Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “detection network”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 1,081 records · Page 60
All sourcesNASA NTRSDOE OSTI
NASA NTRS1993

Neurocomputing strategies in decomposition based structural design

The present paper explores the applicability of neurocomputing strategies in decomposition based structural optimization problems. It is shown that the modeling capability of a backpropagation neural network can be used to detect weak couplings in a system, and to effectively decompose it into smaller, more tractable, subsystems. When such partitioning of a design space is possible, parallel optimization can be performed in each subsystem, with a penalty term added to its objective function to account for constraint violations in all other subsystems. Dependencies among subsystems are represented in terms of global design variables, and a neural network is used to map the relations between these variables and all subsystem constraints. A vector quantization technique, referred to as a z-Network, can effectively be used for this purpose. The approach is illustrated with applications to minimum weight sizing of truss structures with multiple design constraints.

Szewczyk, Z.↗
DOE OSTI2018

Situ: Identifying and Explaining Suspicious Behavior in Networks

Despite the best efforts of cyber security analysts, networked computing assets are routinely compromised, resulting in the loss of intellectual property, the disclosure of state secrets, and major financial damages. Anomaly detection methods are beneficial for detecting new types of attacks and abnormal network activity, but such algorithms can be difficult to understand and trust. Network operators and cyber analysts need fast and scalable tools to help identify suspicious behavior that bypasses automated security systems, but operators do not want another automated tool with algorithms they do not trust. Experts need tools to augment their own domain expertise and to provide a contextual understanding of suspicious behavior to help them make decisions. In this paper we present Situ, a visual analytics system for discovering suspicious behavior in streaming network data. Situ provides a scalable solution that combines anomaly detection with information visualization. The system's visualizations enable operators to identify and investigate the most anomalous events and IP addresses, and the tool provides context to help operators understand why they are anomalous. Finally, operators need tools that can be integrated into their workflow and with their existing tools. This paper describes the Situ platform and its deployment in an operational network setting. Furthermore, we discuss how operators are currently using the tool in a large organization's security operations center and present the results of expert reviews with professionals.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2021

DeepMerge – II. Building robust deep learning algorithms for merging galaxy identification across domains

In astronomy, neural networks are often trained on simulation data with the prospect of being used on telescope observations. Unfortunately, training a model on simulation data and then applying it to instrument data leads to a substantial and potentially even detrimental decrease in model accuracy on the new target dataset. Simulated and instrument data represent different data domains, and for an algorithm to work in both, domain-invariant learning is necessary. Here we employ domain adaptation techniques— Maximum Mean Discrepancy (MMD) as an additional transfer loss and Domain Adversarial Neural Networks (DANNs)— and demonstrate their viability to extract domain-invariant features within the astronomical context of classifying merging and non-merging galaxies. Additionally, we explore the use of Fisher loss and entropy minimization to enforce better in-domain class discriminability. We show that the addition of each domain adaptation technique improves the performance of a classifier when compared to conventional deep learning algorithms. We demonstrate this on two examples: between two Illustris-1 simulated datasets of distant merging galaxies, and between Illustris-1 simulated data of nearby merging galaxies and observed data from the Sloan Digital Sky Survey. The use of domain adaptation techniques in our experiments leads to an increase of target domain classification accuracy of up to ~20%. With further development, these techniques will allow astronomers to successfully implement neural network models trained on simulation data to efficiently detect and study astrophysical objects in current and future large-scale astronomical surveys.

galaxies: interactions↗
DOE OSTI2014

Water Security Toolkit User Manual Version 1.2.

The Water Security Toolkit (WST) is a suite of open source software tools that can be used by water utilities to create response strategies to reduce the impact of contamination in a water distribution network . WST includes hydraulic and water quality modeling software , optimizati on methodologies , and visualization tools to identify: (1) sensor locations to detect contamination, (2) locations in the network in which the contamination was introduced, (3) hydrants to remove contaminated water from the distribution system, (4) locations in the network to inject decontamination agents to inactivate, remove, or destroy contaminants, (5) locations in the network to take grab sample s to help identify the source of contamination and (6) valves to close in order to isolate contaminate d areas of the network. This user manual describes the different components of WST , along w ith examples and case studies. License Notice The Water Security Toolkit (WST) v.1.2 Copyright c 2012 Sandia Corporation. Under the terms of Contract DE-AC04-94AL85000, there is a non-exclusive license for use of this work by or on behalf of the U.S. government. This software is distributed under the Revised BSD License (see below). In addition, WST leverages a variety of third-party software packages, which have separate licensing policies: Acro Revised BSD License argparse Python Software Foundation License Boost Boost Software License Coopr Revised BSD License Coverage BSD License Distribute Python Software Foundation License / Zope Public License EPANET Public Domain EPANET-ERD Revised BSD License EPANET-MSX GNU Lesser General Public License (LGPL) v.3 gcovr Revised BSD License GRASP AT&T Commercial License for noncommercial use; includes randomsample and sideconstraints executable files LZMA SDK Public Domain nose GNU Lesser General Public License (LGPL) v.2.1 ordereddict MIT License pip MIT License PLY BSD License PyEPANET Revised BSD License Pyro MIT License PyUtilib Revised BSD License PyYAML MIT License runpy2 Python Software Foundation License setuptools Python Software Foundation License / Zope Public License six MIT License TinyXML zlib License unittest2 BSD License Utilib Revised BSD License virtualenv MIT License Vol Common Public License vpykit Revised BSD License Additionally, some precompiled WST binary distributions might bundle other third-party executables files: Coliny Revised BSD License (part of Acro project) Dakota GNU Lesser General Public License (LGPL) v.2.1 PICO Revised BSD License (part of Acro project) i Revised BSD License Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. * Neither the name of Sandia National Laboratories nor Sandia Corporation nor the names of its con- tributors may be used to endorse or promote products derived from this software without specific prior written permission. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IM- PLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL SANDIA CORPORATION BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUD- ING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ii Acknowledgements This work was supported by the U.S. Environmental Protection Agency through its Office of Research and Development (Interagency Agreement # DW8992192801). The material in this document has been subject to technical and policy review by the U.S. EPA, and approved for publication. The views expressed by individual authors, however, are their own, and do not necessarily reflect those of the U.S. Environmental Protection Agency. Mention of trade names, products, or services does not convey official U.S. EPA approval, endorsement, or recommendation. The Water Security Toolkit is an extension of the Threat Ensemble Vulnerability Assessment-Sensor Place- ment Optimization Tool (TEVA-SPOT), which was also developed with funding from the U.S. Environ- mental Protection Agency through its Office of Research and Development (Interagency Agreement # DW8992192801). The authors acknowledge the following individuals for their contributions to the devel- opment of TEVA-SPOT: Jonathan Berry (Sandia National Laboratories), Erik Boman (Sandia National Laboratories), Lee Ann Riesen (Sandia National Laboratories), James Uber (University of Cincinnati), and Jean-Paul Watson (Sandia National Laboratories). iii Acronyms ATUS American Time-Use Survey BLAS Basic linear algebra sub-routines CFU Colony-forming unit CVAR Conditional value at risk CWS Contamination warning system EA Evolutionary algorithm EDS Event detection system EPA U.S. Environmental Protection Agency EC Extent of Contamination ERD EPANET results database file GLPK GNU Linear Programming Kit GRASP Greedy randomized adaptive sampling process HEX Hexadecimal HTML HyperText markup language INP EPANET input file LP Linear program MC Mass consumed MILP Mixed integer linear program MIP Mixed integer program MSX Multi-species extension for EPANET NFD Number of failed detections NS Number of sensors NZD Non-zero demand PD Population dosed PE Population exposed PK Population killed TAI Threat assessment input file TCE Tailed-conditioned expectation TD Time to detection TEC Timed extent of contamination TEVA Threat ensemble vulnerability assessment TSB Tryptic soy broth TSG Threat scenario generation file TSI Threat simulation input file VAR Value at risk VC Volume consumed WST Water Security Toolkit YML YAML configuration file format for WST iv Symbols Notation Definition Example { , } set brackets { 1,2,3 } means a set containing the values 1,2, and 3. [?] is an element of s [?] S means that s is an element of the set S . [?] for all s = 1 [?] s [?] S means that the statement s = 1 is true for all s in set S . P summation P n i =1 s i means s 1 + s 2 + * * * + s n . \ set minus S \ T means the set that contains all those elements of S that are not in set T . %7C given %7C is used to define conditional probability. P ( s %7C t ) means the prob- ability of s occurring given that t occurs. %7C ... %7C cardinality Cardinality of a set is the number of elements of the set. If set S = { 2,4,6 } , then %7C S %7C = 3. v

Klise, Katherine A.↗
DOE OSTI2018

Sparse Hardware Embedding of Spiking Neuron Systems for Community Detection

We study the applicability of spiking neural networks and neuromorphic hardware for solving general optimization problems without the use of adaptive training or learning algorithms. We leverage the dynamics of Hopfield networks and spin-glass systems to construct a fully connected spiking neural system to generate synchronous spike responses indicative of the underlying community structure in an undirected, unweighted graph. Mapping this fully connected system to current generation neuromorphic hardware is done by embedding sparse tree graphs to generate only the leading-order spiking dynamics. Here, we demonstrate that for a chosen set of benchmark graphs, the spike responses generated on a current generation neuromorphic processor can improve the stability of graph partitions and non-overlapping communities can be identified even with the loss of higher-order spiking behavior if the graphs are sufficiently dense. For sparse graphs, the loss of higher-order spiking behavior improves the stability of certain graph partitions but does not retrieve the known community memberships.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2023

Examining the potential for detecting simultaneous noble gas and aerosol samples in the international monitoring system radionuclide network

The purpose of the Comprehensive Nuclear-Test-Ban Treaty (CTBT) is to establish a legally binding ban on nuclear weapon test explosions or any other nuclear explosions. The Preparatory Commission for the CTBT Organization (CTBTO PrepCom) is developing the International Monitoring System (IMS) that includes a global network of 80 stations to monitor for airborne radionuclides upon entry into force of the CTBT. All 80 radionuclide stations will monitor for particulate radionuclides and at least half of the stations will monitor for radioxenon. The airborne radionuclide monitoring is an important verification technology both for the detection of a radionuclide release and in the determination of whether the release event originates from a nuclear explosion as opposed to an industrial use of nuclear materials. Nuclear power plants and many medical isotope production facilities release radioxenon into the atmosphere. Low levels of a few particulate isotopes, such as iodine, may also be released. Detections of multiple isotopes are useful for screening the radionuclide samples for relevance to the Treaty. This paper examines the anticipated joint detections in the IMS of noble gas and particulate isotopes from underground nuclear explosions where breaches in the underground containment vents from low levels to up to 1% of the radionuclide inventory of the resulting fission products to the atmosphere. Detection probabilities are based on 844 simulated release events spaced out at 17 release locations and one year in time. Six different release (venting) scenarios, including two fractionated scenarios, were analyzed. When ranked by detection probability, 11 particulate isotopes and one noble gas isotope ( 133 Xe) appear in the top 20 isotopes for all six release scenarios. Using the 11 particulate isotopes and the one noble gas isotope, the IMS has nearly the same detection probability as when 45 particulate and 4 noble gas isotopes are used. Thus, a limited list of relevant radionuclides may be sufficient for treaty verification purposes. The probability that at least one particulate and at least one radioxenon isotope would be detected in the IMS from the release events ranged from 0.15 to 0.86 depending on the release scenario.

98 NUCLEAR DISARMAMENT, SAFEGUARDS, AND PHYSICAL P↗
DOE OSTI2022

Expediting DECam Multimessenger Counterpart Searches with Convolutional Neural Networks

Searches for counterparts to multimessenger events with optical imagers use difference imaging to detect new transient sources. However, even with existing artifact-detection algorithms, this process simultaneously returns several classes of false positives: false detections from poor-quality image subtractions, false detections from low signal-to-noise images, and detections of preexisting variable sources. Currently, human visual inspection to remove the false positives is a central part of multimessenger follow-up observations, but when next generation gravitational wave and neutrino detectors come online and increase the rate of multimessenger events, the visual inspection process will be prohibitively expensive. We approach this problem with two convolutional neural networks operating on the difference imaging outputs. The first network focuses on removing false detections and demonstrates an accuracy of 92% on our data set. The second network focuses on sorting all real detections by the probability of being a transient source within a host galaxy and distinguishes between various classes of images that previously required additional human inspection. We find the number of images requiring human inspection will decrease by a factor of 1.5 using our approach alone and a factor of 3.6 using our approach in combination with existing algorithms, facilitating rapid multimessenger counterpart identification by the astronomical community.

46 INSTRUMENTATION RELATED TO NUCLEAR SCIENCE AND ↗
DOE OSTI2020

Applying Machine Learning to the Classification of DC-DC Converters. NA-22 Final Report

Tools are now available that enable measurement electromagnetic radiation (EMR) from active electronics in an item. This radiation may be intended WIFI or cellular network links, for example or unintended such as the switching noise generated by DC-to-DC converters. It would be extremely valuable to have the capability to discriminate between the low-voltage DC-to-DC converters or other digital noise prevalent in most modern electronics, versus the high-voltage DC-to-DC converters used in utility firesets. Previous work performed under a Sandia Laboratory Directed Research and Development (LDRD) project on Charge State Detection using a deep neural network has been continued in this effort. A state-of-the-art supervised machine learning algorithm has not only been extended to discriminate between low and high voltage converters but has been validated in determining a converters make and model.

42 ENGINEERING↗
NASA NTRS1989

Advances in image compression and automatic target recognition; Proceedings of the Meeting, Orlando, FL, Mar. 30, 31, 1989

Various papers on image compression and automatic target recognition are presented. Individual topics addressed include: target cluster detection in cluttered SAR imagery, model-based target recognition using laser radar imagery, Smart Sensor front-end processor for feature extraction of images, object attitude estimation and tracking from a single video sensor, symmetry detection in human vision, analysis of high resolution aerial images for object detection, obscured object recognition for an ATR application, neural networks for adaptive shape tracking, statistical mechanics and pattern recognition, detection of cylinders in aerial range images, moving object tracking using local windows, new transform method for image data compression, quad-tree product vector quantization of images, predictive trellis encoding of imagery, reduced generalized chain code for contour description, compact architecture for a real-time vision system, use of human visibility functions in segmentation coding, color texture analysis and synthesis using Gibbs random fields.

Tescher, Andrew G.↗
NASA NTRS2007

GEO Population Estimates using Optical Survey Data

Optical survey data taken using the NASA Michigan Orbital Debris Survey Telescope (MODEST) gives us an opportunity to statistically sample faint object population in the Geosynchronous (GEO) and near-GEO environment. This paper will summarize the MODEST survey work that has been conducted by NASA since 2002, and will outline the techniques employed to arrive at the current population estimates in the GEO environment for dim objects difficult to detect and track using current systems in the Space Surveillance Network (SSN). Some types of orbits have a higher detection rate based on what parts of the GEO belt is being observed, a straightforward statistical technique is used to debias these observations to arrive at an estimate of the total population potentially visible to the telescope. The size and magnitude distributions of these fainter debris objects are markedly different from the catalogued population. GEO debris consists of at least two different populations, one which follows the standard breakup power law and one which has anomalously high Area-to-Mass Ratios (1 to approx. 30 square meters per kilogram; a sheet of paper = approx. 13 square meters per kilogram). The Inter-Agency Space Debris Coordination Committee (IADC) is investigating objects in GEO orbits with anomalously high Area-to-Mass Ratios (AMRs). The ESA Space Debris Telescope discovered this population and has and its properties of inclinations (0 to 30 degrees), changing eccentricities (0 and 0.6), and mean motions (approx. 1 rev), will be presented. The accepted interpretation of this orbital behavior is that solar radiation pressure drives the perturbations causing time varying inclinations and eccentricities. The orbital parameters are unstable for this population and thus difficult to predict. Their dim visual magnitudes and photometric variability make observations a challenge. The IADC has enlisted a series of observatories (participating institutions: University of Michigan/CTIO, Astronomical Institute University of Bern, Boeing LTS / AMOS, Keldysh Institute of Applied Mathematics) at different longitudes. Complete observational coverage over periods of days to months will provide a better understanding of the properties, such as solar radiation pressure effects on orbital elements, size, shape, attitude, color variations, and spectral characteristics. Results from recent observational programs will be summarized, and includes a description of the orbit elements prediction processes, a summary of the metric tracking performance, and some photometric characteristics of this class of debris.

Barker, Edwin S.↗
DOE OSTI2012

Singularities, swallowtails and Dirac points. An analysis for families of Hamiltonians and applications to wire networks, especially the Gyroid

Motivated by the Double Gyroid nanowire network we develop methods to detect Dirac points and classify level crossings, aka. singularities in the spectrum of a family of Hamiltonians. The approach we use is singularity theory. Using this language, we obtain a characterization of Dirac points and also show that the branching behavior of the level crossings is given by an unfolding of A{sub n} type singularities. Which type of singularity occurs can be read off a characteristic region inside the miniversal unfolding of an A{sub k} singularity. We then apply these methods in the setting of families of graph Hamiltonians, such as those for wire networks. In the particular case of the Double Gyroid we analytically classify its singularities and show that it has Dirac points. This indicates that nanowire systems of this type should have very special physical properties. - Highlights: Black-Right-Pointing-Pointer New method for analytically finding Dirac points. Black-Right-Pointing-Pointer Novel relation of level crossings to singularity theory. Black-Right-Pointing-Pointer More precise version of the von-Neumann-Wigner theorem for arbitrary smooth families of Hamiltonians of fixed size. Black-Right-Pointing-Pointer Analytical proof of the existence of Dirac points for the Gyroid wire network.

77 NANOSCIENCE AND NANOTECHNOLOGY↗
DOE OSTI2018

Implementation of the Waveform Correlation Event Detection System (WCEDS) Method for Regional Seismic Event Detection in Utah

Backprojection techniques are a class of methods for detecting and locating events that have been successfully implemented at local scales for dense networks. This paper develops the framework for applying a backprojection method to detect and locate a range of event sizes across a heteorogeneous regional network. This article extends previous work on the development of a backprojection method for local and regional seismic event detection, the Waveform Correlation Event Detection System (WCEDS). The improvements outlined here make the technique much more flexible for regional earthquake or explosion monitoring. We first explore how the backprojection operator can be formulated using either a travel-time model or a stack of full waveforms, showing that the former approach is much more flexible and can lead to the detection of smaller events, and to significant improvements in the resolution of event parameters. Second, we discuss the factors that influence the grid of event hypotheses used for backprojection, and develop an algorithm for generating suitable grids for networks with variable density. Third, we explore the effect of including different phases in the backprojection operator, showing that the best results for the study region can be obtained using only the Pg phase, and by including terms for penalizing early arrivals when evaluating the fit for a given event hypothesis. Fourth, we incorporate two parallel backprojection computations with different distance thresholds to enable the robust detection of both network-wide and small (sub-network-only) events. Finally, the set of improvements are outlined by applying WCEDS to four example events on the University of Utah Seismograph Stations (UUSS) network.

58 GEOSCIENCES↗
DOE OSTI2020

Detecting Rain–Snow-Transition Elevations in Mountain Basins Using Wireless Sensor Networks

Here, to provide complementary information on the hydrologically important rain–snow-transition elevation in mountain basins, this study provides two estimation methods using ground measurements from basin-scale wireless sensor networks: one based on wet-bulb temperature T wet and the other based on snow-depth measurements of accumulation and ablation. With data from 17 spatially distributed clusters (178 nodes) from two networks, in the American and Feather River basins of California’s Sierra Nevada, we analyzed transition elevation during 76 storm events in 2014–18. A T wet threshold of 0.5°C best matched the transition elevation defined by snow depth. Transition elevations using T wet in upper elevations of the basins generally agreed with atmospheric snow level from radars located at lower elevations, while radar snow level was ~100 m higher due to snow-level lowering on windward mountainsides during orographic lifting. Diurnal patterns of the difference between transition elevation and radar snow level were observed in the American basin, related to diurnal ground-temperature variations. However, these patterns were not found in the Feather basin due to complex terrain and higher uncertainties in transition-elevation estimates. The American basin tends to exhibit 100-m-higher transition elevations than does the Feather basin, consistent with the Feather basin being about 1° latitude farther north. Transition elevation averaged 155 m higher in intense atmospheric river events than in other events; meanwhile, snow-level lowering was enhanced with a 90-m-larger difference between radar snow level and transition elevation. On-the-ground continuous observations from distributed sensor networks can complement radar data and provide important ground truth and spatially resolved information on transition elevations in mountain basins.

54 ENVIRONMENTAL SCIENCES↗
NASA NTRS1992

A conjugate gradients/trust regions algorithms for training multilayer perceptrons for nonlinear mapping

This paper addresses the issue of applying a globally convergent optimization algorithm to the training of multilayer perceptrons, a class of Artificial Neural Networks. The multilayer perceptrons are trained towards the solution of two highly nonlinear problems: (1) signal detection in a multi-user communication network, and (2) solving the inverse kinematics for a robotic manipulator. The research is motivated by the fact that a multilayer perceptron is theoretically capable of approximating any nonlinear function to within a specified accuracy. The algorithm that has been employed in this study combines the merits of two well known optimization algorithms, the Conjugate Gradients and the Trust Regions Algorithms. The performance is compared to a widely used algorithm, the Backpropagation Algorithm, that is basically a gradient-based algorithm, and hence, slow in converging. The performances of the two algorithms are compared with the convergence rate. Furthermore, in the case of the signal detection problem, performances are also benchmarked by the decision boundaries drawn as well as the probability of error obtained in either case.

Madyastha, Raghavendra K.↗
DOE OSTI2024

Image-based novel fault detection with deep learning classifiers using hierarchical labels

One important characteristic of modern fault classification systems is the ability to flag the system when faced with previously unseen fault types. This work considers the unknown fault detection capabilities of deep neural network-based fault classifiers. Specifically, we propose a methodology on how, when available, labels regarding the fault taxonomy can be used to increase unknown fault detection performance without sacrificing model performance. To achieve this, we propose to utilize soft label techniques to improve the state-of-the-art deep novel fault detection techniques during the training process and novel hierarchically consistent detection statistics for online novel fault detection. Lastly, we demonstrated increased detection performance on novel fault detection in inspection images from the hot steel rolling process, with results well replicated across multiple scenarios and baseline detection methods.

42 ENGINEERING↗
DOE OSTI2023

Denial of Service Attack Detection via Differential Analysis of Generalized Entropy Progressions

Denial-of-Service (DoS) attacks are one the most common and consequential cyber attacks in computer networks. While existing research offers a plethora of detection methods, the issue of achieving scalability, a low false positive rate, and high detection accuracy remains open. In this work, we address this problem by developing a differential method based on generalized entropy progression. In this method, named as DoDGE, we continuously fit the line of best fit to the entropy progression of destination addresses and check if the derivative, that is, the slope of this line is less than the negative of the dynamically computed standard deviation of the derivatives. Furthermore, to distinguish from flash events, we leverage the symmetry that when a flash event occurs, the derivative of the entropy progression of source addresses is positive. With this design, we omit the usage of the thresholds and the results with five real-world network traffic datasets confirm that DoDGE outperforms threshold-based DoS attack detection by two orders of magnitude in terms of false positives on average. When compared to ten machine learning (ML) models, DoDGE achieves a balanced accuracy of 99%, while the average balanced accuracy for the ML models is 52%. Moreover, the results show that DoDGE successfully differentiates between a flash event and a DoS attack. Furthermore, since the main computation cost of DoDGE is the entropy computation, which is linear in the volume of the unit-time network flow, uses integer only operations, and works on a small fraction of the total flow, it is lightweight and scalable.

Cybersecurity, wireless communication↗