基于滑动窗口的直升机序列异常检测算法

无标签的序列在异常检测算法中往往存在着对数据的信息掌握不全面、不能合理使用的情况,而采用深度学习的技术实现检测时往往对其计算的解释性欠佳;对于攻克这些难题,以直升机飞行数据为例对时间序列的反常检测问题展开了深入研究,并利用Iforest技术和PCA算法,给出了一个采用滑动窗口的时间序列异常检测方法,利用从滑动窗口采集信息的时间变化状态等数据信息,将序列异常检测问题转换为点异常检测问题;同时以auc评分为衡量标准,从带有时刻特殊标志的多个信息集上检验了检测效率的提高;在无标签的直升机飞行数据集上进行实验,验证了算法的有效性,并通过对比检测过程中不同特征变量的变化情况,从算法层面和现实层面上阐述了算法的可解释性。     

一种基于降维密度聚类的船舶异常轨迹识别方法

目的 有效分析和探索海洋船舶时空轨迹行为模式,提高船舶轨迹聚类的效率与质量,更好地检测真实船舶的异常行为。方法 针对当前船舶轨迹数据研究中存在的对多维特征信息利用不足、检测效率不高、检测精度较差等问题,提出一种精确度高、能自主识别分析多维特征的船舶异常轨迹识别方法。首先利用随机森林分类器评估多维特征重要性,构建轨迹特征的最优组合;然后提出一种降维密度聚类方法,将T–分布随机邻域嵌入(T–SNE)和自适应密度聚类(DBSCAN)模型结合,通过构建特征选择层和无监督聚类层实现对数据元素非线性关系的高效提取以及对聚类参数的智能选择;最后根据聚类结果构建类簇特征向量,计算距离阈值判别轨迹相似度,实现轨迹异常检测模型的构建。结果 以UCI数据集为例,降维密度聚类方法对4、13、30、64维特征数据集的F1分数能达到0.9 048、0.9 534、0.8 218、0.6 627,多个聚类指标均优于DBSCAN、K–Means等常见聚类算法的。结论 研究结果表明,降维密度聚类方法能有效提取数据多维特征结构,实现聚类参数自适应,弥补密度聚类中参数难以确定的问题,有效实现对多种类型船舶轨迹异常的识别。     

Fine-Grained Multivariate Time Series Anomaly Detection in IoT

Sensors produce a large amount of multivariate time series data to record the states of Internet of Things (IoT) systems. Multivariate time series timestamp anomaly detection (TSAD) can identify timestamps of attacks and malfunctions. However, it is necessary to determine which sensor or indicator is abnormal to facilitate a more detailed diagnosis, a process referred to as fine-grained anomaly detection (FGAD). Although further FGAD can be extended based on TSAD methods, existing works do not provide a quantitative evaluation, and the performance is unknown. Therefore, to tackle the FGAD problem, this paper first verifies that the TSAD methods achieve low performance when applied to the FGAD task directly because of the excessive fusion of features and the ignoring of the relationship’s dynamic changes between indicators. Accordingly, this paper proposes a multivariate time series fine-grained anomaly detection (MFGAD) framework. To avoid excessive fusion of features, MFGAD constructs two sub-models to independently identify the abnormal timestamp and abnormal indicator instead of a single model and then combines the two kinds of abnormal results to detect the fine-grained anomaly. Based on this framework, an algorithm based on Graph Attention Neural Network (GAT) and Attention Convolutional Long-Short Term Memory (A-ConvLSTM) is proposed, in which GAT learns temporal features of multiple indicators to detect abnormal timestamps and A-ConvLSTM captures the dynamic relationship between indicators to identify abnormal indicators. Extensive simulations on a real-world dataset demonstrate that the proposed algorithm can achieve a higher F1 score and hit rate than the extension of existing TSAD methods with the benefit of two independent sub-models for timestamp and indicator detection.     

Prioritizing Information for the Discovery of Phenomena

We consider the problem of prioritizing a collection of discrete pieces of information, or transactions. The goal is to rank the transactions in such a way that the user can best pursue a subset of the transactions in hopes of discovering those which were generated by an interesting source. The problem is shown to differ from traditional classification in several fundamental ways. Ranking algorithms are divided into classes, depending on the amount of information they may utilize. We demonstrate that while ranking by the least constrained algorithm class is consistent with classification, such is not the case for a more constrained class of algorithms. We demonstrate also that while optimal ranking by the former class is easy, optimal ranking by the latter class is NP-hard. Finally, we present detectors which solve optimally restricted versions of the ranking problem, including symmetric anomaly detection.     

树突状细胞算法原理及其应用

描述树突状细胞的生物学机理,给出树突状细胞算法(DCA)的设计、实现及改进过程。介绍DCA在计算机网络、无线传感器网络、实时嵌入式系统和机器人学等方面的应用情况,对算法性能进行评价。基于标准数据集,将DCA与其他方法进行比较,分析DCA存在的问题,指出其下一步的研究方向。     

基于击键压力和时间匹配的异常检测方法

为了有效利用用户的生物特征进行入侵者身份识别,提出了一种基于用户击键特征进行异常检测的新方法.该方法根据人们在击键时所产生的按键压力和时间间隔的惟一性,利用正态分布的特性控制模式库生成方式,构造出能够描述每个用户独有特征的击键特征向量库,然后利用模式匹配算法对新登陆用户进行检测.相关实验验证了该方法具有较高的用户识别能力.     

基于Linux平台的流量统计与异常检测系统的设计与实现

流量统计与异常检测技术具有广泛的应用前景,从一个实际的应用项目出发,针对Netflow流数据的生成、输出、采集、统计、检测等几个方面进行了大量深入的研究,并对统计结果的输出方式、监测算法的参数优化提出了改进。在此基础上,设计并实现了一个基于Linux平台的流量统计与异常检测系统。     

基于密度的离群点挖掘在入侵检测中的应用

给出一种基于密度的局部离群点挖掘方法。采用KDD99数据集进行实验,对数据集中的41个属性提取特征,利用基于密度的聚类对统计处理过的数据集实行剪枝操作,剪除数据集中大部分密集的数据对象,保留未被剪除的候选离群对象集。采用局部离群挖掘方法计算离群候选对象的离群因子,检测出异常攻击。实验结果表明,该方法能保证较高的检测率和较低的误报率。     

A TCAM-based solution for integrated traffic anomaly detection and policy filtering

The survivability of the future Internet is largely dependent on whether it will be able to successfully address both security and performance issues facing the Internet. On one hand, the Internet becomes more and more vulnerable due to fast spreading malicious attacks. On the other hand, it is under great stress to meet ever growing/changing application demands while having to sustain multi-gigabit forwarding performance. In this paper, we propose a Ternary Content Addressable Memory (TCAM) coprocessor based solution for high speed, integrated TCP flow anomaly detection and policy filtering. The attacking packets with spoofed source IP addresses are detected through two-dimensional (2D) matching. The key features of the solution are: (1) setting flag bits in TCAM action code to support various packet treatments; (2) managing TCP flow state in pair to do 2D matching. We evaluate the solution’s ability to detect TCP-based flooding attacks based on real-world-trace simulations. The results show that the proposed solution can match up OC-192 line rate. The possible modifications of the solution for the detection of low rate TCP-targeted attacks are also discussed.     

基于改进遗传算法和隐Markov模型的协议异常检测方法

针对现有基于隐Markov模型的协议异常检测方法中存在的训练样本不足问题和初始参数敏感问题,提出一种基于改进遗传算法和隐Markov模型的协议异常检测新方法。首先,采用局部竞争选择策略、算术交叉算子和自适应非均匀变异算子改进遗传算法,避免传统遗传算法在收敛过程中的“早熟”和“停滞”问题;然后,利用改进的遗传算法优化隐Markov模型的初始参数,解决模型对初始参数敏感的问题;最后,以协议关键词和关键词时间间隔作为训练观测值,细粒度的描述协议行为,扩大模型的训练样本空间。在DARPA 1999数据集上的实验结果表明,该方法具有很高的检测率和较低的误报率。