Zhihui Du

h-index82
2papers
74,960citations

2 Papers

2.6LGMar 15, 2024Code
From Chaos to Clarity: Time Series Anomaly Detection in Astronomical Observations

Xinli Hao, Yile Chen, Chen Yang et al.

With the development of astronomical facilities, large-scale time series data observed by these facilities is being collected. Analyzing anomalies in these astronomical observations is crucial for uncovering potential celestial events and physical phenomena, thus advancing the scientific research process. However, existing time series anomaly detection methods fall short in tackling the unique characteristics of astronomical observations where each star is inherently independent but interfered by random concurrent noise, resulting in a high rate of false alarms. To overcome the challenges, we propose AERO, a novel two-stage framework tailored for unsupervised anomaly detection in astronomical observations. In the first stage, we employ a Transformer-based encoder-decoder architecture to learn the normal temporal patterns on each variate (i.e., star) in alignment with the characteristic of variate independence. In the second stage, we enhance the graph neural network with a window-wise graph structure learning to tackle the occurrence of concurrent noise characterized by spatial and temporal randomness. In this way, AERO is not only capable of distinguishing normal temporal patterns from potential anomalies but also effectively differentiating concurrent noise, thus decreasing the number of false alarms. We conducted extensive experiments on three synthetic datasets and three real-world datasets. The results demonstrate that AERO outperforms the compared baselines. Notably, compared to the state-of-the-art model, AERO improves the F1-score by up to 8.76% and 2.63% on synthetic and real-world datasets respectively.

7.8CRApr 18, 2017
Enabling an Anatomic View to Investigate Honeypot Systems: A Survey

Wenjun Fan, Zhihui Du, David Fernandez et al.

A honeypot is a type of security facility deliberately created to be probed, attacked and compromised. It is often used for protecting production systems by detecting and deflecting unauthorized accesses. It is also useful for investigating the behaviour of attackers, and in particular, unknown attacks. For the past 17 years much effort has been invested in the research and development of honeypot based techniques and tools and they have evolved to become an increasingly powerful means of defending against the creations of the blackhat community. In this paper, by studying multiple honeypot systems, the two essential elements of honeypots - the decoy and the security program - are captured and presented, together with two abstract organizational forms - independent and cooperative - in which these two elements can be integrated. A novel decoy and security program (D-P) based taxonomy is proposed, for the purpose of investigating and classifying the various techniques involved in honeypot systems. An extensive set of honeypot projects and research, which cover the techniques applied in both independent and cooperative honeypots, is surveyed under the taxonomy framework. Finally, the taxonomy is applied to a wide set of tools and systems in order to demonstrate its validity and predict the tendency of honeypot development.