Trusted Anomaly Detection with Context Dependency

Introduction Privilegedprocessesareoftencommonattack targetsbecausetheseprocessesthatprovidesys-temservicesandresourcesexecutewithspecial privileges.Infact,thetracesofsystemcallsexe-cutedbytheprivilegedprocessesaretheordered sequenceinUNIXoperatingsystem.Becausethe tracesofsystemcallsexecutedbythetheseprivi-legedprocessesputupbetterstabilityunderthe conditionofnormaloperationstheyareconsidered asbetterauditdatasourceascomparedwithsys-temaudittrails,systemlogsandapplicationlogs.Consequently,a…     

TW-2系统测重设备轴重异常报警分析及解决方案

针对近年来部分驼峰场TW-2型驼峰控制系统使用的测重设备的轴重异常报警频发的现象,通过分析典型轴重异常报警故障,找出问题的主要原因,提出有效的解决方案并成功运用于现场,取得良好的效果,可为后续工程设计提供参考和借鉴。     

Efficient Accurate Context-Sensitive Anomaly Detection

For program behavior-based anomaly detection, the only way to ensure accurate monitoring is to construct an efficient and precise program behavior model. A new program behavior-based anomaly detection model, called combined pushdown automaton （CPDA） model was proposed, which is based on static binary executable analysis. The CPDA model incorporates the optimized call stack walk and code instrumentation technique to gain complete context information. Thereby the proposed method can detect more attacks, while retaining good performance.     

GPS高程异常拟合粗差剔除以及精度评价方法研究

提出一种GPS高程拟合公共点粗差定位的新方法,即利用最小二乘法平差所得方差,采用假设检验法,完成GPS高程异常拟合模型参数计算过程中的粗差定位与剔除。对多种高程拟合模型的拟合精度进行评价,引入均方误差、信噪比和互相关系数评价指标,提出一种多指标融合评价方法,实现对GPS高程异常拟合精度的评价。结合实例分析,证明所提方法的有效性。     

基于半监督聚类的网络入侵检测算法

入侵检测是维护网络安全的重要技术手段之一.本文提出一种聚类算法:k-cubes,用于网络异常检测.算法采用基于网格的方法对网络连接数据进行预处理,然后以网格为数据处理单位进行聚类,在聚类过程中通过动态合并与分裂自动决定聚类的数目.在此基础上给出了半监督k-cubes聚类算法,并根据聚类的结果生成检测规则.k-cubes聚类算法适合处理高维并且含有多值字符属性的大数据量数据,同时具有输入参数少等特点.在KDD99入侵检测数据集上的实验结果显示,算法获得95.82%的检测率和1.25%的误报率,并且在识别新入侵的能力上,算法检测到17种新入侵中的15种.     

一起牵引变电所损失率超标原因分析及处理

介绍了京广线电气化铁路黄粱梦变电所损失率过大的情况,通过实地测量分析随动车组密度的增加,损失率逐月上升的原因,针对这一问题提出了牵引变电所施工、验收、运营3个环节应注意的事项。     

采用双层预切缝办法防治沥青路面不规则缩裂的实践

为了防治沥青路面低温缩裂这一病害 ,在沥青路面施工中将基层和面层在同一断面沿路线一定间距做横向双层预切缝 ,使路面裂缝按预切位置规则缩裂 ,以减少沥青路面网裂数量 ,延长沥青路面使用寿命     

Spatial-temporal traffic flow pattern identification and anomaly detection with dictionary-based compression theory in a large-scale urban network

Traffic flow pattern identification, as well as anomaly detection, is an important component for traffic operations and control. To reveal the characteristics of regional traffic flow patterns in large road networks, this paper employs dictionary-based compression theory to identify the features of both spatial and temporal patterns by analyzing the multi-dimensional traffic-related data. An anomaly index is derived to quantify the network traffic in both spatial and temporal perspectives. Both pattern identifications are conducted in three different geographic levels: detector, intersection, and sub-region. From different geographic levels, this study finds several important features of traffic flow patterns, including the geographic distribution of traffic flow patterns, pattern shifts at different times-of-day, pattern fluctuations over different days, etc. Both spatial and temporal traffic flow patterns defined in this study can jointly characterize pattern changes and provide a good performance measure of traffic operations and management. The proposed method is further implemented in a case study for the impact of a newly constructed subway line. The before-and-after study identifies the major changes of surrounding road traffic near the subway stations. It is found that new metro stations attract more commute traffic in weekdays as well as entertaining traffic during weekends.     

基于贝叶斯正则化 BP 神经网络的 GPS 高程转换

为了改善BP神经网络在GPS高程转换过程中过拟合的现象,提出了用贝叶斯正则化算法的BP神经网络转换GPS高程的新方法,并利用区域GPS/水准数据,将新方法和未采用正则化算法的BP神经网络进行GPS高程转换的比较.结果表明:在较大区域和高程异常呈不规则的情况下,新方法不仅可以有效提高GPS高程转换的精度,而且通过贝叶斯正则化算法可以改善网络结构,抑制过拟合现象.在约10 km的GPS基线尺度上,新方法可以得到精度达0.050 m的正常高.     

基于太阳辐射效应校正的高原铁路廊道地热异常区识别研究

为提高热红外遥感识别地热异常区的准确度，选取高原铁路廊道作为研究区，基于Landsat8数据采用单窗算法反演得到白天地表温度，并基于ECO2LSTE数据得到夜间地表温度；然后，利用随机森林方法选取海拔、坡度、坡向、累积太阳辐射、NDVI、NDSI、NDWI以及反照率作为输入因子，得到去除太阳辐射效应的地表温度；最后，选取去除太阳辐射效应的地表温度、断裂密度、到水系距离和地磁异常作为指标因子，采用确定性系数模型定量识别地热异常区，并利用已知温泉点对结果进行评价。结果表明： 1）随机森林方法可有效去除非地热引起的温度变化，减弱太阳辐射效应，提高地热异常区识别的准确度； 2）地热异常区评价结果与已知温泉点分布较为一致，高异常区和中异常区的识别结果可靠； 3）高原铁路廊道主要途经7个地热异常区，经过高异常区和中异常区的廊道长度分别为72 km和125 km，泸定—康定、理塘盆地及周边、巴塘、贡觉、昌都—察雅、八宿、波密—鲁朗是需要重点防范高温热害的区段。研究结果初步实现了高原铁路廊道的地热异常区定量化和精细化识别。