Alexander A. Grusho

Prohibitions in discrete probabilistic statistical problems

Abstract In this paper, we continue our studies concerning consistent sequences of tests in discrete probabilistic statistical schemes. We introduce the concept of a ‘prohibition’ in a discrete probabilistic scheme and give a series of examples where ‘prohibitions’ arise. In statistical problems, tests exist whose critical sets are completely determined by means of ‘prohibitions.’ We find necessary and sufficient conditions for existence of consistent sequences of tests in discrete schemes where all critical sets are defined by means of ‘prohibitions.’

Problems of modeling in the analysis of covert channels

Sometimes the analysis of covert channel is weakly dependent on the correctness of probabilistic models, but more often the result of such analysis is seriously dependent on the choice of aprobabilistic model. We show how the problem of detection of covert communications depends on the correctness of the choice of probabilistic model. We found the dependence of judgments about invisibility of covert communication from the bans in a probabilistic model of the legal communication.

Detection of illegal information flow

Several types of statistical covert channels that break the informational system security policy ensuring a reliable information transfer between hostile agents can be detected by a competent warden. We introduce the basic detection technique and analyze the conditions under which the warden with limited resources can perform his task successfully.

Consistent Sequences of Tests Defined by Bans

Finite probability spaces are important in such problems of operation research as data mining, computer simulation, network and computer security, cryptography and many others. We consider complexity of testing a simple hypothesis H 0,n against complex alternative H 1, n in finite models. The way to make calculation of tests simpler is to build critical sets dependent on smallest bans (the shortest vectors, which have probability zero). We prove necessary and sufficient conditions when consistent sequence of statistical tests exists and all critical sets of the tests are defined by smallest bans. Existence of such sequences of tests is equivalent to existence of strictly consistent sequence of tests.

Statistical covert channels through PROXY server

The paper is devoted to creating a covert channel through a PROXY server. The channel is based upon data permutation in server buffer using the sequence of packets coming from the router connected to the PROXY server. The resulting data flow allows to create a statistical covert channel that transfers information by manipulating expectation and dispersion of the number of increasing pairs in the sequence of network addresses.

Limit distributions of certain characteristics of random automaton graphs

The paper deals with the following characteristics of random automaton graphs: the numbers of recurrent and nonrecurrent vertices, the number and dimensions of the components of strong connectivity, and the number of vertices attainable from a given one. Limit theorems are found for the distributions of these characteristics.

Statistical decision functions based on bans

A ban of a probability distribution on a finite space is a point which has zero probability. A statistical decision function defined by bans has zero probability for false alarms, low complexity of calculation and may be consistent. We prove properties of these decision functions and analyze the case for statistical search of bans. Then we apply these results to the problems of vulnerability search in computer programs and to the construction of covert channels.

Power Functions Of Statistical Criteria Defined By Bans.

The basic problem for developers of monitoring systems for technological processes is to exclude the false alarms. False alarms generate the interruption of technological process and lead to the manual analysis of the reasons of the wrong system behavior. In the paper it is offered to use the statistical techniques with probabilities of false alarms equal to zero. This class of statistical decisions is based on concept of bans of probability measures in a finite space. Conditions under which powers of statistical criteria accept value 1 on a finite step are found. These conditions are formulated in terms of supports of probability measures. INTRODUCTION The paper deals with the mathematical model of monitoring of a technological system behavior with finite set of states. Suppose that such monitoring systems solve the task with the help of statistical techniques. In the mathematical models the trajectories of functioning of such system are represented by infinite sequences in which each coordinate accepts value in the finite fixed alphabet. Application of statistical techniques on a set of infinite sequences demands a probability measure P which describes the correct behavior of analyzable system. The wrong system behavior is described by a probability distribution Q. Different wrong behaviors of the technological system can be described by different distributions of probabilities on space of the infinite sequences. However in the elementary case it is possible to assume that distribution of the wrong behavior of technological system is unique and known. In practice the monitoring system of technological process observes initial sections of trajectories and for each step n it tests the hypothesis H0, n that the distribution of the observed section of trajectory is defined by probablity distribution measure Pn which is the projection of measure P on the first n coordinates. The alternative hypothesis H1, n in the elementary case is defined by measure Qn which is projection of measure Q on the first n coordinates. Criteria of testing of hypotheses H0, n against alternatives H1, n allow to make the decision about the wrong behavior of technological system. The basic problem for developers of such monitoring systems is the false alarms appearance when the correct behavior of technological process is perceived as wrong (Axelson, 1999). False alarms generate interruption of technological process, and that the worst, they lead to necessity of the manual analysis of the reasons of the wrong system behavior. For this purpose in the paper it is offered to use the statistical techniques for monitoring with probabilities of false alarms equal to zero. This class of statistical decisions is based on concept of the ban (Grusho and Timonina, 2011; Grusho et al., 2013). The ban of a probability measure in the considered scheme is a vector for which probability of its appearance is equal to 0 in a finite projection of measure. Any statistical criterion for testing H0, n against H1, n is defined by a critical set Sn of vectors of length n. When the observed vector is in Sn then it leads to the acceptance of alternative H1, n. If all vectors in Sn are bans of a measure Pn, say that the criterion is defined by bans of a measure P . Existence and properties of the criteria determined by bans were researched in papers (Grusho and Timonina, 2011; Grusho et al., 2013, 2014). In particular, the behavior of power function of criteria was researched in case of n → ∞. Conditions of consistency of sequence of the statistical criteria determined by bans, i.e. conditions when powers of criteria tend to 1 in case of n→∞ are found. Specialists believed that all properties of power functions for finite n were defined by numerical values of probability distributions P and Q. However in this paper conditions under which power functions of criteria accept value 1 on a finite step are found. These conditions are formulated in terms of supports of probability measures for the main measure P on space of the infinite sequences and for alternatives. Information about supports of measures is known not always. Therefore in the paper we built the constructive check of conditions for existence of criteria with the power function equals to 1 on a finite step N . The article is structured as follows. Section 2 introduces definitions and previous results. In Section 3 the Proceedings 29th European Conference on Modelling and Simulation ©ECMS Valeri M. Mladenov, Petia Georgieva, Grisha Spasov, Galidiya Petrova (Editors) ISBN: 978-0-9932440-0-1 / ISBN: 978-0-9932440-1-8 (CD) main results are proved. In Conclusion we shortly analyze applications of constructed sequences of tests. MATHEMATICAL MODEL. BASIC DEFINITIONS AND PREVIOUS RESULTS Let’s consider mathematical model of some technological process. Let X = {x1, ..., xm} be a finite set, X be a Cartesian product of X, X∞ be a set of all sequences when i-th element belongs to X. Define A be a σ-algebra on X∞, generated by cylindrical sets. A is also Borel σ-algebra in Tychonoff product X∞, where X has a discrete topology (Bourbaki, 1968; Prokhorov and Rozanov, 1993). On (X∞, A) a probability measure P is defined. For any n = 1, 2, ..., assume that probability distribution Pn is a projection of measure P on the first n coordinates of random sequences from X∞. It is clear that for every Bn ⊆ X Pn(Bn) = P (Bn ×X∞). (1) LetDn(P ) be the support of a measure Pn (Prokhorov and Rozanov, 1993): Dn(P ) = {xn ∈ X, Pn(xn) > 0}. Define cylindrical set ∆n(P ) as follows: ∆n(P ) = Dn(P )×X∞. The sequence of cylindrical sets ∆n(P ), n=1,2,..., is not increasing and ∆(P ) = lim n→∞ ∆n(P ) = ∞ ⋂

Some relations between discrete statistical problems and properties of probability measures on topological spaces

We study problems of existence of consistent sequences of tests in a sequence of finite spaces. We also touch upon problems of existence of sequence of tests close in some sense to consistent ones. These problems are closely related to properties of some sets in Tikhonov products.

Statistical analysis of precipitation events

In the present paper we demonstrate the results of a statistical analysis of some characteristics of precipitation events and propose a kind of a theoretical explanation of the proposed models in terms of mixed Poisson and mixed exponential distributions based on the information-theoretical entropy reasoning. The proposed models can be also treated as the result of following the popular Bayesian approach.