To improve the training speed of support vector machine （SVM）, a method called improved center distance ratio method （ICDRM） with determining thresholds automatically is presented here without reduce the identific...To improve the training speed of support vector machine （SVM）, a method called improved center distance ratio method （ICDRM） with determining thresholds automatically is presented here without reduce the identification rate. In this method border vectors are chosen from the given samples by comparing sample vectors with center distance ratio in advance. The number of training samples is reduced greatly and the training speed is improved. This method is used to the identification for license plate characters. Experimental resuhs show that the improved SVM method-ICDRM does well at identification rate and training speed.展开更多
Considering the secure authentication problem for equipment support information network,a clustering method based on the business information flow is proposed. Based on the proposed method,a cluster-based distributed ...Considering the secure authentication problem for equipment support information network,a clustering method based on the business information flow is proposed. Based on the proposed method,a cluster-based distributed authentication mechanism and an optimal design method for distributed certificate authority( CA)are designed. Compared with some conventional clustering methods for network,the proposed clustering method considers the business information flow of the network and the task of the network nodes,which can decrease the communication spending between the clusters and improve the network efficiency effectively. The identity authentication protocols between the nodes in the same cluster and in different clusters are designed. From the perspective of the security of network and the availability of distributed authentication service,the definition of the secure service success rate of distributed CA is given and it is taken as the aim of the optimal design for distributed CA. The efficiency of providing the distributed certificate service successfully by the distributed CA is taken as the constraint condition of the optimal design for distributed CA. The determination method for the optimal value of the threshold is investigated. The proposed method can provide references for the optimal design for distributed CA.展开更多
[目的]DDoS攻击作为一种破坏性极强的网络威胁,严重影响电力系统的稳定运行。由于电力监控局域网中的数据流量复杂多变,DDoS攻击流量与正常流量在表现形式上存在较高相似性,导致二者难以有效区分。传统的静态阈值方法虽能在一定程度上...[目的]DDoS攻击作为一种破坏性极强的网络威胁,严重影响电力系统的稳定运行。由于电力监控局域网中的数据流量复杂多变,DDoS攻击流量与正常流量在表现形式上存在较高相似性,导致二者难以有效区分。传统的静态阈值方法虽能在一定程度上实现流量监测,但因无法适应流量的动态变化,常出现误判,从而削弱了对DDoS攻击的检测效果,难以为电力监控局域网提供可靠的安全保障。为此,提出一种基于动态阈值的电力监控局域网DDoS攻击检测方法。[方法]通过网络流量采集设备实时获取电力监控局域网的流量数据,并利用信息熵理论计算流量熵值。信息熵可反映数据的混乱程度:正常流量通常具有一定规律性,熵值相对稳定;而DDoS攻击流量因异常数据包的大量涌入,导致熵值显著波动。基于此特性,本文设定动态阈值,当流量熵值超过阈值时判定为异常流量。随后,提取异常流量的六元组特征集(包括平均流包数、平均字节数、源IP地址增速、流表生存时间变化、端口增速以及对流比),并将其输入预训练的最小二乘支持向量机(least squares support vector machine,LSSVM)分类器中。LSSVM通过对已知样本的学习建立特征与类别的映射关系,从而实现对异常流量的分类与判断,确定其是否为DDoS攻击流量。[结果]实验结果表明,本文方法在ROC曲线和PR曲线上均表现较好,ROC-AUC和PR-AUC值均较传统方法有所提高。这表明该方法在检测DDoS攻击时具备更高的准确率与召回率,能够有效识别隐藏于正常流量中的攻击流量,并显著降低误判率。[结论]基于动态阈值与LSSVM分类器的检测方法能够有效应对电力监控局域网中DDoS攻击与正常流量难以区分的问题,提升检测的准确性与可靠性,为电力监控局域网提供更为有效的DDoS攻击防护手段,有助于增强电力系统的安全性与稳定性,保障电力供应的可靠运行,对电力行业网络安全防护具有重要的实际应用价值。展开更多
基金Sponsored by the National Natural Science Foundation of China(60472110)
文摘To improve the training speed of support vector machine （SVM）, a method called improved center distance ratio method （ICDRM） with determining thresholds automatically is presented here without reduce the identification rate. In this method border vectors are chosen from the given samples by comparing sample vectors with center distance ratio in advance. The number of training samples is reduced greatly and the training speed is improved. This method is used to the identification for license plate characters. Experimental resuhs show that the improved SVM method-ICDRM does well at identification rate and training speed.
基金National Natural Science Foundation of China(No.61271152)Natural Science Foundation of Hebei Province,China(No.F2012506008)the Original Innovation Foundation of Ordnance Engineering College,China(No.YSCX0903)
文摘Considering the secure authentication problem for equipment support information network,a clustering method based on the business information flow is proposed. Based on the proposed method,a cluster-based distributed authentication mechanism and an optimal design method for distributed certificate authority( CA)are designed. Compared with some conventional clustering methods for network,the proposed clustering method considers the business information flow of the network and the task of the network nodes,which can decrease the communication spending between the clusters and improve the network efficiency effectively. The identity authentication protocols between the nodes in the same cluster and in different clusters are designed. From the perspective of the security of network and the availability of distributed authentication service,the definition of the secure service success rate of distributed CA is given and it is taken as the aim of the optimal design for distributed CA. The efficiency of providing the distributed certificate service successfully by the distributed CA is taken as the constraint condition of the optimal design for distributed CA. The determination method for the optimal value of the threshold is investigated. The proposed method can provide references for the optimal design for distributed CA.
文摘[目的]DDoS攻击作为一种破坏性极强的网络威胁,严重影响电力系统的稳定运行。由于电力监控局域网中的数据流量复杂多变,DDoS攻击流量与正常流量在表现形式上存在较高相似性,导致二者难以有效区分。传统的静态阈值方法虽能在一定程度上实现流量监测,但因无法适应流量的动态变化,常出现误判,从而削弱了对DDoS攻击的检测效果,难以为电力监控局域网提供可靠的安全保障。为此,提出一种基于动态阈值的电力监控局域网DDoS攻击检测方法。[方法]通过网络流量采集设备实时获取电力监控局域网的流量数据,并利用信息熵理论计算流量熵值。信息熵可反映数据的混乱程度:正常流量通常具有一定规律性,熵值相对稳定;而DDoS攻击流量因异常数据包的大量涌入,导致熵值显著波动。基于此特性,本文设定动态阈值,当流量熵值超过阈值时判定为异常流量。随后,提取异常流量的六元组特征集(包括平均流包数、平均字节数、源IP地址增速、流表生存时间变化、端口增速以及对流比),并将其输入预训练的最小二乘支持向量机(least squares support vector machine,LSSVM)分类器中。LSSVM通过对已知样本的学习建立特征与类别的映射关系,从而实现对异常流量的分类与判断,确定其是否为DDoS攻击流量。[结果]实验结果表明,本文方法在ROC曲线和PR曲线上均表现较好,ROC-AUC和PR-AUC值均较传统方法有所提高。这表明该方法在检测DDoS攻击时具备更高的准确率与召回率,能够有效识别隐藏于正常流量中的攻击流量,并显著降低误判率。[结论]基于动态阈值与LSSVM分类器的检测方法能够有效应对电力监控局域网中DDoS攻击与正常流量难以区分的问题,提升检测的准确性与可靠性,为电力监控局域网提供更为有效的DDoS攻击防护手段,有助于增强电力系统的安全性与稳定性,保障电力供应的可靠运行,对电力行业网络安全防护具有重要的实际应用价值。
