基于层次隐马尔科夫模型和变长语义模式的入侵检测方法

分析了定长系统调用短序列在入侵检测系统应用中的不足,利用进程堆栈中的函数调用返回地址信息,提出了一种变长短序列的语义模式切分方法,并根据这种变长语义模式之间的层次关系和状态转移特性提出了基于层次隐马尔科夫模型的入侵检测方法.实验结果表明,与传统的隐马尔科夫模型相比,基于层次隐马尔科夫模型的入侵检测方法具有更好的检测效果.     

利用SVM的聚类算法在时间序列信号识别中的应用

研究了一维时间序列信号识别的问题.针对基于混合高斯模型的隐马尔科夫(HMM)编码准确率低的问题,提出了一种利用多个支持向量机构造混合支持向量机,从而为隐马尔科夫模型提供更精确的观测值编码和发生矩阵,能有效的提高HMM在语音信号识别或者文字识别中的准确率.本方法可以应用到语音识别,文字识别以及生物信息处理等领域.     

基于N阶近邻路网的车辆行程时间估计模型

车联网的提出为智能交通的研究提供了新的交通信息收集技术.针对短时交通中车辆的路网行程时间估计问题,提出了基于N阶近邻的隐马尔科夫模型,利用马尔科夫性质来解决道路行程时间的前后关联性问题,同时考虑不同道路的异构性构建了N阶近邻路网模型来模拟路网间的交互影响.针对短时交通中实时数据更新的问题,提出基于道路关联性算法,并结合车联网的采集技术给出了迭代更新模型的方法.实验表明,本文提出的方法在短时交通车辆行程时间预测中精度较高,能够在车辆行进中做出实时预测.     

一种基于加权隐马尔可夫的 自回归状态预测模型

针对电子系统状态趋势预测问题,提出了一种加权隐马尔可夫模型的自回归趋势预测方法.该方法以自回归模型作为隐马尔可夫的状态输出,利用加权预测思想对马尔可夫链中的隐状态进行混合高斯模型的加权序列预测,并利用最大概率隐状态下的自回归系数计算模型输出.通过对实际的复杂混沌序列和电子系统BIT状态数据进行趋势预测,并针对不同模型参数下的预测结果进行实验分析,结果表明该方法对系统状态变化的趋势具有较好的预测性能.     

基于谱聚类的高阶模糊时序自适应预测方法

结合数据特征及分布特点提出一种基于谱聚类的模糊时间序列自适应预测方法。首先基于谱聚类的思想,根据样本数据特征获取其所属论域的个数及范围,实现向模糊时间序列的自适应转化;然后基于Markov概率模型表示模糊时间序列中的模糊关系,从而对多步模糊关系、高阶模糊关系及模糊关系的稳态进行求解;最后获取预测值的可能模糊状态,进而利用去模糊化方法将其还原为预测值。在真实以及人工时间序列数据上的实验表明了所提方法的合理性与有效性。     

一种基于Opinosis图和马尔科夫随机游走模型的多文本情感摘要框架

针对在线文本情感摘要生成问题,本文提出了一种基于Opinosis图和马尔科夫随机游走模型的情感摘要框架.首先,该框架将原始文本转化为Opinosis图,并利用其挖掘出文本中的特征词,这些特征词可以用来对原始文本的句子进行分类;其次本文在基于聚类的条件马尔科夫随机游走模型的基础上增加了情感层,改进后的模型可以判断同一聚类中各句子的情感倾向是否具有代表性并结合情感和聚类信息对句子进行排序.实验结果表明,本文提出的方法与基准算法相比在ROUGE（Recall-Oriented Understudy for Gisting Evaluation）值上具有明显提高.     

基于EEMD技术在电力信息安全中的多步时间序列预测方法

针对用户访问轨迹的数据特征,提出一种基于EEMD技术的多步时间序列预测模型。该模型利用了集合经验模态分解EEMD结合极限学习机ELM模型,混合人工鱼群MAFA优化的方式,克服了算法中存在过拟合和多步时间序列预测的策略限制问题。通过该模型,实现了对访问轨迹时间序列多步预测,结合安全范围包络线,进而提前发现是否存在入侵行为。验证结果表明,优化后的EEMD-ELM模型比传统时间序列预测方法的迭代速率与精度得到了极大提高,泛化能力增强,说明了该方法的有效性、可行性。     

混沌时间序列局域偏最小二乘回归多步预测模型

针对混沌序列局域一阶多步预测问题,提出了基于偏最小二乘回归的混沌时间序列局域直接多步预测模型,偏最小二乘用于混沌时序重构相空间中演化轨迹前后相点信息间的建模。该模型克服了以往一阶局域单步预测模型进行多步预测时存在的误差累积,而且能抑制重构相空间中多重共线性的影响,提高了预测精度。试验中使用交叉验证方法将偏最小二乘的提取成分数。通过对Chen’s混沌序列和Mackey-Glass混沌序列的多步预测试验,验证了该模型在混沌时序预测方面具有很好的效果。     

隐马尔科夫模型检测LDoS攻击方法的研究

针对低速率拒绝服务LDoS （Low-Rate Denial of Service）攻击具有平均速率低、隐蔽性强的特点,提出了一种基于隐马尔科夫模型的LDoS攻击检测方法。首先对网络状态建立隐马尔科夫模型,将归一化累计功率谱密度NCPSD（Normalized Cumulative Power Spectrum Density）方法的检测结果作为隐马尔科夫模型的观测值。利用前向算法得到不同观测值序列在该模型下的相似度作为检测依据。在NS 2中对本检测方法进行测试,实验结果表明本方法能够有效的检测LDoS攻击,与其他方法相比也具有更好的检测性能。通过假设检验得出检测率为99.96%。      

状态不可观测的信息物理融合系统运行时验证

确保信息物理融合系统（Cyber-Physical System,CPS）运行时行为正确性是至关重要的,尤其在航空航天、汽车、核电和医疗等安全攸关领域.本文针对具有随机行为且状态不可观测的CPS,提出一种基于隐马尔科夫模型的运行时安全性验证方法.首先构造状态不可观测的CPS运行时安全性验证框架,该框架通过隐马尔科夫模型表示系统,使用确定性有限自动机规约系统安全属性的否定,两者的乘积自动机作为运行时监控器,从而将CPS运行时安全性验证问题约简到监控器上的概率推断问题.然后,提出一种增量迭代安全性验证算法以及反例生成算法.实验结果表明本文算法和粒子滤波算法相比预测错误率下降了近20%,并且当系统违背安全属性时,本文的方法能给出反例.     

A high precision global prediction approach based on local prediction approaches

Traditional model-free prediction approaches, such as neural networks or fuzzy models use all training data without preference in building their prediction models. Alternately, one may make predictions based only on a set of the most recent data without using other data. Usually, such local prediction schemes may have better performance in predicting time series than global prediction schemes do. However, local prediction schemes only use the most recent information and ignore information bearing on far away data. As a result, the accuracy of local prediction schemes may be limited. In this paper a novel prediction approach, termed the Markov-Fourier gray model (MFGM), is proposed. The approach builds a gray model from a set of the most recent data and a Fourier series is used to fit the residuals produced by this gray model. Then, the Markov matrices are employed to encode possible global information generated also by the residuals. It is evident that MFGM can provide the best performance among existing prediction schemes. Besides, we also implemented a short-term MFGM approach, in which the Markov matrices only recorded information for a period of time instead of all data. The predictions using MFGM again are more accurate than those using short-term MFGM. Thus, it is concluded that the global information encoded in the Markov matrices indeed can provide useful information for predictions.     

State-dependent vector hybrid linear and nonlinear ARMA modeling: Applications

In a recent companion paper, a new method has been presented for modeling general vector nonstationary and nonlinear processes based on a state-dependent vector hybrid linear and nonlinear autoregressive moving average (SVH-ARMA) model. This paper discusses some potential applications of the SVH-ARMA model, including signal filtering, time series prediction, and system control. First, a state-space model governed by a hidden Markov Chain is shown to be equivalent to the SVH-ARMA model. Based on this state-space model, the extended Kalman filtering and Bayesian estimation techniques are applied for noisy signal enhancement. The result of a noisy image enhancement verifies that the model can track the time-varying statistical characteristics of nonstationary and nonlinear processes adaptively. Second, the SVH-ARMA model is used for a vector time series prediction, which can attain more accurate multiple step ahead prediction, than conventional forecasting methods. Third, a new technique is developed for predicting scalar long correlation time series in the wavelet scale space domain based on the SVH-ARMA model. Dyadic wavelet transform is employed to convert a scalar time series to a vector time series, to which the SVH-ARMA model is applied for vector time series prediction. More accurate and robust forecasting results in both one step and multiple step ahead prediction can be gained. See also the companion paper on theory, by Zheng et al., pp. 551–574, this issue.     

A hidden Markov model-based algorithm for fault diagnosis withpartial and imperfect tests

We present a hidden Markov model (HMM) based algorithm for fault diagnosis in systems with partial and imperfect tests. The HMM-based algorithm finds the most likely state evolution, given a sequence of uncertain test outcomes over time. We also present a method to estimate online the HMM parameters, namely, the state transition probabilities, the instantaneous probabilities of test outcomes given the system state and the initial state distribution, that are fundamental to HMM-based adaptive fault diagnosis. The efficacy of the parameter estimation method is demonstrated by comparing the diagnostic accuracies of an algorithm with complete knowledge of HMM parameters with those of an adaptive one. In addition, the advantages of using the HMM approach over a Hamming-distance based fault diagnosis technique are quantified. Tradeoffs in computational complexity versus performance of the diagnostic algorithm are also discussed     

Investigation on random access in a VLC system with multipacket reception in the presence of hidden devices and obstructions

Due to the directionality of light, the hidden device problem and the obstruction cannot be ignored for carrier sense multiple access with collision avoidance (CSMA/CA)-based uplink visible light communication (VLC). In this paper, we introduce multipacket reception (MPR) to handle the hidden device problem in VLC system. We model the traffic of the device with on/off Markov source. With the unsaturated traffic, we formulate a two dimensional (2D) Markov chain to model the CSMA/CA-based slotted random access procedure to evaluate the effects of hidden devices and obstructions on the performance of MPR-aided VLC system, which are mapped into the transition probabilities of the Markov chain. Then, we analyze the throughput and the reception power efficiency (RE) of MPR-aided VLC system with the obstructed optical channel. Numerical results show that the effect is negative when hidden devices or obstructions appear solely. But when they appear simultaneously, they will interact with each other to mitigate the negative effects.     

Hidden Markov models for wavelet-based blind source separation.

In this paper, we consider the problem of blind source separation in the wavelet domain. We propose a Bayesian estimation framework for the problem where different models of the wavelet coefficients are considered: the independent Gaussian mixture model, the hidden Markov tree model, and the contextual hidden Markov field model. For each of the three models, we give expressions of the posterior laws and propose appropriate Markov chain Monte Carlo algorithms in order to perform unsupervised joint blind separation of the sources and estimation of the mixing matrix and hyper parameters of the problem. Indeed, in order to achieve an efficient joint separation and denoising procedures in the case of high noise level in the data, a slight modification of the exposed models is presented: the Bernoulli-Gaussian mixture model, which is equivalent to a hard thresholding rule in denoising problems. A number of simulations are presented in order to highlight the performances of the aforementioned approach: 1) in both high and low signal-to-noise ratios and 2) comparing the results with respect to the choice of the wavelet basis decomposition.     

A Posteriori Probability Distances Between Finite-Alphabet Hidden Markov Models

In this correspondence, we consider a probability distance problem for a class of hidden Markov models (HMMs). The notion of conditional relative entropy between conditional probability measures is introduced as an a posteriori probability distance which can be used to measure the discrepancy between hidden Markov models when a realized observation sequence is observed. Using a measure change technique, we derive a representation for conditional relative entropy in terms of the parameters of the HMMs and conditional expectations given measurements. With this representation, we show that this distance can be calculated using an information state approach     

Maximum likelihood hidden Markov modeling using a dominant sequenceof states

Approximate maximum likelihood (ML) hidden Markov modeling using the most likely state sequence (MLSS) is examined and compared with the exact ML approach that considers all possible state sequences. It is shown that for any hidden Markov model (HMM), the difference between the approximate and the exact normalized likelihood functions cannot exceed the logarithm of the number of states divided by the dimension of the output vectors (frame length). Furthermore, for Gaussian HMMs and a given observation sequence, the MLSS is typically the sequence of nearest neighbor states in the Itakura-Saito sense, and the posterior probability of any state sequence which departs from the MLSS in a single time instant, decays exponentially with the frame length. Hence, for a sufficiently large frame length the exact and approximate ML approach provide similar model estimates and likelihood values