Instruction Clustering Analysis for Unknown Network Protocol's Abnormal Behavior

There are many abnormal user behavior in the enterprise network environment, how to monitor it effectively is a hot research hotspot. At present, the analysis of abnormal behavior is mainly through the means of traffic monitoring, but there is no precise definition and related research on the behavior of enterprise network users. Therefore, the paper propose a model to analyze the abnormal behavior of enterprise network users. First, the data from the monitoring log of enterprise network should be pre-processing and the user behavior are serializing; then, for each user behavior sequence in sequence databases, calculating the user behavior similarity and correlation coefficient in a week by the improved algorithm; finally, comparing the similarity and the correlation coefficient between users and finding the user abnormal behavior. In this paper, we use the model to verify the feasibility of the internal network of the company, and find out the user’s abnormal behavior.

The dangerous and harmful factors of machinery manufacturing mainly include human unsafe behavior and consciousness factors, unsafe state factors of equipment and adverse environmental factors. The characteristics and classification of abnormal behavior are analyzed, the detection methods of operators' abnormal running behavior are compared, and the discrimination basis of operators' abnormal running behavior is analyzed. The wearable inertial sensor is studied. The acceleration sensor is used to measure the acceleration of the measured object, and the gyroscope sensor can measure the angle of the human body relative to the ground. MPU9250 is selected as the measurement tool of acceleration and angle to identify the abnormal behavior of the human body, and cooperate with the single chip microcomputer, It is conducive to the detection and early warning of abnormal behavior of mechanical operators.

Abnormal behavior analysis in crowded scenes is a challenging task in the computer vision field. Determining how to quickly and accurately locate abnormal behavior in a crowd, especially in airports, shopping malls, stations, and other practical application scenarios, has become the key to the timely handling of mass incidents. The authors have developed an embedded video analysis robot capable of local processing for crowd anomaly detection in application scenarios. In recent years, many methods of crowd anomaly detection have been proposed by scholars, but the performance of these methods when applied to video service robots is unsatisfactory. In this paper, an anomaly analysis method based on improved k-means is proposed. This method combines mean shift and the k-means classification method to achieve rapid and accurate crowd anomaly detection. A quantitative experimental evaluation was carried out on a video service robot, and the results demonstrate that the method is effective for the detection of abnormal behavior on multiple and publicly available video sequences.

A novel automatic detection method for abnormal behavior of single fish using image fusion

Most modern production systems, especially in temperate climates, do not offer wallowing facilities to pigs and, to date, this has neither generated much concern in welfare science nor public debate on pig welfare. Nevertheless, wallowing is a natural behaviour of pigs which may be important to them. This paper systematically examines the overall importance of wallowing for pig welfare using principles developed in semantic modelling. As a first step, relevant citations were collected from the scientific literature. Secondly, since the importance of the attribute (‘wallowing’) is dependent upon the discrepancy between its best and worst levels, these levels were specified in relation to thestatus quoin pig husbandry, ie no pool (even during periods of overheating) and the ideal mud pool, respectively. Criteria for an ideal mud pool were formulated in terms of pool location and size, substrate, thermal conditions, body care and hygiene. Thirdly, available scientific information about wallowing was systematically described in relation to ten so-called weighting categories identified in semantic modelling (pain and illness, survival/heat stress, fitness, stress, aggression, abnormal behaviour, frustration, natural behaviour, preferences and demand). Fourthly, the welfare importance of wallowing was assessed by tentatively comparing it to several other welfare attributes, such as food, foraging substrate, social contact and non-castration. This leads to the suggestion that wallowing is important for pig welfare because of its multifaceted nature. It may even be very important when other forms of thermoregulation are sub-optimal. This paper, finally, discusses the ‘ethical room for manoeuvre’ concerning the (non-) implementation of mud pools in practice. An integrated approach is suggested to address related scientific, technological and ethical issues, because stakeholders are faced not only with scientific and technological gaps in knowledge but also with economical, ecological, food-safety and psychological barriers. As an important element of natural behaviour and positive welfare, the subject may provide an opportunity for pig farming. This should be recognised more explicitly in transition processes towards fully sustainable pig production systems.

Network security requires effective detection and proper analysis of abnormal network behavior. To address the uncertainty associated with the process of network intrusion detection, this article proposes a network intrusion-detection algorithm based on dynamic intuitionistic fuzzy sets (IFSs). We use the classic network intrusion datasets KDD 99, NSL-KDD, and the massive, high-dimensional dataset UNSW-NB15 to evaluate the performance of our proposed algorithm. First, we perform data preprocessing on these three datasets and select features based on the results of a chi-square test. Second, using time-series processing, we construct dynamic intuitionistic fuzzy patterns from the feature-selected datasets. At last, we use a proposed distance measure for the dynamic IFSs to generate a classifier that facilitates the detection of network intrusion. Experimental results show that the classification performance of the proposed algorithm is superior to that of other state-of-the-art algorithms on the three aforementioned datasets. The achieved improvement in classification performance is particularly significant for large datasets.

Recent years have witnessed the very rapid increase in both the volume and sophistication of malware programs. Malware authors invest heavily in technologies and capabilities to streamline the process of building and mutating existing malware programs to evade traditional protection. One major challenge currently faced by the antivirus industry is to efficiently process the vast amount of incoming suspicious samples. Since most new malware is a variation of an existing malware family with the same forms of malicious behavior, automatic clustering and classification of malware programs into families have become valuable tools for malware analysts. Such grouping criteria not only allow analysts to prioritize the allocation of their investigation efforts but may also be applied to detect new malware samples based on their association with existing families. In this paper, we address the multi-class malware classification challenge from a scalability perspective. We present the design, development, and evaluation of a novel machine learning classifier trained on multifaceted content features (e.g., instruction sequences, strings, section information, and other malware features) as well as threat intelligence gathered from external sources (e.g., antivirus output). Our experiments on a dataset of 21,741 malware samples demonstrate the efficacy and precision of the proposed algorithm and also provide insights into the utility of various features.

Electronic invoice is the product of the information age. The issuance of electronic invoice greatly saves the cost of enterprises and provides more convenient services for consumers. At present, our country is vigorously promoting electronic invoices, but there are also some abnormal behaviors in the process of circulation of electronic invoices, such as false invoices reimbursement, over-quota invoices and so on. This paper designed and implemented a deep fusion analysis method of electronic invoices based on K-means and Skip-gram. On the basis of abnormal behavior of electronic invoices, it carries out correlation analysis, excavates abnormal relationship between users and enterprises in the process of electronic invoices circulation, and provides support for the normal operation of electronic invoice service system. In this paper, the model is trained on the abnormal behavior data of electronic invoices. The accuracy of the model is 76% in the inter-enterprise association analysis and 85% in the inter-user association analysis.

In spite of excellent performance of deep learning-based computer vision algorithms, they are not suitable for real-time surveillance to detect abnormal behavior because of very high computational complexity. In this paper, we propose a real-time surveillance system for abnormal behavior analysis in a closed-circuit television (CCTV) environment by constructing an algorithm and system optimized for a CCTV environment. The proposed method combines pedestrian detection and tracking to extract pedestrian information in real-time, and detects abnormal behaviors such as intrusion, loitering, fall-down, and violence. To analyze an abnormal behavior, it first determines intrusion/loitering through the coordinates of an object and then determines fall-down/violence based on the behavior pattern of the object. The performance of the proposed method is evaluated using an intelligent CCTV data set distributed by Korea Internet and Security Agency (KISA).

Detection of collaborative misbehaviour in distributed cyber-attacks

Insider threat is a serious and increasing concern for many organizations.The group of individuals who operate within the organization have access to highly confidential and sensitive information, however, if they choose to act against the organization, with their privileged access authority and their extensive knowledge, they are well positioned to cause serious damage.Compared with vast amounts of normal daily operations, malicious behaviors are indeed small probability events, and are easily ignored.Thus, there is a desperate need to explore an effective approach to detect such suspicious behaviors.In order to solve this problem, we propose a two-stage algorithm to detect anomaly through analyzing user behavior based on activity log data collected in a real office automation system.In the first stage, we compare users' behavioral activities with activities of his/her belonging role, and in the second stage, we compare individual behavioral activities with his/her activities in a window period.By adopting several effective features to describe users' regular behavioral patterns, the analyst is capable of refining underlying abnormal users and abnormal periods to better support the network security administration.

BackgroundTo date, the differentiated requirements for network performance in various health care service scenarios—within, outside, and between hospitals—remain a key challenge that restricts the development and implementation of digital medical services.ObjectiveThis study aims to construct and implement a private 5G (the 5th generation mobile communication technology) standalone (SA) medical network in a smart health environment to meet the diverse needs of various medical services.MethodsBased on an analysis of network differentiation requirements in medical applications, the system architecture and functional positioning of the proposed private 5G SA medical network are designed and implemented. The system architecture includes the development of exclusive and preferential channels for medical use, as well as an ordinary user channel. A 3-layer network function architecture is designed, encompassing resource, control, and intelligent operation layers to facilitate management arrangements and provide network open services. Core technologies, including edge cloud collaboration; service awareness; and slicing of access, bearer, and core networks, are employed in the construction and application of the 5G SA network.ResultsThe construction of the private 5G SA medical network primarily involves system architecture, standards, and security measures. The system, featuring exclusive, preferential, and common channels, supports a variety of medical applications. Relevant standards are adhered to in order to ensure the interaction and sharing of medical service information. Security is achieved through mechanisms such as authentication, abnormal behavior analysis, and dynamic access control. Three typical medical applications that rely on the 5G network in intrahospital, interhospital, and out-of-hospital scenarios—namely, mobile ward rounds, remote first aid, and remote ultrasound—were conducted. Testing of the 5G-enabled mobile ward rounds showed an average download rate of 790 Mbps and an average upload rate of 91 Mbps. Compared with 4G, the 5G network more effectively meets the diverse requirements of various business applications in prehospital emergency scenarios. For remote ultrasound, the average downlink rate of the 5G network is 4.82 Mbps, and the average uplink rate is 2 Mbps, with an average fluctuation of approximately 8 ms. The bandwidth, performance, and delay of the 5G SA network were also examined and confirmed to be effective.ConclusionsThe proposed 5G SA medical network demonstrates strong performance in typical medical applications. Its construction and application could lead to the development of new medical service models and provide valuable references for the further advancement and implementation of 5G networks in other industries, both in China and globally.

Recently, indiscriminate ransomware attacks targeting a wide range of victims for monetary gains have become a worldwide social issue. In the early years, ransomware has used e-mails as attack method. The most common spreading method was through spam mail or harmful websites. In addition, social networking sites or smartphone messages are used. Ransomware can encrypt the user's files and issues a warning message to the user and requests payment through bitcoin, which is a virtual currency that is hard to trace. It is possible to analyze ransomware but this has its limitations as new ransomware is being continuously created and disseminated. In this paper, we propose an enhanced ransomware prevention system based on abnormal behavior analysis and detection in cloud analysis system--CloudRPS. This proposed system can defend against ransomware through more in-depth prevention. It can monitors the network, file, and server in real time. Furthermore, it installs a cloud system to collect and analyze various information from the device and log information to defend against attacks. Finally, the goal of the system is to minimize the possibility of the early intrusion. And it can detect the attack quickly more to prevent at the user's system in case of the ransomware compromises.

This study aimed to describe the limitations in information-processing skills observed among persons with schizophrenia performing daily tasks and to explore whether subgroups of participants have similar profiles based on these functional limitations. Eighty-two participants with schizophrenia living in the community were assessed during their performance of a daily activity (meal preparation). Measures included a performance-based assessment for evaluating information-processing skills-the Perceive, Recall, Plan, and Perform System of Task Analysis-community functioning and symptom assessments, and neuropsychological tests from the Cambridge Neuropsychological Test Automated Battery. Research participants were classified as having high efficiency or low efficiency according to their score on the performance-based assessment and were compared on the functional, cognitive, and symptoms variables. Participants committed various errors, and functional limitations, namely problematic information-processing skills in the perceive, recall, and plan quadrants, were observed during the daily task performance. Participants from the high-efficiency group were more independent in their living skills and more successful in attaining residential independence compared with participants from the low-efficiency group. The only cognitive test that differentiated both groups was the visuospatial associative learning test. No differences were found in the severity of symptoms. Findings suggest that both performance in a daily task and memory-and specifically associative learning capacity-provide key information for the level of residential independence. Interventions aiming for the efficient use of information-processing skills during daily tasks among persons with schizophrenia should be carried out accordingly.

Daily Functioning and Information-Processing Skills Among Persons With Schizophrenia