基于函数的时间序列分段线性表示方法

考虑到时间序列的时间特性对不同区段的影响以及时间序列数据动态增长的实际情况,在RPAA ( Reversed Piecewise Aggregate Approximation)和PAA(Piecewise Aggregate Approximation)方法的基础上,提出了一种新的时间序列分段线性表示方法FPAA(Founction Piecewise Aggregate Approximation)。FPAA方法通过定义函数影响因子,克服了RPAA和PAA方法的不足。该方法具有线性时间复杂度,满足下界定理,并且支持时间序列的在线划分。实验表明,与PAA方法和RPAA方法相比,所提出的方法可以较有效地进行时间序列的在线查询。     

RPAA：一种基于时间特性的时间序列建模表示

滑动聚集平均近似PAA（Piecewise Aggregate Approximation）是一种表示时间序列的方法，它通过时间序列上滑动一个等宽的滑动窗口将时间序列分成小的区段。考虑到时间序列的时间特性q-不同区段的影响，本文提出了一种改进表示RPAA（Reversed Piecewise Aggregate Approximation）。RPAA表示对处于不同时间段的序列赋以不同的影响因子，具有线性时间复杂度，并且证明了RPAA满足下界定理，因而能够进行实际的查询。最后的实验表明该表示是有效的。     

Classification and visualization for symbolic people flow data

People flow information brings us useful knowledge in various industrial and social fields including traffic, disaster prevention, and marketing. However, it is still an open problem to develop effective people flow analysis techniques. We considered compression and data mining techniques are especially important for analysis and visualization of large-scale people flow datasets. This paper presents a visualization method for large-scale people flow dataset featuring compression and data mining techniques. This method firstly compresses the people flow datasets using UniversalSAX, an extended method of SAX (Symbolic Aggregate Approximation). Next, we apply algorithms inspired by natural language processing to extract movement patterns and classify walking routes. After this process, users can interactively observe trajectories and extracted features such as congestions and popular walking routes using a visualization tool. We had experiments of classifying and visualizing walking routes using two types of people flow dataset recorded at an exhibition and a corridor applying our method. The results allow us to discover characteristic movements such as stopping in front of particular exhibits, or persons who passed same places but walked at different speeds.     

基于频繁模式发现的时间序列异常检测方法

针对传统异常片段检测方法在处理增量式时间序列时效率低的问题,提出一种基于频繁模式发现的时间序列异常检测（TSAD）方法。首先,将历史输入的时间序列数据进行符号转化;其次,利用符号化特征找出历史序列数据集中的频繁模式;最后,结合最长公共子序列匹配方法度量频繁模式与当前新增加时间序列数据之间的相似度,从而发现新增加数据中的异常模式。与基于滑动窗口预测的水文时间序列异常检测方法（TSOD）和基于扩展符号聚集近似的水文时间序列异常挖掘方法（ESAA）相比,对于实验选择的三种类型的时间序列数据,TSAD的检测率都超过90%;TSOD对规则性较强的序列检测率较高,能达到99%,但对噪声干扰较大的序列检测率较低,对数据偏向性较强;ESAA对三种类型的数据检测率均不超过70%。实验结果表明,TSAD在时间序列异常检测中能够较好地发现异常片段。     

大规模时间序列数据库降维及相似搜索

提出一种基于分段多项式表示（PPR）的时间序列数据库相似查询的系统化方法．PPR是一类基于线性多项式回归的正交变换．用PPR变换索引时间序列数据在理论上具备非漏报性质．文中分析了PPR的计算复杂性以及查询阈值的下界,并提出了一种衡量时间序列相似查询算法之查询效率的定量指标．与基于离散傅立叶变换（DFT）和离散小波变换（DWT）的时间序列相似查询算法所作的对比实验表明,所提算法可以用低的索引结构维数获得高的查询效率．     

基于符号化聚合近似的时间序列相似性复合度量方法

基于关键点的符号化聚合近似(SAX)改进算法(KP_SAX)在SAX的基础上利用关键点对时间序列进行点距离度量,能更有效地计算时间序列的相似性,但对时间序列的模式信息体现不足,仍不能合理地度量时间序列的相似性。针对SAX与KP_SAX存在的缺陷,提出了一种基于SAX的时间序列相似性复合度量方法。综合了点距离和模式距离两种度量,先利用关键点将分段累积近似(PAA)法平均分段进一步细分成各个子分段;再用一个包含此两种距离信息的三元组表示每个子分段;最后利用定义的复合距离度量公式计算时间序列间的相似性,计算结果能更有效地反映时间序列间的差异。实验结果显示,改进方法的时间效率比KP_SAX算法仅降低了0.96%,而在时间序列区分度性能上优于KP_SAX算法和SAX算法。     

高效的时间序列下界技术

针对时间序列数据,提出一种新的基于动态时间弯曲的下界技术,该技术首先基于分段聚集近似的线性表示对原始序列进行降维,同时生成查询序列的网格最小边界矩形近似表示,然后利用基于动态时间弯曲距离对两者下界距离度量。实验结果表明,该下界技术与以往相关技术相比,能够产生更大的下界距离,具有更强的紧凑度、裁剪搜索空间能力以及更短的运行时间,有利于时间序列数据挖掘。     

基于大数据的网络安全态势感知及主动防御技术研究与应用

针对电力信息系统网络安全态势感知及主动防御问题,介绍了网络安全态势感知相关概念及技术。为了监控网络安全态势,研究了利用大数据分析技术开展基于多源日志的网络安全态势感知,提出了态势感知平台部署架构及主动防御模型思想,并将其技术应用于某电力公司网络信息系统环境。通过在公司内外网网络出口部署全流量数据采集分析器,对原始网络流量进行实时采集和存储,并借助大数据可视化分析工具与丰富的数据展示组件,实现对分析结果的多维度图形化直观展现。经实验测试实现了攻击事件及安全态势的实时监控预警,保障了公司信息系统的安全稳定运行。     

基于统计特征的时序数据符号化算法

为克服SAX(符号聚合近似)算法对时序信息描述不完整的缺陷,提出基于统计特征的时序数据符号化算法,与SAX不同的是,该算法将时序符号看作矢量,而各时序子段的均值和方差则分别作为描述其平均值及发散程度的分量.由于该算法能够比SAX提供更多的描述信息,因而在时序数据挖掘应用中能够获得比SAX更精确的结果.大量的实验也证实了它的出色表现.     

Functional segmentation of dynamic nuclear images by cross-psi B-energy operator

We describe a new segmentation method of dynamic nuclear medicine images based on the cross-Psi(B)-energy operator. Psi(B) is a nonlinear measure which quantifies the interaction between two time-signals including their first and second derivatives. Similarity measure, noted SimilB, between the time activity curve (TAC) of each pixel and the mean value of the TACs of a reference region of the scintigraphic image series is calculated. The resulting SimilB map is a functional image representing regions with different temporal dynamics. Some new properties of Psi(B) are presented. Particularly, we show that Psi(B) as a similarity measure is robust to both scale and time shift. The proposed method is applied to nuclear cardiac sequences for visualization and analysis of the ventricular emptying pattern, which may be useful in studying motion or conduction abnormalities. Results of a normal subject and four patients with abnormal ventricular contraction patterns are presented to highlight the suitability of this operator for studying non-stationary TAC series.     

软件网络通信过程逆向分析及可视化技术研究

针对软件逆向分析中遇到的软件网络通信过程复杂,分析耗时的问题,提出了软件网络通信过程逆向分析及可视化方法.利用动态二进制平台DynamoRIO记录软件网络通信过程中执行的API函数信息,对记录结果进行函数关联性分析,结合图形化工具软件aiSee,将软件网络通信过程以图形化形式展现.实验结果表明,该方法能够在不影响程序的情况下通过程序的一次运行即正确解析并可视化其网络通信过程.     

Anomaly detection using piecewise aggregate approximation in the amplitude domain

Anomaly detection has received much attention due to its various applications. Generally, the first step to discover anomalies is a data representation method which reduces dimensionality as well as preserves key information. Anomaly detection based on real-value representation methods is meaningful for its convenience in numeric operation. A typical real-value representation method is the Piecewise Aggregate Approximation (PAA) that is simple and intuitive by capturing mean values of segments in a sequence. However, if segments are same or similar in their average values but different in their oscillation amplitudes, the PAA method is ineffective to describe a sequence composed of such segments. To address this issue, we propose a representation method called the Piecewise Aggregate Approximation in the Amplitude Domain (AD-PAA). For discovering anomalies, a sequence is partitioned into subsequences by a sliding window firstly. Then in the AD-PAA method, a subsequence is divided into equal size subsections according to the amplitude domain. With mean values of subsections computed, the amplitude oscillation of a subsequence is embodied effectively. When the AD-PAA method is applied to approximate subsequences, the AD-PAA representation of a sequence is constructed. Anomalies are determined by anomaly scores that are based on similarities among representation results. Experimental results on various data confirm that the proposed method is more accurate than the PAA based method and other comparison methods. The ability to differentiate anomalies of the proposed algorithm is also superior.     

改进的SAX符号化算法在QAR数据中的应用

鉴于快速存取记录器（QAR）数据是结构非常复杂和数据量大的时间序列数据,直接采用传统的符号聚合近似算法（SAX）对QAR数据进行描述、存储、检索等操作时,不能克服时间序列幅度值伸缩和时间轴漂移等方面的不足。提出了改进的符号聚合近似算法,将快速存取记录器数据划分为起飞、巡航和降落三个阶段,并利用此改进的算法对巡航阶段进行填补,对不同长度的故障模型序列进行有效的相似性搜索。通过实验以及其在飞机故障诊断项目中的应用,证明了其可行性和有效性,从而提高了飞机的排故效率。     

A graphical editor and process visualization system for man-machine interfaces of dynamic systems

The process visualization system of a manmachine interface is presented. It allows human operator(s) to interact with a dynamic technical system, here a thermal power plant. Also, a graphical editor for designing dynamic pictures of the process visualization system is explained. Both new systems have a common architecture and are based on the computer graphics standard PHIGS-2D with extensions for handling non-graphical and graphical information. The hierarchical information structures are manipulated with lists and pointers in a dynamic visual database. The two menu-driven interfaces for designers and for operators are described with their multi-window display layouts. The software of both systems is highly portable to different hardware and to other application domains.     

Impact of visualization type and contextual factors on performance with enterprise resource planning systems

We studied the use of two types of graphic information visualization to support human operators performing tasks using enterprise resource planning systems (ERP). We compared the original display design of a commercial ERP system with a prototype information visualization design. A simulated supply chain was used to test the hypothesis that graphical visualization can improve the performance of the human operator using ERP systems for supply chain management. Tasks from the production and purchasing domains were tested in the experiment in which experienced and inexperienced human operators had to perform tasks of an easy, moderate, and difficult nature. Analysis of the results revealed that the two types of graphical visualization significantly reduced response time, particularly with inexperienced users performing difficult tasks. Our results imply that some graphic information visualization displays for ERP systems can increase the probability of a successful implementation and enhance the capabilities of the human operators.     

PACKTER: implementation of internet traffic visualizer and extension for network forensics

Traffic visualization tools help network operators to maintain awareness of the status of a network, including anomalous activities. Unfortunately, the network operator may look away from the visualizer when beginning network forensics, such as launching a terminal application, logging into a server, and analyzing log files. Thus, the eyesight of the network operator will move from the visual screen even if valuable information is displayed. Our motivation is to develop the ability to use visualization tools as a network operation console. Whereas previous tools focused on outputting packet information, we herein extend the visualizer to accept inputting for operators to start their operations. Since little such software exists for our intent, we develop PACKTER, which is able to visualize traffic based on per-packet information in real time. We also extend PACKTER to have a function of negotiating to a network forensic system, which allows the operator to select an individual packet using a mouse, to start network forensics using a keyboard, and to receive results without looking away from the PACKTER viewer.     

基于页面流可视化图形工具的研究与实现

在页面流中经常需要相应的配置文件和一些java类,而这些若采用手工编写会浪费很多人力。基于页面流可视化图形工具即在Eclipse平台上开发的页面流插件,插件本身即为一个图形编辑器,并采用GEF框架技术在编辑器中达到图形拖动的目的,以可视化的方式绘制Web组件间的关系。生成的页面流插件配置文件信息,提升用户可视化的体验。     

基于自适应搜索窗口的序列相似比对算法

DTW（Dynamic Time Warping）算法被广泛应用于序列数据比对,以度量序列间距离,但算法较高的时间复杂度限制了其在长序列比对上的应用。提出基于自适应搜索窗口的序列相似比对算法（ADTW）,算法利用分段聚集平均（Piecewise Aggregate Approximation,PAA）策略进行序列抽样得到低精度序列,然后计算低精度序列下的比对路径,并根据低精度距离矩阵上的梯度变化预测路径偏差,限制路径搜索窗口的拓展范围;随后算法逐步提高序列精度,并在搜索窗口内修正路径、计算新的搜索窗口,最终,实现DTW距离和相似比对路径的快速求解。对比FastDTW,ADTW算法在同等度量准确率下提高计算效率约20%,其时间复杂度为[O(n)]。     

基于数据可视化的复杂系统信号时序识别方法

针对复杂系统研发及运行过程中产生的大量信号可以表征系统运行的时序健康状态这一特性,提出了一种基于数据可视化及卷积神经网络(convolutional neural networks, CNN)智能识别的时序特征识别方法;该方法使用数据可视化技术将信号的时序特征映射至图像,通过训练好的特征识别模型对信号可视化图像进行时序特征的识别,可实现系统运行时的实时智能状态监测;选取了三种典型信号的正常及异常特征,通过模型构建及测试分析,验证该方法对复杂系统信号的时序特征有良好的识别效果,可应用于对时序要求较高的复杂系统进行状态监测及故障诊断。     

一种基于时序的状态监控及故障诊断系统

复杂系统在研发及运行过程中会产生大量的状态量及参数记录，为判定系统运行的健康状况，往往在运行结束后对其进行挖掘分析。在对数据分析的过程中，信号的时序变化成为复杂系统运行状态评估的重要参照之一，但是目前将时序分析作为独立分析模块进行状态监测的研究较少。在时序分析方面进行了改进，使用阈值判断结合时序分析的方法对复杂系统的监测点信号进行数据分析，根据分析结果使用专家系统进行基于案例的信号匹配及故障诊断，实现复杂系统基于时序的状态监测及故障诊断。提出的状态监测及故障诊断系统除了适用于对时序要求较高的复杂系统以外，对航天探测、新能源设备研发、医疗技术发展及海洋、大气、大地环境监测等领域都具有应用价值。