检索结果-内蒙古大学图书馆

International Conference on parallel and distributed Systems (ICPADS)

作者： Zhongyang Wang Yijie Wang Hongzuo Xu Yongjun Wang Science and Technology on Parallel and Distributed Processing Laboratory College of Computer National University of Defense Technology

Mixed-type data with both categorical and numerical features are ubiquitous in network security, but the existing methods are minimal to deal with them. Existing methods usually process mixed-type data through feature conversion, whereas their performance is downgraded by information loss and noise caused by the transformation. Meanwhile, existing methods usually superimpose domain knowledge and machine learning in which fixed thresholds are used. It cannot dynamically adjust the anomaly threshold to the actual scenario, resulting in inaccurate anomalies obtained, which results in poor performance. To address these issues, this paper proposes a novel Anomaly Detection method based on Reinforcement Learning, termed ADRL, which uses reinforcement learning to dynamically search for thresholds and accurately obtain anomaly candidate sets, fusing domain knowledge and machine learning fully and promoting each other. Specifically, ADRL uses prior domain knowledge to label known anomalies and uses entropy and deep autoencoder in the categorical and numerical feature spaces, respectively, to obtain anomaly scores combining with known anomaly information, which are integrated to get the overall anomaly scores via a dynamic integration strategy. To obtain accurate anomaly candidate sets, ADRL uses reinforcement learning to search for the best threshold. Detailedly, it initializes the anomaly threshold to get the initial anomaly candidate set and carries on the frequent rule mining to the anomaly candidate set to form the new knowledge. Then, ADRL uses the obtained knowledge to adjust the anomaly score and get the score modification rate. According to the modification rate, different threshold modification strategies are executed, and the best threshold, that is, the threshold under the maximum modification rate, is finally obtained, and the modified anomaly scores are obtained. The scores are used to re-carry out machine learning to improve the algorithm's accuracy for anomalo

关键词： Knowledge engineering Machine learning algorithms Conferences distributed databases Reinforcement learning Telecommunication traffic Network security

来源：评论

学校读者我要写书评

暂无评论

Entropy and Autoencoder-Based Outlier Detection in Mixed-Type Network Traffic Data

Entropy and Autoencoder-Based Outlier Detection in Mixed-Typ...

引用

IEEE International Conference on Big Data and Cloud Computing (BdCloud)

作者： Zhongyang Wang Yijie Wang Zhenyu Huang Yongjun Wang Science and Technology on Parallel and Distributed Processing Laboratory College of Computer National University of Defense Technology

Mixed-type data containing categorical and numerical features are pervasive in real life, but very limited outlier detection methods are available for these data. Some existing methods handle mixed-type data by feature converting, whereas their performance is downgraded by information loss and noise caused by the transformation. Meanwhile, the existing general algorithms cannot combine the characteristics of outliers in specific fields, leading to an unsatisfying performance in actual scenarios, such as the field of network security. This paper proposes a novel Entropy and Autoencoder-based Outlier Detection in mixed-type network traffic data, termed EAOD, which combines characteristics of outliers in specific fields and machine learning models to detect outliers. EAOD utilizes the expert rules made by domain knowledge summarized based on characteristics of existing outliers to label known outlier data. It performs holoentropy and deep autoencoder for the category and numerical feature spaces, respectively, in unlabeled data to obtain outlier scores integrated to get the final outlier scores via a dynamic integration strategy. Especially in the numerical feature space, to fully mine known outlier behavior patterns, deep autoencoders of outlier and normal types are constructed separately to capture unknown outliers jointly. Experiments show that EAOD significantly outperforms eight state-of-the-art outlier detectors on seven real network traffic datasets.

关键词： Telecommunication traffic Machine learning Detectors Network security Feature extraction Entropy Data models

来源：评论

学校读者我要写书评

暂无评论

Deep Isolation Forest for Anomaly Detection

arXiv

引用

arXiv 2022年

作者： Xu, Hongzuo Pang, Guansong Wang, Yijie Wang, Yongjun The College of Computer National University of Defense Technology Changsha410073 China The Science and Technology on Parallel and Distributed Processing Laboratory China The School of Computing and Information Systems Singapore Management University 178902 Singapore

Isolation forest (iForest) has been emerging as arguably the most popular anomaly detector in recent years due to its general effectiveness across different benchmarks and strong scalability. Nevertheless, its linear axis-parallel isolation method often leads to (i) failure in detecting hard anomalies that are difficult to isolate in high-dimensional/non-linear-separable data space, and (ii) notorious algorithmic bias that assigns unexpectedly lower anomaly scores to artefact regions. These issues contribute to high false negative errors. Several iForest extensions are introduced, but they essentially still employ shallow, linear data partition, restricting their power in isolating true anomalies. Therefore, this paper proposes deep isolation forest. We introduce a new representation scheme that utilises casually initialised neural networks to map original data into random representation ensembles, where random axis-parallel cuts are subsequently applied to perform the data partition. This representation scheme facilitates high freedom of the partition in the original data space (equivalent to non-linear partition on subspaces of varying sizes), encouraging a unique synergy between random representations and random partition-based isolation. Extensive experiments show that our model achieves significant improvement over state-of-the-art isolation-based methods and deep detectors on tabular, graph and time series datasets;our model also inherits desired scalability from iForest. © 2022, CC BY.

关键词： Anomaly detection

来源：评论

学校读者我要写书评

暂无评论

Attention-based Encoder-Decoder Recurrent Neural Networks for HTTP Payload Anomaly Detection

Attention-based Encoder-Decoder Recurrent Neural Networks fo...

引用

IEEE International Conference on Big Data and Cloud Computing (BdCloud)

作者： Shang Wu Yijie Wang Science and Technology on Parallel and Distributed Processing Laboratory College of Computer National University of Defense Technology

Attack payloads are often short segments hidden in HTTP requests; thus they can be found by HTTP payload anomaly detection. Deep learning models learn data features during training without manual feature extraction, and better performance has received more attention. Recurrent Neural Network models process sequences directly, which are widely used in payload anomaly detection. However, due to the gradient vanishing problem, RNN has limits on processing the long sequences. Meanwhile, RNN uses its final hidden state for detection and pays more attention to the content of the end of the payload. Besides, deep learning generally lacks interpretability. The paper proposes an unsupervised deep learning model for HTTP payload Anomaly Detection, namely Attention-based Encoder-Decoder Recurrent Neural Networks Anomaly Detection model (AEDRAD). AEDRAD utilizes the encoder-decoder RNN and attention mechanism to detect anomalies by reconstructing the original sequences. AEDRAD filters the fields of HTTP protocol that cannot exist anomalies, focusing on the suspicious segments. Through the encoder-decoder network, the normal payload can be well-reconstructed while the anomaly payload fails. With the attention mechanism, AEDRAD generates practical features for further anomaly detection from a global perspective. Meanwhile, it marks abnormal fragments visually, which is conducive to a subsequent analysis by experts. The experimental results show that AEDRAD significantly outperforms three state-of-the-art unsupervised algorithms on two real datasets.

关键词： Deep learning Training Recurrent neural networks Protocols Focusing Manuals Feature extraction

来源：评论

学校读者我要写书评

暂无评论

A Memory Saving Mechanism Based on Data Transferring for Pipeline parallelism

A Memory Saving Mechanism Based on Data Transferring for Pip...

引用

IEEE International Conference on Big Data and Cloud Computing (BdCloud)

作者： Wei Jiang Rui Xu Sheng Ma Qiong Wang Xiang Hou Hongyi Lu Science and Technology on Parallel and Distributed Processing Laboratory College of Computer National University of Defense Technology Changsha China

The correctness and robustness of the neural network model are usually proportional to its depth and width. Currently, the neural network models become deeper and wider to cope with complex applications, which leads to high memory capacity requirement and computer capacity requirements of the training process. The multi-accelerator parallelism is a promising choice for the two challenges, which deploys multiple accelerators in parallel for training neural networks. Among them, the pipeline parallel scheme has a great advantage in training speed, but its memory capacity requirements are relatively higher than other parallel schemes. Aiming at solving this challenge of pipeline parallel scheme, we propose a data transfer mechanism, which effectively reduces the peak memory usage of the training process by real-time data transferring. In the experiment, we implement our design and apply it to Pipedream, a mature pipeline parallel scheme. The memory requirement of training process is reduced by up to 48.5%, and the speed loss is kept within a reasonable range.

关键词： Training Computational modeling Pipelines Neural networks Memory management Bandwidth parallel processing

来源：评论

学校读者我要写书评

暂无评论

Co-designing the Topology/Algorithm to Accelerate distributed Training

Co-designing the Topology/Algorithm to Accelerate Distribute...

引用

IEEE International Conference on Big Data and Cloud Computing (BdCloud)

作者： Xiang Hou Rui Xu Sheng Ma Qiong Wang Wei Jiang Hongyi Lu Science and Technology on Parallel and Distributed Processing Laboratory College of Computer National University of Defense Technology Changsha China

With the development of Deep Learning (DL), Deep Neural Network (DNN) models have become more complex. At the same time, the development of the Internet makes it easy to obtain large data sets for DL training. Large-scale model parameters and training data enhance the level of AI by improving the accuracy of DNN models. But on the other hand, they also present more severe challenges to the hardware training platform because training a large model needs a lot of computing and memory resources that can easily exceed the capacity of a single processor. In this context, integrating more processors on a hierarchical system to conduct distributed training is a direction for the development of training platforms. In distributed training, collective communication operations (including all-to-all, all-reduce, and all-gather) take up a lot of training time, making the interconnection network between computing nodes one of the most critical factors affecting the system performance. The hierarchical torus topology, combined with the Ring All-Reduce collective communication algorithm, is one of the current mainstream distributed interconnection networks. However, we believe that its communication performance is not the best. In this work, we first designed a new intra-package communication topology, i.e. the switch-based fully connected topology, which shortens the time consumed by cross-node communication. Then, considering the characteristics of this topology, we carefully devised more efficient all-reduce and all-gather communication algorithms. Finally, combined with the torus topology, we implemented a novel distributed DL training platform. Compared with the hierarchical torus, our platform improves communication efficiency and provides 1.16-2.68 times speedup in distributed training of DNN models.

关键词： Training Deep learning Network topology Multiprocessor interconnection Computational modeling Training data Switches

来源：评论

学校读者我要写书评

暂无评论

Surrogate Supervision-based Deep Weakly-supervised Anomaly Detection

Surrogate Supervision-based Deep Weakly-supervised Anomaly D...

引用

IEEE International Conference on Data Mining Workshops (ICDM Workshops)

作者： Zhiyue Wu Hongzuo Xu Yijie Wang Yongjun Wang Science and Technology on Parallel and Distributed Processing Laboratory College of Computer National University of Defense Technology Changsha China

ISBN: (纸本)9781665424288

Many anomaly detection applications can provide partially observed anomalies, but only limited work is for this setting. Additionally, a number of anomaly detectors focus on learning a particular model of normal/abnormal class. However, the intra-class model might be too complicated to be accurately learned. It is still a non-trivial task to handle data with anomalies/inliers in skewed and heterogeneous distributions. To address these problems, this paper proposes an anomaly detection method to leverage Partially Labeled anomalies via Surrogate supervision-based Deviation learning (denominated PLSD). The original supervision (i.e., known anomalies and a set of explored inliers) is transferred to semantic-rich surrogate supervision signals (i.e., anomaly-inlier and inlier-inlier class) via vector concatenation. Then different relationships and interactions between anomalies and inliers are directly and efficiently learned thanks to the neural network’s connection property. Anomaly scoring is processed via the trained network and the high-efficacy inliers. Extensive experiments show that PLSD significantly prevails state-of-the-art semi/weakly-supervised anomaly detectors.

关键词： Learning systems Conferences Detectors Gaussian distribution Benchmark testing Task analysis Anomaly detection

来源：评论

学校读者我要写书评

暂无评论

Word Embedding-based Context-sensitive Network Flow Payload Anomaly Detection

Word Embedding-based Context-sensitive Network Flow Payload ...

引用

International Conference on Applied Machine Learning (ICAML)

作者： Yizhou Li Yijie Wang Li Cheng Hongzuo Xu Science and Technology on Parallel and Distributed Processing Laboratory College of Computer National University of Defense Technology Changsha China

ISBN: (纸本)9781665421263

Payload anomaly detection can discover malicious behaviors hidden in network packets. It is hard to handle payload due to its various possible characters and complex semantic context, and thus identifying abnormal payload is also a non-trivial task. Prior art only uses the n-gram language model to extract features, which directly leads to ultra-high-dimensional feature space and also fails to capture the context semantics fully. Accordingly, this paper proposes a word embedding-based context-sensitive network flow payload anomaly detection method (termed WECAD). First, WECAD obtains the initial feature representation of the payload through the word embedding-based method. Then, we propose a corpus pruning algorithm, which applies the cosine similarity clustering and frequency distribution to prune inconsequential characters. We only keep the essential characters to reduce the calculation space. Subsequently, we propose a context learning algorithm. It employs the co-occurrence matrix transformation technology and introduces the backward step size to consider the order relationship of essential characters. Comprehensive experiments on real-world intrusion detection datasets validate the effectiveness of our method.

关键词： Art Semantics Clustering algorithms Intrusion detection Machine learning Feature extraction Task analysis

来源：评论

学校读者我要写书评

暂无评论

Fden: Mining Effective Information of Features in Detecting Network Anomalies

Fden: Mining Effective Information of Features in Detecting ...

引用

IEEE International Conference on Acoustics, Speech and Signal processing

作者： Bin Li Yijie Wang Mingyu Liu Kele Xu Zhongyang Wang Li Cheng Yizhou Li Science and Technology on Parallel and Distributed Processing Laboratory College of Computer National University of Defense Technology Changsha China

Network anomaly detection is important for detecting and reacting to the presence of network attacks. In this paper, we propose a novel method to effectively leverage the features in detecting network anomalies, named FDEn, consisting of flow-based Feature Derivation (FD) and prior knowledge incorporated Ensemble models (En pk). To mine the effective information in features, 149 features are derived to enrich the feature set of the original data with covering more characteristics of network traffic. To leverage these features effectively, an ensemble model En pk, including CatBoost and XGBoost, based on the bagging strategy is proposed to first detect anomalies by combining numerical features and categorical features. And then, En pk adjusts the predicted label of specific data by incorporating the prior knowledge of network security. We conduct empirically experiments on the data set provided by the Network Anomaly Detection Challenge (NADC), in which we obtain average improvement up to 61.6%, 31.7%, 50.2%, and 45.0%, in terms of the cost score, precision, recall and F1-score, respectively.

关键词： Knowledge engineering Conferences Telecommunication traffic Signal processing Feature extraction Numerical models Security

来源：评论

学校读者我要写书评

暂无评论

EmbRace: Accelerating Sparse Communication for distributed Training of NLP Neural Networks

arXiv

引用

arXiv 2021年

作者： Li, Shengwei Lai, Zhiquan Li, Dongsheng Zhang, Yiming Ye, Xiangyu Duan, Yabo National Key Laboratory of Parallel Distributed Processing Computer College National University of Defense Technology China Xiamen University China

distributed data-parallel training has been widely adopted for deep neural network (DNN) models. Although current deep learning (DL) frameworks scale well for dense models like image classification models, we find that these DL frameworks have relatively low scalability for sparse models like natural language processing (NLP) models that have highly sparse embedding tables. Most existing works overlook the sparsity of model parameters thus suffering from significant but unnecessary communication overhead. In this paper, we propose EmbRace, an efficient communication framework to accelerate communications of distributed training for sparse models. EmbRace introduces Sparsity-aware Hybrid Communication, which integrates AlltoAll and model parallelism into data-parallel training, so as to reduce the communication overhead of highly sparse parameters. To effectively overlap sparse communication with both backward and forward computation, EmbRace further designs a 2D Communication Scheduling approach which optimizes the model computation procedure, relaxes the dependency of embeddings, and schedules the sparse communications of each embedding row with a priority queue. We have implemented a prototype of EmbRace based on PyTorch and Horovod, and conducted comprehensive evaluations with four representative NLP models. Experimental results show that EmbRace achieves up to 2.41X speedup compared to the state-of-the-art distributed training baselines. Copyright © 2021, The Authors. All rights reserved.

关键词： Embeddings

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：