计算机取证中的异常文件发现

在计算机取证中,寻找证据的过程是最耗费时间的一个阶段,是计算机取证自动化的瓶颈。面对海量的数据信息,如何确定哪些是犯罪证据,并更快更准确地找到这些证据,是摆在每一个计算机取证者面前的难题。为了解决这一问题,提出了一种取证目标自动确定的新方法,通过孤立文件检测法找出安全事件中产生的异常文件。实验结果表明,这种方法能快速找出系统中隐藏的异常文件,加快证据搜索的速度,进而提高整个计算机取证工作的效率。     

基于强跟踪滤波器的抗“飞点”容错滤波

由于雷达数据在获取和传输中受干扰的影响，数据融合中心接收到的雷达测量数据中常常含有“飞点”。这种测量数据中的异常数据对Kalman滤波具有较严重的不利影响。本文利用强跟踪滤波算法，构造容错策略，使之既可以充分利用正常新息(innovations)确保滤波的精度，又可以有效抑制异常新息的不利影响，从而达到对“飞点”数据的容错能力，保持目标跟踪的性能。最后，通过仿真计算验证了该算法的有效性。     

稳健残差控制图的构建及在金融时序中的应用

对于呈现自相关和波动族聚性并存的受控过程,通常采用残差控制图对其进行监控。但异常点的存在会对自相关或波动族聚性模型的拟合产生重要影响,使得基于该模型的残差并非独立同分布导致常规残差控制图监控失效。为解决这类问题,本文提出稳健残差控制图。即建立稳健的ARMA模型解决自相关问题从而得到无自相关的残差序列,用稳健的GARCH模型来构建控制图的上下限。模拟和实证研究表明,本文提出的稳健残差控制图具有很好的抗异常点能力并能更好的对金融时间序列的异常现象进行监控。     

Some closed form robust moment‐based estimators for the MEM(1,1)

In this paper, we extend the closed form moment estimator (ordinary MCFE) for the autoregressive conditional duration model given by Lu et al (2016) and propose some closed form robust moment‐based estimators for the multiplicative error model to deal with the additive and innovational outliers. The robustification of the closed form estimator is done by replacing the sample mean and sample autocorrelation with some robust estimators. These estimators are more robust than the quasi‐maximum likelihood estimator (QMLE) often used to estimate this model, and they are easy to implement and do not require the use of any numerical optimization procedure and the choice of initial value. The performance of our proposal in estimating the parameters and forecasting conditional mean μ_t of the MEM(1,1) process is compared with the proposals existing in the literature via Monte Carlo experiments, and the results of these experiments show that our proposal outperforms the ordinary MCFE, QMLE, and least absolute deviation estimator in the presence of outliers in general. Finally, we fit the price durations of IBM stock with the robust closed form estimators and the benchmarks and analyze their performances in estimating model parameters and forecasting the irregularly spaced intraday Value at Risk.     

综合评价中异常值的识别及无量纲化处理方法

针对综合评价中的异常值现象,讨论了原始数据中是否存在异常值、若存在异常值该如何识别异常值以及对含有异常值的评价数据如何进行无量纲化处理三个问题。关于异常值的判断与识别,给出了以“中位数”为参考点,通过比较排序后两端数据偏离中位数的距离的处理思路。对含有异常值的评价数据的无量纲化处理问题,基于常用的“极值处理法”,通过分别指定异常值和非异常值无量纲化取值区间的方式,提出了一种分段的无量纲化处理方法。最后,通过与已有文献异常值识别及无量纲化处理结果的对比分析,验证了本文方法的有效性,发现本文给出的方法能够实现对异常值的适度筛选,且能够提升无量纲化数据分布均衡性。     

An efficient approach for outlier detection in big sensor data of health care

In recent years, wireless sensor networks are pervasive and are generating tons of data every second. Performing outlier detection to detect faulty sensors from such a large amount of data becomes a challenging task. Most of the existing techniques for outlier detection in wireless sensor networks concentrate only on contents of the data source without considering correlation among different data attributes. Moreover, these methods are not scalable to big data. To address these 2 limitations, this paper proposes an outlier detection approach based on correlation and dynamic SMO (sequential minimal optimization) regression that is scalable to big data. Initially, correlation is used to find out strongly correlated attributes and then the point anomalous nodes are detected using dynamic SMO regression. For fast processing of big data, Hadoop MapReduce framework is used. The experimental analysis demonstrates that the proposed approach efficiently detects the point and contextual anomalies and reduces the number of false alarms. For experiments, real data of sensors used in body sensor networks are taken from Physionet database.     

面向网络环境的SQL注入行为检测方法

SQL注入攻击是Web应用面临的主要威胁之一,传统的检测方法针对客户端或服务器端进行。通过对SQL注入的一般过程及其流量特征分析,发现其在请求长度、连接数以及特征串等方面,与正常流量相比有较大区别,并据此提出了基于长度、连接频率和特征串的LFF（length-frequency-feature）检测方法,首次从网络流量分析的角度检测SQL注入行为。实验结果表明,在模拟环境下,LFF检测方法召回率在95%以上,在真实环境下,该方法也取得较好的检测效果。     

Simple outlier labeling based on quantile regression,with application to the steelmaking process

This paper introduces some methods for outlier identification in the regression setting, motivated by the analysis of steelmaking process data. The proposed methodology extends to the regression setting the boxplot rule, commonly used for outlier screening with univariate data. The focus here is on bivariate settings with a single covariate, but extensions are possible. The proposal is based on quantile regression, including an additional transformation parameter for selecting the best scale for linearity of the conditional quantiles. The resulting method is used to perform effective labeling of potential outliers, with a quite low computational complexity, allowing for simple implementation within statistical software as well as commonly used spreadsheets. Some simulation experiments have been carried out to study the swamping and masking properties of the proposal. The methodology is also illustrated by some real life examples, taking as the response variable the energy consumed in the melting process. Copyright © 2015 John Wiley & Sons, Ltd.     

Statistics-Based Outlier Detection and Correction Method for Amazon Customer Reviews

People nowadays use the internet to project their assessments, impressions, ideas, and observations about various subjects or products on numerous social networking sites. These sites serve as a great source to gather data for data analytics, sentiment analysis, natural language processing, etc. Conventionally, the true sentiment of a customer review matches its corresponding star rating. There are exceptions when the star rating of a review is opposite to its true nature. These are labeled as the outliers in a dataset in this work. The state-of-the-art methods for anomaly detection involve manual searching, predefined rules, or traditional machine learning techniques to detect such instances. This paper conducts a sentiment analysis and outlier detection case study for Amazon customer reviews, and it proposes a statistics-based outlier detection and correction method (SODCM), which helps identify such reviews and rectify their star ratings to enhance the performance of a sentiment analysis algorithm without any data loss. This paper focuses on performing SODCM in datasets containing customer reviews of various products, which are (a) scraped from Amazon.com and (b) publicly available. The paper also studies the dataset and concludes the effect of SODCM on the performance of a sentiment analysis algorithm. The results exhibit that SODCM achieves higher accuracy and recall percentage than other state-of-the-art anomaly detection algorithms.     

基于可变阈值的无线传感网络异常值检测

定义了新的异常因子,将数据分为正常、异常、临界3种状态,并在此基础上构建了一个基于动态阈值的异常值检测模型。在修正马尔科夫假设的基础上,给出动态阈值的更新方法。算法在无需训练集的条件下,实现了在线的实时异常值检测。仿真实验表明,算法在保持较高检测精度的同时,维持了较低的误报率。