Haruhiko Shirai

A hybrid command sequence model for anomaly detection

A new anomaly detection method based on models of user behavior at the command level is proposed as an intrusion detection technique. The hybrid command sequence (HCS) model is trained from historical session data by a genetic algorithm, and then it is used as the criterion in verifying observed behavior. The proposed model considers the occurrence of multiple command sequence fragments in a single session, so that it could recognize nonsequential patterns. Experiment results demonstrate an anomaly detection rate of higher than 90%, comparable to other statistical methods and 10% higher than the original command sequence model.

Fuzzy linguistic facial caricature drawing system

Considers a realization of a process drawing facial caricatures and exaggerating them using the concept of fuzzy information granulation. Face space is introduced, for the facial caricature drawn in computer graphics. The linguistic terms which indicate features of ones face are given as a fuzzy set by means of the concept of computing with words. Exaggerated knowledge is realized as rules on linguistic labels. Also simulation examples of facial caricature drawing and exaggerating are shown.

Improvement of Low-dose MDCT Images by Applying a Novel Adaptive Median Filter with Local Averaging

In order to reduce the quantum noise level without the expense of feature preservation of small tumors, a novel 3D adaptive median filter with local averaging is developed according to the size of tumors and the distribution of voxel value in a local region. In this paper, two new methods based on entropy of correlation and mutual information of correlation are also proposed to evaluate the validity and efficiency of the proposed filter quantitatively. The proposed filter is applied to processing low-dose abdominal datasets, and experimental results show that the filtering technique is able to reduce the level of the quantum noise and preserve the features of the edge region and the shape of the tumors for low-dose abdominal 3D MDCT images.

Analysis of command frequency and command sequence grammar in IDS

Masquerader is someone who impersonates another user and operates computer system with privileged access. Its difficult to detect out by conventional techniques as firewall or misuse-based intrusion detection. Anomaly detection has been considered as a promising approach for masquerade detection, which is based on the idea that significant departures from normal behavior could be considered due to a masquerade. However, for low detection accuracy and high false alarm rate, it is still in research stage. Till now, many methods have been proposed from different viewpoints, such as Hidden Markov Model, Naive Bayes, SVM, and so on. Compared with other methods that with well theoretical backgrounds, two intuitive determined statistical methods: the Customized Grammars method and the Self Signature approach combined with Uniqueness, reported the much better detection efficiency. Especially, both methods based on the intuitive notion that the more frequently a usage pattern was employed by current user previously, the more indicative of normal. In other hand, the statistics of usage pattern in the Customized Grammars method was based on sequential grammars, and that of the Self Signature approach combined with Uniqueness was on commands and 2-grams. In this paper, these two methods are compared and evaluated on two benchmark data sets of Unix command sequence: the Schonlau data and the Greenberg data. As a result, contributions of command frequency and command sequence grammar in IDS were analyzed and clarified.

Response Properties to Inputs of Memory Pattern Fragments in Three Types of Chaotic Neural Network Models

In this paper, we investigate response properties to inputs of memory pattern fragments in chaotic wandering states among three types of chaotic neural network (CNN) models, related with the instability of their orbits. From the computer experiments, Aihara model shows the highest success ratio and the shortest steps for all the memory pattern fragments. On the other hand, Nara & Davis model and Kuroiwa & Nara model show quite higher success ratio and shorter averaged steps than random search. Thus, choas in the three model is practical in the memory pattern search.

Analysis of 3D Linear and Non-linear Filtering Effects Based on 3D MDCT Medical Images

The risk of X-ray exposure will increase when applying the 3D-CT methods such as MDCT. To decrease this risk it is better to lower the dose-level of X-ray, but it reduces the resolution of obtained image and causes negative effect on imaging diagnosis. We think that 3D-filtering methods will recover the reduction. In order to obtain a better filtered result, 3D linear and non-linear filters are designed and applied to 80%, 60%, 40% and 20%-dose simulated low dose clinical MDCT images of abdomen with a tumor. Direct observation and 3D voxel value profile is extracted to evaluate the filtered results. Experimental results show both the filtering and the evaluating method perform well.

Dependence on memory pattern in sensitive response of memory fragments among three types of chaotic neural network models

In this paper, we investigate the dependence on the size and the number of memory pattern in the sensitive response to memory pattern fragments in chaotic wandering states among three types of chaotic neural network (CNN) models. From the computer experiments, the three types of chaotic neural network model show that the success ratio is high and the accessing time is short without depending on the size and the number of the memory patterns. The feature is introduced in chaotic wandering states with weaker instability of orbits and stronger randomness in memory pattern space. Thus, chaos in the three model is practical in the memory pattern search.