基于条件随机场的实时入侵检测系统框架实现

入侵检测系统（IDS）如今是网络的重要组成部分,现在各种无线网络及专用网络都已配备检测系统。随着网络技术的迅猛发展,入侵检测的技术已经从简单的签名匹配发展成能充分利用上下文信息的基于异常和混合的检测方式。为了从网络环境大量记录信息中正确有效地识别出入侵,提出一种基于层叠条件随机场模型的入侵检测框架,该框架针对4类不同攻...     

Fence vibrations [intruder detection]

Many Perimeter Intrusion Detection Systems (PIDS) use microphonic sensors mounted on fences to detect intruder attacks. Vibrations in the fence are detected and analysed to determine whether they represent an intrusion attempt. The signals from the fence are processed to filter out as many false alarms as possible. It is important that the output from the sensors is linear along the fence, to ensure that there is no point on the perimeter less sensitive to intruder attack. The investigation reported in this paper aims to discover whether the performance of acoustic detection systems could be improved through research into fence acoustics. Using models of fence vibrations, sensors could be positioned to obtain a more linear response. In addition, through knowledge of the fence vibrations produced by both real attacks and the typical causes of false alarms, a system could be designed which could better distinguish between them, giving a lower false alarm rate and increased detection performance. Characteristic profiles were found for the different forms of attack to the fence. Although the investigation is still in its early stages, these attack profiles suggest that a new type of detection system could be designed based on profile recognition     

Fluctuating Target Detection in Clutter Using Sidelobe Blanking Logic

In an earlier paper, Maisel [6] considered two-channel detection systems using a sidelobe blanking logic when a nonfluctuating target was present. This paper is an extension of the earlier work to include fluctuating targets. The Swerling I, II, III, and IV models are considered when single-pulse detection is of interest. An adaptive threshold procedure is also briefly discussed whereby the probability of false alarm at any given resolution cell is maintained constant, even though the input clutter level may vary from cell to cell or from beam position to beam position. Useful data are presented for detection probabilities in the range 0.5 to 0.9, for false alarm probabilities in the range 104 to 10-8, and for a false detection probability of 0.1 for a sidelobe target yielding an apparent signal to total noise power density ratio of 13.0 dB in the main beam receiver.     

Intersatellite laser crosslinks

Intersatellite laser crosslinks (ISL) provide a method of communication that has significantly increased the data throughput that can be managed over typical RF communication systems, and has significant growth potential. Optical communications offer very wide bandwidths which can be effectively utilized with wavelength division multiplexing techniques. The data rate growth potential is well beyond the few gigabit per second range of RF technology. The use of lasers in transmitting optical data takes advantage of its small wavelength and low beam divergence to send highly directed signals over significant distances with controlled losses in intensity. The high directivity of the laser aids in resistance to jamming communications between satellites, or between satellites and ground stations. Various intersatellite laser optical crosslink system are discussed including the Massachusetts Institute of Technology's Laser Intersatellite Transmission Experiment (LITE), the McDonnell Douglas Electronic Systems Company Laser Crosslink System, and The Ball Aerospace Optical Intersatellite Link,in order to display the various subsystem and their implementations. Link budget calculations are performed on the most commonly used modulation formats to determine system parameters necessary to close the crosslink. Background is provided on primal system architectures and methods of laser communication, as well as presently implemented systems. The authors provide some insights on where ISL systems have opportunity to increase their data throughput and reduce acquisition time     

Model-based vision for automatic alarm interpretation

The further development of a previously reported knowledge-based vision recognition system for automating the interpretation of alarm events resulting from a perimeter intrusion detection system (PIDS) is reported. Measurements extracted over a sequence of digitized images are analyzed to identify the cause of the alarm. Models are maintained for alarm causes, and the scene and the measurements are matched with the models to derive an appropriate classification of the event. An overview of the initial classification system is provided, and modifications to the system are described. The results of applying the system to a range of real alarm events are presented, and further improvements are discussed     

基于时间应力分析的机内测试系统综合降虚警技术

 虚警率高是困扰机内测试（BIT）系统得到广泛应用的主要原因。针对该问题,从机电系统所承受时间应力的角度构建了机内测试系统综合降低虚警技术的总体模型。首先采用双支持向量机（SVM）的方法将实时应力信息与机内测试诊断结果相互关联。在此基础上,提出了基于核主元模糊聚类的虚警识别方法将机电系统多源信息进行综合分析,并通过优化决策实现多级降低机内测试系统虚警的目的。最后,针对某型直升机航空地平仪的机内测试系统进行了试验验证与分析。     

Intelligent Detection and Response Strategies for Complex Attacks

The current intrusion detection systems (IDS) which attempt to identify suspicious network traffic have major limitations, including generation of significant levels of false alerts. We present intelligent strategies for reduction of false positives and infrastructure protection, which increases the detection capability of the IDSs. This involves a unique approach using adaptive responses from multiple firewall and virtual private network architectures and rule sets in a novel "network quarantine channels".     

Sensor fusion for intelligent alarm analysis

The purpose of an intelligent alarm analysis system is to provide complete and manageable information to a central alarm station operator by applying alarm processing and fusion techniques to sensor information. This paper discusses the sensor fusion approach taken to perform intelligent alarm analysis for the Advanced Exterior Sensor (AES). The AES is an intrusion detection and assessment system designed for wide-area coverage, quick deployment, low false/nuisance alarm operation, and immediate visual assessment. It combines three sensor technologies (visible, infrared, and millimeter wave radar) collocated on a compact and portable remote sensor module. The remote sensor module rotates at a rate of 1 revolution per second to detect and track motion and provide assessment in a continuous 360° field-of-regard. Sensor fusion techniques are used to correlate and integrate the track data from these three sensors into a single track for operator observation. Additional inputs to the fusion process include environmental data, knowledge of sensor performance under certain weather conditions, sensor priority, and recent operator feedback. A confidence value is assigned to the track as a result of the fusion process. This helps to reduce nuisance alarms and to increase operator confidence in the system while reducing the workload of the operator     

Evaluating Radar Detection Probabilities by Steepest Descent Integration

The probability of detection for radars employing noncoherent integration and a fixed threshold or cell-averaging constant false alarm rate (CA-CFAR) processor is computed by numerical contour integration in the complex plane. The technique is applied to both nonfluctuating and chi-squared fluctuating targets. A bound on the truncation error allows for a simple stopping rule for the numerical integration. The method has applicability to many problems in radar detection theory.     

末制导雷达虚警概率检验方法

针对只有10^-8～10^-9量级的末制导雷达虚警概率难以检验的问题,研究虚警概率与发现概率、虚警时间的关系,论证了将虚警概率转化为虚警时间的检验方法,利用定时截尾统计检验理论,研究了不同鉴别比、不同试验时间、不同接收故障数时研制方与使用方的风险,提出了新型末制导雷达虚警概率的检验方法,解决了该项指标检验的难题。     

Search Radar Cumulative Probability of Detection

A procedure is presented for computing radar range performance for different types of radars. It is associated with any arbitrary cumulative probability of detection and false alarm probability for a search radar when scanning uniformly. The emphasis is on presenting a model for engineering use, rather than on its theoretical justification.     

Parallel Distributed CFAR Detection Optimization Based on Genetic Algorithm with Interval Encoding

Aiming at parallel distributed constant false alarm rate (CFAR) detection employing K/N fusion rule, an optimization algorithm based on the genetic algorithm with interval encoding is proposed. N-1 local probabilities of false alarm are selected as optimization variables. And the encoding intervals for local false alarm probabilities are sequentially designed by the person-by-person optimization technique according to the constraints. By turning constrained optimization to unconstrained optimization, the problem of increasing iteration times due to the punishment technique frequently adopted in the genetic algorithm is thus overcome. Then this optimization scheme is applied to spacebased synthetic aperture radar (SAR) multi-angle collaborative detection, in which the nominal factor for each local detector is determined. The scheme is verified with simulations of cases including two, three and four independent SAR systems. Besides, detection performances with varying K and N are compared and analyzed.     

False Alarm Rate and False Alarm Number for Discrete and Continuous Time Sampling

A comparison of the false alarm rates and false alarm numbers for discrete and continuous time sampling is given for different noise spectrums (rectangular, Hamming, Gaussian, and cosine noise voltage spectrums) and for different sampling rates for the case of discrete time sampling. Also given is the increase in the false alarm rate when going from discrete to continuous time sampling when the detection threshold is held fixed. The amount that the threshold has to be increased for continuous sampling to achieve the same false alarm rate obtained with discrete time sampling is also given.     

一种多源组合定位系统中信息质量评估方法

多源组合定位系统可有效提高定位精度及定位鲁棒性。但更多的信息源提高了引入低质量信号的可能性,从而影响组合系统的定位性能。针对该问题,提出了一种多源组合定位系统中信息质量评估方法。在单系统信息质量评估的基础上,分析了其虚警率与漏警率,发现了二者的影响因素,利用多系统拥有更多冗余信息的特点,通过一致性检验,实现了多源组合导航系统的信息质量评估。仿真实验结果表明,该方法可以同时降低信息质量评估的虚警率与漏警率,且随着组合定位系统数量的增大,虚警率与漏警率呈持续下降趋势,拥有较好的信息质量评估效果。     

Performance Data for a Double-Threshold Detection Radar

A problem f requently encountered by radar systems analysts is the evaluation of the "double-threshold" or M out of N detection process. Detection probabilities of this process are binomially distributed, making it difficult to obtain exact results for large values of the number of samples and for low probabilities of false alarm. In this paper, the M out of N detection algorithm is defined and detection performance is calculated for the special cases of the nonfluctuating target and Swerling cases I and 11 for false alarm probabilities of 106, 10-8 and 10-10.     

Threshold Control for Automatic Detection in Radar Systems

In automatic detection in radar systems an estimate of background clutter power is used to set the detection threshold. Usually detection cells surrounding the cell under test for the presence of a target are used to estimate the clutter power. In the research reported herein, the target location is taken to be uncertain and thus returns from a target could corrupt this clutter power estimate. It is shown how the threshold should be varied to compensate for the resulting degradation in detection performance. The threshold control procedure is based on a priori information about target location that could be supplied by the radar's tracking system. In addition, a simple procedure for calculating detection and false alarm probabilities for Swerling II target models is presented.     

Calculating Detection Probabilities for Adaptive Thresholds

In calculating detection probabiities for radar and sonar systems it is usually assumed that the threshold required to yield a certain probability of false alarm is known. This is often not the case for real systems and therefore the threshold must be estimated using some measure related to the test statistic. This paper presents a calculation technique that handles estimated (adaptive) thresholds in a general framework that can be applied easily to many detection problems. False alarm and detection probabilities are calculated from the characteristic function of the noise or signal plus noise variate and the characteristic function of the threshold estimate. To illustrate the method the detection performance of overlapped discrete Fourier transforms (DFTs) is calculated for a narrowband Gaussian target signal.     

激光熔覆耐磨涂层的研究现状与展望

激光熔覆技术是一种先进的表面改性技术，在制造耐靡涂层方面具有广阔的前景。本文综合评述了激光熔覆耐磨涂层的研究和应用。其中包括熔覆工艺、材料体系及其熔覆所形成的冶金组织特征和性能。最后，提出了存在的问题如今后努力的方向。     

Performance of the Analog Moving Window Detector

A type of analog integrating moving window detector for use with a scanning pulse radar is examined. A performance analysis is carried out, which takes into account both the radiation pattern of the antenna and the dynamic character of the detection process due to the angular scanning of the antenna. An expression for the false alarm rate of the detector is first derived and evaluated numerically. The detection performance and angular accuracy are next determined in a direct Monte Carlo simulation of the detector on a digital computer for both no fading and pulse-to-pulse Rayleigh fading. Finally the influence on detection performance of the width used for the moving window is investigated.     

Adaptive cell-averaging CFAR detection in distributed sensornetworks

The problem of adaptive cell-averaging constant false-alarm rate (CFAR) detection is considered for two distributed sensor network topologies, namely the parallel and the tandem topologies. The compressed data transmitted amongst the detectors is assumed to be in the form of decisions. The overall systems are optimized to yield the maximum probability of detection for a fixed probability of false alarm. The performance of the systems is also analyzed