大流量分布式拒绝服务攻击的防御策略研究

大流量分布式拒绝服务攻击（High-rate Distributed Denial of Service Attack）是指导致网络流量激增,呈明显异常的＂淹没受害者＂式的DDoS,简称HDDoS。与其相对应的概念是低流量DDoS。通过建立、分析HDDoS的概念模型总结了其特点、分析了当前HDDoS防御策略的发展趋势。提出了一种基于离群数据挖掘算法的HDDoS防御策略ODM方法。实验证明,ODM方法解决了DDoS过滤中产生的间接伤害无法恢复的问题,是防御HDDoS的一种新思路。     

一种基于自然最近邻的离群检测算法

任何涉及k近邻求解问题的算法被应用于处理不同特征的数据集时,参数k值的选择都会明显影响算法的性能和结果。因而,如何选择k近邻算法中敏感参数k值一直是一个研究难点。提出了一种新的近邻关系———自然最近邻,它不需要设置参数k,每个节点的邻居是由算法自适应计算而形成的。针对离群点检测的特殊性,通过确定自然最近邻居搜索算法的终止条件,提出一种基于自然最近邻的新的离群检测算法ODb3N。实验表明,该算法不仅避免了k近邻中参数的选择问题,而且能够更有效地发现离群簇。     

Ellipsoidal neighbourhood outlier factor for distributed anomaly detection in resource constrained networks

Anomaly detection in resource constrained wireless networks is an important challenge for tasks such as intrusion detection, quality assurance and event monitoring applications. The challenge is to detect these interesting events or anomalies in a timely manner, while minimising energy consumption in the network. We propose a distributed anomaly detection architecture, which uses multiple hyperellipsoidal clusters to model the data at each sensor node, and identify global and local anomalies in the network. In particular, a novel anomaly scoring method is proposed to provide a score for each hyperellipsoidal model, based on how remote the ellipsoid is relative to their neighbours. We demonstrate using several synthetic and real datasets that our proposed scheme achieves a higher detection performance with a significant reduction in communication overhead in the network compared to centralised and existing schemes.     

线性回归中粗差的特征值判别法及其应用

随着仪器仪表智能化程度的提高，在线性回归中寻求较好的粗差剔除算法变得越来越重要。通常的方法是在所有观测值的基础上作一初始的线性回归，然后将离差最大的点作为可能的粗差点。该方法常由于粗差值参与初始回归造成的不准确而发生判别错误。本文提出一种在线性回归中用特征值方法判别粗差点的方法，它不依赖于初始的回归离差，从而提高了判别的准确性。该方法应用于智能离子计中有关线性回归校正法及Ｇｒａｎ法数据处理软件中，取得满意的效果。     

基于一阶差分的粗差剔除方法

粗大误差的剔除是数据处理的重要内容。本文提出了基于一阶差分的分位数粗大误差剔除方法。实验证明，该方法与带通滤波器的结合可以取得良好的滤波效果，并在流化床压力信号的处理中得到了成功的应用。     

一种放射CT重建的鲁棒估计算法

放射CT的重建问题可以归结为一种基于泊松分布的最大似然估计（MuxnimumLikelihood,ML），其中最著名的如EM算法[1]，这种算法存在的问题是鲁棒性不强，当观测数据中存在一些出格点（outlier）（如2％）时，EM算法的性能就变得很差。本文分析了算法性能变差的原因，将泊松分布近似为高斯分布后，仿照鲁律估计中的M-估计，构造了一种鲁棒性很强的EM改进算法。实验结果表明，即使在投影数据中混有10％的出格点，仍能重建出满意的结果来。     

Outlier-resistant methods for estimation and model fitting

Least squares is perhaps the most widely used technique for model fitting. In this article, we illustrate the poor performance of least squares when there are spurious values, or outliers, in a sequence of measurements. A brief overview of three well-known classes of robust alternatives to the least-squares mean is presented. For robust regression, a recent proposal called least median squares (LMS) is decribed. LMS regression is compared to least-squares regression in an example involving the estimation of optical fiber geometry. References are provided for software that is available for robust estimation techniques surveyed in this article.     

Bayesian analysis of robust Poisson geometric process model using heavy-tailed distributions

We propose a robust Poisson geometric process model with heavy-tailed distributions to cope with the problem of outliers as it may lead to an overestimation of mean and variance resulting in inaccurate interpretations of the situations. Two heavy-tailed distributions namely Student’s t and exponential power distributions with different tailednesses and kurtoses are used and they are represented in scale mixture of normal and scale mixture of uniform respectively. The proposed model is capable of describing the trend and meanwhile the mixing parameters in the scale mixture representations can detect the outlying observations. Simulations and real data analysis are performed to investigate the properties of the models.     

Stochastic volatility models with leverage and heavy-tailed distributions: A Bayesian approach using scale mixtures

This paper studies a heavy-tailed stochastic volatility (SV) model with leverage effect, where a bivariate Student-t distribution is used to model the error innovations of the return and volatility equations. Choy et al. (2008) studied this model by expressing the bivariate Student-t distribution as a scale mixture of bivariate normal distributions. We propose an alternative formulation by first deriving a conditional Student-t distribution for the return and a marginal Student-t distribution for the log-volatility and then express these two Student-t distributions as a scale mixture of normal (SMN) distributions. Our approach separates the sources of outliers and allows for distinguishing between outliers generated by the return process or by the volatility process, and hence is an improvement over the approach of Choy et al. (2008). In addition, it allows an efficient model implementation using the WinBUGS software. A simulation study is conducted to assess the performance of the proposed approach and its comparison with the approach by Choy et al. (2008). In the empirical study, daily exchange rate returns of the Australian dollar to various currencies and daily stock market index returns of various international stock markets are analysed. Model comparison relies on the Deviance Information Criterion and convergence diagnostic is monitored by Geweke’s convergence test.     

离群点挖掘方法综述

离群点挖掘可揭示稀有事件和现象、发现有趣的模式,有着广阔的应用前景,因此引起广泛关注。首先介绍离群点的定义、引起离群的原因和离群点挖掘算法的分类,对基于距离和基于密度的离群点挖掘算法进行了比较详细的讨论,指出了其优缺点和发展方向,重点对当前研究的热点——高维大数据量的挖掘、空间数据挖掘、时序离群点挖掘和离群点挖掘技术的应用进行了讨论,指出了进一步研究方向。