k最近邻流序列算法对异常流检测的优化研究

通过时空异常流检测技术可以发现城市交通数据中的异常交通特征。与时间序列中单个异常流检测采用的方法不同,提出了从流序列中检测异常流分布的k最近邻流序列算法（kNNFS）。算法首先为每个位置测定每个时间区间内的单个流观测值;随后计算单个流的观测频率来构建每个位置处每个时间区间的流分布概率库;最后由阈值判定使用KL散度计算的新的流分布概率与其k最近邻之间的距离是否为异常值,距离值小于阈值则更新入流分布概率库,否则为异常的流分布。仿真分析表明,对比DPMM算法和SETMADA算法,kNNFS算法在检测精度和算法运行时间方面均有优化提升。     

采用图遍历算法的服务端请求伪造漏洞检测

针对基于PHP语言开发的Web应用系统,提出了一种基于图遍历算法的服务端请求伪造漏洞检测和利用方法。通过构建抽象语法树,获取每个文件的数据流信息,进而利用数据流中的传递依赖关系构造全局的代码属性图,使用图遍历算法对生成的代码属性图进行污点分析,得到污点变量的代码传递依赖路径图,最后使用约束求解的方法对路径图中的经过函数信息进行漏洞检测并生成可利用的攻击向量。实验结果表明,这种检测方式相较于传统的静态审计方法能够很好地发现服务端请求伪造漏洞,并能够自动化生成可绕过的攻击向量。     

一种基于小波分析的异常数据样本检测与修复方法

准确的数据预处理是实现正确有效的数据挖掘和基于数据样本进行系统建模的前提和关键环节．数据预处理的一项重要任务是从大量数据样本中剔除异常样本或对受污染的样本进行清洗修复，但在数据集中各数据项间关系未知的情况下。检测异常样本比较困难，为此，文章提出了一种基于小波分析的异常数据样本检测与修复方法．该方法充分利用了小波分析的多尺度、多分辨特性，能有效地实现异常数据样本的准确检测和修复．为了实现离散序列小波变换的快速计算，文章还提出了一种基于Newton-Cores公式的修正的数值积分算法．仿真结果表明，文章提出的方法切实可行，效果盘好，有很强的实用性．     

Pathlistings applied to data flow analysis

Summary In this paper the pathlisting mechanism is developed as a new tool useful in performing efficient data flow analysis of programs for a wide variety of problems. An algorithm using this tool for forward flow, code improvement problems is presented. It is shown that for all practical purposes this algorithm is linear in the size of the input which is, generally speaking, a reducible flow graph modeling the given program. Pathlistings generalize the nodelisting approach, introduced by Kennedy, for solving data flow problems. The efficiency of the pathlisting algorithm is due to the reuse of intermediate values and due to the fact that the cycles of a reducible flow graph can be ordered. Other advantages of the approach are also discussed.Work supported by National Science Foundation grant DCR73-00365-AO     

Building k-connected neighborhood graphs for isometric data embedding

Isometric data embedding using geodesic distance requires the construction of a connected neighborhood graph so that the geodesic distance between every pair of data points can be estimated. This paper proposes an approach for constructing k-connected neighborhood graphs. The approach works by applying a greedy algorithm to add each edge, in a nondecreasing order of edge length, to a neighborhood graph if end vertices of the edge are not yet k-connected on the graph. The k-connectedness between vertices is tested using a network flow technique by assigning every vertex a unit flow capacity. This approach is applicable to a wide range of data. Experiments show that it gives better estimation of geodesic distances than other approaches, especially when the data are undersampled or nonuniformly distributed.     

内存泄漏故障静态分析研究

目前研究人员主要采用静态测试技术实施对内存泄漏故障的检测,其基本思想就是依据待测程序的控制流图来设计特定的算法以检测内存泄漏问题,但这些方法的不足之处主要是控制流图的表示方式上未含有进一步可用信息,因此所设计的算法不能很好地执行该故障的检测任务.为此,定义了一种用于内存泄漏故障检测的控制流图,提出控制流图可达路径生成算法,然后根据生成的路径进行内存泄漏故障的检测与分析.实验证实,该方法取得了理想的效果.     

基于模式挖掘的用户行为异常检测

行为模式通常反映了用户的身份和习惯，该文阐述了针对Telnet会话中用户执行的shell命令，利用数据挖掘中的关联分析和序列挖掘技术对用户行为进行模式挖掘的方法，分析了传统的相关函数法在应用于序列模式比较时的不足，提出了基于递归式相关函数的模式比较算法，根据用户历史行为模式和当前行模式的比较相似度来检测用户行为中的异常，最后给出了相应的实验结果。     

无偏KL散度算法对时空异常区间检测的优化研究

通过对多变量时空时间序列中异常的度量，可以从大量时空事件数据中检测出异常的数据部分。与孤立异常数据点检测采用的技术不同，提出了无偏KL散度算法(UKLD)。首先定义了时空时间序列中的异常区间，嵌入时间延迟后用高斯分布来估计检测区间和剩余区间的分布并通过累计和来加快高斯分布的参数估计过程，最后使用无偏KL散度计算区间之间的差异水平，将这种差异水平作为检测区间的异常得分从而得到时空异常区间。仿真分析结果表明，对比HOT SAX算法和RKDE算法，UKLD算法在精度方面更优，能更好地实现时空数据中的异常区间检测。     

PHP程序污点型漏洞静态检测方法

针对基于PHP语言开发的Web应用程序产生的污点型漏洞,提出一种静态代码分析检测的方法。提出的生成控制流图的算法,基于PHP内置函数解析PHP程序,生成抽象解析树,进而生成控制流图;对内置特征、入口点和敏感点进行建模,精确分析数据流;提出基于有效路径的污点分析方法,提高了分析的准确性,实现了基于变量回溯的路径遍历算法。实现了该方法的原型系统,并对两个广泛使用的PHP应用程序进行测试,发现了6个未公开漏洞和11个已公开漏洞,证明了该系统具有较强的漏洞检测能力。     

采样数据系统输出量的新计算方法

本文用新的原理推广了信号流图和梅逊公式在采样数据系统中的应用,提出了"新采样信 号流图",以及相应的计算单输入、单输出周期采样数据系统的采样输出、连续输出和广义采样 输出的新计算方法.根据新计算方法,可利用系统方块图一步构造出新采样信号流图,并可 直接计算出采样数据系统的三种输出量.这种方法比目前利用系统方块图构造"原始信号流 图","采样信号流图"和"复合信号流图"再进行计算的方法简单、方便,计算量亦大为减少.对 于一般采样数据系统,通过心算就能得到输出量结果.对于多速采样数据系统,只要将系统稍 加变换,新计算方法仍能适用. 本文还给出了计算多变量采样数据系统输出量的最优拓扑方法.     

Decision tree based light weight intrusion detection using a wrapper approach

The objective of this paper is to construct a lightweight Intrusion Detection System (IDS) aimed at detecting anomalies in networks. The crucial part of building lightweight IDS depends on preprocessing of network data, identifying important features and in the design of efficient learning algorithm that classify normal and anomalous patterns. Therefore in this work, the design of IDS is investigated from these three perspectives. The goals of this paper are (i) removing redundant instances that causes the learning algorithm to be unbiased (ii) identifying suitable subset of features by employing a wrapper based feature selection algorithm (iii) realizing proposed IDS with neurotree to achieve better detection accuracy. The lightweight IDS has been developed by using a wrapper based feature selection algorithm that maximizes the specificity and sensitivity of the IDS as well as by employing a neural ensemble decision tree iterative procedure to evolve optimal features. An extensive experimental evaluation of the proposed approach with a family of six decision tree classifiers namely Decision Stump, C4.5, Naive Baye’s Tree, Random Forest, Random Tree and Representative Tree model to perform the detection of anomalous network pattern has been introduced.     

C语言的别名分析方法研究

别名分析对于数据流分析、程序优化和分析工具的实现非常重要.文章提出了一种需求驱动,流非敏感的分析算法来解决指针别名问题.通过构造程序表达式图(PEG)把指针别名问题转化成判断两个指针节点是否是联通的问题,它不同于传统的别名分析方法,它不需要构造别名集合和对其求交集,所以提高了分析指针别名的效率.     

The combining DAG: a technique for parallel data flow analysis

As the number of available multiprocessors increases, so does the importance of providing software support for these systems, including parallel compilers. Data flow analysis, an important component of software tools, may be computed many times during the compilation of a program, especially when compiling for a multiprocessor. Although converting a sequential data flow algorithm to a parallel algorithm can present some opportunities for computing data flow in parallel, more parallelism can be exposed by the development of new parallel data flow algorithms. We present a technique that computes rapid data flow problems in parallel and thus is applicable for commonly used classical data flow problems, including reaching definitions, reachable uses, available expressions, and very busy expressions. Unlike previous techniques, our technique exploits the inherent parallelism in the data flow computation that occurs across independent paths, within linear paths, and in paths through loops of a control flow graph. The technique first changes cyclic structures in a control flow graph to acyclic structures and then builds a combining directed acyclic graph (DAG) that represents the paths through the control flow graph needed to compute data flow. Data flow is then computed using two passes over the DAG by computing the data flow for the nodes on each level of the DAG in parallel. We also present experimental results comparing the performance of our algorithm with a sequential algorithm and a parallelized sequential algorithm     

面向关键字流图的相似程序间测试用例的重用

软件测试是软件开发中重要的一环,能有效地提高软件的可靠性和质量.而测试用例的重用可减少软件测试的工作量,提升测试的效率.提出一种面向关键字流图的相似程序间测试用例的重用方法,该方法将程序已经生成的测试数据重用到与之相似的程序中.可见,探究测试用例重用的前期工作是判定程序的相似性.对于程序相似性的判定,给出根据关键字流图相似性比较的方法：首先,将程序代码中的关键字存储在流图所对应的节点中,构建关键字流图;接下来,利用动态规划算法查找待测程序关键字流图的最大公共子图;最后,根据最大公共子图距离算法计算程序的相似度.较高相似程度的程序可用到测试用例重用的方法中.在利用遗传算法生成测试用例时,引用相似程序中适应度较高的测试用例,使种群在进行进化操作过程中不断与这些用例进行交叉,加快用例的生成效率.实验表明：将测试用例重用在相似程序的测试生成中,与传统方法相比,在覆盖率和平均进化代数等方面均有明显优势.     

A bottom-up algorithm for finding principal curves with applications to image skeletonization

This paper proposes a new method for finding principal curves from data sets. Motivated by solving the problem of highly curved and self-intersecting curves, we present a bottom-up strategy to construct a graph called a principal graph for representing a principal curve. The method initializes a set of vertices based on principal oriented points introduced by Delicado, and then constructs the principal graph from these vertices through a two-layer iteration process. In inner iteration, the kernel smoother is used to smooth the positions of the vertices. In outer iteration, the principal graph is spanned by minimum spanning tree and is modified by detecting closed regions and intersectional regions, and then, new vertices are inserted into some edges in the principal graph. We tested the algorithm on simulated data sets and applied it to image skeletonization. Experimental results show the effectiveness of the proposed algorithm.     

面向SIMD机器的全局自动数据分割

提出了一种面向ＳＩＭＤ机器的全局数据自动分割算法,该算法能处理多个非紧嵌折循环嵌套,并且数组下标存取为循环变量的线性式,首先通过数据与迭代映射抽象了计算中的通信方式,然事提出识别规则模式通信模式的形式比条件,接着建立包含对准信息和相应通信开销的数据迭代图,并在数据迭代图的基础上提出了一个启发式算法来计算较优的数据分布和迭代分布,以优化处理单元之间的通信开销,通过发析多个循环嵌套所涉及的多个数组映和     

基于底层数据流分析的恶意软件检测方法

近些年来,层出不穷的恶意软件对系统安全构成了严重的威胁并造成巨大的经济损失,研究者提出了许多恶意软件检测方案。但恶意软件开发中常利用加壳和多态等混淆技术,这使得传统的静态检测方案如静态特征匹配不足以应对。而传统的应用层动态检测方法也存在易被恶意软件禁用或绕过的缺点。本文提出一种利用底层数据流关系进行恶意软件检测的方法,即在系统底层监视程序运行时的数据传递情况,生成数据流图,提取图的特征形成特征向量,使用特征向量衡量数据流图的相似性,评估程序行为的恶意倾向,以达到快速检测恶意软件的目的。该方法具有低复杂度与高检测效率的特点。实验结果表明本文提出的恶意软件检测方法可达到较高的检测精度以及较低的误报率,分别为98.50%及3.18%。     

基于内容的视频拷贝检测研究

提出基于图的视频拷贝检测方法,该方法将视频序列匹配结果转换为匹配结果图,进而将视频拷贝检测转换成在匹配结果图中查找最长路径的问题。实验结果显示基于图的序列匹配算法拷贝定位准确度高,可弥补图像底层特征描述力不足的缺陷,节约检测时间,批量定位2段视频序列中可能存在的多段拷贝。     

An optimal graph theoretic approach to data clustering: theory andits application to image segmentation

A novel graph theoretic approach for data clustering is presented and its application to the image segmentation problem is demonstrated. The data to be clustered are represented by an undirected adjacency graph 𝒢 with arc capacities assigned to reflect the similarity between the linked vertices. Clustering is achieved by removing arcs of 𝒢 to form mutually exclusive subgraphs such that the largest inter-subgraph maximum flow is minimized. For graphs of moderate size (~ 2000 vertices), the optimal solution is obtained through partitioning a flow and cut equivalent tree of 𝒢, which can be efficiently constructed using the Gomory-Hu algorithm (1961). However for larger graphs this approach is impractical. New theorems for subgraph condensation are derived and are then used to develop a fast algorithm which hierarchically constructs and partitions a partially equivalent tree of much reduced size. This algorithm results in an optimal solution equivalent to that obtained by partitioning the complete equivalent tree and is able to handle very large graphs with several hundred thousand vertices. The new clustering algorithm is applied to the image segmentation problem. The segmentation is achieved by effectively searching for closed contours of edge elements (equivalent to minimum cuts in 𝒢), which consist mostly of strong edges, while rejecting contours containing isolated strong edges. This method is able to accurately locate region boundaries and at the same time guarantees the formation of closed edge contours     

Combining temporal partitioning and temporal placement techniques for communication cost improvement

In this paper, we present a typical temporal partitioning methodology that temporally partitions a data flow graph on reconfigurable system. Our approach optimizes the communication cost of the design. This aim can be reached by minimizing the transfer of data required between design partitions and the routing cost between FPGA modules. Consequently, our algorithm is composed by two main steps. The first step aims to find a temporal partitioning of the graph. This step gives the optimal solution in term of communication cost. Next, our approach builds the best architecture, on a partially reconfigurable FPGA, that gives the lowest routing cost between modules. The proposed methodology was tested on several examples on the Xilinx Virtex-II pro. The results show significant reduction in the communication cost compared with others famous approaches used in this field.