基于流量行为的DDoS检测系统

针对传统攻击检测算法不能实时识别攻击源和受害者的问题,基于对单用户流量行为的分析,设计实现一种实时的DDoS洪流攻击检测和防御系统。通过周期性地检测每个用户发送和接收的流量,判断其是否满足TCP和UDP协议行为的时间同步性,从而有效识别攻击者、受害者和正常用户,并且实时过滤攻击流量和转发正常流量。测试结果表明,该系统能够在攻击早期实时地检测出攻击者并过滤其流量,防御效果明显。     

基于累积和算法的域名系统缓存攻击检测

针对域名系统(DNS)缓存攻击,提出一种简单有效的检测机制。为增强对攻击行为的敏感性并减小计算复杂度,通过无参数累积和检测模型改进DNS的协议行为,利用变点检测的相关算法实现对攻击行为的检测。仿真结果表明,该机制能够有效检测DNS缓存攻击,并实现检测准确率和误警率间的平衡。     

The Effect of Estimation Error on Risk‐Adjusted Survival Time CUSUM Chart Performance

Research on risk‐adjusted control charts has gained great interest in healthcare settings. Based on monitored variables (binary outcome or survival times), risk‐adjusted cumulative sum (CUSUM) charts are divided into Bernoulli and survival time CUSUM charts. The effect of estimation error on control chart performance has been systematically studied for Bernoulli CUSUM but not for survival time CUSUM in continuous time. We investigate the effect of estimation error on the performance of risk‐adjusted survival time CUSUM scheme in continuous time with the cardiac surgery data. The impact is studied with the use of the median run lengths (medRLs) and the standard deviation (SD) of medRLs for different sample sizes, specified in‐control median run length, adverse event rate and patient variability. Results show that estimation error affects the performance of risk‐adjusted survival time CUSUM chart significantly and the performance is more sensitive to the specified in‐control median run length (medRL₀) and adverse event rate. To take the estimation error into account, the practitioners can bootstrap many samples from Phase I data and then determine the threshold that can guarantee at least a medRL₀ with certain probability under which false alarms occur less frequently and meanwhile out‐of‐control alarms don't signal too slow. Moreover, additional event occurrences can be used to update the estimation but should be from in‐control process. Finally, non‐parametric bootstrap can be applied to reduce model misspecification error. Copyright © 2015 John Wiley & Sons, Ltd.     

An Efficient Shewhart‐Type Control Chart to Monitor Moderate Size Shifts in the Process Mean in Phase II

According to Shewhart, control charts are not very sensitive to small and moderate size process shifts that is why those are less likely to be effective in Phase II. So to monitor small or moderate size process shifts in Phase II, cumulative sum (CUSUM) and exponentially weighted moving average (EWMA) control charts are considered as alternate of Shewhart control charts. In this paper, a Shewhart‐type control chart is proposed by using difference‐in‐difference estimator in order to detect moderate size shifts in process mean in Phase II. The performance of the proposed control chart is studied for known and unknown cases separately through a detailed simulation study. For the unknown case, instead of using reference samples of small sizes, large size reference sample(s) is used as we can see in some of nonparametric control chart articles. In an illustrative example, the proposed control charts are constructed for both known and unknown cases along with Shewhart ‐chart, classical EWMA, and CUSUM control charts. In this application, the proposed chart is found comprehensively better than not only Shewhart ‐chart but also EWMA and CUSUM control charts. By comparing average run length, the proposed control chart is found always better than Shewhart ‐chart and in general better than classical EWMA and CUSUM control charts when we have relatively higher values of correlation coefficients and detection of the moderate shifts in the process mean is concerned. Copyright © 2015 John Wiley & Sons, Ltd.     

A New Rank‐based Multivariate CUSUM Approach for Monitoring the Process Mean

In many cases, data do not follow a specific probability distribution in practice. As a result, a variety of distribution‐free control charts have been developed to monitor changes in the processes. An existing rank‐based multivariate cumulative sum (CUSUM) procedure based on the antirank vector does not quickly detect the large shift levels of the process mean. In this paper, we explore and develop an improved version of the existing rank‐based multivariate CUSUM procedure in order to overcome the difficulty. The numerical experiments show that the proposed approach dramatically outperforms the existing rank‐based multivariate CUSUM procedure in terms of the out‐of‐control average run length. In addition, the proposed approach particularly resolves the critical problem of the original approach, which occurs in the simultaneous shifts whose components are all the same but not 0. We believe that the proposed approach can be utilized for monitoring real data. Copyright © 2015 John Wiley & Sons, Ltd.     

Combined Application of Shewhart and Cumulative Sum R Chart for Monitoring Process Dispersion

This study analyzes the performance of combined applications of the Shewhart and cumulative sum (CUSUM) range R chart and proposes modifications based on well‐structured sampling techniques, the extreme variations of ranked set sampling, for efficient monitoring of changes in the process dispersion. In this combined scheme, the Shewhart feature enables quick detection of large shifts from the target standard deviation while the CUSUM feature takes care of small to moderate shifts from the target value. We evaluate the numerical performance of the proposed scheme in terms of the average run length, standard deviation of run length, the average ratio average run length, and average extra quadratic loss. The results show that the combined scheme can detect changes in the process that were small or large enough to escape detection by the lone Shewhart R chart or CUSUM R chart, respectively. We present a comparison of the proposed schemes with several dispersion charts for monitoring changes in process variability. The practical application of the proposed scheme is demonstrated using real industrial data. Copyright © 2014 John Wiley & Sons, Ltd.     

Efficient global monitoring statistics for high-dimensional data

Global monitoring statistics play an important role in developing efficient monitoring schemes for high-dimensional data. A number of global monitoring statistics have been proposed in the literature. However, most of them only work for certain types of abnormal scenarios under specific model assumptions. How to develop global monitoring statistics that are powerful for any abnormal scenarios under flexible model assumptions is a long-standing problem in the statistical process monitoring field. To provide a potential solution to this problem, we propose a novel class of global monitoring statistics. Our proposed global monitoring statistics are easy to calculate and can work under flexible model assumptions since they can be built on any local monitoring statistic that is suitable for monitoring a single data stream. Our simulation studies show that the proposed global monitoring statistics perform well across a broad range of settings and compare favorably with existing methods.     

Detecting changes in a multiparameter exponential family by using adaptive CUSUM procedure

An adaptive cumulative sum (CUSUM) procedure is proposed to monitor parameter changes in a multiparameter exponential family where the change-point and postchange parameters are estimated adaptively. Approximations for average run lengths are derived. Monitoring changes in both mean and variance in the normal case is considered as an illustration. The conditional biases of the estimations for the change-point and postchange mean and variance is studied by simulation comparison with several other CUSUM procedures. An adaptive dam process by modifying the adaptive CUSUM process is used to detect and identify change points and change segments by using Citibank stock prices from 30 Dow Jones Industry Index.     

A head-to-head comparative study of the conditional performance of control charts based on estimated parameters

Implementation of the Shewhart, CUSUM, and EWMA charts requires estimates of the in-control process parameters. Many researchers have shown that estimation error strongly influences the performance of these charts. However, a given amount of estimation error may differ in effect across charts. Therefore, we perform a pairwise comparison of the effect of estimation error across these charts. We conclude that the Shewhart chart is more strongly affected by estimation error than the CUSUM and EWMA charts. Furthermore, we show that the general belief that the CUSUM and EWMA charts have similar performance no longer holds under estimated parameters.     

A linear‐time method for computing the ANOS of Bernoulli and Poisson CUSUM charts

The average number of observations to signal (ANOS) is an important measure of the effectiveness of Bernoulli or Poisson cumulative sum (CUSUM) control charts. Being able to quickly and accurately calculate an ANOS vector facilitates effective control chart design. We present a linear‐time method for computing the ANOS of Bernoulli CUSUM charts and generalize to Poisson CUSUM charts. This method overcomes computation challenges associated with previously existing methods.