The self-organizing map

The self-organized map, an architecture suggested for artificial neural networks, is explained by presenting simulation experiments and practical applications. The self-organizing map has the property of effectively creating spatially organized internal representations of various features of input signals and their abstractions. One result of this is that the self-organization process can discover semantic relationships in sentences. Brain maps, semantic maps, and early work on competitive learning are reviewed. The self-organizing map algorithm (an algorithm which order responses spatially) is reviewed, focusing on best matching cell selection and adaptation of the weight vectors. Suggestions for applying the self-organizing map algorithm, demonstrations of the ordering process, and an example of hierarchical clustering of data are presented. Fine tuning the map by learning vector quantization is addressed. The use of self-organized maps in practical speech recognition and a simulation experiment on semantic mapping are discussed     

基于自组织映射神经网络的VANET组网算法

研究了应用于汽车辅助驾驶、无人驾驶等智能交通领域的车辆组网方法,提出一种将自组织映射神经网络算法应用于车辆自组织网络进行车辆组网的算法,该算法根据车辆定时发出的消息中位置、行驶方向等信息对车辆按目的地、行驶方向的相似性进行组网,组网后的车辆主要接收并处理与之在同一个网络中的车辆的信息。理论分析和仿真结果表明,组网后的系统传输时延远低于未组网通信情况,吞吐量有显著提高。     

基于KELM_AdaBoost的网络入侵检测

针对AdaBoost网络入侵检测方法存在正确率低和误判率高的缺点,将核极限学习机引入AdaBoost,提出一种基于KELM_AdaBoost的网络入侵检测模型。核极限学习机作为AdaBoost的弱分类器,通过迭代动态调整样本间权重,加权组合获得网络入侵检测的强分类器。以KDD CUP99数据集为研究对象,选择检测率和误判率为评价指标,与KELM、ELM和AdaBoost算法对比可知,KELM_AdaBoost可以有效提高网络入侵检测的准确率和降低误判率,其网络入侵检测率高达98.41%,为网络入侵检测提供新的方法和途径。     

Engineering applications of the self-organizing map

The self-organizing map (SOM) method is a new, powerful software tool for the visualization of high-dimensional data. It converts complex, nonlinear statistical relationships between high-dimensional data into simple geometric relationships on a low-dimensional display. As it thereby compresses information while preserving the most important topological and metric relationships of the primary data elements on the display, it may also be thought to produce some kind of abstractions. The term self-organizing map signifies a class of mappings defined by error-theoretic considerations. In practice they result in certain unsupervised, competitive learning processes, computed by simple-looking SOM algorithms. Many industries have found the SOM-based software tools useful. The most important property of the SOM, orderliness of the input-output mapping, can be utilized for many tasks: reduction of the amount of training data, speeding up learning nonlinear interpolation and extrapolation, generalization, and effective compression of information for its transmission     

Fault-tolerant self-organizing map implemented by wafer-scaleintegration

The self-organizing map (SOM) implemented by wafer-scale integration (WSI) will provide significantly high speed and desktop-size hardware for many practical applications such as pattern classification, image-processing, and robotics. Due to the synergistic effect of all neurons for ordering, the SOM-WSI is expected to reach the desired global-ordering state even in the presence of defective neurons. This fault tolerant capability, however, has not yet been studied. In this paper, we propose a fundamental SOM-WSI structure and its defect model. From the defect model, we derive a critical-stuck-output and show that if the defective neuron's stuck-output is larger than the critical-stuck-output, the defective SOM can eventually organize itself completely tolerating defects. In an ordinary digital design of a neuron, the critical-stuck-output is proved to be small. Therefore, we can expect high-fault tolerance in the SOM-WSI. Experiments are carried out by injecting defective neurons in a neurocomputer currently used as a prototype of the SOM-WSI. The experimental result agrees well with the proposed theory. In addition, we derive an equation to estimate the degree of fault-tolerance in the SOM hardware by expanding the critical-stuck-output calculation. The derived equation can be used to determine the fundamental design parameters in the SOM-WSI as well as other neurocomputer designs     

基于Dempster-Shafer理论的GHSOM入侵检测方法

结合证据推理DS理论,提出了基于Dempster-Shafer理论的GHSOM神经网络入侵检测方法,一方面处理数据不确定性中的随机性和模糊性问题,可以在噪音环境下保持良好的检测率,此外通过证据融合理论缩小数据集,有效控制网络的动态增长。实验结果表明,基于Dempster-Shafer理论的GHSOM入侵检测方法实现了对子网拓展规模在检测中的动态控制,提升了在网络规模不断扩展时的动态适应性,在噪音环境下具有良好的检测准确率,提升了GHSOM入侵检测方法的扩展性。     

基于LSTM的CAN总线入侵检测

提出结合CAN矩阵对报文数据场信号的具体定义提取特征,训练LSTM网络在多个时间步长上,对一些重要的信号进行预测,引入观测值得到预测误差矩阵.使用多元高斯分布对误差矩阵建立异常概率模型,根据误报率、漏报率调整阈值大小.得到完整模型后,模拟总线攻击,并实验验证了模型的精度.     

NETWORK INTRUSION DETECTION METHOD BASED ON RS-MSVM

A new method called RS-MSVM （Rough Set and Multi-class Support Vector Machine） is proposed for network intrusion detection. This method is based on rough set followed by MSVM for attribute reduction and classification respectively, The number of attributes of the network data used in this paper is reduced from 41 to 30 using rough set theory. The kernel function of HVDM-RBF （Heterogeneous Value Difference Metric Radial Basis Function）, based on the heterogeneous value difference metric of heterogeneous datasets, is constructed for the heterogeneous network data. HVDM-RBF and one-against-one method are applied to build MSVM. DARPA （Defense Advanced Research Projects Agency） intrusion detection evaluating data were used in the experiment. The testing results show that our method outperforms other methods mentioned in this paper on six aspects： detection accuracy, number of support vectors, false positive rate, falsc negative rate, training time and testing time.     

基于ARMA模型的CFAR网络入侵检测方法研究

提出了一种基于ARMA网络流量模型的CFAR入侵检测系统。采用ARMA模型对网络流量进行预测,并运用雷达信号处理中的恒误警CFAR技术,选取检测阀值以判定是否存在入侵信号。利用林肯实验室DARPA数据对系统进行试验,结果表明,此方法与AR预测模型相比,具有更高的检测率和更低的误警率。     

Integrated intrusion detection model based on artificial immune

The author puts forward an integrated intrusion detection （ID） model based on artificial immune （IIDAI）, a vaccination strategy based on the significance degree of genes and a method to generate initial memory antibodies with rough set （RS）. IIDAI integrates two kinds of intrusion detection mode： misuse detection and anonymous detection. Misuse detection and anonymous detection are applied to detect the known and the unknown attacks, respectively. On the basis of IIDAI model, an ID algorithm is presented. Simulation shows that the IIDAI has better performance than traditional ID methods in feasibility and effectiveness. It is very prone to achieve a higher convergence rate by using the vaccination strategy. Moreover, RS can remove the redundancy attributes and increase the detection speed. It can also increase detection rate by applying the integrated method.     

基于特征选择的网络入侵检测模型

入侵检测是保证网络安全的重要手段之一,针对当前网络入侵检测模型无法获得理想网络入侵检测效果的难题,设计了基于特征选择的网络入侵检测模型。首先对当前网络入侵检测研究现状进行分析,指出当前网络入侵检测模型存在的不足;然后采集网络状态信息,并提取网络原始特征;最后采用主成分分析选择主要特征,并引入极限学习机建立网络入侵检测的分类器,采用KDD CUP99数据集对模型进行分析,结果表明,所提方法大幅度改善了网络入侵检测率,网络入侵的误检率、漏检率低,网络入侵检测整体效果要显著优于当前其他网络入侵检测模型。     

基于计算机免疫的Multi-agent入侵检测系统

传统入侵检测系统的能力在迅猛发展的互联网面前日显薄弱。本文探讨了将计算机免疫技术、Multi—agent技术引入到传统入侵检测系统中，构建一个基于计算机免疫的Multi—agent入侵检测系统。该系统与传统系统相比具有灵活性、分布式、智能化等特点，能全面、深入的实现入侵的检测和防御。     

基于层次化的入侵检测模型研究

随着互联网络的广泛应用,网络信息量迅速增长,网络安全问题日趋突出,入侵检测已经成为网络安全的重要组成部分.针对传统的入侵检测模型所存在的已知系统漏洞或攻击方法的知识缺陷,分析了当前入侵检测系统所存在的诸多问题,提出了基于入侵检测策略的层次化入侵检测模型,该模型可以监视已知入侵和检测未知入侵,对网络入侵检测系统的设计有一定参考价值,对综合解决网络安全问题是一个有益的探索.     

一种基于相似度的DDoS攻击检测方法

在分析了网络流量构成的基础上,提出了基于相似度的DDoS检测方法。这种方法不是简单的根据流量的突变来检测网络状况,而是从分析攻击对流量分布的影响着手。首先对网络流量进行高频统计,然后对其相邻时刻进行相似度分析,根据相似度的变化来发现异常。从大量的实验结果可以看出基于相似度的检测方法能够比较有效的发现大流量背景下,攻击流量并没有引起整个网络流量显著变化的DDoS攻击,因此更适合大规模网络的异常检测。     

基于机器学习算法的网络入侵检测

网络入侵的频率越来越高,严重危害了网络安全。为了获得高正确率的网络入侵检测结果,针对当前网络入侵检测模型的局限性,提出基于机器学习算法的网络入侵检测模型,通过机器学习算法中性能优异的支持向量机构建"一对一"的网络入侵检测分类器,采用当前标准网络入侵检测数据库对模型的有效性进行验证,网络入侵检测正确率高达95%以上,检测误差远远低于实际应用范围,可以应用于实际的网络安全管理中。     

Flexible assembly work cooperating system based on work state identifications by a self-organizing map

This paper presents a method of realizing flexible assembly work cooperation where the assembler is free to carry out the work, without constraints in the process. To realize such systems, there exists an issue of identifying work states during the assembly and to determine when and what kind of support is necessary. As an approach to solve such issues we took a self-organizing approach in constructing a work model, as an abstract model describing typical work states during the assembly. The necessity of support is judged by detecting uncommon work states occurring, and the type of support is determined by detecting the work state. Examples of work state identifications by the self-organized map are shown. We carried out experiments to evaluate the judgment of situational necessity of support and to verify the correct identification rate of typical work states. Finally a robotic support system was constructed that gives supports of autonomously holding and handing out assembly pieces by the judging of situational necessity of support.     

Network intrusion detection

Intrusion detection is a new, retrofit approach for providing a sense of security in existing computers and data networks, while allowing them to operate in their current "open" mode. The goal of intrusion detection is to identify unauthorized use, misuse, and abuse of computer systems by both system insiders and external penetrators. The intrusion detection problem is becoming a challenging task due to the proliferation of heterogeneous computer networks since the increased connectivity of computer systems gives greater access to outsiders and makes it easier for intruders to avoid identification. Intrusion detection systems (IDSs) are based on the beliefs that an intruder's behavior will be noticeably different from that of a legitimate user and that many unauthorized actions are detectable. Typically, IDSs employ statistical anomaly and rulebased misuse models in order to detect intrusions. A number of prototype IDSs have been developed at several institutions, and some of them have also been deployed on an experimental basis in operational systems. In the present paper, several host-based and network-based IDSs are surveyed, and the characteristics of the corresponding systems are identified. The host-based systems employ the host operating system's audit trails as the main source of input to detect intrusive activity, while most of the network-based IDSs build their detection mechanism on monitored network traffic, and some employ host audit trails as well. An outline of a statistical anomaly detection algorithm employed in a typical IDS is also included     

基于移动代理的入侵检测系统模型的研究

阐述了基于移动代理的入侵检测系统的优势,提出了一个使用移动代理技术的入侵检测系统MAAFID。首先由数据收集代理(DCA)在网络中随机移动并收集信息,然后将收集到的信息传递给数据分析代理(DAA)来评估入侵发生的可能性。本文重点讨论了系统中数据收集代理的数目与检测出入侵发生的可能性二者之间的定量关系,最后还给出了一个仿真结果。