Mehmet Celenk

Predictive Network Anomaly Detection and Visualization

Various approaches have been developed for quantifying and displaying network traffic information for determining network status and in detecting anomalies. Although many of these methods are effective, they rely on the collection of long-term network statistics. Here, we present an approach that uses short-term observations of network features and their respective time averaged entropies. Acute changes are localized in network feature space using adaptive Wiener filtering and auto-regressive moving average modeling. The color-enhanced datagram is designed to allow a network engineer to quickly capture and visually comprehend at a glance the statistical characteristics of a network anomaly. First, average entropy for each feature is calculated for every second of observation. Then, the resultant short-term measurement is subjected to first- and second-order time averaging statistics. These measurements are the basis of a novel approach to anomaly estimation based on the well-known Fisher linear discriminant (FLD). Average port, high port, server ports, and peered ports are some of the network features used for stochastic clustering and filtering. We empirically determine that these network features obey Gaussian-like distributions. The proposed algorithm is tested on real-time network traffic data from Ohio Universitys main Internet connection. Experimentation has shown that the presented FLD-based scheme is accurate in identifying anomalies in network feature space, in localizing anomalies in network traffic flow, and in helping network engineers to prevent potential hazards. Furthermore, its performance is highly effective in providing a colorized visualization chart to network analysts in the presence of bursty network traffic.

Parallel task execution in LANs and performance analysis

This paper analyzes the performance of local area networks (LANs) of workstations for distributed computing. Application programs are scheduled by the user workstation (master) for parallel execution in the idle or lightly loaded processors (slaves). Partial results are collected by the master station to synchronize the operation of slave nodes. A general speedup equation is derived to verify the measurement values. The sequential and parallel execution times and the performance degradation factors (scheduling, communication, TCP/IP communication overhead, and synchronization times) were measured for various network loads and sizes. Experimental and theoretical results show that the system performance is degraded mainly by the TCP/IP overhead (0.2 s), the network size, and the network load.<<ETX>>

Content-Based Image Retrieval Based on ROI Detection and Relevance Feedback

Content-based image retrieval is an important research topic in computer vision. We present a new method that combines region of interest (ROI) detection and relevance feedback. The ROI based approach is more accurate in describing the image content than using global features, and the relevance feedback makes the system to be adaptive to subjective human perception. The feedback information is utilized to discover the subjective ROI perception of a particular user, and it is further employed to recompute the features associated with ROIs with the updated personalized ROI preference. A fast computation technique is proposed to avoid repeating the ROI detection for images in the database. It directly estimates the features of the ROIs, which makes the query process fast and efficient. For illustration of the overall approach, we use the color saliency and wavelet feature saliency to determine the ROIs. Normalized projections are selected to represent the shape features associated with the ROIs. Experimental results show that the proposed system has better performance than the global features based approaches and region based techniques without feedback.

Higher-order spectra (HOS) invariants for shape recognition

Abstract This paper describes a shape feature-based invariant object recognition method. First, a set of features invariant to rotation, translation, and scaling (RTS) is generated using the Radon transform and bispectral analysis. In order to improve the noise resistance of the invariants, the ensemble averaging technique is introduced into the estimation of bispectra. The feature data are further reduced to a smaller set using thresholding and principal component analysis. The resultant feature invariants are proved to be more reliable and discriminable in the classification stage than the original ones. It is shown experimentally that the extracted higher-order spectra (HOS) invariants form compact and isolated clusters in the feature space, and that a simple minimum distance classifier yields high classification accuracy with low SNR inputs. The comparison study with Hus moment invariants and Fourier descriptors also shows that the performance of the proposed method is better than these two methods especially in the presence of background noise. The HOS invariants algorithm is also applied to shape-similarity-based image indexing. A new similarity matching technique based on Tanimoto measure is employed for fast image retrieval. The retrieval accuracy is high as shown in the experimental results.

Spatio-temporal modeling of facial expressions using Gabor-wavelets and hierarchical hidden Markov models

As one of the key techniques for futuristic man-machine interface, facial expression analysis has received much attention in recent years. This paper proposes a hierarchical approach to facial expression recognition in image sequences by exploiting both spatial and temporal characteristics within the framework of hierarchical hidden Markov models (HHMMs). Human faces are automatically detected in the maximum likelihood sense. Gabor-wavelet based features are extracted from image sequences to capture the subtle changes of facial expressions. Four prototype emotions; i.e. happiness, anger, fear and sadness, are investigated using the Cohn-Kanade database and an average of 90.98% person-independent recognition rate is achieved. We also demonstrate that HHMMs outperform HMMs for modeling image sequences with multilevel statistical structure.

Upper airway detection and visualization from cone beam image slices.

This paper describes a method developed to assist in the detection and reconstruction of a three dimensional (3D) model of the human upper airway using cone beam computed tomography (CBCT) image slices and a 3D Gaussian smoothing kernel. The segmented and reconstructed volumetric airway is characterized by the corresponding three principal axes that are selected for viewing direction orientation via rotation and translation. These axes are derived using the 3D Principal Component Analysis (PCA) result of the rendered volume. To finely adjust the view and access airway, the major and minor axes of each slice are also computed using the two dimensional (2D) PCA in the respective planes. The exterior volume view is visualized in two modes, namely, a solid surface (volume details transparent to user) view and a nontransparent (volume detail accessible) view. This functionality provides an application driven use of the 3D airway in CBCT based anatomy studies. The extracted information may be useful as an imaging biomarker in the diagnostic assessment of patients with upper airway respiratory conditions such as obstructive sleep apnea, allergic rhinitis, and other related diseases; as well as planning orthopedic/orthodontic therapies.

Optimal thresholding for color images

Color image thresholding is a special case of color clustering which is commonly used for tasks such as object detection, region segmentation, enhancement, and target tracking. As compared to the three-dimensional (3-D) color clustering, thresholding is computationally more efficient for computer implementation and pipelined hardware realization. Traditionally, this method operates on a particular color component whose distribution possesses more prominent peaks than the other two color histograms. In this operation, it is expected that the histogram peaks represent meaningful object areas. However, the color component thresholding results are less reliable than those of 3-D clustering because the valuable information in the other two color components are ignored in region acceptance process. To improve the performance of thresholding, we describe a method that thresholds an input image three times on three different color components independently. The best thresholds are selected by optimizing the within-group variance or directed divergence measure for red, green, and blue distributions separately. The resultant three binary images are combined by means of a predicate logic function that makes use of a 3-input, 1-output majority logic gate. This enables 1-D thresholding mechanism to incorporate the information on all the color components in region acceptance process.

Approaching car detection via clustering of vertical-horizontal line scanning optical edge flow

Here, we describe a method that detects vehicle(s) approaching from behind to a commuting car in the lane in which both are travelling. This research contributes to the development of driver assistance systems by means of informing them about the approaching traffic from behind and warn the drivers in case they are drowsy or not alert and the driving conditions are hazardous. We use the image pairs extracted from a video clip obtained from a video camera mounted on the back side of the car. This allows detection of the moving objects from the video image pairs using optical flow. Objects which are determined as not cars or vehicles have been eliminated by edge extraction. In turn, this approach leads to lessen the operation processing cost. Then, Density Histogram of Cluster Rows (DHCR) and Density Histogram of Cluster Columns (DHCC) are generated for the purpose of classification of motion vectors (MVs). Consequently, approching vehicles and cars are detected by localizing the place of the motion vector clusters using Vertical Horizontal Line Scanning (VHLS) as experimental results demonstrate.

Anomaly prediction in network traffic using adaptive Wiener filtering and ARMA modeling

Fast and efficient detection of anomalies is essential for maintaining a robust and secure network. This research presents a method of anomaly detection based on adaptive Wiener filtering of noise followed by ARMA modeling of network flow data. We dynamically calculate noise and traffic signal statistics using network-monitoring metrics for traffic features such as average port, high port, server ports, and peered ports. The underlying approach is tested on near-real-time Internet traffic in the wide-area network (WAN) of Ohio University. The average port feature is determined to be the most informative measure in the estimation process. High port, server ports, and peered ports are used for confirmation of the anomaly detection result. We empirically determine that most of the network features obey Gaussian-like distributions. Experiments reveal that the method is highly effective in predicting anomalies in network traffic flow and preventing any hazard that they may cause.

An effective variable selection algorithm for Aggressive/Calm Driving detection via CAN bus

In this research, the aim is to come up with an algorithm determining most appropriate variables of CAN (Controller Area Network) bus data for Aggressive/Calm Driving detection problem. This study assists drivers to take attention their Aggressive/Calm Driving habits on steering wheel. System complexity increases as involving all the variables in the problem. Therefore we can get cost efficiency by eliminating variables. With this aim, the proposed algorithm is applied to find optimal variables before identifying driving mood. As an initial phase, we have realized several test-drives having employed drivers with different driving styles being aggressive and calm in order for collecting data needed. Afterwards the novel algorithm developed is applied to eliminate trivial variables. Proposed method is based on exploiting similar correlation characteristics related to variables appearing in both Aggressive and Calm driving. As applying the selection algorithm, similar relation clusters are obtained with the aim of searching for redundant variables that will be eliminated. In this manner we reach a favorable set belonging to optimal variables. This novel algorithm can be easily applied for the systems including binary data set.