基于隐马尔可夫模型的用户行为异常检测新方法

提出一种基于隐马尔可夫模型的用户行为异常检测方法,主要用于以shell命令为审计数据的主机型入侵检测系统。与Lane T提出的检测方法相比,所提出的方法改进了对用户行为模式和行为轮廓的表示方式,在HMM的训练中采用了运算量较小的序列匹配方法,并基于状态序列出现概率对被监测用户的行为进行判决。实验表明,此方法具有很高的检测准确度和较强的可操作性。     

Power spectral density estimation via wavelet decomposition

A soft decision algorithm for wavelet decomposition, in which a probability measure is assigned to each frequency band bearing energy, is presented. This soft decision algorithm is used as an approximate estimator of power spectral density. A staircase approximation of power spectral density (PSD) is obtained by plotting the 2/sup m/ probabilities after an m-stage decomposition. Different wavelet filters are used for estimating the PSD of a speech segment. The type of the wavelet filter used can be selected as a compromise between accuracy and complexity.     

Traffic-based queue-aware scheduling for 3GPP LTE system

Although the medium access control （MAC） signaling has been well-defined in the 3rd generation partnership project （3GPP） long term evolution （LTE） specifications, the scheduling algorithm crucial to guarantee QoS performance, still remains as open issues. In this article, a traffic-based queue-aware scheduling （TQS） algorithm is proposed for evolved nodeB＇s （eNB＇s） MAC scheduler in 3GPP LTE broadband wireless networks. The proposed TQS is divided into three sub-algorithms： firstly, the authors propose a traffic model construction （TMC） algorithm which can construct a discrete-time Markov-modulated Poisson process （dMMPP） to represent each flow. Secondly, a newly traffic state estimation （TSE） algorithm is designed to obtain the queue＇s analytical statistics. Thirdly, based on the derived results of TSE and the channel states, a scheduling action decision （SAD） algorithm is presented that can adaptively allocate bandwidth to flows by considering both queue states and spectrum efficiency. Simulation shows that the TMC and TSE algorithm can capture the fluctuation of traffic and queue accurately. Moreover, compared with a widely accepted traffic-based scheduling algorithm, the proposed TQS has better average queue length and overflow probability performance.     

Decoding algorithms for noncoherent trellis coded modulation

Noncoherent decoding of trellis codes using multiple-symbol overlapped observations was shown previously to achieve close to the coherent performance. Optimal decoding by the Viterbi algorithm for L-symbol observations requires a number of states which grows exponentially with L. Two novel suboptimal algorithms are presented, for which the number of states is the same as the original code, yielding a complexity depending weakly on L. For practical values of L, both algorithms are substantially less complex than the optimal algorithm. The first algorithm, the basic decision feedback algorithm (BDFA), is a low complexity feedback decoding scheme, based on the Viterbi algorithm. This algorithm is shown to suffer from increased error probability and from error propagation. A slight modification to this algorithm can, in most cases, reduce these effects significantly. The second algorithm uses the BDFA as a basic building block. This algorithm is based on a novel concept called “estimated future” and its performance is very close to optimum for most practical eases with some additional complexity and memory requirements as compared to the first algorithm. Performance analysis and simulation results are also given     

Decision feedback sequence estimation for continuous phasemodulation on a linear multipath channel

An approach to reduced-complexity detection of partial response continuous phase modulation (CPM) on a linear multipath channel is presented. The method, referred to as decision feedback sequence estimation (DFSE), is based on a conventional Viterbi algorithm (VA) using a reduced-state trellis combined with decision feedback (DF). By varying the number of states in the VA, the receiver structure can be changed gradually from a DF receiver to the optimal maximum-likelihood sequence estimator (MLSE). In this way different tradeoffs between performance and complexity can be obtained. Results on the receiver performance, based on minimum distance calculations and bit error rate simulations, are given for Gaussian minimum-shift keying modulation on typical mobile radio channels. It is shown that for channels with a long memory, a significant complexity reduction can be achieved at the cost of a moderate degradation in performance     

一种类型辅助的航迹相关算法

针对分布式多传感器信息融合系统中可利用目标特征和属性信息提高航迹相关性能的问题,提出了一种类型辅助的航迹相关算法。该算法以统计学理论为基础,首先将基于目标运动状态和类型信息的航迹相关问题转化为相应的假设检验问题;然后,利用目标运动状态检验统计量和类型检验统计量,根据预设的显著性因子,构建运动状态相关矩阵和类型相关矩阵,并通过逻辑“与”规则形成融合航迹相关矩阵;最后,采用最小平均统计距离准则进行相关判决,并通过Monte Carlo仿真分析了基于运动状态的航迹相关算法和类型辅助的航迹相关算法的相关正确率随相关点数、编队中的目标间距和过程噪声系数等因素的变化规律。仿真结果表明,在相关点数较少、目标密集或过程噪声较大等情况下,在航迹相关过程中引入目标类型信息可以获得更好的性能。      

Decision Feedback Equalization of Dispersive Radio Channels

The performance of adaptive decision feedback equalization applied to high bit rate digital radio systems in the presence of multipath propagation is analytically investigated. Minimum phase (MP) and nonminimum phase (NMP) type fades as well as the transition periods between these two states are considered. Insight is given into the IF recovered timing epoch and its consequences on the decision feedback equalizer (DFE) behavior, especially during transition periods. Required conditions on the DFE structure for ensuring its maximum efficiency are derived and a modified updating algorithm is presented. Finally, dynamic simulation results are reported and compared to theoretical results. They show that the proposed structure is capable of coping with most propagation conditions.     

Optimum soft-output detection for channels with intersymbol interference

In contrast to the conventional Viterbi algorithm (VA) which generates hard-outputs, an optimum soft-output algorithm (OSA) is derived under the constraint of fixed decision delay for detection of M-ary digital signals in the presence of intersymbol interference and additive white Gaussian noise. The OSA, a new type of the conventional symbol-by-symbol maximum a posteriori probability algorithm, requires only a forward recursion and the number of variables to be stored and recursively updated increases linearly, rather than exponentially, with the decision delay. Then, with little performance degradation, a suboptimum soft-output algorithm (SSA) is obtained by simplifying the OSA. The main computations in the SSA, as in the VA, are the add-compare-select operations. Simulation results of a convolutional-coded communication system are presented that demonstrate the superiority of the OSA and the SSA over the conventional VA when they are used as detectors. When the decision delay of the detectors equals the channel memory, a significant performance improvement is achieved with only a small increase in computational complexity.<>     

一种基于隐马尔可夫模型的IDS异常检测新方法

提出一种新的基于隐马尔可夫模型的异常检测方法,主要用于以shell命令或系统调用为原始数据的IDS。此方法对用户(或程序)行为建立特殊的隐马尔可夫模型,根据行为模式所对应的序列长度对其进行分类,将行为模式类型同隐马尔可夫模型的状态联系在一起,并引入一个附加状态。由于模型中各状态对应的观测值集合互不相交,模型训练中采用了运算量较小的的序列匹配方法,与传统的Baum-Welch算法相比,大大减小了训练时间。根据模型中状态的实际含义,采用了基于状态序列出现概率的判决准则。利用UNIX平台上用户shell命令数据进行的实验表明,此方法具有很高的检测准确性,其可操作性也优于同类方法。     

A reduced-state Viterbi receiver with prefiltering for the mobile radio channel

This paper presents a possible receiver structure for high bit rate transmission on the mobile radio channel. The receiver is based on a reduced-state Viterbi algorithm combined with decision feedback, known as Decision Feedback Sequence Estimation. A tdma concept using a training sequence for channel estimation and continuous phase modulation is assumed. For channel estimation a least squares method is studied, and an adaptive prefilter is used to improve the receiver performance on minimum phase channels. Estimates on the computational complexity of the receiver and simulation results showing the performance on a typical urban (tu) channel are presented. The results show that the prefilter improves the performance of the receiver significantly when a small number of states is used in the Viterbi algorithm. However, the computational complexity for 2 Mbit/s continuous transmission is very high.     

Efficient symbolic computation of generalised spectra

An efficient algorithm is presented for the calculation of any generalised spectrum represented as an algebraic decision diagram (ADD) from an ordered binary decision diagram (OBDD) of a Boolean function, and vice versa     

基于遗传算法的快速软判决译码

本文采用遗传算法实现快速软判决译码（ＧＳＤ）。将软判决译码问题转化为相应的组合优化问题,利用遗传算法固有的并行特性和启发式搜索能力,进行快速优化计算,完成快速软判决译码。该算法适合于并行的译码结构,能够在保持译码性能不变的同时,加快译码速度。模拟计算表明：算法的泽码性能和译码速度都比较好,具有较高的实用价值。     

切换时延不为零的光交换调度算法

文章针对切换时延不为零的光交换调度提出了一种新算法--2近似启发算法.算法由两部分组成:选择匹配和决策权重.其中,选择匹配是确定光交叉阵列的切换次数,由贪心算法完成;决策权重是决定各个配置的持续时长,它是通过选择一个值以使剩下的业务矩阵的开销估计最优.2近似启发算法的近似因子为2,时间复杂度为O(N2logN).仿真表明这种调度算法更接近最优调度,比DOUBLE[1]和ADJUST[2]算法更能自适应传送来的不同业务模式.     

适合高阶QAM的载波恢复算法

为解决DVB—C系统中多电平调制信号(如64，128，256QAM)的频偏捕获，描述了一种极性判决鉴相的算法，该算法可捕获高阶QAM信号的频偏达200kHz。对于一般的频偏较小的QAM信号可用传统的DD算法纠正。这样对收到的带有较大频偏和噪声、部分多径的基带信号就可先用极性判决捕获大频偏，稳定之后再用全星座判决纠正剩下的小频偏。     

Adaptive solution for blind identification/equalization usingdeterministic maximum likelihood

A deterministic maximum likelihood (DML) approach is presented for the blind channel estimation problem. It is first proposed in a block version, which consists of iterating two steps, each one solving a least-squares problem either in the channel or in the symbols. In the noiseless case and under certain conditions, this algorithm gives the exact channel and the exact symbol vector with a finite number of samples. It is shown that even if the DML method has a single global minimum, the proposed iterative procedure can converge to spurious local minima. This problem can be detected (under some channel diversity conditions) by using a numerical test that is proposed in the paper. Based on these considerations, we extend the maximum likelihood block algorithm (MLBA) to recursive implementations [maximum likelihood recursive algorithm (MLRA)]. The MLRA is able to track variations of the system by the introduction of an exponential forgetting factor in the DML criterion. The link between the adaptive algorithm and a soft decision feedback equalizer (SDFE) is emphasized. Low-complexity versions of the recursive and adaptive algorithm are presented     

一种Golay码的快速译码算法

本文提出了一种（２４，１２，８）扩展Ｇｏｌａｙ码的新的软判决译码算法，其译一组码字的运算量最多为５０７次二元运算，优于目前已发表的各种算法。我们证明了该算法，并实现了广义最小距离译码。计算机模拟表明在完备译码时其性能与最大似然译码几乎一样。     

Tracking the direction-of-arrival of multiple moving targets bypassive arrays: algorithm

We propose a maximum likelihood (ML) approach for tracking the direction-of-arrival (DOA) of multiple moving targets by a passive array. A locally linear model is assumed for the target motion, and the multiple target states (MTSs) are defined to describe the states of the target motion, The locally linear model is shown to be strongly locally observable almost everywhere. The approach is to estimate the initial MTS by maximizing the likelihood function of the array data. The tracking is implemented by prediction through the target motion dynamics using the initial MTS estimate. By incorporating the target motion dynamics, the algorithm is able to eliminate the spread spectrum effects due to target motion. A modified Newton-type algorithm is also presented, which ensures fast convergence of the algorithm. Finally, numerical simulations are included to show the effectiveness of the proposed algorithm     

一种基于Chase的RS码代数软判决译码算法

为了提高RS码的纠错性能,本文提出了一种基于Chase的代数软判决译码算法,称为Chase-ASD.该算法充分利用了接收比特的可信度信息,但运算复杂度较高.针对该算法运算复杂度高的问题,本文进一步给出了简化的Chase-ASD算法.仿真结果表明,提出的Chase-ASD和简化的Chase-ASD算法均可比原ASD算法提供更多的译码增益.     

An algorithm to find minimal cuts of coherent fault-trees withevent-classes, using a decision tree

A new algorithm, the Carrasco-Sune minimal cuts (CS-MC) algorithm for computing the minimal cuts of s-coherent fault trees is presented. Input events of the fault tree are assumed classified into classes, where events of the same class are indistinguishable. This allows capturing some symmetries which some systems exhibit. CS-MC uses a decision tree. The search implemented by the decision tree is guided by heuristics which try to make the CS-MC algorithm as efficient as possible. In addition, an irrelevance test on the inputs of the fault tree is used to prune the search. The performance of CS-MC is illustrated and compared with the basic top-down and bottom-up algorithms using a set of fault trees, some of which are very difficult. The CS-MC performs very well even in the difficult examples, and the memory requirements of CS-MC are small     

MPEG-2到H.264转码的快速模式选择算法

研究了MPEG-2到H.264的转码技术,主要偏重帧间和帧内的快速模式选择。提出了基于DCT域SAD的快速帧内模式选择算法以及基于DCT系数阈值的快速帧间模式选择算法。实验表明,在对PSNR和码率影响较小的情况下,本算法能大大提高转码速率。