CEP-traj: An event-based solution to process trajectory data

In this day and age, there exists an increasing need for systems and architectures able to process spatio-temporal data in a timely way. As a result, this paper presents CEP-traj, a novel middleware to ease the development of real-time trajectory-based services based on the Complex Event Processing (CEP) paradigm. By means of an event-based approach, the present middleware is able to detect a set of generic patterns along with meaningful changes of an entity׳s movement. In order to prove its suitability and feasibility, a vessel abnormal-behaviour detection system has been developed on the basis of the middleware׳s features. Finally, both synthetic and real datasets have been used to test the accuracy and performance of the middleware and the detection system implemented on top of the Esper engine.     

Hierarchical crowd analysis and anomaly detection

ObjectiveThis work proposes a novel approach to model the spatiotemporal distribution of crowd motions and detect anomalous events.MethodsWe first learn the regions of interest (ROIs) which inform the behavioral patterns by trajectory analysis with Hierarchical Dirichlet Processes (HDP), so that the main trends of crowd motions can be modeled. Based on the ROIs, we then build a series of histograms both on global and local levels as the templates for the observed movement distribution, which statistically describes time-correlated crowd events. Once the template has been built hierarchically, we import real data containing the discrete trajectory observations from video surveillance and detect abnormal events for individuals and for crowds.ResultsExperimental results show the effectiveness of our approach, which is able to analyze and extract the crowd motion information from observed trajectory dataset, and achieve the anomaly detection at the hierarchical levels.ConclusionThe proposed hierarchical approach can learn the moving trends of crowd both in global and local area and describe the crowd behaviors in statistical way, which build a template for pedestrian movement distribution that allows for the detection of time-correlated abnormal crowd events.     

Learning motion patterns in unstructured scene based on latent structural information

ContextAs trajectory analysis is widely used in the fields of video surveillance, crowd monitoring, behavioral prediction, and anomaly detection, finding motion patterns is a fundamental task for pedestrian trajectory analysis.ObjectiveIn this paper, we focus on learning dominant motion patterns in unstructured scene.MethodsAs the invisible implicit indicator to scene structure, latent structural information is first defined and learned by clustering source/sink points using CURE algorithm. Considering the basic assumption that most pedestrians would find the similar paths to pass through an unstructured scene if their entry and exit areas are fixed, trajectories are then grouped based on the latent structural information. Finally, the motion patterns are learned for each group, which are characterized by a series of statistical temporal and spatial properties including length, duration and envelopes in polar coordinate space.ResultsExperimental results demonstrate the feasibility and effectiveness of our method, and the learned motion patterns can efficiently describe the statistical spatiotemporal models of the typical pedestrian behaviors in a real scene. Based on the learned motion patterns, abnormal or suspicious trajectories are detected.ConclusionThe performance of our approach shows high spatial accuracy and low computational cost.     

基于数据挖掘的协议分析检测模型

针对现有入侵检测系统的不足,根据入侵和正常访问模式的网络数据表现形式的不同以及特定数据分组的出现规律,提出按协议分层的入侵检测模型,并在各个协议层运用不同的数据挖掘方法抽取入侵特征,以达到提高建模的准确性、检测速度和克服人工提取入侵特征的主观性的目的。其中运用的数据挖掘算法主要有关联挖掘、序列挖掘、分类算法和聚类算法。     

基于隐马尔科夫模型的用户行为异常检测方法

提出了一种基于HMM的用户行为异常检测的新方法,用shell命令序列作为审计数据,但在数据预处理、用户行为轮廓的表示方面与现有方法不同。仿真实验结果表明,本方法的检测效率和实时性相对较高,在检测准确率方面也有较大优势。     

免疫算法在入侵检测数据预处理中的应用

基于聚类的入侵检测方法大都是以距离差异为基础的,而同等重要地依赖所有属性的相似性度量会引起误导。提出利用免疫算法确定网络数据属性的权重值的设计方法。采用二进制编码方式对网络数据的属性进行编码,并设计了抗体和抗原亲和力的评价算法。实验结果显示,该方法确定的权重值在检测入侵方面是可行的、有效的。     

Goal-based trajectory analysis for unusual behaviour detection in intelligent surveillance

In a typical surveillance installation, a human operator has to constantly monitor a large array of video feeds for suspicious behaviour. As the number of cameras increases, information overload makes manual surveillance increasingly difficult, adding to other confounding factors such as human fatigue and boredom. The objective of an intelligent vision-based surveillance system is to automate the monitoring and event detection components of surveillance, alerting the operator only when unusual behaviour or other events of interest are detected. While most traditional methods for trajectory-based unusual behaviour detection rely on low-level trajectory features such as flow vectors or control points, this paper builds upon a recently introduced approach that makes use of higher-level features of intentionality. Individuals in the scene are modelled as intentional agents, and unusual behaviour is detected by evaluating the explicability of the agent's trajectory with respect to known spatial goals. The proposed method extends the original goal-based approach in three ways: first, the spatial scene structure is learned in a training phase; second, a region transition model is learned to describe normal movement patterns between spatial regions; and third, classification of trajectories in progress is performed in a probabilistic framework using particle filtering. Experimental validation on three published third-party datasets demonstrates the validity of the proposed approach.     

聚类分析与模糊评判结合的入侵检测算法

针对K-prototypes聚类算法处理混合型入侵检测数据时易陷入局部最优且对初始值敏感的问题,提出了一种基于K-prototypes与模糊评判相结合的入侵检测方法,利用K-prototypes对数据进行统计归类,在聚类中建立模糊评判模型,从统计和特征两方面对数据进行双重判定。实验结果表明两种算法的有效结合,可以提高任一种算法单独使用时的检测性能,有效地提高了检测率,降低了误检率。     

基于数据挖掘的网络入侵检测技术研究

现有NIDS的检测知识一般由手工编写,其难度和工作量都较大.将数据挖掘技术应用于网络入侵检测,在Snort的基础上构建了基于数据挖掘的网络入侵检测系统模型.重点设计和实现了基于K-Means算法的异常检测引擎和聚类分析模块,以及基于Apriori算法的关联分析器.实验结果表明,聚类分析模块能够自动建立网络正常行为模型,并用于异常检测,其关联分析器能够自动挖掘出新的入侵检测规则.     

基于数据挖掘的入侵检测系统智能结构模型

为了提高对拒绝服务攻击、内存溢出攻击、端口扫描攻击和网络非法入侵等发现的有效性以及对海量的安全审计数据能进行智能化处理,采用数据挖掘的方法从大量的信息中提取有威胁的、隐蔽的入侵行为及其模式.将数据挖掘的聚类分析方法与入侵检测系统相结合,提出了一种入侵检测系统的智能结构模型.实验表明,它能够有效地从海量的网络数据中进行聚类划分,找到相关的入侵数据,从而提高对各种攻击类型网络入侵检测的效率.     

增量式SVM的数据流异常检测模型

针对网络数据流异常检测,既要保证分类准确率,又要提高检测速度的问题,在原有数据流挖掘技术的基础上提出一种改进的增量式学习算法.算法中建立多模型轮转结构,在每次训练中从几何角度出发求出当前训练样本集的支持向量,选择出分布于超平面间隔中的支持向量进行增量SVM训练.使用UCI标准数据库中的数据进行实验,并且与另外两种经典分类模型进行比较,结果表明了方法的有效性.     

TRASMIL: A local anomaly detection framework based on trajectory segmentation and multi-instance learning

Local anomaly detection refers to detecting small anomalies or outliers that exist in some subsegments of events or behaviors. Such local anomalies are easily overlooked by most of the existing approaches since they are designed for detecting global or large anomalies. In this paper, an accurate and flexible three-phase framework TRASMIL is proposed for local anomaly detection based on TRAjectory Segmentation and Multi-Instance Learning. Firstly, every motion trajectory is segmented into independent sub-trajectories, and a metric with Diversity and Granularity is proposed to measure the quality of segmentation. Secondly, the segmented sub-trajectories are modeled by a sequence learning model. Finally, multi-instance learning is applied to detect abnormal trajectories and sub-trajectories which are viewed as bags and instances, respectively. We validate the TRASMIL framework in terms of 16 different algorithms built on the three-phase framework. Substantial experiments show that algorithms based on the TRASMIL framework outperform existing methods in effectively detecting the trajectories with local anomalies in terms of the whole trajectory. In particular, the MDL-C algorithm (the combination of HDP-HMM with MDL segmentation and Citation kNN) achieves the highest accuracy and recall rates. We further show that TRASMIL is generic enough to adopt other algorithms for identifying local anomalies.     

基于模糊聚类神经网络的镜头突变检测算法

讨论了采用无监督的模糊竞争学习算法,并结合自组织竞争网络构成的一种新型模糊聚类神经网络模型,提出了一种基于该网络模型的镜头突变检测算法。该算法通过对线性特征空间进行由粗到细的两步模糊聚类实现镜头突变的检测。实验结果表明该算法是可行和有效的。     

基于FCM和RBF网络的入侵检测研究

入侵检测过程广义上属于分类和模式识别的范畴。文章提出了用模糊C-均值聚类法将网络连接信息聚类，再通过训练RBF网络存储数据并进行识别的入侵检测方法，分析了网络连接信息中的正常网络信息和各种不同的攻击信息。通过仿真实验，该方法取得了较好的实验结果。     

一种基于聚类技术软切换的双模式盲均衡算法

传统双模式算法中的切换时机一般采用经验确定,在迭代达到一定次数或者均方误差(MSE)降低到某一范围时硬性将算法进行切换.针对这种情况,提出了一种基于聚类技术的软判决双模式均衡算法,在不影响算法的收敛速度和精度前提下,让算法间自动进行切换,更具有实际意义和价值.该算法首先通过分析初始均衡算法输出的星座图信息,再使用减法聚类获得粗略的星座图轮廓,最后采用模糊C-均值(FCM)聚类进行二次处理,以获得精准的星座图信息.若所得星座图符合判断标准则切换至后续算法完成均衡,实现了算法中的软切换.仿真结果验证了该算法的有效性.     

Activity classification and anomaly detection using m-mediods based modelling of motion patterns

Techniques for video object motion analysis, behaviour recognition and event detection are becoming increasingly important with the rapid increase in demand for and deployment of video surveillance systems. Motion trajectories provide rich spatiotemporal information about an object's activity. This paper presents a novel technique for classification of motion activity and anomaly detection using object motion trajectory. In the proposed motion learning system, trajectories are treated as time series and modelled using modified DFT-based coefficient feature space representation. A modelling technique, referred to as m-mediods, is proposed that models the class containing n members with m mediods. Once the m-mediods based model for all the classes have been learnt, the classification of new trajectories and anomaly detection can be performed by checking the closeness of said trajectory to the models of known classes. A mechanism based on agglomerative approach is proposed for anomaly detection. Four anomaly detection algorithms using m-mediods based representation of classes are proposed. These includes: (i)global merged anomaly detection (GMAD), (ii) localized merged anomaly detection (LMAD), (iii) global un-merged anomaly detection (GUAD), and (iv) localized un-merged anomaly detection (LUAD). Our proposed techniques are validated using variety of simulated and complex real life trajectory datasets.     

峰值检测 FCM 算法的医学图像分割

为了更好地平衡传统FCM及其相关改进算法的分割效果与分割效率问题,提出了一种基于峰值检测的快速FCM图像分割算法。首先基于峰值检测策略对聚类中心进行初始化;然后在初始化聚类中心的基础上对医学图像进行分割。其本质是运用峰值检测技术指导聚类中心的初始化,以使初始化的聚类中心尽可能靠近最终的聚类中心,从而以提高算法的工作效率。在医学图像上进行的实验表明,算法可以有效地提高图像分割的效率,并能得到很好的分割效果。     

基于聚类和拟合的QAR数据离群点检测算法

为解决从飞机快速存取记录器(QAR)数据中发现异常数据并预测飞机潜在故障的问题,考虑QAR数据量大、飞行参数数据值相对较为稳定的特点,提出一种适用于QAR数据的离群点检测算法。第一阶段采用K均值聚类对QAR数据流分区进行聚类生成均值参考点;第二阶段采用最小二乘法对生成的均值参考点进行拟合,通过计算均值参考点到拟合飞机参数曲线的距离来判断并找出可能的离群点。实验结果表明,该算法可以准确发现飞机中的故障数据,有效解决部分飞机故障的离群点检测问题。     

一种基于中心对称性的聚类算法

提出了一种新型的聚类算法。这个新型的聚类算法是基于中心对称的概念之上的。使用这种基于中心对称性的聚类算法,在一个指定的数据集中的超球面形状的聚类能够被侦测出来。在对超球面性状的目标的侦测方面,这种聚类算法大大优于传统的算法。这个算法可以用于数据聚类和人脸识别方面,实验结果也证明了该算法的效果。     

基于Spark框架的分布式入侵检测方法

为以较低的误报率和较高的检测率对攻击和恶意行为进行实时检测,基于Spark框架和位置敏感哈希算法,提出一种分布式数据流聚类方法DSCLS ,能够处理实时数据流,可根据数据流速进行横向分布式扩展。基于DSCLS分布式聚类算法,建立网络入侵检测系统,能够高速实时分析数据流,聚类相关模式,实时检测已知攻击和入侵,能够对未知的新型攻击进行检测。理论分析和实验结果表明,与主流的数据流聚类算法D‐Stream相比, DSCLS方法能够有效提高检测率并降低误报率,在时间性能和可扩展性方面更有优势。