High False Alarm Rate Research Articles

An Infrared small target detection method based on local contrast measure and gradient property

Infrared small target detection plays an important role in infrared search and tracking applications. In order to solve the problem of detection has high false alarm rates and low probabilities with complex backgrounds. An infrared small target detection method based on local contrast measure and gradient property (LCG) is proposed in this paper. Initially, the contrast map of the input image is calculated using the modified local contrast measure which is employed to enhance target and suppress background. Then, according to the property of distribution regularly around the target, the gradient map is calculated from the input image to further suppress clutters. Next, the feature map is achieved by integrating the local contrast map and gradient map in a pixel-wise multiplication manner. Finally, an adaptive threshold is used to extract the target region. Experimental results on two real sequences demonstrate that the proposed method has a good performance in background suppression and target enhancement. Besides, the proposed method has satisfying robustness under complex backgrounds.

Detecting Website Defacement Attacks using Web-page Text and Image Features

Recently, web attacks in general and defacement attacks in particular to websites and web applications have been considered one of major security threats to many enterprises and organizations who provide web-based services. A defacement attack can result in a critical effect to the owner’s website, such as instant discontinuity of website operations and damage of the owner’s reputation, which in turn may lead to huge financial losses. A number of techniques, measures and tools for monitoring and detecting website defacements have been researched, developed and deployed in practice. However, some measures and techniques can only work with static web-pages while some others can work with dynamic web-pages, but they require extensive computing resources. The other issues of existing proposals are relatively low detection rate and high false alarm rate because many important elements of web-pages, such as embedded code and images are not processed. In order to address these issues, this paper proposes a combination model based on BiLSTM and EfficientNet for website defacement detection. The proposed model processes web-pages’ two important components, including the text content and page screenshot images. The combination model can work effectively with dynamic web-pages and it can produce high detection accuracy as well as low false alarm rate. Experimental results on a dataset of over 96,000 web-pages confirm that the proposed model outperforms existing models on most of measurements. The model’s overall accuracy, F1-score and false positive rate are 97.49%, 96.87% and 1.49%, respectively.

一种基于人机协同的窃电用户判别方法

人工智能模型在窃电用户识别实际工业场景中应用时面临着高识别率与低成本之间的矛盾。对于训练完成的模型，通过设置模型判别阈值使其识别出更多窃电用户的同时也将导致更多非窃电用户被错误识别，造成现场排查成本的增加；反之，若追求较低的现场排查成本，那么只能识别出相对较少的窃电用户。针对此矛盾，本文提出了一种基于人机协同的窃电用户判别方法。在该方法中，电网公司首先根据自身特点与需求选取合适的模型判别阈值，然后结合模型判别依据与人工经验知识对模型初步判定结果进行筛查，最后只需对相对较少的用户进行现场排查，从而降低人力、物力成本。此外，电力公司可以根据模型从用户用电数据中学到的“知识”对自身领域知识进行补充，还可以对模型所使用的指标体系进行修正、改善。本文所提出的方法对于人工智能模型在窃电用户识别的应用方面具有一定的管理意义与实际应用价值。 There is a contradiction between high recognition rate and low cost in the real industrial condition of electricity theft users distinguishing when using artificial intelligence model. For a trained artificial intelligence model, there will be higher false alarm rate when the model discrimination threshold is set to identify more electricity theft users; on the contrary, only a relatively small number of electricity theft users can be identified if a lower on-site investigation cost is pursued. In the light of this contradiction, a human-machine cooperation method is proposed. In this method, the power grid company first selects the appropriate model discrimination threshold according to its own characteristics and needs, then combines the artificial experience and the model explanations to screen the preliminary judgment results of the model, and finally only needs to conduct on-site investigation for relatively few users, so as to reduce the cost of human and material resources. In addition, power grid companies can supplement their own domain knowledge according to the “knowledge” learned from the user electricity data. They can also improve the designing of features used in the model. The method proposed in this article has significance value of management and practical application of artificial intelligence model in distinguishing electricity theft users.

Similarity-Measured Isolation Forest: Anomaly Detection Method for Machine Monitoring Data

A rough environment or unexpected accident of data acquisition instrument can introduce some anomalies in monitoring data. Those anomalies reduce data quality and lead to the incorrect recognition of machine health status. However, the research on anomaly detection of machine monitoring data (MMD) is very scarce. Moreover, anomaly detection methods in other fields cannot be directly applied to MMD. Therefore, a robust anomaly detection method called similarity-measured isolation forest (SM-iForest) is proposed to detect abnormal segments and the data therein. The inadaptability and instability of iForest were reduced while processing MMD benefiting from the characteristics of sliding-window processing. Moreover, an anomaly identification stage measuring the relative similarity of possible abnormal segments further improved the robustness of iForest. The effectiveness of the proposed method was verified with a vibration simulation signal and three sets of milling force signals. The results demonstrate that SM-iForest can detect the missing, shifting, and swelling segments robustly. Detection results of comparing seven methods suggest that SM-iForest is a promising method to detect MMD anomaly with a high detection rate and low false alarm rate.

Privacy-Preserving Non-Participatory Surveillance System for COVID-19-Like Pandemics

COVID-19 pandemic has revealed a pressing need for an effective surveillance system to control the spread of infection. However, the existing systems are run by the people's smartphones and without a strong participation from the people, the systems become ineffective. Moreover, these systems can be misused to spy on people and breach their privacy. Due to recent privacy breaches, people became anxious about their privacy, and without privacy reassurance, the people may not accept the systems. In this paper, we propose a non-participatory privacy-preserving surveillance system for COVID-19-like pandemics. The system aims to control the spread of COVID-19 infection without depending on the participation of the people and with privacy preservation. In the proposed system, surveillance cameras of public places take images of visitors and compute embedding vectors that encode the facial features of the images by using deep learning techniques. A searchable encryption scheme is used by public places to encrypt the embedding vectors and send them to a cloud server (service manager). Similarly, hospitals and test centers send the encryptions of the embedding vectors of the images of positively-tested people to the cloud server. Finally, the server does operations on encrypted data to learn whether an infected person visited a public place for contact tracing without being able to learn the images or identify the visitors of the places and the infected persons, and then it alerts these places to take precautionary measures. Our analysis indicates that our system is secure and can preserve privacy. Our experimental results demonstrate that our system has high success rate and low false alarm rate, and needs low computation and communication overhead and acceptable search time.

Intrusion Detection Algorithm and Simulation of Wireless Sensor Network under Internet Environment

As an effective security protection technology, intrusion detection technology has been widely used in traditional wireless sensor network environments. With the rapid development of wireless sensor network technology and wireless sensor network applications, the wireless sensor network data traffic also grows rapidly, and various kinds of viruses and attacks appear. Based on the temporal correlation characteristics of the intrusion detection dataset, we propose a multicorrelation‐based intrusion detection model for long‐ and short‐term memory wireless sensor networks. The model selects the optimal feature subset through the information gain feature selection module, converts the feature subset into a TAM matrix using the multicorrelation analysis algorithm, and inputs the TAM matrix into the long‐ and short‐term memory wireless sensor network module for training and testing. Aiming at the problems of low detection accuracy and high false alarm rate of traditional machine learning‐based wireless sensor network intrusion detection models in the intrusion detection process, a wireless sensor network intrusion detection model combining two‐way long‐ and short‐term memory wireless sensor network and C5.0 classifier is proposed. The model first uses the hidden layer of the bidirectional long‐ and short‐term memory wireless sensor network to extract the features of the intrusion detection data set and finally inputs extracted features into the C5.0 classifier for training and classification. In order to illustrate the applicability of the model, the experiment selects three different data sets as the experimental data sets and conducts simulation performance analysis through simulation experiments. Experimental results show that the model had better classification performance.

Design of fire alarm system of intelligent camera based on fuzzy recognition algorithm

Aiming at the problems of low fire detection accuracy and high false alarm rate of the current intelligent camera fire accident alarm system, a fire accident alarm system based on fuzzy recognition algorithm is designed. By analyzing the structural principle of the fire detection and alarm system, selecting the CO gas, temperature and smoke sensor selection, designing the corresponding fire signal detection circuit, and designing the single-chip system circuit, including the single-chip clock circuit, reset circuit, power supply circuit and A/D conversion circuit design, on the basis of in-depth study of the Bluetooth communication protocol structure, the hardware design of the serial interface circuit of the single-chip microcomputer, PC and Bluetooth module has been completed. The fuzzy recognition algorithm is used to set the input and output, establish the control rule table and reasoning relationship, generate the input and output rule table, preprocess the sensor signal, and finally output the fire alarm model through the fuzzy inference system, so as to realize the fire accident alarm of the intelligent camera. The experimental results show that the fire detection accuracy of the proposed method is high, and can effectively reduce the false alarm rate and false alarm rate of the system.

Application of Improved YOLO V3 Algorithm for Target Detection in Echo Image of Sonar under Reverb

aiming at the problems of low detection rate and high false alarm rate of small and medium targets in images, a YOLO V3 improvement method is proposed and applied to the detection of small targets. Because the small target occupies less pixels and the feature is not obvious, it is proposed to up-sample the 8 times downsampling feature map of the original network output, splice the 2 times upsampling feature map with the second residual block output feature map, and establish the feature fusion target detection layer with 4 times downsampling output. In order to gainMore small target feature information is added to the second residual block DarkNe-t53 the YOLO V3 network structure. k-means clustering algorithm is used to cluster the number of target candidate boxes and the aspect ratio dimension. The results show that the improved YOLO V3 algorithm can effectively detect small targets and improve the recall rate and detection rate of small targets.

A Review of Rule Learning-Based Intrusion Detection Systems and Their Prospects in Smart Grids

Intrusion detection systems (IDS) are commonly categorized into misuse based, anomaly based and specification based IDS. Both misuse based IDS and anomaly based IDS are extensively researched in academia and industry. However, as critical infrastructures including smart grids (SG) may often face sophisticated unknown attacks in the near future, misuse based attack detection techniques will mostly miss their targets. Despite the fact that anomaly based IDS can detect novel attacks, they are not often deployed in industry, mainly owing to high false positive rate and lack of interpretability of trained models. With misuse based IDS’ inability to detect unknown attacks and requirement for frequently manually crafting and updating signatures and with anomaly based IDS’ bad reputation for high false alarm rate, specification based IDS can be regarded as the most suitable detection engine for cyber-physical systems (CPS) including SG. We argue that specification based IDS especially using rule learning could prove to be the most promising IDS for SG. Intrusion detection rules are learned through rule learning techniques and periodically automatically updated to accommodate dynamic system behaviors in SG. Fortunately, rule learning based IDS can not only detect previously unknown attacks but also achieve higher interpretability, due to symbolic representation of learned rules. It can thus be considered more “trustworthy” from human perspective and further assist human in the loop security operation. The present work provides a systematic and deep analysis of rule learning techniques and their suitability for IDS in SG. Besides, it concludes the most important criteria for learning intrusion detection rules and assessing their quality. This work serves not only as a guide to a number of important rule learning techniques but also as the first survey on their applications in IDS, which indicates their potential opportunities in SG security.

WINDS: A Wavelet-Based Intrusion Detection System for Controller Area Network (CAN)

Vehicles are equipped with Electronic Control Units (ECUs) to increase their overall system functionality and connectivity. However, the rising connectivity exposes a defenseless internal Controller Area Network (CAN) to cyberattacks. An Intrusion Detection System (IDS) is a supervisory module, proposed for identifying CAN network malicious messages, without modifying legacy ECUs and causing high traffic overhead. The traditional IDS approaches rely on time and frequency thresholding, leading to high false alarm rates, whereas state-of-the-art solutions may suffer from vehicle dependency. This paper presents a wavelet-based approach to locating the behavior change in the CAN traffic by analyzing the CAN network’s transmission pattern. The proposed Wavelet-based Intrusion Detection System (WINDS) is tested on various attack scenarios, using real vehicle traffic from two independent research centers, while being expanded toward more comprehensive attack scenarios using synthetic attacks. The technique is evaluated and compared against the state-of-the-art solutions and the baseline frequency method. Experimental results show that WINDS offers a vehicle-independent solution applicable for various vehicles through a unique approach while generating low false alarms.

Lateral positioning of vibration source for underground pipeline monitoring based on ultra-weak fiber Bragg grating sensing array

Monitoring the underground pipeline to prevent the illegal intrusion is a quite important work for civil infrastructure security management. The distributed fiber optic sensing technology nowadays has been widely used in the monitoring. Meanwhile, it also suffers from a relatively high false alarm rate. To tackle the difficult problem of false alarms, the paper develops a short range lateral positioning method of vibration source based on ultra-weak fiber Bragg grating vibration sensing array. Two parallel fiber optic cables are required to be deployed at the both sides of the pipeline. The positioning algorithm establishes a least square misfit function between the predicted and observed travel time difference based on the double-cable data. By systematically searching through the possible lateral distance in a selected range, an optimal distance can be identified according to the minimal misfit value. The tests on synthetic and field data validate the effectiveness of the proposed method.

Feature Selection with IG-R for Improving Performance of Intrusion Detection System

As the popularity of the internet computer continued to grow and become an indispensable in human life, the security of computer network has become an important issue in computer security field. The Intrusion Detection System (IDS) is a system used in computer security for network security. The feature selection stage of IDS is considered to be the most critical stage in IDS. This stage is very costly both in efforts and time. However, many machine learning approaches have been presented to improve this stage in order to improve the performance of an IDS. However, these approaches did not give desirable results with respect to the detection accuracy in the IDS. A novel technique is proposed in this paper combining the Information Gain and Ranker (IG+R) method as the feature selection strategy with Naive Bayes (NB), Support Vector Machine (SVM) and K-Nearest Neighbor (KNN) as the classifiers. The performance of these IG+R-NB, IG+R-SVM, and IG+R-KNN was evaluated on NSLKDD dataset. The experimental results of our proposed method gave high accuracy and low false alarm rate. The results obtained was compared and benchmarked with existing works. The results of this paper outperformed the existing approaches in terms of the detection accuracy.

Microstructural integrity of affective neurocircuitry in patients with dissociative seizures is associated with emotional task performance, illness severity and trauma history

PurposeTo identify variations in white matter tract integrity related to behavioural control in response to emotional stimuli in patients with dissociative seizures (DS) and healthy controls (HC), and examine associations with illness characteristics and psychological trauma history. MethodsTwenty DS patients and 20 HC completed an emotional go/no-go task and questionnaires, and then underwent diffusion tensor imaging (DTI). ResultsPatients had higher false alarm rates in response to negative emotional stimuli than HC. Task performance was correlated with self-reported difficulties in emotional awareness and regulation in everyday life. White matter analysis using tract-based spatial statistics revealed no between-group differences. In patients, fractional anisotropy (FA) in the right uncinate fasciculus, right and left fornix/stria terminalis, and corpus callosum were correlated with task performance. Similar results were found for radial diffusivity (RD), but not mean (MD) or axial diffusivity (AD). In HC, task performance was associated with AD and RD of fewer and smaller clusters in the corpus callosum and right fornix/stria terminalis, and none for FA or MD. Probabilistic tractography of thus identified tracts revealed that mean FA values were correlated with illness parameters (right fornix/stria terminalis with age at onset; posterior corpus callosum with seizure frequency), and psychological trauma history (traumatic experiences during adolescence with anterior corpus callosum). ConclusionsPatients with DS show impaired behavioural control in response to emotional stimuli. Microstructural variations in task-related neurocircuitry show associations with illness parameters and psychological trauma history. Future studies using psychiatric controls should examine the specificity of these findings.

Local contrast measure with iterative error for infrared small target detection

Local contrast measure (LCM) has been proved to be an effective method for infrared small target detection. However, the detection performance of LCM decreases dramatically when the background contains strong edges and pixel-sized noises with high brightness (PNHB). Based on the analysis of the inherent causes of the poor performance of LCM in extremely complex backgrounds, this study presents an effective LCM with an iterative error. The contribution is as follows: first, the two-dimensional least mean square (TDLMS) filter with an adaptive parameter is applied to suppress the background clutters roughly in each multiscale window. Then, the partial maximum pixel mean is applied to the LCM to optimise the sub-block statistical parameters, which achieves excellent strong edges suppression performance. Finally, the iteration error generated by TDLMS and the sub-block weight matrix is updated alternately to further optimise the statistical parameters of the contrast measure to make it more effective in suppressing PNHB. Experimental results demonstrate that the proposed approach is not only superior to the contrast methods in terms of high detection efficiency and low false alarm rate but also has satisfactory adaptability under extremely complex backgrounds.

Leak detection in a subcritical boiler

Thermal power plants experience cycling duty leading to the fatigue of the boiler and heat exchanger tubes. As a result, tube failures occur frequently in coal fired fleets leading to forced outages. Because the tube leaks have been the major source of unwanted shutdowns and the number of outages is increasing, present work focuses on the detection and isolation of the leak in a subcritical boiler based upon the process data from a commercial coal-fired power plant. The mass balance equation around the steam drum was analyzed using timeseries data collected from a 300 MW power plant. The ratio of the feed water mass flow rate to the steam mass flow rate was defined as a key parameter for detecting leaks. The difference in slope between the feedwater and steam mass flow rate during the normal and faulty operations was established as the upper control limit for real time monitoring. To reduce false alarm rates that arise when raw signal is directly compared against the threshold due to common process fluctuations, an optimal filter was derived for smoothing. It was found that the optimal filter reacted much more quickly to process changes than an exponential moving average filter, around 8 h earlier on average. Occurrence of relatively high false alarm rates even in the filtered responses was related to the cycling of the boiler from the base load condition. Variable threshold was established to keep false alarm rates to the minimum while maintaining the leak detection rate. Finally, the leak was located at the economizer and this could readily be isolated by investigating the magnitude of the mass flow rates ratio and the temperature at the economizer outlet.

Detection of Undocumented Building Constructions from Official Geodata Using a Convolutional Neural Network

Undocumented building constructions are buildings or stories that were built years ago, but are missing in the official digital cadastral maps (DFK). The detection of undocumented building constructions is essential to urban planning and monitoring. The state of Bavaria, Germany, uses two semi-automatic detection methods for this task that suffer from a high false alarm rate. To solve this problem, we propose a novel framework to detect undocumented building constructions using a Convolutional Neural Network (CNN) and official geodata, including high resolution optical data and the Normalized Digital Surface Model (nDSM). More specifically, an undocumented building pixel is labeled as “building” by the CNN but does not overlap with a building polygon of the DFK. The class of old or new undocumented building can be further separated when a Temporal Digital Surface Model (tDSM) is introduced in the stage of decision fusion. In a further step, undocumented story construction is detected as the pixels that are “building” in both DFK and predicted results from CNN, but shows a height deviation from the tDSM. By doing so, we have produced a seamless map of undocumented building constructions for one-quarter of the state of Bavaria, Germany at a spatial resolution of 0.4 m, which has proved that our framework is robust to detect undocumented building constructions at large-scale. Considering that the official geodata exploited in this research is advantageous because of its high quality and large coverage, a transferability analysis experiment is also designed in our research to investigate the sampling strategies for building detection at large-scale. Our results indicate that building detection results in unseen areas at large-scale can be improved when training samples are collected from different districts. In an area where training samples are available, local training sampless collection and training can save much time and effort.

Hyperspectral deep convolution anomaly detection based on weight adjustment strategy.

Hyperspectral anomaly detection has garnered much research in recent years due to the excellent detection ability of hyperspectral remote sensing in agriculture, forestry, geological surveys, environmental monitoring, and battlefield target detection. The traditional anomaly detection method ignores the non-linearity and complexity of the hyperspectral image (HSI), while making use of the effectiveness of spatial information rarely. Besides, the anomalous pixels and the background are mixed, which causes a higher false alarm rate in the detection result. In this paper, a hyperspectral deep net-based anomaly detector using weight adjustment strategy (WAHyperDNet) is proposed to circumvent the above issues. We leverage three-dimensional convolution instead of the two-dimensional convolution to get a better way of handling high-dimensional data. In this study, the determinative spectrum-spatial features are extracted across the correlation between HSI pixels. Moreover, feature weights in the method are automatically generated based on absolute distance and the spectral similarity angle to describe the differences between the background pixels and the pixels to be tested. Experimental results on five public datasets show that the proposed approach outperforms the state-of-the-art baselines in both effectiveness and efficiency.

Multi-level Gaussian mixture modeling for detection of malicious network traffic

Along with the growing network connectivity across the world, there is a substantial increase in malicious network traffic to exploit the vulnerabilities, thus hampering several organizations and end-users. Though signature-based and classification-based machine learning approaches can detect malicious network traffic, they cannot reliably detect unknown attacks. Several issues are yet unsolved using the existing approaches such as imbalanced training data, high false alarm rate, and lack of detection of unknown attacks. To address these issues, in this work, we propose a novel multi-level classification method that can accurately classify the network traffic into several classes and identify the novel attacks. The unsupervised Gaussian mixture modeling approach is used to learn the statistical characteristics of each traffic category, and an adaptive thresholding technique based on the interquartile range is used to identify any outlier. The proposed work is evaluated on the benchmark CICIDS2017 dataset that includes modern network traffic patterns. The results show a significant improvement relative to the state-of-the-art techniques for detecting unknown attacks and classifying multiple network traffic attacks.

Research on the adaptability of an improved high-intelligence long-distance optical fiber pre-warning system

With the development of technology, the total extent of global pipeline transportation is also increased each year. Nevertheless, owing to the wide distribution of gas and oil pipelines and the complex laying environment, the traditional long-distance optical fiber pre-warning system (OFPS) has a high false alarm rate when recognizing events threatening the pipeline safety, and it is difficult to define the type of intrusion events. Therefore, an improved high-intelligence long-distance OFPS was proposed, and the generalized adaptability of the system in various environments was studied. Φ-optical time-domain reflectometry technology was used in the distributed sensing part of the system, and a neural network (NN) was used in the signal recognition part to identify and classify intrusion events. Three methods were used in this system including an improved NN, a wavelet packet decomposition-based artificial NN, and a five-layer deep NN. Finally, through experiments in these three methods, the adaptability of the system was explored. The results show that the system possesses an excellent classification effect in the recognition of intrusion events with an average recognition rate reaching over 95%. Thus, it has good adaptability under various real environmental circumstances.

Video smoke detection base on dense optical flow and convolutional neural network

Fire is one of the disasters with the highest probability among natural disasters and social disasters. It poses a serious threat to human life and life safety. In order to reduce fire losses, a reliable fire warning method is particularly important. But due to huge variations of smoke in color, shapes, and texture and complex application environments, the existing methods still do not meet the application requirements well. To solve these problems, in this paper, we propose a two-stage real-time video smoke detection method base on dense optical flow and convolutional neural network. In the first stage, we propose a fast pre-positioning module to obtain suspicious smoke areas through the dynamic characteristics of smoke which can greatly reduce the subsequent computational complexity, and only extract the moving optical flow of suspicious smoke areas as the dynamic features of the smoke which reduce the subsequent processing time cost. Instead of simply using moving optical flow as the dynamic characteristics of smoke, we found that the optical flow of the blue channel (OFBC) can effectively reflect the motion characteristics of smoke, so we combine the OFBC of suspicious smoke areas with its three RGB color channels to form a quaternion matrix for subsequent classification. In the second stage, we choose ResNet as our pre-classifier, and a temporal enhanced adjustment algorithm was proposed as the pre-classified follow-up fine optimization module, which can fully utilize the characteristics of the smoke movement in the video to improve detection rate. The experimental results show that compared with the existing smoke detection methods, our proposed method achieves high detection rate and low false alarm rate.