Identifying High-Distributed Low-Rate QoS Violation Based on Multi-Stream Fused HMM

In order to maintain high network QoS (quality of service) against new high-distributed low-rate QoS violation, this paper proposes a novel recognition scheme with the consideration of multiple network features in both macro and micro side. This scheme uses Multi-stream Fused Hidden Markov Model (MF-HMM) in automatic low-rate QoS violation recognition for integrating multi-features simultaneously. The multi-features include the I-I-P triple and TCP header control Flag in a data packet at a micro level, and R feature in network flow at a macro level. In addition, based on the successful experience of Load-Shedding, Kaufman algorithm is used to adjust and upgrade threshold value dynamically. Our experiments show that our approach effectively reduces false-positive rate and false-negative rate. Moreover, it has a high recognition rate specifically for new QoS violation by High-Distributed Low-rate Denial of Service attacks.

Download Full-text

Accurately Identifying New QoS Violation Driven by High-Distributed Low-Rate Denial of Service Attacks Based on Multiple Observed Features

Journal of Sensors ◽

10.1155/2015/465402 ◽

2015 ◽

Vol 2015 ◽

pp. 1-11 ◽

Cited By ~ 1

Author(s):

Jian Kang ◽

Mei Yang ◽

Junyao Zhang

Keyword(s):

Network Traffic ◽

False Positive Rate ◽

Denial Of Service ◽

Threshold Value ◽

Detection Accuracy ◽

Packet Header ◽

Positive Rate ◽

Spectrum Density ◽

Microscopic Feature ◽

Low Rate

We propose using multiple observed features of network traffic to identify new high-distributed low-rate quality of services (QoS) violation so that detection accuracy may be further improved. For the multiple observed features, we chooseF featurein TCP packet header as a microscopic feature and,P featureandD featureof network traffic as macroscopic features. Based on these features, we establishmultistream fused hidden Markov model(MF-HMM) to detect stealthy low-rate denial of service (LDoS) attacks hidden in legitimate network background traffic. In addition, the threshold value is dynamically adjusted by using Kaufman algorithm. Our experiments show that the additive effect of combining multiple features effectively reduces the false-positive rate. The average detection rate of MF-HMM results in a significant 23.39% and 44.64% improvement over typical power spectrum density (PSD) algorithm and nonparametric cumulative sum (CUSUM) algorithm.

Download Full-text

Adaptive EWMA Method Based on Abnormal Network Traffic for LDoS Attacks

Mathematical Problems in Engineering ◽

10.1155/2014/496376 ◽

2014 ◽

Vol 2014 ◽

pp. 1-11 ◽

Cited By ~ 7

Author(s):

Dan Tang ◽

Kai Chen ◽

XiaoSu Chen ◽

HuiYu Liu ◽

Xinhua Li

Keyword(s):

Weighting Function ◽

False Positive Rate ◽

Denial Of Service ◽

False Negative ◽

False Negative Rate ◽

Network Services ◽

Detection Methods ◽

Abnormal Distribution ◽

Accidental Error ◽

Positive Rate

The low-rate denial of service (LDoS) attacks reduce network services capabilities by periodically sending high intensity pulse data flows. For their concealed performance, it is more difficult for traditional DoS detection methods to detect LDoS attacks; at the same time the accuracy of the current detection methods for LDoS attacks is relatively low. As the fact that LDoS attacks led to abnormal distribution of the ACK traffic, LDoS attacks can be detected by analyzing the distribution characteristics of ACK traffic. Then traditional EWMA algorithm which can smooth the accidental error while being the same as the exceptional mutation may cause some misjudgment; therefore a new LDoS detection method based on adaptive EWMA (AEWMA) algorithm is proposed. The AEWMA algorithm which uses an adaptive weighting function instead of the constant weighting of EWMA algorithm can smooth the accidental error and retain the exceptional mutation. So AEWMA method is more beneficial than EWMA method for analyzing and measuring the abnormal distribution of ACK traffic. The NS2 simulations show that AEWMA method can detect LDoS attacks effectively and has a low false negative rate and a false positive rate. Based on DARPA99 datasets, experiment results show that AEWMA method is more efficient than EWMA method.

Download Full-text

Letters to the Editor

PEDIATRICS ◽

10.1542/peds.68.1.144a ◽

1981 ◽

Vol 68 (1) ◽

pp. 144-145

Author(s):

Lachlan Ch De Crespigny ◽

Hugh P. Robinson

Keyword(s):

Real Time ◽

Linear Array ◽

False Positive Rate ◽

False Negative ◽

False Negative Rate ◽

Letters To The Editor ◽

Premature Babies ◽

Computed Tomography Scans ◽

Positive Rate ◽

Time Linear

We read with interest the report which suggested that the diagnosis of cerebroventricular hemorrhage ([CVH] including both subependymal [SEH] and intraventricular) with real time ultrasound was unreliable.1 Ultrasound, when compared with computed tomography scans, had a 35% false-positive rate and a 21% false-negative rate. In our institution over a 12-month period more than 200 premature babies have been examined (ADR real time linear array scanner with a 7-MHz transducer).

Download Full-text

Low-Rate DoS Attacks Detection Based on MAF-ADM

Sensors ◽

10.3390/s20010189 ◽

2019 ◽

Vol 20 (1) ◽

pp. 189 ◽

Cited By ~ 4

Author(s):

Sijia Zhan ◽

Dan Tang ◽

Jianping Man ◽

Rui Dai ◽

Xiyin Wang

Keyword(s):

Joint Distribution ◽

Transmission Control Protocol ◽

Denial Of Service ◽

False Negative ◽

False Negative Rate ◽

Network Simulator ◽

Dos Attacks ◽

Time Frequency ◽

Anomaly Score ◽

Low Rate

Low-rate denial of service (LDoS) attacks reduce the quality of network service by sending periodical packet bursts to the bottleneck routers. It is difficult to detect by counter-DoS mechanisms due to its stealthy and low average attack traffic behavior. In this paper, we propose an anomaly detection method based on adaptive fusion of multiple features (MAF-ADM) for LDoS attacks. This study is based on the fact that the time-frequency joint distribution of the legitimate transmission control protocol (TCP) traffic would be changed under LDoS attacks. Several statistical metrics of the time-frequency joint distribution are chosen to generate isolation trees, which can simultaneously reflect the anomalies in time domain and frequency domain. Then we calculate anomaly score by fusing the results of all isolation trees according to their ability to isolate samples containing LDoS attacks. Finally, the anomaly score is smoothed by weighted moving average algorithm to avoid errors caused by noise in the network. Experimental results of Network Simulator 2 (NS2), testbed, and public datasets (WIDE2018 and LBNL) demonstrate that this method does detect LDoS attacks effectively with lower false negative rate.

Download Full-text

Pathologic Assessment of Computerized Tomography Accuracy for the Evaluation of the Laryngeal Cartilaginous Frame Work in Laryngopharyngeal Carcinomas

Tumori Journal ◽

10.1177/030089168907500216 ◽

1989 ◽

Vol 75 (2) ◽

pp. 156-162 ◽

Cited By ~ 5

Author(s):

Sandro Sulfaro ◽

Francesco Querin ◽

Luigi Barzan ◽

Mario Lutman ◽

Roberto Comoretto ◽

...

Keyword(s):

Computerized Tomography ◽

False Positive ◽

False Positive Rate ◽

False Negative ◽

False Negative Rate ◽

Cartilage Destruction ◽

High False Negative Rate ◽

Positive Rate ◽

Pathologic Assessment ◽

Low Sensitivity

Sixty-six whole-organ sectioned laryngopharyngectomy specimens removed for cancer during a seven-year period were uniformly examined to determine the accuracy of preoperative high resolution computerized tomography (CT) for detection of cartilaginous involvement. Our results indicate that CT has a high overall specificity (88.2%) but a low sensitivity (47.1 %); we observed a high false-negative rate (26.5%) and a fairly low false-positive rate (5.9%). Massive cartilage destruction was easily assessed by CT, whereas both small macroscopic and microscopic neoplastic foci of cartilaginous invasion were missed on CT scans. Moreover, false-positive cases were mainly due to proximity of the tumor to the cartilage. Clinical implications of these results are discussed.

Download Full-text

Macromolecule Particle Picking and Segmentation of a KLH Database by Unsupervised Cryo-EM Image Processing

Biomolecules ◽

10.3390/biom9120809 ◽

2019 ◽

Vol 9 (12) ◽

pp. 809

Author(s):

Miguel Carrasco ◽

Patricio Toledo ◽

Nicole D. Tischler

Keyword(s):

Signal To Noise Ratio ◽

False Positive Rate ◽

False Negative ◽

False Negative Rate ◽

Keyhole Limpet Hemocyanin ◽

True Positive Rate ◽

Cryo Electron Microscopy ◽

Positive Rate ◽

Top View ◽

Non Negative Matrix Factorization

Segmentation is one of the most important stages in the 3D reconstruction of macromolecule structures in cryo-electron microscopy. Due to the variability of macromolecules and the low signal-to-noise ratio of the structures present, there is no generally satisfactory solution to this process. This work proposes a new unsupervised particle picking and segmentation algorithm based on the composition of two well-known image filters: Anisotropic (Perona–Malik) diffusion and non-negative matrix factorization. This study focused on keyhole limpet hemocyanin (KLH) macromolecules which offer both a top view and a side view. Our proposal was able to detect both types of views and separate them automatically. In our experiments, we used 30 images from the KLH dataset of 680 positive classified regions. The true positive rate was 95.1% for top views and 77.8% for side views. The false negative rate was 14.3%. Although the false positive rate was high at 21.8%, it can be lowered with a supervised classification technique.

Download Full-text

Validity and Reliability of the Hooper Visual Organization Test

Perceptual and Motor Skills ◽

10.2466/pms.1974.39.1.95 ◽

1974 ◽

Vol 39 (1) ◽

pp. 95-100 ◽

Cited By ~ 13

Author(s):

Allan Gerson

Keyword(s):

False Positive Rate ◽

False Negative ◽

False Negative Rate ◽

Functional Disorders ◽

Validity And Reliability ◽

Clinical Value ◽

Clear Cut ◽

Positive Rate ◽

Organic Brain ◽

Visual Organization

To assess the validity and reliability of the Hooper Visual Organization Test, 68 Ss, of whom 16 were clinically and psychometrically determined to be suffering from organic brain damage, 19 had functional disorders, and 33 were without organic or functional disorders (normal), were given the test. The instrument was shown to be reliable ( r = .80), however, clear-cut discriminations between groups were not achieved. There were significant differences in scores of normal and damaged groups, functional and damaged Ss, but not functional and normal Ss. The qualitative signs said to aid in differentiations were totally absent from all protocols. Performance was affected in part by IQ and other aspects of recognition of meaning. There was a 19% false negative rate for the functionals and a 51% false positive rate for normals. The conclusion was that this device is of dubious clinical value.

Download Full-text

Empirical mean curve decomposition with multiwavelet transformation for eye movements recognition using electrooculogram signals

Proceedings of the Institution of Mechanical Engineers Part H Journal of Engineering in Medicine ◽

10.1177/0954411920924496 ◽

2020 ◽

Vol 234 (8) ◽

pp. 794-811

Author(s):

Harikrishna Mulam ◽

Malini Mudigonda

Keyword(s):

Neural Network ◽

Eye Movements ◽

False Positive Rate ◽

False Negative ◽

False Negative Rate ◽

Principal Component ◽

The Neural Network ◽

Marquardt Algorithm ◽

Positive Rate ◽

Sensitivity Specificity

Many research works are in progress in classification of the eye movements using the electrooculography signals and employing them to control the human–computer interface systems. This article introduces a new model for recognizing various eye movements using electrooculography signals with the help of empirical mean curve decomposition and multiwavelet transformation. Furthermore, this article also adopts a principal component analysis algorithm to reduce the dimension of electrooculography signals. Accordingly, the dimensionally reduced decomposed signal is provided to the neural network classifier for classifying the electrooculography signals, along with this, the weight of the neural network is fine-tuned with the assistance of the Levenberg–Marquardt algorithm. Finally, the proposed method is compared with the existing methods and it is observed that the proposed methodology gives the better performance in correspondence with accuracy, sensitivity, specificity, precision, false positive rate, false negative rate, negative predictive value, false discovery rate, F1 score, and Mathews correlation coefficient.

Download Full-text

Malicious Domain Names Detection Algorithm Based on N-Gram

Journal of Computer Networks and Communications ◽

10.1155/2019/4612474 ◽

2019 ◽

Vol 2019 ◽

pp. 1-9 ◽

Cited By ~ 2

Author(s):

Hong Zhao ◽

Zhaobin Chang ◽

Guangbin Bao ◽

Xiangyan Zeng

Keyword(s):

False Positive Rate ◽

False Negative ◽

False Negative Rate ◽

Detection Algorithm ◽

Internet Security ◽

Domain Name ◽

Domain Names ◽

Malicious Attack ◽

Positive Rate ◽

N Gram

Malicious domain name attacks have become a serious issue for Internet security. In this study, a malicious domain names detection algorithm based on N-Gram is proposed. The top 100,000 domain names in Alexa 2013 are used in the N-Gram method. Each domain name excluding the top-level domain is segmented into substrings according to its domain level with the lengths of 3, 4, 5, 6, and 7. The substring set of the 100,000 domain names is established, and the weight value of a substring is calculated according to its occurrence number in the substring set. To detect a malicious attack, the domain name is also segmented by the N-Gram method and its reputation value is calculated based on the weight values of its substrings. Finally, the judgment of whether the domain name is malicious is made by thresholding. In the experiments on Alexa 2017 and Malware domain list, the proposed detection algorithm yielded an accuracy rate of 94.04%, a false negative rate of 7.42%, and a false positive rate of 6.14%. The time complexity is lower than other popular malicious domain names detection algorithms.

Download Full-text

Correlation of preoperative citology/histology in radiologically detected lesions and histologic findings at excision

Journal of Clinical Oncology ◽

10.1200/jco.2007.25.18_suppl.1552 ◽

2007 ◽

Vol 25 (18_suppl) ◽

pp. 1552-1552

Author(s):

P. Manente ◽

G. Vicario ◽

E. Scelzi ◽

L. Sartor ◽

L. Nicolardi ◽

...

Keyword(s):

High Performance ◽

False Positive Rate ◽

False Negative ◽

False Negative Rate ◽

Needle Aspiration ◽

European Guidelines ◽

Breast Abnormality ◽

Positive Rate ◽

Preoperative Procedures ◽

Screening Assessment

1552 Background: The major techniques used to diagnose breast abnormality has been for many years fine-needle aspiration (FNA) cytology and core needle biopsy (CNB) and more recently vacuum-assisted core biopsy (VACB). These techniques are accurate and allow definitive therapeutic surgery. The aim of our study was to detemine whether cytology/histologic findings mach histologic findings at excision. Methods: In our Institution, between January 2004 and June 2006, 43,138 mammographic exams were performed. 1,012 patients had patological lesions at mammography: 617 FNA cytology ( C due to European guidelines for breast cancer screening assessment) and 395 CNB/VACB (B) were performed. Patients with respectively suspicious and malignant FNA cytology (C4 and C5) and respectively uncertain malignant potential, suspicious and malignant histology (B3, B4 and B5) underwent to surgery. Results: The number of cancer identified by FNA cytology was 158 and the number of cancer identified by CNB/VACB was 253. The correlation of preoparative citology/histology with definitive histology had showed: false negative rate respectively 0.79% for histology (B) and 3.16% for cytology (C). False positive rate was respectively 0.4% for B and 0.63 for C. Complete sensitivity was 98.2% for B and 89.87% for C. Absolute sensitivity was 90.51% for B and 76.58% for C. Conclusions: Our data demostrated very high performance of diagnostic preoperative procedures due to multidisciplinary approach between the radiologists, the clinicians and the pathologists. No significant financial relationships to disclose.

Download Full-text