Research of internet worm warning system based on system identification

In this paper, by analyzing the worm’s propagation model, we propose a new worm warning system based on the method of system identification, and use recursive least squares algorithm to estimate the worm’s infection rate. The simulation result shows the method we adopted is an efficient way to conduct Internet worm warning.     

Research of internet worm warning system

In this paper, by analyzing the worm’s propagation model, we propose a new worm warning system based on the method of system identification, and use recursive least squares algorithm to estimate the worm’s infection rate. The simulation result shows the method we adopted is an efficient way to conduct Internet worm warning.     

基于正交最小二乘法的小波网络在系统辨识中的应用

利用单尺度小液框架理论建立初始小波网络。首先，提出基于ROLS思想的小波网络正交化算法，实现参数的在线辩识。其次，提出一种基于0LS思想的小波网络结构辩识算法，删除那些所网络影响小的小波基，来解决高维辩识问题。最后，列举事例证明了所述方法的有效性。     

P2P worm detection based on application identification

P2P worm exploits common vulnerabilities and spreads through peer-to-peer networks. Despite being recognized as a potential and deadly threat to the Internet recently, few relevant countermeasures are found in extant literature. Once it breaks out, a P2P worm could result in unpredictable losses. Based on propagation characteristics of the worm, this paper presents a detection method called PWD (P2P Worm Detection), which is designed based on application identification and unknown worm detection. Simulation result and LAN-environment experiment result both indicate that PWD is an effective method to detect and block P2P worms. Translated from Journal of Beijing University of Aeronautics and Astronautics, 2006, 32(8): 998–1002 [译自: 北京航空航天大学学报]     

基于贝叶斯的网络蠕虫检测技术的研究

介绍了网络蠕虫的定义和工作机制,通过分析得到了网络蠕虫的共有特性.根据蠕虫的特性,提出了一个基于贝叶斯的网络蠕虫检测方法,采用贝叶斯公式来计算首次连接失败的概率,对于不能确定的情况,用后验概率更新先验概率.设计了一个基于贝叶斯的网络蠕虫检测系统的原型系统,详细描述了该系统的结构模型,并从功能角度上介绍了该系统的两个主要组成部分.     

基于良性蠕虫对抗P2P蠕虫的策略研究

随着P2P软件的推广与普及, P2P蠕虫已成为P2P网络安全的主要威胁之一,P2P蠕虫基于hit-list攻击邻居节点,具有隐蔽性好、攻击性强等特点。基于混合型良性蠕虫概念设计出自动优先趋进优质节点(APTHQN)的对抗策略,合理利用优质节点的拓扑优势,有效适应了P2P网络的动态性。实验仿真结果表明,采用此策略的良性蠕虫在保持较少的网络资源消耗同时,高效地抑制了P2P蠕虫的传播。     

Recursive identification of switched ARX systems

We consider the problem of recursively identifying the parameters of a deterministic discrete-time Switched Auto-Regressive eXogenous (SARX) model, under the assumption that the number of models, the model orders and the mode sequence are unknown. The key to our approach is to view the identification of multiple ARX models as the identification of a single, though more complex, lifted dynamical model built by applying a polynomial embedding to the input/output data. We show that the dynamics of this lifted model do not depend on the value of the discrete state or the switching mechanism, and are linear on the so-called hybrid model parameters. Therefore, one can identify the parameters of the lifted model using a standard recursive identifier applied to the embedded input/output data. The estimated hybrid model parameters are then used to build a polynomial whose derivatives at a regressor give an estimate of the parameters of the ARX model generating that regressor. The estimated ARX model parameters are shown to converge exponentially to their true values under a suitable persistence of excitation condition on a projection of the embedded input/output data. Such a condition is a natural generalization of the well known result for ARX models. Although our algorithm is designed for perfect input/output data, our experiments also evaluate its performance as a function of the level of noise for different choices of the number of models and model orders. We also present an application to temporal video segmentation.     

基于贪婪算法的蠕虫综合容忍预警方法

针对网络蠕虫准确预警的困难性,综合蠕虫传播的特点,提出一种基于贪婪算法的容忍预警方法,对一些危害较小的可疑蠕虫采取一定的容忍机制,设计一个特定报文的数据段结构,在服务器端通过对这类报文的统计分析,计算出是否要启动预警的阈值。通过实验仿真和理论分析,表明此方案具有一定的可行性。     

Recursive identification for multivariate autoregressive equation-error systems with autoregressive noise

This paper considers the recursive identification problems for a class of multivariate autoregressive equation-error systems with autoregressive noise. By decomposing the system into several regressive identification subsystems, a maximum likelihood recursive generalised least squares identification algorithm is proposed to identify the parameter vectors in each subsystem. In addition, a multivariate recursive generalised least squares algorithm is derived as a comparison. The numerical simulation results indicate that the maximum likelihood recursive generalised least squares algorithm can effectively estimate the parameters of the multivariate autoregressive equation-error autoregressive systems and get more accurate parameter estimates than the multivariate recursive generalised least squares algorithm.     

Convergence of the iterative algorithm for a general Hammerstein system identification

The convergence of the iterative identification algorithm for a general Hammerstein system has been an open problem for a long time. In this paper, it is shown that the convergence can be achieved by incorporating a regularization procedure on the nonlinearity in addition to a normalization step on the parameters.