SCADA系统通信网中的高级持续性攻击检测方法

高级持续性攻击（advanced persistent threat,APT）作为一种新型攻击,已成为SCADA（supervisory control and data acquisition）系统安全面临的主要威胁,而现有的入侵检测技术无法有效应对这一类攻击,因此研究有效的APT检测模型具有重要的意义。提出了一种新的APT攻击检测方法,该方法在正常日志行为建模阶段改进了对行为模式的表示方式,采用多种长度不同的特征子串表示行为模式,通过基于序列模式支持度来建立正常日志行为轮廓;在充分考虑日志事件时序特征的基础上,针对APT攻击行为复杂多变的特点,提出了基于矩阵相似匹配和判决阈值联合的检测模型。通过对比研究,该检测方法表现出了良好的检测性能。     

面向智能监控的行为识别

目的 为了进一步提高智能监控场景下行为识别的准确率和时间效率,提出了一种基于YOLO（you only look once：unified,real-time object detection）并结合LSTM（long short-term memory）和CNN（convolutional neural network）的人体行为识别算法LC-YOLO（LSTM and CNN based on YOLO）。方法 利用YOLO目标检测的实时性,首先对监控视频中的特定行为进行即时检测,获取目标大小、位置等信息后进行深度特征提取;然后,去除图像中无关区域的噪声数据;最后,结合LSTM建模处理时间序列,对监控视频中的行为动作序列做出最终的行为判别。结果 在公开行为识别数据集KTH和MSR中的实验表明,各行为平均识别率达到了96.6%,平均识别速度达到215 ms,本文方法在智能监控的行为识别上具有较好效果。结论 提出了一种行为识别算法,实验结果表明算法有效提高了行为识别的实时性和准确率,在实时性要求较高和场景复杂的智能监控中有较好的适应性和广泛的应用前景。     

基于深度特征和Seq2Seq模型的网络态势预测方法

针对目前大多数的网络态势预测方法不能挖掘数据中的深度信息且需要手动提取与构造特征的问题,提出了深度特征网络态势预测方法DFS-Seq2Seq。首先将网络流、日志和系统事件等产生的数据进行清洗处理,使用深度特征融合算法自动合成深度关系特征,然后采用自动编码器对合成的特征进行提取,最后使用长短期记忆网络（LSTM）构建Seq2Seq模型对数据进行预测。通过设计缜密的实验在公开数据集Kent2016上对所提方法进行验证,结果显示在深度为2时与支持向量机（SVM）、贝叶斯、随机森林（RF）和LSTM这四种分类模型相比,其召回率分别提升了7.4%、11.5%、6.5%、3.0%。实验结果表明DFS-Seq2Seq可以在实际应用中有效地识别网络身份验证中的危险事件,对网络态势作出有效的预测。     

基于深度学习的融合流程多视角行为分析:预测业务流程监控

预测性业务流程监控（PBPM）是业务流程管理（BPM）中的一个重要研究领域,旨在准确预测未来的行为事件。目前,PBPM研究中广泛引用了深度学习方法,但大多数方法只考虑单一的事件-控制流视角,无法将属性-数据流视角与之结合进行流程预测。针对这一问题,提出了一种基于双层BERT神经网络和融合流程多视角行为分析方法（简称FMP框架）。首先,基于第一层BERT学习属性-数据流信息;接着,基于第二层BERT学习事件-行为控制流信息;最后,通过FMP框架融合数据流和控制流实现多维视角流程预测。在真实的事件日志中的实验结果表明,相比其他研究方法,基于FPM框架预测下一个事件的活动精度更高。这证明融合流程多视角的FMP框架能够更全面、更深层次地分析复杂的流程行为,并提高预测的性能。     

基于正弦级数拟合的行为识别方法

提出了一种基于正弦级数拟合的行为识别方法.该方法利用二值轮廓序列来表示给定的运动图像序列,按照时针顺序计算从轮廓质心到轮廓边界点的距离,将人体轮廓转化为距离曲线,并将这一距离曲线利用正弦级数进行拟合,将距离曲线转化为正弦参数,从而极大地减小了计算量,将行为识别过程转化为曲线参数特征匹配的过程.在特征匹配过程中,通过计算待预测行为与已知类别行为的特征级数距离,对待预测行为中的每一个动作进行分类,最后通过投票决定该行为所属类别.在包含90个不同运动类别的视频数据库上进行留一交叉验证,实验结果表明,提出的方法能够有效地进行人体行为识别.     

基于通讯行为轮廓挖掘条件非频繁行为的方法

条件非频繁行为是指带有属性值的频数较低事件轨迹所记录的行为。从记录的事件日志中挖掘条件非频繁行为是业务过程优化的主要内容之一。已有的方法删除低频次行为,较少考虑模块网间数据流角度下的条件非频繁行为。基于此,文中提出了基于通讯行为轮廓挖掘条件非频繁行为的方法。以模块网间的通讯行为轮廓理论为基础,首先,通过给定的业务过程源模型查找其可执行事件日志,并且找出频数较低的事件轨迹,添加相关属性及属性值,即可得到条件非频繁轨迹；其次,通过计算不同模块网间通讯特征的条件依赖数值,确定条件不频繁轨迹是否删除或保留,从而得到优化事件日志,进而挖掘出优化通讯模型；最后,通过仿真实验验证了该方法的可行性。     

基于矩阵画像的金融时序数据预测方法

针对金融市场中机构交易对股票市场中的散户投资行为具有较强的误导性的现象,提出了一种基于机构交易行为影响的趋势预测方法。首先,利用时间序列的矩阵画像（MP）方法,以股票换手率数据为切入点,构建不同兴趣模式长度下的基于机构交易行为影响的换手率波动知识库;其次,确定待预测股票在兴趣模式长度取何值时的预测结果精确度高;最后,根据该兴趣模式长度下的知识库,预测在机构交易行为影响下的单支股票的波动趋势。为验证趋势预测新方法的可行性和准确性,将其与自回归滑动平均（ARMA）模型和长短时记忆（LSTM）网络这两种预测方法进行对比分析,运用均方根误差（RMSE）与平均绝对百分误差（MAPE）评价指标综合比较3种方法对70支股票的预测结果。实验结果分析表明,与ARMA模型和LSTM网络相比,在70支的股票价格趋势预测上,所提方法有80%以上的股票预测结果更准确。     

基于CNN和LSTM混合模型的人体跌倒行为研究

目前深度学习模型不能较好地把监控视频中跌倒行为的空间和时序特征有效结合起来。为此,提出基于CNN（convolutional neural network）和LSTM（long-short term memory）混合模型的人体跌倒行为识别方法。该模型采用两层结构,将视频以每5帧为一组输入到网络中,CNN提取视频序列的空间特征,LSTM提取视频时间维度上的特征,最后使用softmax分类器进行识别。实验表明,该方法可以有效提高跌倒识别的准确率。     

基于BERT的多视角事件日志修复

在业务流程执行过程中,由于信息系统故障或者人工记录出错等问题导致事件日志中数据的丢失,从而产生缺失的事件日志,使用这种缺失日志会严重影响业务流程分析结果的质量。针对这种缺失日志的修复问题,现有的研究大部分仅从数据视角或者行为视角进行展开,很少从数据和行为相融合的视角开展事件日志的修复工作。提出了一种基于BERT模型的多视角事件日志修复方法。该方法利用双层BERT模型,从数据和行为融合的视角训练模型,通过BERT模型的预训练任务（masked attribute model,MAM）和（masked event model,MEM）以及Transformer编码块的注意力机制,捕获输入属性的双向语义信息和长期依赖关系,使用微调策略进行模型训练,以预测的形式修复事件日志中的缺失值。最后,通过公开可用的数据集进行评估分析,结果表明,该方法在修复事件日志方面表现良好。     

一种基于 Transformer 的三维人体姿态估计方法

三维人体姿态估计是人类行为理解的基础,但是预测出合理的三维人体姿态序列仍然是具有挑 战性的问题。为了解决这个问题,提出一种基于 Transformer 的三维人体姿态估计方法,利用多层长短期记忆 (LSTM)单元和多尺度 Transformer 结构增强人体姿态序列预测的准确性。首先,设计基于时间序列的生成器, 通过 ResNet 预训练神经网络提取图像特征;其次,采用多层 LSTM 单元学习时间连续性的图像序列中人体姿 态之间的关系,输出合理的 SMPL 人体参数模型序列;最后,构建基于多尺度 Transformer 的判别器,利用多 尺度 Transformer 结构对多个分割粒度进行细节特征学习,尤其是 Transformer block 对相对位置进行编码增强 局部特征学习能力。实验结果表明,该方法相对于 VIBE 方法具有更好地预测精度,在 3DPW 数据集上比 VIBE 的平均(每)关节位置误差(MPJPE)低了 7.5%;在 MP-INF-3DHP 数据集上比 VIBE 的 MPJPE 降低了 1.8%。      

一种预测流程剩余时间的可解释特征分层方法

流程剩余时间预测对于业务异常的预防和干预有着重要的价值和意义.现有的剩余时间预测方法通过深度学习技术达到了更高的准确率,然而大多数深度模型结构复杂难以解释预测结果,即不可解释问题.此外,剩余时间预测除了活动这一关键属性还会根据领域知识选择若干其他属性作为预测模型的输入特征,缺少通用的特征选择方法,对于预测的准确率和模型的可解释性存在一定的影响.针对上述问题,提出基于可解释特征分层模型(explainable feature-based hierarchical model,EFH model)的流程剩余时间预测框架.具体而言,首先提出特征自选择策略,通过基于优先级的后向特征删除和基于特征重要性值的前向特征选择,得到对预测任务具有积极影响的属性作为模型输入.然后提出可解释特征分层模型架构,通过逐层加入不同特征得到每层的预测结果,解释特征值与预测结果的内在联系.采用LightGBM (light gradient boosting machine)和LSTM (long short-term memory)算法实例化所提方法,框架是通用的,不限于选用算法.最后在8个真实事件日志上与最新方法进行比较.实验结果表明所提方法能够选取出有效特征,提高预测的准确率,并解释预测结果.     

Workflow simulation for operational decision support using event graph through process mining

It is increasingly common to see computer-based simulation being used as a vehicle to model and analyze business processes in relation to process management and improvement. While there are a number of business process management (BPM) and business process simulation (BPS) methodologies, approaches and tools available, it is more desirable to have a systemic BPS approach for operational decision support, from constructing process models based on historical data to simulating processes for typical and common problems. In this paper, we have proposed a generic approach of BPS for operational decision support which includes business processes modeling and workflow simulation with the models generated. Processes are modeled with event graphs through process mining from workflow logs that have integrated comprehensive information about the control-flow, data and resource aspects of a business process. A case study of a credit card application is presented to illustrate the steps involved in constructing an event graph. The evaluation detail is also given in terms of precision, generalization and robustness. Based on the event graph model constructed, we simulate the process under different scenarios and analyze the simulation logs for three generic problems in the case study: 1) suitable resource allocation plan for different case arrival rates; 2) teamwork performance under different case arrival rates; and 3) evaluation and prediction for personal performances. Our experimental results show that the proposed approach is able to model business processes using event graphs and simulate the processes for common operational decision support which collectively play an important role in process management and improvement.     

基于相邻事件概率统计的流程挖掘方法

为了提高流程挖掘的准确性和抗噪性,针对目前流程挖掘的基本结构有限、抗噪能力弱、计算耗时长等问题,提出了一种基于相邻事件概率统计的流程挖掘方法。该方法基于挖掘规则,仅需做一次日志遍历和矩阵的简单运算,就可生成挖掘的流程模型。与α算法和启发式算法的实验验证结果表明,该算法不仅能够挖掘顺序、选择、并行、短循环、递归等流程基本结构,而且具有计算复杂度低、抗噪能力强等优势。     

From knowledge-driven to data-driven inter-case feature encoding in predictive process monitoring

Predictive process monitoring (PPM) is a research area that focuses on predicting measures of interest (e.g., the completion time) for running cases based on event logs. State-of-the-art PPM techniques only consider intra-case information that comes from the case whose measures of interest one wishes to predict. However, in many systems, the outcome of a running case depends on the interplay of all cases that are being executed concurrently, or can be derived from the characteristics of cases that are executed in the same period of time. For example, in many situations, running cases compete over scarce resources, and the completion time of a running case can be derived from the number of similar cases running concurrently. In this work, we present a general framework for feature encoding that relies on a bi-dimensional state space representation. The first dimension corresponds to intra-case dependencies and utilizes existing feature encoding techniques. The second dimension encodes inter-case features using two approaches: (1) a knowledge-driven encoding (KDE), which assumes prior knowledge on case types, and (2) a data-driven encoding (DDE), which automatically identifies case types from data using case proximity metrics. Both approaches partition the event log into sets of cases that share common characteristics, and derive features according to these commonalities. We demonstrate the usefulness of the proposed framework with an empirical evaluation carried out against two real-life datasets coming from an outpatient hospital process and a manufacturing process.     

Residue buildup predictive modeling for stencil cleaning profile decision-making using recurrent neural network

This research proposes a novel framework to control the stencil cleaning profile selection in the stencil printing process (SPP). The SPP is a major contributor to yield loss in surface mount technology (SMT). Enhancement in SPP performance is critical to improving the printed circuit board (PCB) assembly line. The selection of a solvent-based or a dry-based cleaning profile is challenging, but the choice determines the effectiveness and efficiency of the stencil cleaning operation. The amount of residue buildup under the stencil is the main criterion used to decide the appropriate cleaning profile in SPP. In this research, a multi-dimensional temporal recurrent neural network (RNN) approach is used to accurately predict the amount of residue buildup on the underneath surface of the stencil in real-time. Specifically, the long short-term memory (LSTM) architecture is trained using actual residue buildup data. The proposed LSTM prediction model is compared with other state-of-the-art regression models such as multilayer perceptron (MLP) and ensemble learning models. Experimental results show the proposed LSTM model outperforms the state-of-the-art regression models and accurately predicts the stencil status. The proposed research aids decision-makers in the SPP line to select the appropriate stencil cleaning profile adaptively and in real-time. As a result, the overall SPP performance is improved.     

基于长短时记忆单元和卷积神经网络混合神经网络模型的视频着色方法

视频可以看作是连续的视频帧图像组成的序列,视频彩色化的实质是对图像进行彩色化处理,但由于视频的长期序列性,若直接将现有的图像着色方法应用到视频彩色化上极易产生抖动或闪烁现象。针对这个问题,提出一种结合长短时记忆（LSTM）和卷积神经网络（CNN）的混合神经网络模型用于视频的着色。该方法用CNN提取视频帧的语义特征,同时使用LSTM单元学习灰度视频的时序信息,保证视频的时空一致性,然后融合局部语义特征和时序特征,生成最终的彩色视频帧序列。通过对实验结果的定量分析和用户研究表明,该方法在视频彩色化上实现了较好的效果。     

Stage-based discovery of business process models from event logs

An automated process discovery technique generates a process model from an event log recording the execution of a business process. For it to be useful, the generated process model should be as simple as possible, while accurately capturing the behavior recorded in, and implied by, the event log. Most existing automated process discovery techniques generate flat process models. When confronted to large event logs, these approaches lead to overly complex or inaccurate process models. An alternative is to apply a divide-and-conquer approach by decomposing the process into stages and discovering one model per stage. It turns out, however, that existing divide-and-conquer process discovery approaches often produce less accurate models than flat discovery techniques, when applied to real-life event logs. This article proposes an automated method to identify business process stages from an event log and an automated technique to discover process models based on a given stage-based process decomposition. An experimental evaluation shows that: (i) relative to existing automated process decomposition methods in the field of process mining, the proposed method leads to stage-based decompositions that are closer to decompositions derived by human experts; and (ii) the proposed stage-based process discovery technique outperforms existing flat and divide-and-conquer discovery techniques with respect to well-accepted measures of accuracy and achieves comparable results in terms of model complexity.