路与方法。     

Instability detection of ARMA systems based on AR system identification

The ability of parametric autoregressive (AR) system identification methods to detect the instability of an autoregressive moving average (ARMA) system of an unknown order is investigated. The collection of least squares AR estimators of various orders is shown to have the capacity to detect the instability of the underlying system. Necessary information is not the order of the system but, instead, an upper bound of the number of unstable poles with the maximal magnitude outside the unit circle.     

A new algorithm for recursive estimation of parameters in controlled ARMA processes

A recursive algorithm for estimating the constant but unknown parameters of a controlled ARMA process is presented. The algorithm is a recursive version of an off-line algorithm using three stages of standard least-squares. In the first stage the parameters of a controlled AR model of degree p are estimated. The residuals used in this stage are employed in the second stage to estimate the parameters of a controlled ARMA process. The first two stages constitute a recursive version of Durbin's algorithm. The model obtained in the second stage is used to filter the input, output and residuals and these filtered variables are used in the final stage to obtain improved estimates of the controlled ARMA process. It is shown that the estimate is (globally) p-consistent, i.e. that the estimate converges a.s. as the number of data tends to infinity, to a vector which, in turn, converges to the true parameter vector as the degree p of the AR model tends to infinity.