Bivariate Entropy Research Articles

Anomaly Detection for Modbus over TCP in Control Systems Using Entropy and Classification-Based Analysis

This article presents a statistical approach using entropy and classification-based analysis to detect anomalies in industrial control systems traffic. Several statistical techniques have been proposed to create baselines and measure deviation to detect intrusion in enterprise networks with a centralized intrusion detection approach in mind. Looking at traffic volume alone to find anomalous deviation may not be enough—it may result in increased false positives. The near real-time communication requirements, coupled with the lack of centralized infrastructure in operations technology and limited resources of the sensor motes, require an efficient anomaly detection system characterized by these limitations. This paper presents extended results from our previous work by presenting a detailed cluster-based entropy analysis on selected network traffic features. It further extends the analysis using a classification-based approach. Our detailed entropy analysis corroborates with our earlier findings that, although some degree of anomaly may be detected using univariate and bivariate entropy analysis for Denial of Service (DOS) and Man-in-the-Middle (MITM) attacks, not much information may be obtained for the initial reconnaissance, thus preventing early stages of attack detection in the Cyber Kill Chain. Our classification-based analysis shows that, overall, the classification results of the DOS attacks were much higher than the MITM attacks using two Modbus features in addition to the three TCP/IP features. In terms of classifiers, J48 and random forest had the best classification results and can be considered comparable. For the DOS attack, no resampling with the 60–40 (training/testing split) had the best results (average accuracy of 97.87%), but for the MITM attack, the 80–20 non-attack vs. attack data with the 75–25 split (average accuracy of 82.81%) had the best results.

Multi-objective constraint task scheduling algorithm for multi-core processors

A task scheduling algorithm is an effective means to ensure multi-core processor system efficiency. This paper defines the task scheduling problem for multi-core processors and proposes a multi-objective constraint task scheduling algorithm based on artificial immune theory (MOCTS-AI). The MOCTS-AI uses vaccine extraction and vaccination to add prior knowledge to the problem and performs vaccine selection and population updating based on the Pareto optimum, thereby accelerating the convergence of the algorithm. In the MOCTS-AI, the crossover and mutation operators and the corresponding use probability for the task scheduling problem are designed to guarantee both the global and local search ability of the algorithm. Additionally, the antibody concentration in the the MOCTS-AI is designed based on the bivariate entropy. By designing the selection probability in consideration of the concentration probability and fitness probability, antibodies with high fitness and low concentration are selected, thereby optimizing the population and ensuring its diversity. A simulation experiment was performed to analyze the convergence of the algorithm and the solution diversity. Compared with other algorithms, the MOCTS-AI effectively optimizes the scheduling length, system energy consumption and system utilization.

What indicators can capture runoff-relevant connectivity properties of the micro-topography at the plot scale?

Although connectivity is acknowledged as a key factor of a catchment hydrological behaviour, it still misses reference evaluation methodologies. Therefore the objective of the paper is to evaluate different quantitative indicators of hydrological connectivity, using the concepts of structural and functional connectivity commonly used in ecology. The indicators were tested on contrasted numerical fields of micro-topography that present distinct hydrological responses. The investigated structural connectivity indicators, mostly used so far in porous or fractured media, were the semivariogram, the bivariate entropy integral scale, the n-point rectilinear connectivity integral scale, the connectivity function integral scale, the percolation threshold and the Euler number. The first three indicators were not able to discriminate between the three extreme types of micro-topographical fields whereas the last three indicators were successful. However, relating the latter three indicators to the hydrological response of a topographical field appears uncertain. We therefore proposed a functional connectivity indicator by adapting the ‘volume to breakthrough’ concept: the degree of surface connection as a function of the surface storage filling. This indicator was capable of discriminating between the micro-topographical types. It could be used to conceptualize the process of depression filling and therefore may become an effective characteristic of an elementary representative area in large scale hydrologic model.

Numerical simulations of geological reservoirs: improving their conditioning through the use of entropy

The aim of this study is to demonstrate by means of numerical experiments that the simulation of random fields may provide images that are too spatially disorganized to represent correctly some continuous properties of geological reservoirs. Increasing the number of conditioning data does not provide a satisfactory answer to the problem. The study shows that the bivariate entropy calculated on the simulated fields is a sensitive indicator of their spatial disorder. By using this measure in the objective function of a simulated annealing procedure, previously simulated random fields can be post-conditioned on their bivariate entropy in order to reduce their spatial disorder.

Assessment of Radiographic Granularity by a Single Number. II. Interpretation of Conditional Entropy Hx(y) in the Bivariate Entropy Method

The meaning of conditional entropy Hx(y) in the bivariate entropy method is interpreted theoretically. It is shown that Hx(y) is related to the geometric mean of individual standard deviations of the output distributions when these are Gaussian. This interpretation is used to assess the radiographic granularity by a single number in terms of entropy. It is indicated that Hx(y) in this application is related to the geometric mean of the RMS granularity and represents entropy granularity as defined in this paper. The results of the above analysis and application show that Hx(y) in the bivariate entropy method is a significant measure of the average of the scatter in measured data.