基于特征选择的网络入侵检测模型研究

为了有效从收集的恶意数据中选择特征去分析,保障网络系统的安全与稳定,需要进行网络入侵检测模型研究。但目前方法是采用遗传算法找出网络入侵的特征子集,再利用粒子群算法进行进一步选择,找出最优的特征子集,最后利用极限学习机对网络入侵进行分类,但该方法准确性较低。为此,提出一种基于特征选择的网络入侵检测模型研究方法。该方法首先以增强寻优性能为目标对网络入侵检测进行特征选择,结合分析出的特征选择利用特征属性的Fisher比构造出特征子集的评价函数,然后结合计算出的特征子集评价函数进行支持向量机完成对基于特征选择的网络入侵检测模型研究方法。仿真实验表明,利用支持向量机对网络入侵进行检测能有效地提高入侵检测的速度以及入侵检测的准确性。     

How to Effectively Collect and Process Network Data for Intrusion Detection?

The number of security breaches in the cyberspace is on the rise. This threat is met with intensive work in the intrusion detection research community. To keep the defensive mechanisms up to date and relevant, realistic network traffic datasets are needed. The use of flow-based data for machine-learning-based network intrusion detection is a promising direction for intrusion detection systems. However, many contemporary benchmark datasets do not contain features that are usable in the wild. The main contribution of this work is to cover the research gap related to identifying and investigating valuable features in the NetFlow schema that allow for effective, machine-learning-based network intrusion detection in the real world. To achieve this goal, several feature selection techniques have been applied on five flow-based network intrusion detection datasets, establishing an informative flow-based feature set. The authors’ experience with the deployment of this kind of system shows that to close the research-to-market gap, and to perform actual real-world application of machine-learning-based intrusion detection, a set of labeled data from the end-user has to be collected. This research aims at establishing the appropriate, minimal amount of data that is sufficient to effectively train machine learning algorithms in intrusion detection. The results show that a set of 10 features and a small amount of data is enough for the final model to perform very well.     

Attention Mechanisms and Their Applications to Complex Systems

Deep learning models and graphics processing units have completely transformed the field of machine learning. Recurrent neural networks and long short-term memories have been successfully used to model and predict complex systems. However, these classic models do not perform sequential reasoning, a process that guides a task based on perception and memory. In recent years, attention mechanisms have emerged as a promising solution to these problems. In this review, we describe the key aspects of attention mechanisms and some relevant attention techniques and point out why they are a remarkable advance in machine learning. Then, we illustrate some important applications of these techniques in the modeling of complex systems.     

Robustness quantification method for network intrusion detection models

Deep learning techniques have been successfully applied to network intrusion detection tasks, but as in the case of autonomous driving and face recognition, the reliability of the system itself has become a pressing issue. Robustness is a key attribute to determine whether a deep learning system is secure and reliable, and we also choose to explore the security of intrusion detection models from a new perspective of robustness quantification. In this paper, we focus on the intrusion detection model based on long and short-term memory, and use a fine-grained linear approximation method to derive a more accurate robustness bound on the nonlinear activation function with tighter linear constraints. We can use this bound to quantitatively measure the robustness of the detection model and determine whether the model is susceptible to the influence of adversarial samples. In our experiments, we test networks with various structures on the MNIST dataset, and the results show that our proposed method can effectively deduce the robustness bounds of output elements, and has good scalability and applicability.     

An Insider Data Leakage Detection Using One-Hot Encoding,Synthetic Minority Oversampling and Machine Learning Techniques

Insider threats are malicious acts that can be carried out by an authorized employee within an organization. Insider threats represent a major cybersecurity challenge for private and public organizations, as an insider attack can cause extensive damage to organization assets much more than external attacks. Most existing approaches in the field of insider threat focused on detecting general insider attack scenarios. However, insider attacks can be carried out in different ways, and the most dangerous one is a data leakage attack that can be executed by a malicious insider before his/her leaving an organization. This paper proposes a machine learning-based model for detecting such serious insider threat incidents. The proposed model addresses the possible bias of detection results that can occur due to an inappropriate encoding process by employing the feature scaling and one-hot encoding techniques. Furthermore, the imbalance issue of the utilized dataset is also addressed utilizing the synthetic minority oversampling technique (SMOTE). Well known machine learning algorithms are employed to detect the most accurate classifier that can detect data leakage events executed by malicious insiders during the sensitive period before they leave an organization. We provide a proof of concept for our model by applying it on CMU-CERT Insider Threat Dataset and comparing its performance with the ground truth. The experimental results show that our model detects insider data leakage events with an AUC-ROC value of 0.99, outperforming the existing approaches that are validated on the same dataset. The proposed model provides effective methods to address possible bias and class imbalance issues for the aim of devising an effective insider data leakage detection system.     

基于子空间分析的人脸识别方法研究

人脸识别技术是模式识别和机器视觉领域的一个重要研究方向,在众多人脸识别的算法中,基于子空间分析的特征提取方法以其稳定可靠的识别效果成为了人脸识别中特征提取的主流方法之一。本文对目前应用较多的子空间分析方法进行了研究,具体介绍了线性子空间分析方法：主成分分析（PCA）、线性鉴别分析（LDA）、独立主成分分析（ICA）、快速主成分分析（FastICA）等及非线性子空间分析方法：基于核的PCA （KPCA）等的基本思想及其在人脸识别中的研究进展,包括一些新的研究成果。此外,还应用orl及Yale B人脸库对几个基础的子空间方法进行了验证实验。实验结果表明,在几个子空间分析方法中,FastICA算法取得了最高的识别率。最后结合实验结果对各算法的优缺点进行了分析总结。     

Detection and tracking of targets in infrared images using Bayesian techniques

Simple yet robust techniques for detecting targets in infrared (IR) images are an important component of automatic target recognition (ATR) systems. In our previous works, we have developed IR target detection and tracking algorithms based on image correlation and intensity. In this paper, we discuss these algorithms, their performances and problems associated with them and then propose novel algorithms to alleviate these problems. Our proposed target detection and tracking algorithms are based on frequency domain correlation and Bayesian probabilistic techniques, respectively. The proposed algorithms are found to be suitable for real-time detection and tracking of static or moving targets, while accommodating for detrimental affects posed by the clutter and background noise. Finally, limitations of all these algorithms are discussed.     

Complex network perspective on modelling chaotic systems via machine learning

Recent advances have demonstrated that a machine learning technique known as "reservoir computing" is a significantly effective method for modelling chaotic systems. Going beyond short-term prediction, we show that long-term behaviors of an observed chaotic system are also preserved in the trained reservoir system by virtue of network measurements. Specifically, we find that a broad range of network statistics induced from the trained reservoir system is nearly identical with that of a learned chaotic system of interest. Moreover, we show that network measurements of the trained reservoir system are sensitive to distinct dynamics and can in turn detect the dynamical transitions in complex systems. Our findings further support that rather than dynamical equations, reservoir computing approach in fact provides an alternative way for modelling chaotic systems.     

基于双向长短期记忆网络的太赫兹光谱识别

特征提取是太赫兹光谱识别的关键处理步骤,通常利用降维方法作为特征提取手段。然而,当一些化合物的太赫兹光谱曲线整体差异度较小时,降维方法往往会缺失样本差异的重要特征信息,从而导致分类错误。如果不采用降维方法提取特征,传统机器学习分类算法对维数较高的原始太赫兹光谱数据又不能很好的分类。针对此问题,提出了一种基于双向长短期记忆网络（BLSTM-RNN）自动提取太赫兹光谱特征的识别方法。BLSTM-RNN作为一种特殊的循环神经网络,利用其LSTM单元可以有效解决原始太赫兹光谱数据维数较高使得模型难以训练问题。再结合模型的双向频谱信息利用架构模式,可以增强模型对复杂光谱数据自动提取有效特征信息的能力。采用三类、15种化合物太赫兹透射光谱作为测试对象,首先利用S-G滤波和三次样条插值对Anthraquinone,Benomyl和Carbazole等十五种化合物在0.9～6 THz内的太赫兹透射光谱数据进行归一化处理,然后通过构建一个具有双向长短期记忆的循环神经网络对太赫兹光谱的全频谱信息进行自动特征提取并利用Softmax分类器进行分类。通过试验优化网络结构和各项参数,最终获得了针对复杂太赫兹透射光谱数据的预测模型,并与传统机器学习算法SVM,KNN及神经网络算法MLP,CNN进行对比实验。结果表明,dataset-1和dataset-2分别作为差异度较大和无明显峰值特征的五种化合物太赫兹透射光谱数据集,其平均识别率分别为100%和98.51%,与其他方法相比识别率有所提高;最重要的是,dataset-3作为5种化合物谱线极为相似的太赫兹透射光谱数据集,其平均识别率为96.56%,与其他方法相比识别率提高显著;dataset-4作为dataset-1,dataset-2和dataset-3的透射光谱数据集集合,其平均识别率为98.87%。从而验证了BLSTM-RNN模型能自动提取有效的太赫兹光谱特征,同时又能保证复杂太赫兹光谱的预测精度。在选择模型训练优化算法方面,使用Adam优化算法要好于RMSProp,SGD和AdaGrad,其模型的目标函数损失值收敛速度最快。同时随着模型训练迭代次数增加,相似太赫兹透射光谱数据集的预测准确率也不断提升。可为复杂太赫兹光谱数据库的光谱识别检索提供一种新的识别方法。     

VIS/NIR imaging application for honey floral origin determination

Nondestructive methods are of utmost importance for honey characterization. This study investigates the potential application of VIS-NIR hyperspectral imaging for detection of honey flower origin using machine learning techniques. Hyperspectral images of 52 honey samples were taken in transmittance mode in the visible/near infrared (VIS-NIR) range (400–1000 nm). Three different machine learning algorithms were implemented to predict honey floral origin using honey spectral images. These methods, included radial basis function (RBF) network, support vector machine (SVM), and random forest (RF). Principal component analysis (PCA) was also exploited for dimensionality reduction. According to the obtained results, the best classifier (RBF) achieved a precision of 94% in a fivefold cross validation experiment using only the first two PCs. Mapping of the classifier results to the test set images showed 90% accuracy for honey images. Three types of honey including buckwheat, rapeseed and heather were classified with 100% accuracy. The proposed approach has great potential for honey floral origin detection. As some other honey properties can also be predicted using image features, in addition to floral origin detection, this method may be applied to predict other honey characteristics.     

可见-近红外多光谱数据对水稻种子成活率的判定

种子活性受到存储条件的影响很大。收集了真实情况下受到不同存储条件影响的种子,通过发芽实验验证了其成活率存在差异。再从中选择适量的种子样本,采集其单颗种子的可见-近红外反射光谱,运用不同的光谱预处理技术,结合不同的机器学习建模手段,以区分不同成活率的种子。比较了不同的光谱预处理方法,比如标准反射光谱校正、多元散射校正等。从识别准确度的角度,认为标准反射光谱校正的方法,能够很大程度上提升不同存活率种子的光谱差异性,从而经过机器学习判断达到更高的识别准确度。同时比较了支持向量机、 K邻近和距离判别分析等机器监督学习建模方法,发现利用标准反射光谱校正的方法结合距离判别分析,能够对种子样本实现完全准确的判定。更进一步,为了满足实际运用中快速识别的要求,将高分辨率的光谱数据压缩成为低分辨率多通道带通光谱数据,这样可以大大降低的光谱数据长度,节约各种机器学习器在训练和判断中所用的时间。使用简化过后的多通道带通光谱数据判定种子存活率,其识别准确度仍然接近90%。充分说明了,利用多通道宽带光谱数据,并选择合适的机器学习建模方式,足以满足实际选种产业的一般性需求,有潜力作为未来粮种成活率快速鉴别的技术手段。还采用了多种带通宽度以简化光谱,分析比较不同带通宽度对识别精度的影响。总体来说由于带宽增大,数据量减少,识别速度更快,但是识别精度降低。从10~50 nm改变光谱带宽,标准反射校正后的简化光谱的识别精度从87.50%下降到58.75%。在实际运用中,需要权衡识别速率和预期识别精度,合理的选择带宽。验证了根据简化后的可见近红外反射光谱,能够较快速且准确的识别水稻种子存活率,为以后的基于带通滤波片的快速种子存活率识别奠定了基础。     

基于Android网络恶意行为检测系统的应用研究

目前Android系统是当今网络用户最对的应用系统之一,而随着科学技术的发展,对于Android系统的恶意行为软件也逐渐增多,给当前的应用用户的财产以及私人信息安全带来了很大的威胁,严重的迟缓了当前移动通信网络技术以及相关于应用客户端的推广。为此本文根据Android系统的特有机构设计出一种基于Binder信息流的自动检测恶意行为系统,以此来解决对于当前网络安全对于Android系统用户带来的负面影响。根据目前网络中的应用通信信息,检测可能存在的泄露用户信息的应用软件为目标,建立信息矢量图以此来分析当前网络中的恶意行为。通过对软件进行检测,研究可实用性和检测效果,结果显示其识别率可以达到100%,并且软件运行只占有内存的7%,结果可以达到当前的Android用户的使用范围。     

从单分子到凝聚相水体系的理论描述：势能面和分子动力学最新进展

本文回顾了近十年来水体系的势能面与分子动力学理论研究的最新进展,包括水分子参与的气相反应,固体表面上的吸附与解离动力学,以及从团簇到凝聚相水的结构、振动光谱与统计力学模拟. 近年来再次发展起来的机器学习技术,例如结合置换不变多项式的神经网络,或结合基本不变量的神经网络,已被成熟应用于气相与固体表面体系的高精度势能面构造中. 对于团簇甚至凝聚相水体系,原子中心神经网络方法或基于核的高斯过程方法应用更为广泛. 此外,在多体展开框架下,在气相体系中发展起来的的方法也组成了高维度体系势函数构造的高精度方案. 当前凝聚相水体系面临的主要问题是高精度从头算数据集的积累,兼顾计算精度与效率的双杂化密度泛函是一种可能的解决方案. 在动力学理论方面,无论是化学反应截面计算还是振动光谱模拟,往往需要合理描述水分子中氢原子的量子效应,才能得到较为可靠的理论计算结果. 量子波包动力学方法已经在气相反应机理研究方面有深入的应用,也在包含数个水分子的团簇振动分析中有初步应用. 基于路径积分的分子动力学方法正在较大水团簇以及凝聚相水的结构与谱学模拟方面发挥重要作用.     

电子对抗系统网络入侵检测技术优化研究

近年来,随着互联网技术的飞速发展,网络入侵防御技术成为互联网安全研究领域中的重要课题。针对现有电子对抗系统存在的网络后台安全逻辑欠缺,导致系统安全度降低、外端数据监测机制断裂的问题,提出电子对抗系统网络入侵检测技术优化研究方法。采用网络电子数据动态交互流特征定向技术、数据溢出监测算法与数据完整度监测机制三大模组对现有问题进行针对性解决。从问题产生根源对电子对抗系统网络入侵检测技术进行优化,通过仿真实验测试表明,提出电子对抗系统网络入侵检测技术优化研究方法具有入侵源监测响应速度快、准确度高、扩展性强、应用性好的特点。     

基于深度残差网络的脱机手写汉字识别研究

摘 要: 手写汉字识别是模式识别与机器学习的重要研究方向和应用领域。近年来,随着深度学习理论方法的完善、新技术的层出不穷,深度神经网络在图像识别分类、图像生成等典型应用中取得了突破性的进展,其中,深度残差网络作为最新的研究成果,已成功应用于手写数字识别、图片识别分类等多个领域。本文将研究深度残差网络在脱机孤立手写汉字识别中的应用方法,通过改进残差学习模块的单元结构,优化深度残差网络性能,同时通过对训练集的预处理,从数据层面实现训练生成模型性能的提升,最后设计实验,验证深度残差网络、End-to-End模式在脱机手写汉字识别中的可行性,分析、总结存在的问题及今后的研究方向。     

Injection attack detection using machine learning for smart IoT applications

Smart cities are a rapidly growing IoT application. These smart cities mainly rely on wireless sensors to connect their different components (smart devices) together. Smart cities rely on the integration of IoT and 5G technologies, and this has created a demand for a massive IoT network of connected devices. The data traffic coming from indoor wireless networks (e.g., smart homes, smart hospitals, smart factories , or smart school buildings) contributes to over 80% of the total data traffic of the current IoT network. As smart cities and their applications grow, security and privacy challenges have become a major concern for billions of IoT smart devices. One reason for this could be the oversight of handling security issues of IoT devices by their manufacturers, which enables attackers to exploit the vulnerabilities in these devices by performing different types of attacks, e.g., DDoS and injection attacks. Intrusion detection is one way to detect and mitigate the risk of such attacks. In this paper, an intrusion detection method was proposed to detect injection attacks in IoT applications (e.g. smart cities). In this method, two types of feature selection techniques (constant removal and recursive feature elimination) were used and tested by a number of machine learning classifiers (i.e., SVM, Random Forest, and Decision Tree). The T-Test was conducted to evaluate the quality of this proposed feature selection method. Using the public dataset, AWID, the evaluation results showed that the decision tree classifier can be used to detect injection attacks with an accuracy of 99% using only 8 features, which were selected using the proposed feature selection method. Also, the comparison with the most related work showed the advantages of the proposed intrusion detection method.     

基于神经网络的光谱识别系统的设计与分析

光谱识别技术是光谱定性分析的基础。随着模式识别技术的发展,光谱识别技术已成为医药、环保、石化等行业进行快速检测的重要的手段。神经网络具有非线性映射、自适应学习、鲁棒性和容错性等特点,在信号处理、知识工程、模式识别等领域有着广泛的应用。文章以符合朗伯-比尔定律的光谱信号为研究对象,概述了运用神经网络进行模式识别的基本原理,随后根据光谱识别的具体要求,提出了基于多特征和神经网络的光谱识别方案,并进行了系统设计,建立了基本的模型框架。最后运用实例对该方法进行了说明。     

基于可视化图形特征的入侵检测方法

入侵检测是保障网络安全的重要措施,网络攻击手段的多样性和隐蔽性不断增强导致入侵检测愈加困难,迫切需要研究新的入侵检测方法。结合可视化技术和k近邻分类算法,提出一种基于图形特征的入侵检测方法。采用信息增益方法对原始特征进行排序选择,并进行雷达图可视化表示,提取雷达图的图形特征构成新的数据集并送入k近邻分类器进行训练和测试。通过KDDCUP99数据集仿真实验表明,该方法不仅能直观显示攻击行为,而且获得较好的攻击检测性能,对DOS攻击的检测率可达97.9%,误报率为1.5%。     

Mechanical systems in the quantum regime

Mechanical systems are ideal candidates for studying quantum behavior of macroscopic objects. To this end, a mechanical resonator has to be cooled to its ground state and its position has to be measured with great accuracy. Currently, various routes to reach these goals are being explored. In this review, we discuss different techniques for sensitive position detection and we give an overview of the cooling techniques that are being employed. The latter includes sideband cooling and active feedback cooling. The basic concepts that are important when measuring on mechanical systems with high accuracy and/or at very low temperatures, such as thermal and quantum noise, linear response theory, and backaction, are explained. From this, the quantum limit on linear position detection is obtained and the sensitivities that have been achieved in recent opto- and nanoelectromechanical experiments are compared to this limit. The mechanical resonators that are used in the experiments range from meter-sized gravitational wave detectors to nanomechanical systems that can only be read out using mesoscopic devices such as single-electron transistors or superconducting quantum interference devices. A special class of nanomechanical systems is bottom-up fabricated carbon-based devices, which have very high frequencies and yet a large zero-point motion, making them ideal for reaching the quantum regime. The mechanics of some of the different mechanical systems at the nanoscale is studied. We conclude this review with an outlook of how state-of-the-art mechanical resonators can be improved to study quantum mechanics.     

深度学习在超声检测缺陷识别中的应用与发展*

深度学习（Deep Learning）是目前最强大的机器学习算法之一,其中卷积神经网络（Convolutional Neural Network, CNN）模型具有自动学习特征的能力,在图像处理领域较其他深度学习模型有较大的性能优势。本文先简述了深度学习的发展史,然后综述了深度学习在超声检测缺陷识别中的应用与发展,从早期浅层神经网络到现在深度学习的应用现状,并借鉴医学影像识别和射线图像识别领域的方法,分析了卷积神经网络对超声图像缺陷识别的适用性。最后,探讨归纳了目前在超声检测图像识别中使用CNN存在的一些问题,及其主要应对策略的研究方向。