网络心跳包序列的数据流分簇检测方法

在对网络会话进行时序分析的基础上,提出基于数据流分簇处理的心跳包序列检测方法。对数据流进行时序分簇处理,按周期性特征扩充簇集合,筛除不符合特征的簇对象,根据稳定的簇集合检测心跳包序列。实验结果表明,该方法检测率较高、误检率较低,能够实现实时检测和处理。     

基于网络通信指纹的启发式木马识别系统

对比传统木马检测技术的原理及特点,根据网络数据流检测木马的需求,提出一种基于网络通信特征分析的木马识别方法。引入通信指纹的概念扩展通信特征的外延,用实验方法归纳木马在连接、控制和文件传输阶段表现出的通信指纹信息,设计并实现一个启发式木马网络通信指纹识别系统。测试结果表明,该系统运行高效、检测结果准确。     

基于多数据流分析的木马检测方法

传统基于单数据流的木马检测方法在实际应用中具有较高的误报率,为此提出一种基于多数据流分析的木马检测方法.通过对应用程序的数据流进行聚类形成数据流簇,在数据流簇上提取相应属性特征描述木马的通信行为,并采用集成学习方法对改进的C4.5决策树分类算法进行多轮训练,生成检测规则,建立检测模型.实验表明,基于多数据流分析的木马检测方法有效降低了传统基于单数据流检测的误报率,并且对无控制端的木马通信数据流具有较好的检测能力,产生的重复报警信息也大大减少,提高了基于数据流的木马检测方法的实用性.     

基于小波变换的木马心跳行为检测方法

通常的木马心跳行为检测方法利用的是聚类的思想,很难避免木马自身传输数据包的干扰,导致误报。为此,提出基于小波变换的木马心跳行为检测方法。该方法首先将TCP数据包流表示成包长度信号,然后用基于Mallat的强制阈值除噪算法对信号进行处理,最后通过基于包速率的行为详细信息判定算法得出检测结果。实验表明,该检测方法能有效地检测出心跳行为并具有较强的抗干扰性。     

一种基于网络行为分析的反弹式木马检测方法

该文首先对反弹式木马的通信过程进行了分析,建立了反弹式木马的网络行为模型,提出了数据包簇的概念,并给出了形式化描述接着从网络行为分析的角度,提出了通过3个网络行为特征去检测木马心跳行为,通过6个网络行为特征去检测反弹式木马的交互性操控行为,并给出了实现算法实验结果表明,该算法对反弹式木马具有较好的检测效果．     

集成时空信息的木马智能检测

木马已成为当前信息安全的重要威胁.研究了已有的恶意代码智能检测方法,针对已有的智能检测没有充分利用时序和空间信息的缺陷,提出集成时序和空间信息的木马行为智能检测.给出了时序特征和空间特征的提取方法,并给出空间特征的特征选择和约简过程,并在此基础上给出了成员分类器的集成决策.给出了总体设计方案,实验结果表明集成时序和空间信息的木马智能检测相对于单分类器能够得到较好的分类准确率.     

基于时序分析的木马规模预测技术

木马作为网络所面临的一种重要威胁。其控制主机的规模对网络安全态势有重大影响。对进行有效预测可为网络安全预警和防御提供决策支持。在大规模网络中检测到的木马数据具有较大的规模和较强的数据独立性,难以进行关联分析,而用时序分析可以获取更多有价值的信息。本文介绍了在时序分析预测中广泛采用的ARMA预测技术、基于小波分析的预测技术和基于时序事件化的预测技术,针对大规模网络中监测到的真实木马数据集的数据特点,在短、中期时间上对三种时序预测技术进行比较讨论。实验表明,基于时序事件化的预测技术具有最优的准确性。     

基于行为分析的木马检测系统

本文通过对木马及木马检测技术的研究,提出了基于行为分析的木马检测技术。主要对木马的行为特征进行抽象描述,首先根据一定的规则建立一个行为特征数据库,并结合启发式分析器来进一步分析判断被检测的程序是否是木马,同时做相应的处理。实验表明,与传统的木马检测技术相比,该算法准确率高,实时性强,占用系统资源少。     

基于运动轨迹分析的启发式木马检测系统

针对主动防御技术检测准确率不高的问题,提出了一种基于运动轨迹分析的启发式木马检测系统。提出了两种典型的木马运动轨迹,利用运动轨迹上的行为数据,结合判定规则与算法,实现对可疑文件危险等级的检测。实验结果表明,该系统检测未知木马性能优于传统方法,并且能够检测一些特殊木马。     

基于时序聚类的北斗位置冗余数据压缩算法

在北斗用户机的位置数据采集过程中,容易出现数据冗余现象。为此,分析导致数据冗余的原因,提出一种基于时序聚类的冗余数据压缩算法。该算法采用基于密度的聚类方法将数据集进行分簇,把属于同一类运动特征的位置数据归为一类,根据簇直径判断该簇是否为冗余数据,并对冗余数据进行压缩。实验结果表明,该算法可以正确标识冗余数据,实现数据压缩。     

Only connect: teaching, technology and telesis

Abstract This paper describes an approach to the design of interactive multimedia materials being developed in a European Community project. The developmental process is seen as a dialogue between technologists and teachers. This dialogue is often problematic because of the differences in training, experience and culture between them. Conditions needed for fruitful dialogue are described and the generic model for learning design used in the project is explained.     

European Community policy and the market

Abstract This paper starts with some reflections on the policy considerations and priorities which are shaping European Commission (EC) research programmes. Then it attempts to position the current projects which seek to capitalise on information and communications technologies for learning in relation to these priorities and the apparent realities of the marketplace. It concludes that while there are grounds to be optimistic about the contribution EC programmes can make to the efficiency and standard of education and training, they are still too technology driven.     

一种自适应子融合集成多分类器方法

融合集成方法已经广泛应用在模式识别领域,然而一些基分类器实时性能稳定性较差,导致多分类器融合性能差,针对上述问题本文提出了一种新的基于多分类器的子融合集成分类器系统。该方法考虑在度量层融合层次之上通过对各类基多分类器进行动态选择,票数最多的类别作为融合系统中对特征向量识别的类别,构成一种新的自适应子融合集成分类器方法。实验表明,该方法比传统的分类器以及分类融合方法识别准确率明显更高,具有更好的鲁棒性。     

Avoiding semantic and temporal gaps in developing software intensive systems

Development of software intensive systems (systems) in practice involves a series of self-contained phases for the lifecycle of a system. Semantic and temporal gaps, which occur among phases and among developer disciplines within and across phases, hinder the ongoing development of a system because of the interdependencies among phases and among disciplines. Such gaps are magnified among systems that are developed at different times by different development teams, which may limit reuse of artifacts of systems development and interoperability among the systems. This article discusses such gaps and a systems development process for avoiding them.     

Designing economic np control charts: A programmed simulation approach

This paper presents control charts models and the necessary simulation software for the location of economic values of the control parameters. The simulation program is written in FORTRAN, requires only 10K of main storage, and can run on most mini and micro computers. Two models are presented - one describes the process when it is operating at full capacity and the other when the process is operating under capacity. The models allow the product quality to deteriorate to a further level before an existing out-of-control state is detected, and they can also be used in situations where no prior knowledge exists of the out-of-control causes and the resulting proportion defectives.     

The development of robot art

Going through a few examples of robot artists who are recognized worldwide, we try to analyze the deepest meaning of what is called “robot art” and the related art field definition. We also try to highlight its well-marked borders, such as kinetic sculptures, kinetic art, cyber art, and cyberpunk. A brief excursion into the importance of the context, the message, and its semiotics is also provided, case by case, together with a few hints on the history of this discipline in the light of an artistic perspective. Therefore, the aim of this article is to try to summarize the main characteristics that might classify robot art as a unique and innovative discipline, and to track down some of the principles by which a robotic artifact can or cannot be considered an art piece in terms of social, cultural, and strictly artistic interest. This work was presented in part at the 13th International Symposium on Artificial Life and Robotics, Oita, Japan, January 31–February 2, 2008     

Explanation and prediction: an architecture for default and abductive reasoning

Although there are many arguments that logic is an appropriate tool for artificial intelligence, there has been a perceived problem with the monotonicity of classical logic. This paper elaborates on the idea that reasoning should be viewed as theory formation where logic tells us the consequences of our assumptions. The two activities of predicting what is expected to be true and explaining observations are considered in a simple theory formation framework. Properties of each activity are discussed, along with a number of proposals as to what should be predicted or accepted as reasonable explanations. An architecture is proposed to combine explanation and prediction into one coherent framework. Algorithms used to implement the system as well as examples from a running implementation are given.     

Three Process Perspectives: Organizations, Teams, and People

This paper provides the author's personal views and perspectives on software process improvement. Starting with his first work on technology assessment in IBM over 20 years ago, Watts Humphrey describes the process improvement work he has been directly involved in. This includes the development of the early process assessment methods, the original design of the CMM, and the introduction of the Personal Software Process (PSP)^SM and Team Software Process (TSP){^SM}. In addition to describing the original motivation for this work, the author also reviews many of the problems he and his associates encountered and why they solved them the way they did. He also comments on the outstanding issues and likely directions for future work. Finally, this work has built on the experiences and contributions of many people. Mr. Humphrey only describes work that he was personally involved in and he names many of the key contributors. However, so many people have been involved in this work that a full list of the important participants would be impractical.     

基于复小波噪声方差显著修正的SAR图像去噪

提出了一种基于复小波域统计建模与噪声方差估计显著性修正相结合的合成孔径雷达(Synthetic Aperture Radar,SAR)图像斑点噪声滤波方法。该方法首先通过对数变换将乘性噪声模型转化为加性噪声模型,然后对变换后的图像进行双树复小波变换(Dualtree Complex Wavelet Transform,DCWT),并对复数小波系数的统计分布进行建模。在此先验分布的基础上,通过运用贝叶斯估计方法从含噪系数中恢复原始系数,达到滤除噪声的目的。实验结果表明该方法在去除噪声的同时保留了图像的细节信息,取得了很好的降噪效果。     

基于QTE的蒙古文显示机制研究与实现

蒙古语言是中国蒙古族使用的通用语言,由于蒙古文区别于其他文字的书写方式和其自身变形机制等特点,在很多通用的文字处理引擎中都不被支持。在嵌入式产品开发与应用领域中Linux加QTE已经成为流行方式。该文给出了一种在QTE环境上实现基于标准Unicode的蒙古文点阵显示和变形算法, 并自定义了支持蒙古文的QTE组件,扩展了QTE功能,为在Linux加QTE方式的嵌入式体系结构中处理蒙古文提供了一种解决方法。