基于流角色检测P2P botnet

提出了一种基于流角色的实时检测P2P botnet的模型,该模型从流本身的特性出发,使其在检测P2P botnet时处于不同的角色,以发现P2P botnet的本质异常和攻击异常,同时考虑到了网络应用程序对检测的影响。为进一步提高检测精度,提出了一种基于滑动窗口的实时估算Hurst指数的方法,并采用Kaufman算法来动态调整阈值。实验表明,该模型能有效检测新型P2P botnet。     

Asymptotically Optimal Quickest Change Detection in Distributed Sensor Systems

Abstract

In the standard formulation of the quickest change-point detection problem, a sequence of observations, whose distribution changes at some unknown point in time, is available to a decision maker, and the goal is to detect this change as quickly as possible, subject to false alarm constraints. In this paper, we study the quickest change detection problem in the setting where the information available for decision-making is distributed across a set of geographically separated sensors, and only a compressed version of observations in sensors may be used for final decision-making due to communication bandwidth constraints. We consider the minimax, uniform, and Bayesian versions of the optimization problem, and we present asymptotically optimal decentralized quickest change detection procedures for two scenarios. In the first scenario, the sensors send quantized versions of their observations to a fusion center where the change detection is performed based on all the sensor messages. In the second scenario, the sensors perform local change detection and send their final decisions to the fusion center for combining. We show that our decentralized procedures for the latter scenario have the same first-order asymptotic performance as the corresponding centralized procedures that have access to all of the sensor observations. We also present simulation results for examples involving Gaussian and Poisson observations. These examples show that although the procedures with local decisions are globally asymptotically optimal as the false alarm rate (or probability) goes to zero, they perform worse than the corresponding decentralized procedures with binary quantization at the sensors, unless the false alarm rate (or probability) is unreasonably small.     

Discussion on “Change-Points: From Sequential Detection to Biology and Back” by David Siegmund

Abstract

Motivated by Professor Siegmund's article and his other works in the area of change-point analysis and its biomedical applications, we discuss approaches to change-point–related problems that involve parameters of unknown dimension.     

Kullback-Leibler Approach to CUSUM Quickest Detection Rule for Markovian Time Series

Abstract

Optimality properties of decision procedures are studied for the quickest detection of a change-point of parameters in autoregressive and other Markov type sequences. The limit of the normalized conditional log-likelihood ratios is shown to exist for Markov chains satisfying the ergodic theorem of information theory. Then closed-form expressions for this limit are derived by making use of the time average rate of Kullback-Leibler divergence. The good properties of the detection procedures based on a sequential analysis approach are proven to hold thanks to geometric ergodicity properties of the observation processes. In particular, the window-limited CUSUM rule is shown to be optimal for detecting the disruption point in autoregressive models. Sparre Andersen models are specifically studied.     

CUSUM方法在企业能源审计中的应用

在企业能源审计过程中,将统计学中的cumulative sum（CUSUM）方法,用于计算企业的节能技改措施节能量并监测技改措施的实施效果,提出了该方法的具体应用步骤,分析了该方法在计算节能量时较基准单耗对比法更为真实的原因。以某建筑陶瓷企业为实际对象,运用该方法所得的结果与实际情况较为一致,从而验证了该方法在企业能源审计中的可行性,建议在企业能源审计中推广该方法。     

多元累积和控制图及其诊断理论

论述了多元累积和控制图的有关内容,提出了2种质量多元累积和控制图的诊断理论,并与多元T^2控制图进行了比较,最后通过1个实例对诊断理论的应用加以说明。     

应用CUSUM控制图监控过程变差方法的比较

累积和控制图监控过程均值偏移的应用较多,而用于监控过程变差较少。在机械零、部件的大批量、高精度生产过程中,需要同时监控过程均值和变差。在介绍三种主要的监控变差的CUSUM控制图方法基础上,结合案例给予比较,并指出各自的不足之处。     

基于改进CUSUM算法的网络异常流量检测*

首先对网络流量进行异常检测,发现异常后再对数据包进行分析,实施相应措施,有利于降低系统开销。针对在使用CUSUM算法进行流量异常检测时产生的累积和效应问题,提出用自适应算法消除累积和效应的影响,分析了参数的设置对解除报警的延迟时间、误报警等的影响。实验结果表明设计的算法是有效和正确的,可以直接应用于检测SYN洪水攻击等。     

一种适用于认知超宽带的CUSUM频谱感知算法

提出了一种新的认知超宽带频谱感知算法,该算法适合检测低平均信噪比、低占空比的超宽带脉冲信号,且具有复杂度低、检测延迟性能优越的特点.论文根据超宽带脉冲信号特性,给出形式统一的低占空比接收信号概率密度函数表达式,并采用累加和(CUSUM)算法实施检测.仿真结果表明,该算法对低占空比信号具有良好的适应性,有效克服了能量检测的信噪比门限效应,且检测延迟性能优越.