Journal Editorial Board Editor-in-ChiefProf. Thomas Byeongnam YOON, PhD.
Founding Editor-in-Chief
ICACT Transactions on the Advanced Communications Technology (TACT) Editors
Prof. Jun-Chul Chun, Kyonggi University, Korea
Dr. JongWon Kim, GIST (Gwangju Institute of Science & Technology), Korea
Dr. Xi Chen, State Grid Corparation of China, China
Prof. Arash Dana, Islamic Azad university , Central Tehran Branch, Iran
Dr. Pasquale Pace, University of Calabria - DEIS - Italy, Italy
Dr. Mitch Haspel, Stochastikos Solutions R&D, Israel
Prof. Shintaro Uno, Aichi University of Technology, Japan
Dr. Tony Tsang, Hong Kong Polytechnic UNiversity, Hong Kong
Prof. Kwang-Hoon Kim, Kyonggi University, Korea
Prof. Rosilah Hassan, Universiti Kebangsaan Malaysia(UKM), Malaysia
Dr. Sung Moon Shin, ETRI, Korea
Dr. Takahiro Matsumoto, Yamaguchi University, Japan
Dr. Christian Esteve Rothenberg, CPqD - R&D Center for. Telecommunications, Brazil
Prof. Lakshmi Prasad Saikia, Assam down town University, India
Prof. Moo Wan Kim, Tokyo University of Information Sciences, Japan
Prof. Yong-Hee Jeon, Catholic Univ. of Daegu, Korea
Dr. E.A.Mary Anita, Prathyusha Institute of Technology and Management, India
Dr. Chun-Hsin Wang, Chung Hua University, Taiwan
Prof. Wilaiporn Lee, King Mongkut’s University of Technology North, Thailand
Dr. Zhi-Qiang Yao, XiangTan University, China
Prof. Bin Shen, Chongqing Univ. of Posts and Telecommunications (CQUPT), China
Prof. Vishal Bharti, Dronacharya College of Engineering, India
Dr. Marsono, Muhammad Nadzir , Universiti Teknologi Malaysia, Malaysia
Mr. Muhammad Yasir Malik, Samsung Electronics, Korea
Prof. Yeonseung Ryu, Myongji University, Korea
Dr. Kyuchang Kang, ETRI, Korea
Prof. Plamena Zlateva, BAS(Bulgarian Academy of Sciences), Bulgaria
Dr. Pasi Ojala, University of Oulu, Finland
Prof. CheonShik Kim, Sejong University, Korea
Dr. Anna bruno, University of Salento, Italy
Prof. Jesuk Ko, Gwangju University, Korea
Dr. Saba Mahmood, Air University Islamabad Pakistan, Pakistan
Prof. Zhiming Cai, Macao University of Science and Technology, Macau
Prof. Man Soo Han, Mokpo National Univ., Korea
Mr. Jose Gutierrez, Aalborg University, Denmark

Copyright ⓒ 2015 GiRI (Global IT Research Institute)Dr. Youssef SAID, Tunisie Telecom, Tunisia
Dr. Noor Zaman, King Faisal University, Al Ahsa Hofuf, Saudi Arabia
Dr. Srinivas Mantha, SASTRA University, Thanjavur, India
Dr. Shahriar Mohammadi, KNTU University, IranProf. Beonsku An, Hongik University, korea
Dr. Guanbo Zheng, University of Houston, USA
Prof. Sangho Choe, The Catholic University of Korea, korea
Dr. Gyanendra Prasad Joshi, Yeungnam University, korea
Dr. Tae-Gyu Lee, Korea Institue of Industrial Technology(KITECH), korea
Prof. Ilkyeun Ra, University of Colorado Denver, USA
Dr. Yong Sun, Beijing University of Posts and Telecommunications, China
Dr. Yulei Wu, Chinese Academy of Sciences, China
Mr. Anup Thapa, Chosun University, korea
Dr. Vo Nguyen Quoc Bao, Posts and Telecommunications Institute of Technology, Vietnam
Dr. Harish Kumar, Bhagwant institute of technology, India
Dr. Jin REN, North china university of technology, China
Dr. Joseph Kandath, Electronics & Commn Engg, India
Dr. Mohamed M. A. Moustafa, Arab Information Union (AIU), Egypt
Dr. Mostafa Zaman Chowdhury, Kookmin University, Korea
Prof. Francis C.M. Lau, Hong Kong Polytechnic University, Hong Kong
Prof. Ju Bin Song, Kyung Hee University, korea
Prof. KyungHi Chang, Inha University, Korea
Prof. Sherif Welsen Shaker, Kuang-Chi Institute of Advanced Technology, China
Prof. Seung-Hoon Hwang, Dongguk University, Korea
Prof. Dal-Hwan Yoon, Semyung University, korea
Prof. Chongyang ZHANG, Shanghai Jiao Tong University, China
Dr. H K Lau, The Open University of Hong Kong, Honh Kong
Prof. Ying-Ren Chien, Department of Electrical Engineering, National Ilan University, Taiwan
Prof. Mai Yi-Ting, Hsiuping University of Science and Technology, Taiwan
Dr. Sang-Hwan Ryu, Korea Railroad Research Institute, Korea
Dr. Yung-Chien Shih, MediaTek Inc., Taiwan
Dr. Kuan Hoong Poo, Multimedia University, Malaysia
Dr. Michael Leung, CEng MIET SMIEEE, Hong Kong
Dr. Abu sahman Bin mohd Supa'at, Universiti Teknologi Malaysia, Malaysia
Prof. Amit Kumar Garg, Deenbandhu Chhotu Ram University of Science & Technology, India
Dr. Jens Myrup Pedersen, Aalborg University, Denmark
Dr. Augustine Ikechi Ukaegbu, KAIST, Korea
Dr. Jamshid Sangirov, KAIST, Korea
Prof. Ahmed Dooguy KORA, Ecole Sup. Multinationale des Telecommunications, Senegal
Dr. Se-Jin Oh, Korea Astronomy & Space Science Institute, Korea
Dr. Rajendra Prasad Mahajan, RGPV Bhopal, India
Dr. Woo-Jin Byun, ETRI, Korea
Dr. Mohammed M. Kadhum, School of Computing, Goodwin Hall, Queen's University , Canada
Prof. Seong Gon Choi, Chungbuk National University, Korea
Prof. Yao-Chung Chang, National Taitung University, Taiwan
Dr. Abdallah Handoura, Engineering school of Gabes - Tunisia, Tunisia
Dr. Gopal Chandra Manna, BSNL, India

Copyright ⓒ 2015 GiRI (Global IT Research Institute)Dr. Il Kwon Cho, National Information Society Agency, Korea
Prof. Jiann-Liang Chen, National Taiwan University of Science and Technology, Taiwan
Prof. Ruay-Shiung Chang, National Dong Hwa University, Taiwan
Dr. Vasaka Visoottiviseth, Mahidol University, Thailand
Prof. Dae-Ki Kang, Dongseo University, Korea
Dr. Yong-Sik Choi, Research Institute, IDLE co., ltd, Korea
Dr. Xuena Peng, Northeastern University, China
Dr. Ming-Shen Jian, National Formosa University, Taiwan
Dr. Soobin Lee, KAIST Institute for IT Convergence, Korea
Prof. Yongpan Liu, Tsinghua University, China
Prof. Chih-Lin HU, National Central University, Taiwan
Prof. Chen-Shie Ho, Oriental Institute of Technology, Taiwan
Dr. Hyoung-Jun Kim, ETRI, Korea
Prof. Bernard Cousin, IRISA/Universite de Rennes 1, France
Prof. Eun-young Lee, Dongduk Woman s University, Korea
Dr. Porkumaran K, NGP institute of technology India, India
Dr. Feng CHENG, Hasso Plattner Institute at University of Potsdam, Germany
Prof. El-Sayed M. El-Alfy, King Fahd University of Petroleum and Minerals, Saudi Arabia
Prof. Lin You, Hangzhou Dianzi Univ, China
Mr. Nicolai Kuntze, Fraunhofer Institute for Secure Information Technology, Germany
Dr. Min-Hong Yun, ETRI, Korea
Dr. Seong Joon Lee, Korea Electrotechnology Research Institute, korea
Dr. Kwihoon Kim, ETRI, Korea
Dr. Jin Woo HONG, Electronics and Telecommunications Research Inst., Korea
Dr. Heeseok Choi, KISTI(Korea Institute of Science and Technology Information), korea
Dr. Somkiat Kitjongthawonkul, Australian Catholic University, St Patrick's Campus, Australia
Dr. Dae Won Kim, ETRI, Korea
Dr. Ho-Jin CHOI, KAIST(Univ), Korea
Dr. Su-Cheng HAW, Multimedia University, Faculty of Information Technology, Malaysia
Dr. Myoung-Jin Kim, Soongsil University, Korea
Dr. Gyu Myoung Lee, Institut Mines-Telecom, Telecom SudParis, France
Dr. Dongkyun Kim, KISTI(Korea Institute of Science and Technology Information), Korea
Prof. Yoonhee Kim, Sookmyung Women s University, Korea
Prof. Li-Der Chou, National Central University, Taiwan
Prof. Young Woong Ko, Hallym University, Korea
Prof. Dimiter G. Velev, UNWE(University of National and World Economy), Bulgaria
Dr. Tadasuke Minagawa, Meiji University, Japan
Prof. Jun-Kyun Choi, KAIST (Univ.), Korea
Dr. Brownson ObaridoaObele, Hyundai Mobis Multimedia R&D Lab , Korea
Prof. Anisha Lal, VIT university, India
Dr. kyeong kang, University of technology sydney, faculty of engineering and IT , Australia
Prof. Chwen-Yea Lin, Tatung Institute of Commerce and Technology, Taiwan
Dr. Ting Peng, Chang'an University, China
Prof. ChaeSoo Kim, Donga University in Korea, Korea
Prof. kirankumar M. joshi, m.s.uni.of baroda, India
Dr. Chin-Feng Lin, National Taiwan Ocean University, Taiwan
Dr. Chang-shin Chung, TTA(Telecommunications Technology Association), Korea

Copyright ⓒ 2015 GiRI (Global IT Research Institute)Dr. Che-Sheng Chiu, Chunghwa Telecom Laboratories, Taiwan
Dr. Chirawat Kotchasarn, RMUTT, Thailand
Dr. Fateme Khalili, K.N.Toosi. University of Technology, IranDr. Izzeldin Ibrahim Mohamed Abdelaziz, Universiti Teknologi Malaysia , Malaysia
Dr. Kamrul Hasan Talukder, Khulna University, Bangladesh
Prof. HwaSung Kim, Kwangwoon University, Korea
Prof. Jongsub Moon, CIST, Korea University, Korea
Prof. Juinn-Horng Deng, Yuan Ze University, Taiwan
Dr. Yen-Wen Lin, National Taichung University, Taiwan
Prof. Junhui Zhao, Beijing Jiaotong University, China
Dr. JaeGwan Kim, SamsungThales co, Korea
Prof. Davar PISHVA, Ph.D., Asia Pacific University, Japan
Ms. Hela Mliki, National School of Engineers of Sfax, Tunisia
Prof. Amirmansour Nabavinejad, Ph.D., Sepahan Institute of Higher Education, Iran

Copyright ⓒ 2015 GiRI (Global IT Research Institute)

Editor Guide
 Introduction for Editor or Reviewer
All the editor group members are to be assigned as a evaluator(editor or reviewer) to submitted journal
papers at the discretion of the Editor-in-Chief. It will be informed by eMail with a Member Login ID and
Password.
Once logined the Website via the Member Login menu in left as a evaluator, you can find out the paper
assigned to you. You can evaluate it there. All the results of the evaluation are supposed to be shown in
the Author Homepage in the real time manner. You can also enter the Author Homepage assigned to
you by the Paper ID and the author's eMail address shown in your Evaluation Webpage. In the Author
Homepage, you can communicate each other efficiently under the peer review policy. Please don't missit!
All the editor group members are supposed to be candidates of a part of the editorial board, dependingon their contribution which comes from history of ICACT TACT as an active evaluator. Because the main
contribution comes from sincere paper reviewing role.

 Role of the Editor
The editor's primary responsibilities are to conduct the peer review process, and check the final cameraready manuscripts for any technical, grammatical or typographical errors.
As a member of the editorial board of the publication, the editor is responsible for ensuring that the
publication maintains the highest quality while adhering to the publication policies and procedures of
the ICACT TACT(Transactions on the Advanced Communications Technology).
For each paper that the editor-in-chief gets assigned, the Secretariat of ICACT Journal will send theeditor an eMail requesting the review process of the paper.
The editor is responsible to make a decision on an "accept", "reject", or "revision" to the Editor-in-Chief
via the Evaluation Webpage that can be shown in the Author Homepage also.

 Deadlines for Regular Review
Editor-in-Chief will assign a evalaution group( a Editor and 2 reviewers) in a week upon receiving acompleted Journal paper submission. Evaluators are given 2 weeks to review the paper. Editors are
given a week to submit a recommendation to the Editor-in-Chief via the evaluation Webpage, once all or
enough of the reviews have come in. In revision case, authors have a maximum of a month to submit
their revised manuscripts. The deadlines for the regular review process are as follows:

Copyright ⓒ 2015 GiRI (Global IT Research Institute)Evalution Procedure

Deadline

Selection of Evaluation Group
Review processing
Editor's recommendation
Final Decision Noticing

1 week2 weeks
1 week
1 week Making Decisions on Manuscript
Editor will make a decision on the disposition of the manuscript, based on remarks of the reviewers. The
editor's recommendation must be well justified and explained in detail. In cases where the revision isrequested, these should be clearly indicated and explained. The editor must then promptly convey thisdecision to the author. The author may contact the editor if instructions regarding amendments to themanuscript are unclear. All these actions could be done via the evaluation system in this Website. The
guidelines of decisions for publication are as follows:

Decision

Description

AcceptAn accept decision means that an editor is accepting the paper withno further modifications. The paper will not be seen again by theeditor or by the reviewers.
The manuscript is not suitable for the ICACT TACT publication.
The paper is conditionally accepted with some requirements. A
revision means that the paper should go back to the original
reviewers for a second round of reviews. We strongly discourage
editors from making a decision based on their own review of themanuscript if a revision had been previously required.

RejectRevision Role of the Reviewer
Reviewer Webpage:
Once logined the Member Login menu in left, you can find out papers assigned to you. You can alsologin the Author Homepage assigned to you with the paper ID and author's eMail address. In there you
can communicate each other via a Communication Channel Box.

Quick Review Required:
You are given 2 weeks for the first round of review and 1 week for the second round of review. You must
agree that time is so important for the rapidly changing IT technologies and applications trend. Pleaserespect the deadline. Authors undoubtedly appreciate your quick review.

Copyright ⓒ 2015 GiRI (Global IT Research Institute)Anonymity:
Do not identify yourself or your organization within the review text.

Review:
Reviewer will perform the paper review based on the main criteria provided below. Please provide
detailed public comments for each criterion, also available to the author.
 How this manuscript advances this field of research and/or contributes something new to theliterature?
 Relevance of this manuscript to the readers of TACT?
 Is the manuscript technically sound?
 Is the paper clearly written and well organized?
 Are all figures and tables appropriately provided and are their resolution good quality?
 Does the introduction state the objectives of the manuscript encouraging the reader to read on?
 Are the references relevant and complete?

Supply missing references:
Please supply any information that you think will be useful to the author in revision for enhancing
quality of the paperor for convincing him/her of the mistakes.

Review Comments:
If you find any already known results related to the manuscript, please give references to earlier papers
which contain these or similar results. If the reasoning is incorrect or ambiguous, please indicate
specifically where and why. If you would like to suggest that the paper be rewritten, give specificsuggestions regarding which parts of the paper should be deleted, added or modified, and pleaseindicate how.

Copyright ⓒ 2015 GiRI (Global IT Research Institute)Journal Procedure
Dear Author,

 You can see all your paper information & progress.
 Step 1. Journal Full Paper Submission
Using the Submit button, submit your journal paper through ICACT Website, then you will get newpaper ID of your journal, and send your journal Paper ID to the Secretariat@icact.org for the review andeditorial processing. Once you got your Journal paper ID, never submit again! Journal Paper/CRF
Template Step 2. Full Paper Review
Using the evaluation system in the ICACT Website, the editor, reviewer and author can communicate
each other for the good quality publication. It may take about 1 month.

 Step 3. Acceptance Notification
It officially informs acceptance, revision, or reject of submitted full paper after the full paper review
process.

Status
Acceptance
Revision
RejectActionGo to next Step.
Re-submit Full Paper within 1 month after Revision Notification.
Drop everything.

 Step 4. Payment Registration
So far it's free of charge in case of the journal promotion paper from the registered ICACT conference
paper! But you have to regist it, because you need your Journal Paper Registration ID for submission of
the final CRF manuscripts in the next step's process. Once you get your Registration ID, send it to
Secretariat@icact.org for further process.

 Step 5. Camera Ready Form (CRF) Manuscripts Submission
After you have received the confirmation notice from secretariat of ICACT, and then you are allowed tosubmit the final CRF manuscripts in PDF file form, the full paper and the Copyright Transfer Agreement.
Journal Paper Template, Copyright Form Template, BioAbstract Template,

Copyright ⓒ 2015 GiRI (Global IT Research Institute)Journal Submission Guide
All the Out-Standing ICACT conference papers have been invited to this "ICACT Transactions on the
Advanced Communications Technology" Journal, and also welcome all the authors whose conference
paper has been accepted by the ICACT Technical Program Committee, if you could extend new contents
at least 30% more than pure content of your conference paper. Journal paper must be followed toensure full compliance with the IEEE Journal Template Form attached on this page.

 How to submit your Journal paper and check the progress?
Step 1. Submit Using the Submit button, submit your journal paper through ICACT

Step 2. Confirm

Step 3. Review

Website, then you will get new paper ID of your journal, and send yourjournal Paper ID to the Secretariat@icact.org for the review and editorial
processing. Once you got your Journal paper ID, never submit again! Using
the Update button, you can change any information of journal paper
related or upload new full journal paper.
Secretariat is supposed to confirm all the necessary conditions of yourjournal paper to make it ready to review. In case of promotion from theconference paper to Journal paper, send us all the .DOC(or Latex) files ofyour ICACT conference paper and journal paper to evaluate the differenceof the pure contents in between at least 30% more to avoid the self
replication violation under scrutiny. The pure content does not include any
reference list, acknowledgement, Appendix and author biography
information.
Upon completing the confirmation, it gets started the review process thru
the Editor & Reviewer Guideline. Whenever you visit the Author
Homepage, you can check the progress status of your paper there fromstart to end like this, " Confirm OK! -> Gets started the review process > ...", in the Review Status column. Please don't miss it!

Copyright ⓒ 2015 GiRI (Global IT Research Institute)Volume. 4 Issue. 4

1 Joint iterative channel estimation and decoding

6J

636

Patcharin Insom*,**, Piyakiat Insom***, Pisit Boonsrimuang****Institute of Remote Sensing and Digital Earth, Chinese Academy of Science (CAS), Beijing, China, 100101** University of Chinese Academy of Science (UCAS), Beijing, China, 100049***Faculty of Engineering, King Mongkut’s Institute of Technology Ladkrabang, Bangkok, Thailand, 10520

2 A MODEL FOR NETWORK TRAFFIC ANOMALY DETECTION

644

Nguyen Ha Duong*, Hoang Dang Hai***Faculty of Information and Technology, National University of Civil Engineering, 55 Giai Phong, Hanoi, Vietnam** Posts and Telecommunications Institute of Technology, Ministry of Information and Communication, Nguyen
Trai, Hanoi, Vietnam

3 Ontological-semantic text analysis and the question answering system using data from ontology

651

Kuznetsov V. A.*, Mochalov V. A.**, Mochalova A. V.*** Petrozavodsk State University, Lenina str. 33, 185910 Petrozavodsk, Russia** Institute of Cosmophysical Research and Radio Wave Propagation FEB RAS, Mirnaia str. 7, 684034
Paratunka, Kamchatka region, Russia.

4 Functional scheme of the flying sensor networks architecture design

659

Mochalov V.A.*, Pschenichnikov A.P.***Institute of Cosmophysical Research and Radio Wave Propagation FEB RAS , Mirnaia str. 7, 684034
Paratunka, Kamchatka region, Russia**Moscow technical university of communications and informatics, Aviamotornaya str. 8a, 111024 Moscow,
RussiaCopyright ⓒ 2015 GiRI (Global IT Research Institute)

ICACT Transactions on Advanced Communications Technology (TACT) Vol. 4, Issue 4, July 2015

636

Joint iterative channel estimation and decoding
under impulsive interference condition
Patcharin Insom*,**, Piyakiat Insom***, Pisit Boonsrimuang****Institute of Remote Sensing and Digital Earth, Chinese Academy of Science (CAS), Beijing, China, 100101** University of Chinese Academy of Science (UCAS), Beijing, China, 100049***Faculty of Engineering, King Mongkut’s Institute of Technology Ladkrabang, Bangkok, Thailand, 10520
insom.patcharin@gmail.com, piyakiat_insom@hotmail.com, kbpisit@kmitl.ac.th
Abstract—Even though Low-Density-Parity-Check (LDPC)
code which has the decoding performance close to the
Shannon Limit and it is designed
as a powerfulforward-error-correction (FEC) code in the Additive White
Gaussian Noise (AWGN) channel, simulation results show thatthe performance of LDPC decoder is degraded when exposed tothe impulsive noise. According to such a impulsive noise impact,
joint iterative channel estimation and decoding technique is
proposed in this paper so as to decrease the effect of impulsive
interference while less complicated in processing. The proposed
methods decreases the complexity by implementing the simple
way of channel estimation and applying joint iterativetechnique between channel estimation and LDPC decoding
under two kind of impulsive noise; pulsed radio frequency
interference( RFI) and symmetric alpha-stable ( S S ). In the
optimal decoder, channel parameter estimation can be as
accurate as possible. Because computed in every time of
iterative decoder, channel parameters have been always
optimized resulting in the enhancement of LDPC decoder
performance.

Keyword—LDPC decoding, pulsed RFI,
alpha-stable, Joint iterative, Channel estimation.

symmetric

I. INTRODUCTION

R

eliability is an important variable in communication
systems. Undesirable signal should be eliminated. Not
only planetary communications systems, but also satellite
communications systems are commonly interrupted by———————————————————————
Manuscript received April 1, 2015. This work was supported
self-research scholarship for Master student of Asia-Pacific Space
Cooperation Organization (APSCO) and the China Scholarship Council(CSC) under Grant 2011GXZH34.
Patcharin Insom was master student in Master program on SpaceTechnology (MASTA), Beihang University, Beijing, China 100191. She is
now PhD. Candidate in the institute of remote sensing and digital earth,
Chinese Academy of Science, and the University of Chinese Academy of
Science, Beijing, China 100101. (corresponding author to provide phone:+86 131 6156 1499; e-mail: insom.patcharin@gmail.com).
Piyakiat Insom is now an undergraduate student in the department ofelectronic, Faculty of Engineering, King Mongkut’s Institute of Technology
Ladkrabang,
Bangkok,Thailand,10520(e-mail:piyakiat_insom@hotmail.com).
Pisit Boonsrimuang is now a lecturer at telecommunication engineering
department, Faculty of Engineering, King Mongkut’s Institute ofTechnology Ladkrabang, Bangkok, Thailand, 10520 (e-mail:kbpisit@kmitl.ac.th).

impulsive noise; pulsed radio frequency interference (RFI)and symmetric alpha- stable noise ( S S ).
Several researches which investigate the impact of pulsed
RFI on LDPC decoder performance found that regardless of
the level of signal to noise ratio (SNR), the Bit-Error-Rate(BER) is always large [1]. Pulsed RFI frequently has the duty
cycles in the order of 5% or smaller through code length. In
addition, pulsed RFI randomly turns up in the form of blockand the noise variance varies with time. Currently, several
applications, such as ISS ACS Transponders, 4th Gen
Transponders,Integrated
Receivers
andsatellite
communication receiver, are involved with pulsed RFI,
resulting in wide awareness of the impact of pulsed RFI.
S S distribution frequently used for simulating theimpulsive interference. S S noise is constructed based on
two important parameters; characteristic exponent anddispersion parameter, in which different value of the twoparameters give different heavy tail noise level. S S noise
has impact on several communication system such as
Orthogonal Frequency Division Multiplexing (OFDM) [2].
LDPC codes, invented by Gallager, achieve near capacity
performance in a wide class of channels [1]. Generally,various simulations and applications are based on AWGN
channel. However, our simulation is unable to consider being
only AWGN channel because of pulsed RFI and S S noise
appearing. In impulsive channel, an initial Log Likelihood
Ratio (LLR) has been developed in many ways [3] [4] [5] [6].
This work constructs the initial LLR based on probability
density function (PDF). Recently, joint iterative techniquehave been extensively implement in several applications [1][7] [8] and attractive for mitigating the effect of heavy noise.
The proposed method presented the joint iterative between
channel estimation and LDPC decoding technique which has
been developed to re-processing parameter estimation for
constructing the PDF during each iterative time of LDPC
decoder processes.
On the one hand, pulsed RFI has close form of PDF and the
SNR has been investigated by several researchers [4] toobtain the noise variance and LLR in consequently. Although
all of them work very well when the SNR value is large, theirperformance suffers at negative SNR. The iterative SNR
estimation [9] is rest on an iterative solution for the maximum
likelihood estimation of the amplitude from which the SNR iscompetent to compute. Its results show that it exhibits a lower
bias and normalized mean squared error than othertechniques and that the useful range extends to negative SNR.
Copyright ⓒ 2015 GiRI (Global IT Research Institute)

ICACT Transactions on Advanced Communications Technology (TACT) Vol. 4, Issue 4, July 2015

However, the iterative SNR estimation is time-consuming
because of demanding a lot of complicated processes andtaking a large of calculating time depending on the number of
iteration. On the other hand, there is no close form of PDF for
S S distribution, thus SNR cannot implemented to obtainthe noise variance. Geometric signal-to-noise ratio (GSNR)
is implemented. Some of research works [10] [11] [12]applied Particle Filter (PF) to estimate the importantparameters in S S distribution and get the appreciated Log
Likelihood Ratio (LLR) in consequently. Since the number ofparticle which deploy in PF process, complexity inprocessing is concern problem. In this work, we implement
commonly use of the second order moment ( M 2 ) method [4]to estimate the noise variance under pulsed RFI channel anduse of Logarithmic Moment (LM) [13] which has nocomplicated mathematic formula to estimate the channel
parameter under S S channel.
The rest of this paper is organized as follows. Section II
presents the system model of the two channel type; the pulsed
RFI, S S , and the influence on LDPC decoder performance.
Section III, which reviews channel estimation techniques,consists of M 2 SNR estimation and GSNR estimation. In
section IV, the joint iterative channel estimation anddecoding approaches are presented for the both channels.
The simulation results of the proposed techniquesdemonstrate in section V. The conclusion is offered in the lastsection.

637

Where
nawgn, k  N (0,  12   2  )nrfi , k  N (0,  22 )Fig. 2 shows pulsed RFI in single source. Generally, pulsed
RFI randomly turns up throughout the length of xk and has
duty cycles 3-5% of the code length. In addition, pulsed RFI
has the noise variance changing with time. Pulse trainfunction ( g (t ) ) is assumed to be periodic gating function
with pulse repetition rate of 1/ T and duty cycle  / T and isused for generating pulsed RFI.

Fig. 2 Gating function for pulsed RFI model.

Fig. 3 demonstrates the influence of pulsed RFI on LDPC
decoder performance. It is found that whatever SNR is, BER
under pulsed RFI environment is always seriously.

II. SYSTEM MODEL
A. Pulsed RFI Model
The system of pulsed RFI channel [1] illustrates as Fig. 1and (1) where xk is transmitted sequence and yk is
received sequence. The transmitted signal ( xk ) isinterrupted by pulsed RFI ( nrfi , k ) and AWGN ( nAWGN , k )which both of them have zero mean, but possess difference
in noise variance. Distribution of AWGN and pulsed RFI
are capable of representing as N (0,  12   2  ) andN (0,  22 ) respectively. In practical, because most of thechannel is time varying SNR mismatch over an AWGN
channel, the noise variance is explainedas222 1    when  signify as the noise variance of
AWGN and  is symbolic of the random walk signal of
AWGN.

Fig. 3 Pulsed RFI impact on LDPC decoder performance simulated with
the AR4JA (8192, 4096) code.

B. Symmetric Alpha-Stable noise Model
The S S channel describes by a transmitted sequence xk isinterrupted by S S noise which depict in Fig. 4 and (2),resulting in yk sequence.
yk  xk  nS S , k

When we mention to S S channel, one properties of
S S distribution [14] [15] is that there is no closed form
expression of the PDF (except in case of Cauchy andGaussian distribution), the most convenient way to explainthem is using their characteristic function, which define as:

Fig. 1 System model for pulsed RFI experiment.

yk  xk  na wgn , k  g (t ) * nrfi , k

(2)

(1)

 ( )  exp( j   |  | )(3)

Copyright ⓒ 2015 GiRI (Global IT Research Institute)

ICACT Transactions on Advanced Communications Technology (TACT) Vol. 4, Issue 4, July 2015

 The

Gaussianby S (2, 0, 

distribution638

N (  ,  2 ) isprovided

2 , ) .

 The Cauchy distribution is denoted by S (1, 0,  ,  ) .
The PDF of Gaussian and Cauchy distribution are given by:
f gaussian ( x) 

Fig. 4 System model for S S experiment.

Where  is the characteristic
exponent. It is vary
between 0    2 , and it describes the tail of the
distribution. A small positive value of  points out
the severe impulsiveness, resulting in heavy-tail ofthe distribution. The distribution is close toGaussian behavior, if  near to 2. A value of  =1 means Cauchy distribution.
  is the dispersion parameter or scale (   0 ). It
indicates the spread of the density around thelocation parameter. It is similar to the variance ofGaussian density. In Gaussian density case, thisvalue is equal to half of the variance of Gaussian
density.
  is the location parameter (      ). It
corresponds to the mean for 1    2 , andcorresponds to the median for 0    1 .

f Cauchy ( x )  ( x   )2 
exp 

4 
4


1


   ( x   ) 2 
2

(4)

(5)

Even though when 0    2,   1, 2 , no closed- form
expressions exist for the PDF, but we can be computed the
PDF, f ( x) by taking the inverse Fourier transform of thecharacteristic function, resulting in:

f S S ( x ) 1j ( x  )d exp( |  | )e
2 

(6)

Fig.6 shows the impact of SαS noise on LDPC decoder
performance when LLR calculate from normal distribution.
Transmitted signal is more interrupted when the value of α goto small value.

Fig. 5 illustrates the S S sequence at difference  values.
They show different impulsiveness with   1 ,   1.2 ,  1.7 , and   2 , respectively. An amplitude of impulse
for small  cases show very high interrupted level whereas
the value of  which is near to 2 illustrates lower amplitudeof impulse which no large of interrupting.

(a)

(b)

Fig. 6 S S noise impact on LDPC decoder performance simulatedwith the AR4JA (8192, 4096) code.

III. CHANNEL PARAMETERS ESTIMATION

(c)

(d)

Fig. 5 The received signal interrupting by S S Noise with (a)   1 ;(b)   1.2 ; (c)   1.7 ;(d)   2 .

When we mention to the alpha-stable distribution, it is afour-parameter family of distributions and is generally
denoted by S ( ,  ,  ,  ) . In the S S distribution,  value
which explains the skewness of the distribution is equal to 0.
We can conclude that the family of alpha-stable distribution
is a rich class, and includes the following distributions:A. Pulsed RFI Model
Various digital communication applications, such as
power control, bit error estimation, and turbo decoding,involve the knowledge of the SNR. For optimal performance,
SNR estimation must be as accurate as possible. Several
techniques have been proposed for SNR estimation. M 2 [4]is popular method in several applications because it provides
a simple processing. SNR is capable of computing from theratio of the signal mean squared ( A ) and the noise variance(  2 ) which both of them are expressed as:A

1 N
 | yk |N k 1(7)

Copyright ⓒ 2015 GiRI (Global IT Research Institute)

ICACT Transactions on Advanced Communications Technology (TACT) Vol. 4, Issue 4, July 20151
   ( yk  A) 2
N k 1N

2(8)

B. Symmetric Alpha-Stable noise Model
As mentioned above, a difficult task arises in using of
S S model because there is no the closed form of PDF. They
do not exist the second-order moment, or the variance.
Therefore, another estimated method for noise power isnecessary. For instance, in this experiment we use GSNR
[15]:
GSNR 

1 A 2( )2Cg S0(9)

Where
A is the signal amplitude.
S0 symbolic to the geometric noise power.
1/ 

S0 

(Cg  )
Cg

(10)

Cg  1.78 is the experiential of the Euler constant. The
CGLLR ( yk )  log 





639




2 122 22
 (13)( yk 1)2( yk 1)2
2
1    212ee 2 2 
2 122 22

1 



e

( yk 1)2
2 12







e

( yk 1) 2
2 22

Where
  12   2  is the noise variance of Gaussian partof the PDF.
  22 is the noise variance of the contaminating heavytailed PDF (pulsed RFI noise). Chosen ranges
are 1.0   22  4.0 .
  is the percentage of sample from the heavy-tailed
PDF. It can range from 0    0.5 with the value
greater than 0.3 occurring with very low probability.
To implement CGLLR, two parameters must be computed.
Firstly, the percentage of sample from the heavy-tailed PDF(  ) or pulsed RFI part is calculated by higher ordermoments. Fig.7 illustrates detection of pulsed RFI technique
by M 2 method. Let N is code length and G is number ofgroup.

constant 2Cg in (9) ensures for the SNR in case of   2
corresponding to the Gaussian distribution withvariance  2  2 . In digital communication system, we areinterested in characteristic of BER in term of Eb / N 0 (theratio of signal energy per bit to the noise spectral density).
This means that the parity bits do not represent transmitted
information and their energy must be removed over
information bits. Therefore, we can define Eb / N 0 for
S S channel as:
Eb GSNR

N0
2rm

(11)

Where r is code rate and m is the number of bits carried per
M-array symbol ( m  1 for binary code).
IV. JOINT ITERATIVE CHANNEL ESTIMATION AND DECODING
A. Pulsed RFI Model
The system model which mentioned in the section II points
out that both AWGN and pulsed RFI are capable ofexplaining as normal distribution. Based on the PDF of the
distribution, we are able to form the initial LLR of simulatedchannel. If the assumed noise PDF has distribution as:f ( n) 1 2 12



e

n2
2 12




2 22



e

n2
2 22

(12)

Where  22   12
Contaminated Gaussian Log-Likelihood-Ratio (CGLLR)[1] has been constructed.
CGLLR provides initial
information more accurate than implementing Gaussian
LLR. CGLLR is re-written as the follow:

Fig. 7 Detection pulsed RFI by the second order moment.

N is divided into G groups; thus, each group is composed of
N/G samples. Because M 2 value of pulsed RFI area is higher
than any other region, we take the advantage from this point
to capture the area that pulsed RFI appearing. M 2 of every
group is calculated and the group which has the largest
M 2 value is capable of considering to be pulsed RFI region.
Therefore, number of sample of pulsed RFI is approximately
equal to N/G. To ensure that all pulsed RFI samples aredetected, a few samples both left and right side of that groupare included. In other words the pulsed RFI region isapproximately equal to the area of group which it has thehighest M 2 value including its side-band. Further precision
may divide N into several groups and each group contains
smaller samples. Applying the same technique; find M 2 ofevery group, consequently, pulsed RFI area may containmore than one group which have the highest M 2 value
respectively. In practice, M 2 are estimated by their respective
time averages for both real and complex channels as:
M2 

1 N
 | yk |2
N k 1(14)

The second factor that needs to compute for implementing
CGLLR is the noise variance of Gaussian part of the PDF(  12   2  ) because the channel status information is
unknown. In various applications, M 2 is used because it is

Copyright ⓒ 2015 GiRI (Global IT Research Institute)

ICACT Transactions on Advanced Communications Technology (TACT) Vol. 4, Issue 4, July 2015

the simple way to obtain  12 and does not take time tocalculate. However, the channel in this work is not same asother works since pulsed RFI also appears in the channel. In
this environment, M 2 is unable to provide very accurate
value. The proposed method to overcome the pulsed RFI candealing with this problem [1]. The proposed approach isconstructed by the principle of joint iterative channel
estimation and decoding. It bases on the fundamental thateach iterative time of decoding process, the noise variance(  12 ) is re-computed by M 2 method to modified informationand obtain more accurate noise variance. Schematic of the
proposed technique implementing under pulsed RFI shows as
Fig. 8 and Algorithm 1.

Fig. 8 Schematic block diagram of the proposed technique.

The received signal ( yk ) is erased pulsed RFI area which
detecting by M 2 method. The received signal after deleting
pulsed RFI region denote as yk _ noRFI . Consequent step is thenoise variance (  12 ) evaluation. On the one hand, if it is thefirst time of LDPC decoder iterations, yk _ noRFI will be used
to perform the noise variance calculation. On the other hand,the noise variance is computed from yk _ new for remaining
iteration. CGLLR ( yk ) is determined based on the estimatednoise variance. We carry out the LDPC decoder only once
iterative time. The results consist of hard-decision output,
values of check node (CN) , and variable node (VN)
updating. Hard-decision outputs are feed back to multiply
with the pre- eliminated pulsed RFI signal ( yk ) resulting in
the new received signal ( yk _ new ). In order to keep LDPC
decoder processes, values of check nodes (CN) and variablenodes (VN) updating are also feedback so as to use in theinitial state of the next LDPC iteration. In the check stopping
criteria step, if the number of iterative time is not equal to the
maximum LDPC iterations or decoding error is not equal tozero, go back to step 2.) and increases the number of
iterations by one until reach the stopping criterion.

B. Symmetric Alpha-Stable noise Model
Joint iteration technique between S S channel parameter
estimation and LDPC decoder allows LLR value updating on
fly in every LDPC iterative times, which lead to acquire ahigh decoder performance. Additionally, because it is not somuch mathematics calculation steps in estimated parametervalues, the whole processes of the proposed method could
has an enhanced results while no computation loss. Thissection consists of two parts. Firstly, LLR computation is
mentioned based on the LM method. Secondly, the joining

640

process of LDPC decoder and estimation of S S channel
parameters is described.
Algorithm 1 Joint iterative between channel estimationand decoding under pulsed RFI condition.
1: procedure pulsedRFI ( yk )Eliminate pulsed RFI2:3:
if decoding iterative =1 then 12  var( yk _ noRFI )

4:

else

 12  var( yk _ new )5: end if
6: LLR computation
7: Once iterative time LDPC decoder
8: Output feedbackyk _ new  yk  hard  decision
Check Node (CN) update vale
Variable Node (VN) update value
9: Check stopping criteria
10: if iterative time = max iteration || Error=0 then
Go to 13
11: else
Back to 3
12: end if
13: Output codeword
14: end procedure
In (3) there are two key parameters for calculate the PDF
of S S distribution: characteristic exponent (  ) anddispersion parameter (  ). The location parameter (  ) can bediscarded because it is a position and no influence on thesimulation analyses. In this experiment, those two parameters
are computed from LM method [13]. Let X  S ( , 0,  , 0) is
sequence of S S signal then:
L1  E  log | X |   0 (1 

1

)

1



|
cos 
1 1
2
L2  E (log | X | E  log | X |) 2    1 (  2 )  2
2 






log |

(15)
(16)

Where
L1 is logarithmic moment at order 1
L2 is logarithmic moment at order 2 0  0.57721566...,

1 

2
6

(17)

We can solve for  by setting   0 and then calculate for 
value. The LLR calculation for S S channel is related to the
PDF of the S S distribution which express as: P ( yk | xk  1) 
LLR ( yk | xk )  ln 
 P ( yk | xk  1) (18)

In S S channel, the joint iterative between channel
estimation and LDPC decoder perform as Fig. 9 and
Algorithm 2. The processes begin with an initial LLR value.

Copyright ⓒ 2015 GiRI (Global IT Research Institute)

ICACT Transactions on Advanced Communications Technology (TACT) Vol. 4, Issue 4, July 2015

For the first iteration of LDPC, LLR is calculated by setting
 equal to 2 (Gaussian LLR). According to (15) - (16), we
can obtain the  value. From these two parameter values, we
can compute LLR. The initial LLR value are input to LDPC
decoder resulting in three output parameters.

Fig. 9 Schematic block diagram of the proposed technique for joint iterative
between channel estimation and decoding under S S channel.

The first two outputs are variable node and check node valuesof LDPC, which will be used for the next iteration of thedecoder. The third output is hard-decision, it will be feedback
to subtract from received signal ( yk ) to estimate  and values by LM method before calculating the LLR value forthe next loop of LDPC decoder. The output from subtracting
hard-decision with received signal ( yk ) is S S noise
sequence, which can be used to estimate  and  values as(15)-(16). Because two important parameters are estimated inevery iterative time, the LLR value can update to moreaccurate value which has influence on the decoder
performance. The loops are continuing until reach thecriterion and get output codeword in the final step.

641

Algorithm 2 Joint iterative between channel estimationand decoding under S S noise.
1: procedure SaSnoise ( yk )LLR computation(  ,  , yk )2:
if decoding iterative =1 then3: 2
  LM ( , S S sequence)else
4:  LM ( S S sequence)  LM ( , S S sequence)
5: end if
6: Once iterative time LDPC decoder
7: Output feedback
S S sequence  yk  hard _ decision
Check Node (CN) update vale
Variable Node (VN) update value
8: Check stopping criteria
9: if iterative time = max iteration || Error=0 then
Go to 12
10: else
Back to 2
11: end if
12: Output codeword
13: end procedure

Therefore, the noise variance (  12 ) has always beenchanged and obtains more accurate value in each time of
LDPC iteration.

V. SIMULATION RESULTS AND DISCUSSION
The LDPC code studied here is the AR4JA (8192, 4096)
code recommended by the Consultative Committee for Space
Data Systems (CCSDS) and it has been chosen for some deep
space applications. In this section, BER of the joint iterative
channel estimation and decoding or the proposed approaches
are presented for both under pulsed RFI and S S channel.

A. Pulsed RFI ModelIn the simulation, we set the noise variance of thecontaminating heavy-tailed (pulsed RFI) PDF (  22 ) by 4.0
and set the random walk signal of AWGN (  ) by 10% of
the noise variance of AWGN part (  12 ). The proposed
method was compared the result with the conventional
method which performs noise variance of AWGN part (  12 )estimation by M 2 SNR estimation based on hard-decisions of
the previous codeword which they are feedback to multiply
with that codeword to eliminate modulated information. Fig.
10 depicts that the proposed technique has only about 0.2 dB
at BER = 10 3 different from the SNR know experiment. The
efficiency of the proposed approach is close to theperformance of ideal technique because the noise variance(  12 ) is re-calculated in every time of iterative LDPC
decoder.

Fig. 10 Bit-Error-Rate performance in the jiggling AWGN channel
simulated with the AR4JA (8192, 4096) code.

Table I. makes a comparison of the single blockinformation for SNR estimation of those two techniques.
Two kind of operation are taken into our consideration;
addition, and multiplication.
TABLE ICOMPARISON OF SINGLE BLOCK INFORMATION FOR SNR ESTIMATION
OF THE TWO METHOD

Addition
Multiplication

Conventional method
M 1

Proposed method( M  1)kM 1

( M  1)k

Let length of single block information which pulsed RFI isremoved is M . k represents the number of LDPC iteration.

Copyright ⓒ 2015 GiRI (Global IT Research Institute)

ICACT Transactions on Advanced Communications Technology (TACT) Vol. 4, Issue 4, July 2015

In the single block information, the conventional method
requires the smallest operational numbers. The proposed
approach has a little more computational complexity thanthe conventional technique depending on the number ofLDPC iteration (k).

B. Symmetric Alpha-Stable noise Model
There are two test cases of  value in this simulation:  1.2 and   1.7 which is no closed form PDF for these values. The results demonstrate the proposed method forthe joint iterative method between S S channel estimationand LDPC decoder in term of BER as depict in Fig. 11. BER
curve of   1.2 is more corrupt than BER curve of   1.7 .
This is because   1.2 generate stronger impulsiveness tothe channel, thus, it needs high level of GSNR value to obtaina satisfied performance. In the curves, GSNR equals to 2.85
could give BER about 104 in case of   1.2 and the GSNR
equals to 2 could get BER about 10 4 when   1.7 , because  1.7 is near to be Gaussian noise and has smaller
impulsiveness on channel than   1.2 .
From Fig 6 and 11, it is clear that the proposed method has
ability to mitigate the effect of S S noise better than theconventional method which widely uses normal distribution
to calculate an initial LLR for LDPC decoder.

642

every iterative time, which established by α = 1.7 and γ =0.5338. Although, the updating of γ parameter is unable toreach the true value, it is better than implement LDPC
decoder with LLR from normal distribution, which both twoparameters have the values same as setting in the first
iteration time. The updated parameter reflects theenhancement of LLR calculation that mean LLR value can go
to the appreciated values which has influence to decoder
performance.
VI. CONCLUSION
Joint iterative between channel estimation and decoding
have been presented in this work for pulsed RFI andS S channel. The second order moment method have been
implement for estimating the noise variance in pulsed RFI
channel and logarithmic moment is used for estimating theimportant two parameter under S S channel. In addition, ajoint iterative technique also provides a chance to update
channel parameters in every iterative time of the decoder
which is useful for decoder performance. The results
demonstrate that the proposed technique can mitigate theimpact of the impulsive noise on LDPC decoder for bothpulsed RFI and S S channel. The proposed method is
attractive to apply to various applications which pulsed RFI
or S S is involved with their requirements.
ACKNOWLEDGMENT
The authors are thankful to the reviewers for their detailed
reviews and constructive comments and suggestions, which
greatly improve the quality of this paper.
REFERENCES[1] P. Insom, R. Liu, R. Duan, Y. Hou and P. Boonsrimuang, "Joint
iterative channel estimation and decoding under pulsed radio frequency
interference condition," in IEEE 16th Int. conf. Adv. Commun.
Technol.(ICACT)., 2014.
[2] N. Jaoua, E. Duflos, P. Vanheeghe, L. Clavier and F. Septier,"Impulsive interference mitigation in ad hoc networks based onalpha-stable modeling and particle filtering," in IEEE Int.
conf.Acoustics, Speech and Signal Process (ICASSP)., 2011.

Fig. 11 Bit-Error-Rate performance in the S S channel when  1.2 and   1.7 simulated with the AR4JA (8192, 4096) code.

TABLE IITHE ESTIMATED PARAMETER VALUES OF S S CHANNEL IN EVERYLDPC ITERATIVE TIME
Characteristic
Dispersion
exponent (  )parameter (  )Iteration =1
2.00001.2377
Iteration =2
1.71530.3491
Iteration =3
1.73040.3289Iteration =4
1.75510.3218Iteration =5
1.74250.3205
.
.
.
.
.
.
.
.
.
Iteration =49
1.70990.3384Iteration =50
1.70990.3384

Table II demonstrates an updating of two importantparameters of SαS channel in the case of GSNR = 2 in fifty
iterative times. Both α and γ tend to go to the true value in[3] T. S. Shehata, I. Marsland and M. El-Tanany, "Near Optimal Viterbi
Decoders for Convolutional Codes in Symmetric Alpha-Stable Noise,"in IEEE 72nd Veh.Technol. Conf. Fall (VTC 2010-Fall)., 2010.
[4] D. R. Pauluzzi and N. C. Beaulieu, "A comparison of SNR estimation
techniques for the AWGN channel," IEEE Trans. Commun., vol. 48,
no. 10, pp. 1681-1691, 2000.
[5] T. S. Saleh, I. Marsland and M. El-Tanany, "Low-complexity
near-optimal map decoder for convolutional codes in symmetricalpha-stable noise," in IEEE 25th Canadian Conf. Elect. and Comput.
Eng. (CCECE)., 2012.
[6] T. S. Saleh, I. Marsland and M. El-Tanany, "Simplified LLR-based
Viterbi decoder for convolutional codes in symmetric alpha-stablenoise," in IEEE 25th Canadian Conf. Elect. and Comput.
Eng.(CCECE)., 2012.
[7] H. D. Pfister and K. Byung-Hak, "An Iterative Joint
Linear-Programming Decoding of LDPC Codes and Finite-State
Channels," in IEEE Int. conf. Commun., 2011.
[8] J. Chen, F. Yang, S. Zhang, L. Tang, L. Luo and L.-N. Tho, "Joint
iterative decoding for irregular-LDPC-based coded cooperation over a
non-ideal relay channel," in IEEE Int. conf. Wireless Commun and
Signal Process (WCSP)., 2009.
[9] L. Bin, R. DiFazio and A. Zeira, "A low bias algorithm to estimate
negative SNRs in an AWGN channel," IEEE Commun. Lett., vol. 6, no.
11, pp. 469-471, 2002.
[10] W. Shuang, C. Lijuan, S. Cheng, Z. Yan, M. Yeary and W. Qiang,

Copyright ⓒ 2015 GiRI (Global IT Research Institute)

ICACT Transactions on Advanced Communications Technology (TACT) Vol. 4, Issue 4, July 2015

643

"Noise Adaptive LDPC Decoding Using Particle Filtering," IEEE
Trans. Commun., vol. 59, no. 4, pp. 913-916, 2011.
[11] C. Lijuan, W. Shuang, S. Cheng and W. Qiang, "Noise adaptive LDPC
decoding using particle filter," in IEEE 43rd Annu. Conf.Inform. Sci.
and Syst.(CISS)., 2009.
[12] L. Mihaylova, P. Brasnett, A. Achim, D. Bull and N. Canagarajah,"Particle filtering with alpha-stable distributions," in IEEE 13thWorkshop Statist. Signal Process., 2005.
[13] E. E. Kuruoglu, "Density parameter estimation of skewed alpha-stable
distributions," IEEE Trans.Signal Process., vol. 49, no. 10, pp.
2192-2201, 2001.
[14] M. Shafieipour, H.-S. Lim and T.-C. Chuah, "Decoding of Turbo Codesin Symmetric Alpha-Stable Noise," ISRN Signal Process., vol. 2011, p.
7, 2011.
[15] T. C. Chuah, "Robust iterative decoding of turbo codes in heavy-tailed
noise," IEE Proc. Commun., vol. 152, no. 1, pp. 29-38, 2005.

Patcharin Insom received the B.E. degree in
Telecommunication Engineering (Second Class
Honors), 2009 from King Mongkut’s Institute ofTechnology Ladkrabang, Bangkok, Thailand. In
2013, she received the M.E degree in spacetechnology application from Beihang University,
Beijing, China supported by APSCO and CSC
scholarship. She currently is Ph.D candidate at the
University of Chinese Academy of Sciences,
Beijing, China sponsor by CAS-TWAS president
fellowship. Her interested research is wirelesscommunication and remote sensing applications.
Piyakiat Insom currently is bachelor degree
student in Electronic Engineering, Faculty ofEngineering, King Mongkut’s Institute ofTechnology Ladkrabang, and Bangkok, Thailand.
His interested researches are included
micro-controller and wireless communication.

Pisit Boonsrimuang received the B.E. and M.E.
degrees in telecommunication engineering fromKing Mongkuts Insti- tute of Technology
Ladkrabang (KMITL), Thailand and Dr.E. fromMie University, Japan, in 1997, 2000 and 2007
respec- tively. He is currently working as lecturer
at King Mongkuts Institute of Technology
Ladkrabang, Thailand. His research inter- ests
include transmission techniques for future
multimedia wireless LAN system.

Copyright ⓒ 2015 GiRI (Global IT Research Institute)

ICACT Transactions on Advanced Communications Technology (TACT) Vol. 4, Issue 4, July 2015

644

A Model for Network Traffic
Anomaly Detection
Nguyen Ha Duong*, Hoang Dang Hai***Faculty of Information and Technology, National University of Civil Engineering,
55 Giai Phong, Hanoi, Vietnam** Posts and Telecommunications Institute of Technology, Ministry of Information and Communication,
Nguyen Trai, Hanoi, Vietnam
duongnh@nuce.edu.vn, hdhai@mic.gov.vn

Abstract—Network traffic anomaly detection can findunusual events cause by hacker activity. Most research in thisarea focus on supervised and unsupervised model. In this work,
we proposed a semi-supervised model based on combination ofMahalanobis distance and principal component analysis for
network traffic anomaly detection. We also experimentclustering technique with suitable features to remove noise intraining data along with some enhanced detection technique.
With the approach of combining anomaly detection andsignature-based detection system, we believe the quality ofnormal dataset will greatly improve.
Keyword—Network traffic anomaly, anomaly detection,
semi-supervised model, intrusion detection, network security

T

I. INTRODUCTION

ODAY, network security is world-wide major concernof many countries. Organizations, companies andagencies are often facing with network attacks. The Intrusion
Detection System (IDS) is implemented as an effective
device to detect attacks outside or inside of a network.
However, typical IDS often rely on signature database or
pattern of known attack [1][2]. Therefore, intruders canchange some parameters or characters that different fromknown patterns to make IDS unable to detect the newvariances. Anomaly detection is the approach of recent IDS[3-6], since it does not require any prior knowledge about theattack signatures. Thus, it is capable to detect new attacks.
Anomaly detection system (ADS) is used to detect theabnormal behaviour of a system. ADS can operate
independently or as a component of IDS.

———————————————————————
Manuscript received April 30, 2015. This work is a follow up of theaccepted conference paper as an outstanding paper for the 17th International
Conference on Advanced Communication Technology.
Nguyen Ha Duong is with the Faculty of Information and Technology,
National University of Civil Engineering (corresponding author to provide
phone: +84-98-756-7271; fax: +84-04-3869-1910; e-mail: duongnh@
nuce.edu.vn).
Hoang Dang Hai was with Vietnam Computer Emergency Response
Teams (VNCERT), Vietnam. He is now with the Posts andTelecommunications Institute of Technology, Ministry of Information andCommunication, Vietnam (e-mail: hdhai@mic.gov.vn).

There are various network anomaly detection methods inrecent years including machine learning techniques,
statistical-based methods, principal component analysis(PCA) methods, etc. A review of different approaches foranomaly detection was given in [1-7]. Various methods andtechniques proposed for anomaly detection indicate thedifficulties of network traffic anomaly detection. There areseveral reasons: 1) the techniques of attackers become moresophisticated. There are many types of anomalies withdifferent traffic data features. 2) No existing method is
considered better than the others due to the complexity of theanomalies. Several issues remain unsolved regarding
detection speed, accuracy, confidence, complexity, etc.
Among various anomaly detection approaches, PCA has
been proposed as an effective solution [8-10]. PCA is usefulto reduce the complexity of the dataset while maintaining
significant dataset features. From high level viewpoint,
anomaly detection can be categorized into 3 models [7]:1) Supervised: models both normality and abnormality. The
entire area outside the normal class represents the outlier
class. Supervised detection techniques fail to recognize
behaviour that is not previously modelled, thus it lacks
the ability to classify unknown anomalies.
2) Unsupervised: no prior knowledge of the data is needed.
It processes the data as a static distribution, pinpoints themost remote points, flags them as potential outliers(anomaly).
3) Semi-Supervised: models only normality. It needs
pre-classified data but only learns data marked normal. It
is suitable for static or dynamic data as it only learns one
class which provides the model of normality (baseline).
If a point’s distance exceeds the established thresholdfrom the normal baseline, it is considered abnormal
point.
In this paper, we propose a semi-supervised model using amodified Mahalanobis distance based on PCA (M-PCA) for
network traffic anomaly detection. In order to reduce thenoise of anomalies, we propose to use the K-means clustering
algorithm to group similar data points and to build normal
profile of traffic. This algorithm helps to improve the qualityof the training dataset. The remainder of the paper isorganized as follows: Section 2 presents related previous
works. Section 3 proposes our research model. Section 4

Copyright ⓒ 2015 GiRI (Global IT Research Institute)

ICACT Transactions on Advanced Communications Technology (TACT) Vol. 4, Issue 4, July 2015

proceeds with our experiment and results. Then, concluding
remarks are provided in Section 5.
II. RELATED WORKS
The authors in [3-7] presented a review of anomaly based
intrusion detection systems. A version of apriori algorithm
was used with systolic arrays to build efficient patternmatching similar to a signature based method. In [5], theexistence of irrelevant and redundant features has beenstudied that affect the performance of machine learning partof the detection system. This work showed that a good
selection of the features will result in better classification
performance. The authors in [6] demonstrated that theelimination of the unimportant features and irrelevant
features did not reduce the performance of the detection
systems.
Anomaly detection models based on PCA was proposedby Shyu in [8]. PCA was used together with outlier detectionin assumption that the anomalies appear as outliers to thenormal data. PCA can reduce the dimensionality of thedataset. The authors in [7-10] further improved PCA
algorithm in combination with several algorithm such as
sketch-based and signal-analysis based in a framework. The
authors in [11] showed that an important advantage ofcombining redundant and complementary classifiers is toincrease accuracy and better overall generalization. Several
authors [9-12] also identified important input features inbuilding IDS that are computationally efficient and effective.
This work showed the performance of various feature
selection algorithms including bayesian networks,classification and regression trees.
Several works provided experiments using KDD-CUP'99
dataset [13-16], which is a subset of the Intrusion Detection
Evaluation dataset of DAPRA. Almost works proposed to use
all features from the raw data of this dataset.

645(1) takes into account the covariance matrix, thus, it canmeasure correlation between variables. In this paper, we use
correlation matrix instead of covariance matrix since many
variables in the training dataset were measured on different
scales and ranges. The drawback of this method is thecomputationally demanding when calculating the inverse of
the correlation matrix for feature vectors with a large numberof dimensions. We need a method to calculate this distancemore efficiently for each new connection. As in [8], the sum
square of standardized PCs score is equivalent to theMahalanobis distance of the observation x from the mean of
the sample as follows:pd ( x, μ ) = ∑
i =1

yi2

(2)

λi

where: yi is ith the PC score, λi is the ith eigenvalue, µ is themean vector of the trained data set.
(2) is not the best choice equation for outlier detection.
Some outlier in yi2/ λi can be small and the total sum of all
yi2/λi take little account for that outlier. One advantage of
PCA is the PCs can be sorted in order of decrease eigenvalue
λ1 ≥ λ2 ≥...≥ λp > 0 then using only some PCs to calculatedistance and find outlier. The number of retained PCs is theweight (W) in our work. We need experiment and choose theeffective W for anomaly detection.
Intuitively, we assume that the last PCs (minor PCs)
contain variances which are inconsistent with the data
structure of the original variables as indication of outlier. In
experiment, we found that using only the minor PCs(1-threshold method) with the weight W2 can achieve good
detection result. Any observation has distance greater than an
Training phase
Incoming
Training Data

New data

Clustering(K-mean)III. PROPOSED MODEL
A. PCA and Mahalanobis DistancePrincipal Component Analysis (PCA) is a method for
identifying patterns in data, and expressing the data in such a
way as to highlight their similarities and differences [8]. PCA
produces a set of principal components (PCs), based on
eigenvalue/eigenvector pairs. Eigenvalues/eigenvectors canbe built from covariance or correlation matrix
The covariance or correlation of any pair of PCs is equal tozero. PCA produces a set of independent variables so the total
variance of a sample is the sum of all the variances accounted
for by the PCs.
Outlier detection techniques are used to calculate thedistance of captured live network data to the normal data
projected by PCA procedure. We proposed using
Mahalanobis distance for outlier detection, thus outliers
measured are presumably anomalous network connections.
Any network connection with a distance greater than an
established threshold value is considered an outlier. The
equation [8] of Mahalanobis distance d between observationx and the sample mean µ is:,where: S-1 is the sample covariance matrix.

(1)

Training
DatasetStandardization Data
(Normalization Data)

Detection Phase

PCA

Normal Profile
Eigenvector
Eigenvalue
MeanStandard Deviation
1-threshold / 2-thresholds
Fig. 1. The proposed model for anomaly detection.

established threshold is considered abnormal event or attack.
Other method is using 2 set PCs: major PCs (the mostsignificant PCs) with the weight W1 and minor PCs (leastsignificant PCs) with the weight W2. Each set has separate
distance calculation and upper threshold. Any observation
has distance greater than corresponding threshold is

Copyright ⓒ 2015 GiRI (Global IT Research Institute)

ICACT Transactions on Advanced Communications Technology (TACT) Vol. 4, Issue 4, July 2015

considered outlier. Major PCs often capture normal trend invariance of original variables. The use of both major andminor PCs is called 2-thresholds method. We call both1-threshold and 2-thresholds methods with a common name:
M-PCA method.
B. The Basic Model
Fig. 1 shows our proposed model for anomaly detection
using M-PCA method and a method to reduce the noise intraining data.
The core principle of anomaly detection is calculating the
distance and building normal traffic profile. Distancedescribes how far a point compared to a centre of the known
distribution. Our anomaly detection scheme require 2 phases:
Training phase and detection phase.
C. Training Phase
The purpose of training phase is building normal traffic
profile from normal data pattern. It has following steps:
Step 1: Choose the features X1, X2,..., Xp which affectnormal profile (p is the number of the features used intraining and detection phase). Build the normal profile on
selected features will reduce the number of dimensions
needed to process. PCA is used to analyse the contribution ofeach feature to PCs of normal data.
Step 2: The network traffic needs to be free of attacks at
training time in order to get a snapshot of captured network
traffic for training dataset. In reality, this traffic can containsome small attacks considered as noise. Thus, we need toclean it beforehand. We propose using K-means clustering
algorithm to remove outliers (noise) of the input data. We
assume that the noise is much lesser than the normal data andrecommend accepted noise level approximately at 10% of all
incoming training data.
Step 3: The cleaned training data needs to standardize:zk =xk − xk(3)

sk

where: and sk is the sample mean and sample varianceof the feature Xk in trained data set respectively; z is thestandardized vector of training data set, and z = (z1, z2, ..., zp)’
Step 4: Calculate the correlation matrix then pairs of
eigenvector and eigenvalue.
Step 5: Compute the PC score of each sample in training
data with z and eigenvector:(4)
where: yi is ith the PC score, ei is the ith eigenvector
Step 6: Sort the PCs by eigenvalues in descending order:
λ1 ≥ λ2 ≥ ... ≥ λp > 0
Step 7: Compute distance for each observation of training
dataset with 1-threshold or 2-thresholds method. 1-thresholdmethod use only minor PCs while 2-thresholds method use
both major PCs and minor PCs:yi2
i =1 λiqd (major PCs) = ∑yi2
i = r λiwhere: 0 < q<r< p(5)pd (minor PCs) = ∑

(6)

646

Step 8: Build the empirical cumulative distributionfunction (ECDF) of distances. Choose the thresholds
corresponding to estimated false positive ratio.
D. Remove noise of input data by K-means
K-means clustering help to clean the data when it havemore noise than it should be. The noise can be recognized asattack and normal connection which are outlier with othernormal connection. K-means is a clustering analysis
algorithm that groups objects based on their feature values
into K disjoint clusters. Objects classified into the samecluster have similar feature values. K is a positive integer
number specifying the number of clusters, it has to be given
in advance. Here are the steps of the K-means clustering
algorithm:
Step 1: Define the number of clusters K and initialize K
cluster centroids. This can be done by arbitrarily dividing all
objects into K clusters, computing their centroids, andverifying that all centroids are different from each other. The
centroids can be initialized to various objects chosen
arbitrarily.
Step 2: Iterate over all objects and compute the distances tothe centroids of all clusters. Assign each object to the clusterwith the nearest centroid.
Step 3: Recalculate the centroids of both modified clusters.
Step 4: Repeat step 2 until the centroids do not change any
more.
The distance we used in K-means algorithm is Pearson
correlation distance [15]. Pearson correlation measures thesimilarity in shape between two profiles. The formula for thePearson Correlation distance is:1(7)

where: c = z(u)•z(v)/n is the dot product of the z-scores of thevectors u and v. The z-score of u is constructed by subtractingfrom u its mean and dividing by its standard deviation. Eachcentroid is the component-wise mean of the points in thatcluster, after centering and normalizing those points to zeromean and unit standard deviation.
E. Detection PhaseIn detection phase we use the sub-score of M-PCA method
to detect each new point from the distribution of the trained
data point.
This phase match each new observation with establishednormal profile to detect anomaly. This include following
steps:
Step 1: Standardize data with means and variances fromsample training dataset.
Step 2: Compute PC score of each observation with trained
eigenvectors which map observed data to subspace.
Step 3: Compute distances of each observation as in (5),(6). A new connection will have 1 or 2 distance values
depend on 1-threshold method or 2-thresholds method.
Step 4: Compare thresholds and detection decision: If newconnection’s distance is greater than any of the establishedthreshold, it marks as anomaly connection. Otherwise, it isnormal connection.
1-threshold method:
If d(minor PCs) > d2, classify new connection as abnormal
Else d(minor PCs) ≤ d2 classify new connection as normal
2-thresholds method:

Copyright ⓒ 2015 GiRI (Global IT Research Institute)

ICACT Transactions on Advanced Communications Technology (TACT) Vol. 4, Issue 4, July 2015

Fig. 2. Detection phase of the model.

If d(major PCs) > d1 OR d(minor PCs) > d2, classify newconnection as abnormal
Else d(major PCs) ≤ d1 AND d(minor PCs) ≤ d2 classify
new connection as normal
Where: d1 and d2 are thresholds of major PCs and minor
PCs respectively.
F. Proposal Enhancement of the ModelIn our approach, Anomaly Detection System (ADS) works
as an inherent component with signature-based detection
system (other name is misuse IDS). ADS alone is a system of
suspicious events detection. ADS will collect suspicious
events and these events will be validated by signature
database, administrator (human) (or supervised classification
modules). Misuse IDS can detect intrusion base on packets
while ADS often work with connections or flows which limit
its response time. For this reason, ADS appropriate for therole of informer for network signature-based IDS generally.
In this way, all components of detection system work in circleof spy and detective network manner.
Suspicious
eventsSignature
database

Host
Agent IDS

ADS
Host
Network IDS

Agent IDS

Fig. 3. ADS work as informer for network signature-based IDS

Misuse system rely on signature which have many rules
and need to update regularly. Some IDSes work as agents(sensors) for hosts (computers) which only detect intrusion
related to those hosts. Using all rules with agent-IDSes will
overload the resource available in these hosts. Normally, only
a subset of rules are active for some specific services in each
host. If we use ADS to check anomaly traffic and thenvalidate by a network signature-based IDS, the detection
system will concentrate on more important events from ADS.
That’s why the precision of ADS system is important because
too many false alarm will make ADS becomes unreliable.

647

The number of output alarm from ADS can be large. There
should be a high performance network signature-based IDS
to validate the result from ADS frequently. Validation canhappen at packet, content, connection, flow level. Misuse
detection cannot detect unknown attack types. In theory,
ADS can detect novel attacks and then validate by human orsupervised machine learning. From post-processing, newsignature can be generated.
Next section describe an enhancement model which
integrate our ADS with misuse IDS. The model focus on the
training phase because the quality of normal dataset is very
important. Fig. 4 shows the enhancement of the model.
At first, incoming training data will go directly to training
dataset pool if the administrator can guarantee there are no
attacks. Otherwise, if incoming data contains some noise(attacks), clustering module (K-means or other algorithm)
will be used to filter noise. For filter noise at more depth,
input training data can go through the signature-based
detection module to check and remove known attacks. All
rule in signature database must be used because using only
subset of rules may let some known attack connections passas negative. Connection pass all the signature-checking as
negative will be considered data for clustering. However,clustering rely on selection of some specific features orvariables. In case that feature set is not available, clustering
module need to disable and data pass signature detection canbe added to training dataset before PCA step.
New data after pass of the anomaly detection module willgo through validation checking. This step validates thecorrect of detection result and identify attack types. If thesystem only detect and cannot classify type of abnormal
events, the detection result is almost nonsense. Signature
database is used again to automatic check for attack types
with all positive records from anomaly module. Normal data
is often has good detection rate and outnumber attack data.
For negative records, to avoid overwhelming with large
number of data, signature database only need to checkrandomly chosen records. After validation, these normal
records use as feedback to the normal dataset. This way,system doesn’t waste resource for many unnecessary
negative records and saves resource for identify attacks inpositive records.
If anomaly module has too many false alarm records
which discover by signature module, all records have to bechecked by signature module whether they are positive or
negative. And administrator must check the anomaly module,
compare score with result from signature module to find whatis wrong.
Positive records cannot identified with signature module
can go through manual check. Identify attacks by human ischallenged task and should only implement for novel attacks.
If the system already built pre-classified attack classes inmachine learning database, positive records can be checkedwith this database to classify attack types. In this manner,
system works as supervised model.
Data in training set need to have aging time. New cleaned
training data will replace oldest data. Some old attack
records still in the normal dataset will be gradually removed.
This will help regulate the training data more efficiently.

Copyright ⓒ 2015 GiRI (Global IT Research Institute)

ICACT Transactions on Advanced Communications Technology (TACT) Vol. 4, Issue 4, July 2015

Incoming
Training Data

Signature-based
detection

Clustering(K-mean)Detected
Normal Data
Training Dataset

PCA

Normal data feed-back

K-Profile
Switcher

Normal Profile
Eigenvector
Eigenvalue
MeanStandard Deviation
Thresholds

New incoming data
(New connections)

Compute PC Score

Computedistances

Compare Thresholds

Signature database
Detection Result

Manual validation
Supervisedclassification

Fig. 4. The Enhancement model

Profile of network can change due to some reasons.
Administrators build multiple profiles based on daily usageof network traffic characteristics. A profile switcher can be
programmed to change suitable profile accordingly.
IV. EXPERIMENT AND RESULTS
A. NSL-KDD Dataset
In [8], Shyu’s test results use KDD CUP 99, the old data
set contains 75% of redundant records. KDD CUP’99 is themostly widely used data set for anomaly detection. The
inherent problem of KDD dataset leads to new version of
NSL KDD dataset that are mentioned in [14-16]. In [16], theauthors conducted a statistical analysis on this data set andfound two important issues which highly affect theperformance of evaluated system, and results in very poor
evaluation of anomaly detection approaches. To solve theseissues, they proposed a new data set, NSL-KDD, which
consists of selected records of the complete KDD data set [14]and does not suffer from any of the mentioned shortcomings.
We don’t use the KDDCUP'99 but the NSL-KDD instead,since the advantages of NSL KDD dataset are as follows:
1) No redundant records in the train set, so the classifier
will not produce any biased result.
2) No duplicated records in the test set which have better
reduction rates.
3) The number of selected records from each difficult levelgroup is inversely proportional to the percentage ofrecords in the original KDD data set.
The NSL-KDD data includes 41 features and 5 classes thatare normal and 4 categories of attacks: Denial of Service
Attack (DoS), Probe, Remote to Local Attack (R2L), and648

User to Root Attack (U2R). Attack categories and types in
NSL-KDD data set were given in [14].
B. Performance Measures
We use the following performance measures:
True Positive (TP): the event when an attack connection
correctly detected.
True Negative (TN): the event when a normal connection
correctly detected.
False Positive (FP): the event when a normal connection
detected falsely as attack connection.
False Negative (FN): the event when an attack connection
detected falsely as normal connection.
Precision: The ratio of true positive and the number ofdetected connection as attack.
True Positive Rate (Recall): The ratio of true positive and thenumber of real attack in the sample data set.
False Positive Rate (FPR): The ratio of false positive and thereal number of normal connection in sample data set.
Total Accuracy: The overall successful prediction of both
attack and normal connection.
C. Removing Noise by K-means
We implemented experiments in Matlab R2013a. We use
the KDDTrain+ dataset [14] for both training and detection
phase.
Through experiments we found some features in
NSL-KDD are significantly affects the normal profile (TableI). This will make the processing data faster. The K-meansclustering algorithm was used with input training data toderive a more cleaned data. The goal of clustering is toremove attack points that not follow the baseline of major
normal data. Attacks should be much lesser than normal
traffic, otherwise malicious connection will dominate thenormal traffic. We recommend malicious volume below 10%of the total incoming training data. In daily condition, many
networks have that upper bound limit. Our experiments use
7000 connections for input data, which are chosen randomly
from KDDTrain+ data and include above 900 attack
connections.
TABLE I
6-FEATURES USED IN CLUSTERING
Featuresprotocol_type
src_bytes
count
diff_srv_rate
dst_host_same_srv_rate
dst_host_serror_rate

Meaning
Protocol types (tcp, udp, …)
Number of bytes from source
Number of connections to the same
host as the current connection in thepast two seconds% of connections to different services% of connections to the same service
for destination host% of connections that have SYN
errors for destination hostThe distance used of K-means algorithm is correlation
distance. We use the number of clustering K=2 for K-means.
The step of clustering input training data are:1) Choose target cluster for training set.
2) Run K-means several times until target cluster haveadequate data point. With 7000 records, the training data
should have above 5000 records.

Copyright ⓒ 2015 GiRI (Global IT Research Institute)

ICACT Transactions on Advanced Communications Technology (TACT) Vol. 4, Issue 4, July 2015

Table II depicted the number of attack connection before
and after clustering input data. The result showed thatclustering the input data significantly reduced the noise
which includes attacks in the background traffic.

TABLE V
13-FEATURES USED IN 1-THRESHOLD EXPERIMENT
Features

Test
Test1
Test2
Test3

TABLE II
REDUCED NOISE OF INPUT DATA
Number of
Number of
Attack Reduced
attacks before
attacks after
Ratio (%)
clustering
clustering
928
152
83.60
937
157
83.20
935
164
82.50

interval
protocol_type
serviceflagsource_bytes
destination bytes
count

D. Experiment with 2-thresholds Method
After clustering, the targeted cluster becomes the data fortraining. The system will derive the training parameters
needed. For measuring the test accuracy, we use random
50,000 connections in KDDTrain+ data with the samefeatures in table I. Through experiments we found that it isbetter to keep major PCs W1 = 3 and minor PCs W2=3.
Increase or decrease PCs more or less than 3 will make thetotal accuracy decrease.
The results before clustering input data are shown in table
III. Table IV depicts the same tests after clustering.

srv_countserror_rate
rerror_rate
diff_srv_rate
dst_host_countdst_host_srv_count

TABLE IIIRESULT BEFORE CLUSTERING INPUT DATA
Test
Test1
Test2
Test3

Precision
(%)
86.6
87
83.6

Recall
(%)
22.7
22
22.2

FPR
(%)
3
2.83
3.7

Total
Accuracy (%)
62.6
62.4
62

Recall rate is sensitive with outlier in the data. Result in
table III showed that a small of approximately 900 attack
records in total 7000 training records still make the recall
result very low accuracy. That make the total accuracy only
achieve above 60%. Table IV shows the effective ofremoving noise with K-means in detection result.
TABLE IVRESULT AFTER CLUSTERING INPUT DATA
Test
Test1
Test2
Test3

Precision
(%)
92
92
92

Recall
(%)
84.7
81.2
82.1

FPR
(%)
6.3
6.1
5.6

Total
Accuracy (%)
89.5
88
88.7

E. Experiment with 1-threshold Method
In the next experiment, we use 1-threshold method for
detection using 13 features in Table V. We choose thesefeatures by experience.
We use some small sets of training data which select frompure normal connections, the first and second set have 1000
connections, the third and fourth set has 500 connections. The
detection test with random 60000 connections. At first, we
use all PCs (W= 13) for training phase and detection phase.
Then we only use minor PCs (W2 = 3, W1=0). The detection
result in Table VI and Table VII showed that 1-thresholdmethod has good accuracy even with small training dataset.
Using only minor PCs for 1-threshold give better recall rate
and overall accuracy. Other advantage is the reduction
dimension from 13 to 3 PCs.

649

Meaning
Interval of the connection
Protocol types (tcp, udp, …)
Destination service (e.g. telnet, ftp)
Status flag of the connection
Bytes sent from source todestination
Bytes sent from destination tosourceNumber of connections to the same
host as the current connection in thepast two seconds
Number of connections to the same
service as the current connection in
the past two seconds% of connections that have
Synchronization errors% of connections that have
Rejection errors% of connections to different
services
Count of connections having thesame destination hostCount of connections having thesame destination host and using thesame service

TABLE VI
1-THRESHOLD METHOD USING ALL PCS
Test
Test1
Test2
Test3
Test4

Precision
(%)
95.2
94.7
94
93.3

Recall
(%)
80
79.6
80.9
81

FPR
(%)
3.5
3.9
4.5
5.11

Total
Accuracy (%)
88.7
88.3
88.6
88.4

TABLE VII
1-THRESHOLD METHOD USING 3 MINOR PCS
Test
Test1
Test2
Test3
Test4

Precision
(%)
94.2
93.3
92.8
92.6

Recall
(%)
88
86.4
87.1
88.7

FPR
(%)
4.6
5.32
5.8
6.1

Total
Accuracy (%)
92
91
91
91.5

Next we test the detection (Table VIII) with training data
after remove noise by K-means. The detection result is stillgood with 1-threshold method. We believe that clustering
step remove some normal data with higher distance that makethe false positive ratio above 10%.
TABLE VIII
1-THRESHOLD RESULT AFTER CLUSTERING
Total
Precision
RecallFPR
Test
Accuracy
(%)
(%)
(%)
(%)
Test1
86.2
84.7
11.6
86.7
Test2
86
83.8
11.7
86.2
Test3
86
81
11.2
85.2

In this case, using PCs with higher variance will take morenormal data of higher distance. Table IX depicts the result
when using all PCs to compute the distance (W=13). With
more normal data detected, true negative ratio (TNR) whichis the ratio between normal data and total normal data
increase above 90% (and decrease FPR= 1−TNR).

Copyright ⓒ 2015 GiRI (Global IT Research Institute)

ICACT Transactions on Advanced Communications Technology (TACT) Vol. 4, Issue 4, July 2015

[5]
TABLE IX
USING ALL PCS TO TAKE MORE NORMAL DATA
Test
Test1
Test2
Test3

Precision
(%)
91.8
91.9
91.2

Recall
(%)
83.4
83.3
83.5

FPR
(%)
6.5
6.4
7.1

Total
Accuracy (%)
88.7
88.7
88.5

We don’t need to use all PCs for this purpose. Table X
depicts the result when using 7 major PCs (W1=7, W2=0). As
we expected, major PCs have more variance which detectnormal data of high distance better. The advantage here issmaller number of necessary dimensions.

[6]

[7]

[8]

[9]

TABLE XUSING 7 MAJOR PCS TO TAKE MORE NORMAL DATA
Test
Test1
Test2
Test3

Precision
(%)
91.7
91.3
90.8

Recall
(%)
83.7
83.8
84

FPR
(%)
6.6
7.1
7.5

Total
Accuracy (%)
88.8
88.6
88.5

[10]
[11]
[12]
[13]

Because noise filter step by K-means often remove highdistance data especially in minor PCs, K-means should only
use with new incoming training data. Normal data feedback
after validation will go directly to normal data pool (Fig. 4)
awaiting for principal component analysis next time. With
the feedback-regulation mechanism of normal data, morehigh distance data will add to the training dataset andimprove the quality of normal profile. When a new profile iscreated from better quality normal dataset, detection system
can use 1-threshold with small minor PCs. 1-thresholdmethod can reduce the computation overhead and delay whenanalysis large amount of data.
V. CONCLUSION
In this work, we proposed M-PCA method for network
traffic anomaly detection. Our approach concentrated onbuilding normal traffic profile of the anomaly detection
model. Through experiments we also showed that somefeatures of NSL-KDD dataset are efficient with the normal
profile. We propose a K-means clustering algorithm toreduce noise with input training data. The experiments
showed that even with small training dataset (less than 1000
points), our approach has good performance including
detection accuracy. We also proposed a new model integrates
anomaly detection system with signature-based detection
system along with some enhancements of building quality
normal profile. In our future plan, we will develop andexperiment the proposed model with an open source IDS inreal network.

[14]
[15]
[16]

650

S. Myers, J. Musacchio, N. Bao, Intrusion Detection Systems: A
Feature and Capability Analysis. Tech.Report UCSC-SOE-10-12.
Jack Baskin School of Engineering, 2010.
C. Kacha, K. A. Shevade, Comparison of Different Intrusion
Detection and Prevention Systems, Intl. Journal of Emerging
Technology and Advanced Engineering, Vol.2, Iss.12, Dec.2012,
pp.243-245.
M.H.Bhuyan, D.K.Bhattacharyya, J.K.Kalita, Survey on Incremental
Approaches for Network Anomaly Detection, Journal ofCommunication Nteworks and Information Security (IJCNIS), Vol.3,
No.3, pp. 226-239, Dec.2011.
M.L. Shyu, S.C.Chen, K.Sarinnapakorn, L.W.Chang, A Novel
Anomaly Detection Scheme Based on Principle Component Classifier,Proc. of the IEEE foundation and New Directions of Data Mining
Workshop in 3rd IEEE Intl. Conference on Data Mining (ICDM03),
pp. 172-179, 2003.
D. Brauckhoff, K. Salamatian, and M. May: Applying PCA for
Traffic Anomaly Detection: Problems and Solutions, IEEE
INFOCOM, pp.2866-2870, April, 2009.
H.Huang, H.Al-Azzawi, H.Brani, Network Traffic Anomaly
Detection, ArXiv:1402.0856v1, 2014.
C.A.P.Boyce, A.N.Zincir-Heywood, A Comparison of Four Intrusion
Detection Systems for Secure E-Business, 2003.
V.J.Hodge, J.Austin, A survey of outlier detection methodologies,
2004.
The KDD
Archive,
KDD99
cup
dataset,1999,
http://kdd.ics.uci.edu /databases/kddcup99/kddcup99.html
NSL-KDD data set for network-based intrusion detection systems,
http://nsl.cs.unb.ca/KDD/NSLKDD.html, March 2009.
M.K. Siddiqui, S.Naahid, Analysis of KDD CUP 99 Dataset using
Clustering based Data Mining, 2013.
M. Tavallaee, E. Bagheri, W. Lu, A.A. Ghorbani, A Detailed
Analysis of the KDD CUP 99 Data Set, In the Proc. of the IEEE
Symposium on Computational Intelligence in Security and Defense
Applications (CISDA 2009), pp. 1-6, 2009.

Nguyen Ha Duong received the B.E. degree inelectronic and telecommunication engineering from the
Ha Noi University of Technology, Vietnam, in 2001, andthe Msc. degree in electronic and telecommunicationengineering from the Ha Noi University of Technology,
Vietnam, in 2003. In 2001, he joined the Department of
Network and System Engineering, IT Faculty, National
University of Civil Engineering as a lecturer. His current
research interests include network security, network protocol, routing, data
mining and machine learning.
Hoang Dang Hai received the Diplom-Ing. degree inTechnical Cybernetics from the Technical University
Ilmenau (Germany) in 1984, Dr.-Ing. degree inTelematics and Dr.-Ing.habil. degree from the Technical
University Ilmenau (Germany) in 1999 and 2003,
respectively. He is currently an Associate Professor at the
Post and Telecommunication Institute of Technology(PTIT), Ministry of Information and Communications ofVietnam. His current research interests include information security,
wireless sensor networks, network security and network traffic management.

REFERENCES
[1]
[2]
[3]
[4]

S. Axelsson, Intrusion Detection Systems: A Survey and Taxonomy,
Chalmers University of Technology, Goteborg Sweden, 2000.
http://www.cs.chalmers.se/~sax/ pub/
S.S. Rajan, V.K. Cherukur, An Overview of Intrusion Detection
Systems, 2010. http://www.idt.mdh.se/
V. Jyothana, V. V. R. Prasad, K. M. Prasad, A Review of Anomaly
based Intrusion Detection Systems, Interl. Journal of Computer
Applications, Vol. 28–No.7, August 2011, pp. 28-34.
A. Jain, B.Verma, J. L. Rana, Anomaly Intrusion Detection
Techniques: A Brief Review, Interl. Journal of Scientific &Engineering Research, Vol. 5, Iss. 7, July 2014, pp.1372-1383.

Copyright ⓒ 2015 GiRI (Global IT Research Institute)

ICACT Transactions on Advanced Communications Technology (TACT) Vol. 4, Issue 4, July 2015

651

Ontological-semantic text analysis and thequestion answering system using data fromontology
Kuznetsov V. A.*, Mochalov V. A.**, Mochalova A. V.*** Petrozavodsk State University, Lenina str. 33, 185910 Petrozavodsk, Russia** Institute of Cosmophysical Research and Radio Wave Propagation FEB RAS, Mirnaia str. 7, 684034
Paratunka, Kamchatka region, Russia.
kuznetcv@mail.ru, sensorlife@mail.ru, stark345@gmail.com

Abstract—Today, with an avalanching increase in
information, the task of developing the systems that allow user
to quickly search desired information in large text volumes is
becoming more and more urgent. An example of such system isthe question answering one. In the work we describe anarchitecture of such system which work is based on utilizing
data from an ontology. We propose an algorithm for automatic
update of the ontology basing on use of an expert system andontological rules for logical inference. We also describe an
ontology with the structure based on object-oriented model anddescribe the functions that are used to update the ontology andextract data from it. We describe the way to update the ontology
and to modify the stored data using the rules stored in the
ontology. For writing ontological-semantic rules we use theDrools expert system that utilizes the PHREK algorithm for fast
pattern matching.
We analyze the issues of using Apache Spark system for
distributed implementation of the algorithm.
Keyword—Question Answering System, ontology, expert
systems, semantic analysis.

I. INTRODUCTIOND

DEVELOPMENT of question answering systems is
nowadays becoming more and more urgent problem.
This is connected with an avalanche growth of information
volume that modern people need to operate.
Basing on analysis of operation algorithms of many
Question Answering Systems (QASs), including Lasso [1],QA-LaSIE [2], TEQUESTA [3] etc., one can conclude that
all of them do, in the whole, comply a certain generalarchitecture. The high-level representation of the latter is———————————————————————
Manuscript received July 9, 2015. The work was implemented withfinancial support from the Russian Foundation for the Humanities as part ofresearch project No.15-04-12029 ―Software development of an electronic
resource with an online version of a Russian-language question answeringsystem‖.
Kuznetsov V. A. is with the Petrozavodsk State University, Russia(e-mail: kuznetcv@mail.ru) .
Mochalov V. A., is with the Institute of Cosmophysical Research andRadio Wave Propagation FEB RAS, Russia (e-mail: sensorlife@mail.ru).
Mochalova A. V. is with the Institute of Cosmophysical Research andRadio Wave Propagation FEB RAS, Russia (corresponding author toprovide phone: 8-916-820-15-25; fax: 8-(41531)-33718;
e-mail:stark345@gmail.com).

given at Fig. 1. The system receives a question on the natural
language as an input. After that, the text of the question is
automatically processed. The main stages of this process are
preliminary text processing, tokenization, morphological,
syntactic and semantic analysis, extraction of named entities
and definition of the logical links between the parts of thesentences. Some of these stages may be dropped out or
simplified in different QASs implementations anddescriptions. Some are, on the contrary, basical for the system
operation in a whole: an example is semantic analysis in thework of M. V. Mozgovoy [4]. Several more procedures thatcan be executed on the stage of automated question text
processing are definition of the question type, definition of the
expected answer type etc. Basing on results of the automatedquestion text processing, a query is formed to be passed on toa search engine. The search engine, in its turn, selects apredefined number (N) of documents most relevant to a queryfrom the collection. The texts of each of selected documents
as well as the question text are automatically processed. Here,the machine algorithms of the question text processing may
differ from the algorithms of the selected documents
processing. Further, by means of internal algorithms of the
QAS, the specific text fragments are selected from the
documents returned by the search engine. The selected text
fragments are presented by the system as an answer. The mostadvanced QASs can use data from factbases (FB), databases(DB) and ontologies on the stage of text fragments selection.
The information from such data storages can complement theanswer/answers of the system.
In the work we propose an operation algorithm of an
ontological-semantic analyzer (a semantic analyzer that uses
ontology) of text. We describe how to use results of its workin a developed question answering system. During operationof the ontological-semantic analyzer, the ontology is beingchanged and its data is used to define semantic links between
parts of the sentences. As a result of these changes, the data inthe ontology may be learned, deleted or updated. In such a
way the ontological-semantic analysis solves one more task
apart from being used in a question answering system: it
performs automated ontology learning.
Further we give a brief overview of the methods ofontologies learning.
In work [5] the authors define three main methods of

Copyright ⓒ 2015 GiRI (Global IT Research Institute)

ICACT Transactions on Advanced Communications Technology (TACT) Vol. 4, Issue 4, July 2015

ontologies learning:

Fig. 1. Workflow architecture in a question answering system

1) «manual» input;2) automatic or automated input using traditional
lexicographicalinformation(encyclopedic,
word-defining and other dictionaries and databases);3) automatic or automated input based on analysis of
distributive characteristics of the lexis in text corpus.
Ontology learning by means of manual input is a very laborconsuming procedure that requires participation of highly
qualified specialists. For this reason, development of
automatic (or at least partly automated) methods of ontology
learning is today a very urgent task.
One of the most frequent methods of automatic ontology
learning is constructed on analysis of dictionary definitions.
In such methods, the ontological constructions (entities andthe type of their relation) discovered by use of pattern searchin dictionary definitions are added to the ontology. For
instance, if one needs to collect information about all possiblemeans of transport, the dictionary search is performed using
all patterns of the kind ―X is a vehicle that...‖, ―X is a means oftransport used for...‖, ―X is a vehicle type equipped for...‖ etc.
Such search patterns may be developed manually or
automatically using self-learning programs [6]. The idea ofsuch a way of automated ontology learning is described inworks [7], [8], [9], [10].
The authors of the work [11] compare the methods ofautomated ontologies learning, consider their own experienceand confirm that at the present day the most promisingtechnology from the perspective of obtaining practical results
is the one that uses traditional lexicographical information(encyclopedic and word-defining dictionaries).
The work [12] describes a method of automaticconstruction of domain-specific ontology basing on analysis
of linguistical characteristics of text corpus.
A more detailed survey of the existing methods ofautomated ontologies learning is provided in work [13].

652

II. ONTOLOGY STRUCTURE AND FUNCTIONS FOR WORKINGWITH THE ONTOLOGY
An ontology (in a formulation by Gruber who was one of
the first to use this notion in the area of information
technology) is a formal specification of conceptualization[14]. By conceptualization, we understand a description of aset of notions (concepts) of the subject domain and links(relations) between them. As understood today, ontology in
informatics is an hierarchical data structure including all
relevant object classes, their connections and rules(restrictions) defined in this domain and necessary for solving
the problems assigned for an information system.
In this work we propose to use an object-oriented ontology
model consisting of classes (certain abstract images sharing in
the common sense a certain set of properties) and objects(part of the real world having some certain properties of theclass it belongs to; the same object may belong to different
classes and the same class may have different objects).
Classes and objects can be interconnected by various
relations that define certain dependencies between them.
Here, a sequence of arguments, for which the relation is being
defined, does matter. Examples of such structured data
storages are DBpedia [15], Freebase [16] and Wikidata [17],Wikipedia [18], Wiktionary [19]. For instance, in work [20]the authors propose an approach to the automatedconstruction of a general-purpose lexical ontology based on
the Wiktionary data. When adding new information (classes,
objects or relations between them) to the ontology, one needs
to store the timestamp of the changes being made and thesource basing on which the changes are made. It should also
be possible to make a recovery of the ontology modifications(for example, when an error has been detected). To make thispossible, the whole history of ontology modification should
be stored. The initial ontology structure can be formed using
ideographic dictionaries.
To be specific, we describe high-level functions forontology learning with the data and for data extraction fromthe ontology:
1) CreateClass (idClass, nameClass) – adds a class withunique identifier idClass and the name nameClass into
the ontology;
2) CreateObject (idObject, idClass, nameObject) – adds
an object with unique identifier idObject and the name
nameObject of the class with unique identifier idClass
into the ontology;
3) CreateRelation (idRelation, relationName) – creates a
relation with unique identifier idRelation and the namerelationName;
4) CreateRelation (id1, id_2, idRelation, h) – adds a
relation with unique identifier idRelation, linking twoclasses or objects (or an object and a class) with unique
identifiers id_1 and id_2 correspondingly, where h is afrequency (or weight) of the relation, into the ontology;5) Inheritance (id1, id2) – adds information that the classwith unique identifier id2 is inherited from the class withunique identifier id1 into the ontology;6) Inheritance_with_denial (id1, id2, {[idRelation1],[idRelation2], [idRelation3], …}) – adds informationthat the class with unique identifier id2 is inherited fromthe class with unique identifier id1 excepting relations
with unique identifiers from the array {[idRelation1],[idRelation2], [idRelation3], …} into the ontology;

Copyright ⓒ 2015 GiRI (Global IT Research Institute)

ICACT Transactions on Advanced Communications Technology (TACT) Vol. 4, Issue 4, July 20157) PartialInheritance
(id1,
id2,
{[idRelation1],[idRelation2], [idRelation3], …}) – adds informationthat the class with unique identifier id2 is inherited fromthe class with unique identifier id1, but only the relations
with unique identifiers from the array {[idRelation1],[idRelation2], [idRelation3], …} are inherited, into the
ontology;8) ReturnClassName (idClass) – returns the name of theclass with unique identifier idClass;
9) ReturnObjectName (idObject) – returns the name ofthe object with unique identifier idObject;
10) What_Is (text, position) – returns value 1 if the sense
entity from the analyzed text text, having its position inthis text is explicitly defined by the data stored in position
variable, is an ontology class; 2 if this entity is an
ontology object; 3 if there has been detected no
information about this sense entity in the ontology;11) ReturnAllRelations (idClassOrIdObject) — for aclass or an object with unique identifier
idClassOrIdObject, returns a set consisting of thefollowing values groups:a) idRelation – unique identifier of the relation linking
a certain class or an object to the class with unique
identifier idClass;b) idClassRel – unique identifier of a class or an object
to which the class with unique identifier idClass islinked by the relation with unique identifier
idRelation;c) relationName – relation name;d) val – relation value;e) h — relation frequency (or weight);
12) ReturnRelations (idClassOrObject, RelationName) –is similar to the function ReturnAllRelations(idClassOrIdObject) in which the names of relations are
restricted to RelationName only;
13) ReturnAllObjects (idClass) — returns a set of unique
identifiers of objects from the class with unique identifier
idClass;14) ReturnParentClasses (idClassOrObject) — returns
unique identifiers of the classes that are parent to a classor an object with unique identifier idClassOrObject;
15) ReturnRelationValue(idClassOrObject1,
idClassOrObject2, relationId) – returns the value ofthe relation with unique identifier relationId, linking two
objects or ontology classes with unique identifiers
idClassOrObject1 and idClassOrObject2;
16) ReturnAllAncestorClasses (idClassOrObject) –returns unique identifiers of all classes that are ancestors
to a class or an object with unique identifier
idClassOrObject;17) ReturnAllSuccessorClasses (idClass) – returns unique
identifiers of all classes that are successors of any level
for a class with unique identifier idClass;18) ReturnAllSuccessorObjects (idClass) – returns unique
identifiers of all objects of the classes that are successorsof any level for the class with unique identifier idClassand for this class itself.
19) insertOrUpdateRelation(RelationName,
idClassOrObject1, idClassOrObject 2, h) – if the
ontology does already contain the relation named
RelationName, connecting the class or the ontology
object with unique identifier idClassOrObject1 to the653

class or the ontology object with unique identifier
idClassOrObject2, then increase the weight of thisrelation by h. If the ontology does not contain such
relation, then add it and assign the weight h.
For writing ontological-semantic rules we propose to use
the following notations:
1) Unit – undefined token, class, object or relation from theontology;2) UnitCO – class or object from the ontology;3) Class – class from the ontology;4) Object – object from the ontology:5) Rel – relation linking two classes, two objects or a classand an object from the ontology;6) UDT – undefined token, that is a token (indivisible sense
entity) the information about which is not present in the
ontology yet. That means that this token is neither an ontology

Fig. 2. Hierarchy of the notations used for describing ontological-semantic
rules.

class nor an object.
Hierarchical relationship between these notations is given
at Fig. 2.
III. ARCHITECTURE OF THE QUESTION ANSWERING SYSTEMINTEGRATED WITH AN ONTOLOGY
The question answering system is supposed to operate in
two modes: ontology learning mode (when system input are
valid texts and the general ontology is being modified) anduser answering mode. By ―valid‖ here we understand the text
containing the data the verity of which is unquestioned. In thescheme presented at Fig. 3 and depicting an architecture of thequestion answering system, everything concerning only theuser answering mode is marked with a dash line.
Ontology learning mode
When a question answering system operates in ontology
learning mode, it receives a valid text T as its input. The text
enters the module of initial text processing where it ispreliminarily processed: text formatting symbols that do notcarry any role during text analysis are removed,
orthographical and syntactic mistakes are corrected, extra
symbols of whitespaces and line breaks are removed and soon. The tokenization stage follows, including breaking text
into paragraphs, sentences and words. For each marked word
its morphological properties are being defined with use ofcorresponding morphological dictionaries. The next stage isseparating non-divisible sense entities which can be separate
words or groups of words that are united by some common
meaning. Some examples of named entities consisting ofseveral words are some named entities (New York, Santa
Claus, Mr. Smith etc.) or composite parts of speech (an idiom―good and proper‖, a linking word ―such as‖, a numeral
adjective ―forty five‖ etc.). The final stage of the initialprocessing is search for logical links in the text.
Copyright ⓒ 2015 GiRI (Global IT Research Institute)

ICACT Transactions on Advanced Communications Technology (TACT) Vol. 4, Issue 4, July 2015

Fig. 3. Architecture of the question answering system.

The text T that has been initially processed, together withall data received on this stage, is denoted as F(T) on thescheme and passed onto input of ontological-semantic
analyzer.
The work of ontological-semantic analyzer begins withassociation of non-divisible sense entities separated in thevalid text T with classes and objects from the ontology. At thisstage, a task of lexical ambiguity resolution is being solved forthe purpose of defining which one of the set of existing classes
and/or objects with the same names does the considered sense
entity belong to.
After the valid text has been initially processed, theontology modification takes place. For this, the ontology
itself, the expert system (consisting of the Knowledge basecontaining rules, the Working memory containing facts, theBlock of logical derivation containing the operational list of
the rules and the Component of knowledge acquisition) andthe object-oriented code are used. As a result of certain rules
stored in the expert system (ES), the ontology may experience
addition or removal of certain classes or objects, as well as
addition, removal or modification of the relations between

654

them.
User answering mode
During operation of the question answering system, thesystem receives as its input the question Q asked by a user andthe text T selected by the user for searching the answer in.
The user provides the question sentence Q in natural
language. The text T to search the answer in and the question
Q are passed onto input of the module of initial text
processing where they get through the same stages ofautomated text processing that were described for the
ontology learning mode. The working results of this module(F(Q) for the question sentence and F(T) for the text in which
an answer is searched), on the analogy with the ontology
learning mode, are passed onto input of the module of the
ontological-semantic analyzer.
In the ontological-semantic analyzer, the association of
non-divisible sense entities that have been separated in Q and
T with classes and objects of the ontology takes place.
Next, with use of the Ontology and the Expert system, theseparate ontology Ont(T) is created by means of theobject-oriented code after the text that has been provided by
the user and experienced the initial processing. All classes
and objects of the ontology Ont(T) refer to the classes andobjects from the main ontology but do not modify the latter.
No modification of the common ontology is performed when
the system operates in user answering mode.
The next stage of work of the ontological-semantic
analyzer in the considered mode is formation of a search
query to the ontology basing on existing information about Q
and T. The search query is formed using functions describing
work with the ontology (see p.1.) and the Unit-terminology,
the hierarchical dependency of which is presented in Fig. 2.
When developing the query to the ontology, one should
consider not only the user-defined question Q itself, but also
the text T in which an answer is to be found. It is related to thefact that the user-provided text can help in solving the tasks oflexical ambiguity that can arise when forming the query. For
example, if the question contains the word ―bank‖ which may
mean either ―coast‖ or ―credit institution‖, then theuser-provided text T may help to solve the lexical ambiguity
that arose in the question. It is more likely that the word―bank‖ is used in the meaning ―coast‖ if the text T contains thewords which are such classes or objects in the ontology thatare close to the class or the object ―bank‖ in the meaning―coast‖ of a river, a sea etc.
In case the query to Ont(T) has been successfully executedand returned data from the ontology, these data are provided
to the user as an answer. In case an answer has not been foundin Ont(T) or it has not satisfied the user, the search iscontinued in the general ontology. Using the explanatorycomponent of the expert system, the user can learn how thesystem has obtained the solution.
IV. ONTOLOGY LEARNING MODE
This section will describe the working algorithm of the
ontological-semantic analyzer operating as a part of thequestion answering system which is functioning in the
ontology learning mode.
A semantic dependency is a certain universal relation thata native speaker beholds in the language. This relation is
Copyright ⓒ 2015 GiRI (Global IT Research Institute)

ICACT Transactions on Advanced Communications Technology (TACT) Vol. 4, Issue 4, July 2015

binary, that is, it holds from one semantic node to another [21].
It is convenient to regard indivisible sense entities of thelanguage as semantic nodes. They can be represented, forexample, by the named entitites. We say that two different

semantic nodes  and  from the same sentence are
related by a semantic dependency named R (denote

R( ,  ) ) if there is a certain universal binary relation
between  and  .
For concrete semantic nodes  and  and thedependency R , the direction is selected in such a way thatthe formula R( ,  ) would be equivalent to the statementthat ―  is R for  ―.
Queue with priority
In a classical definition a queue with priority is defined as an
abstract data type allowing to store pairs (key, value) andsupporting the following operations [22]:1) init — initialize a new empty queue;2) insertToPriorityQueue — insert a new element into thequeue;
3) remove — remove and return the highest-priority
element of the queue.
In this work we will use the ―queue with priority‖ forremoving facts from the working memory of the expert
system. The fact of the expert system consists of thefollowing: UnitCO, a link to the previous fact (left) and to thenext fact (right), morphological characteristics andcoordinates in text (the number of the sequence and theposition of UnitCO in the sentence). In this context we use
two values to define the element priority in the queue:1) priority of the group that the considered semantic relation
belongs to;2) position of UnitCO in the analyzed sentence.
In this work we will consider the queue Q with priority, theelements of which will consist of the following triples:
1) a – the name of UnitCO;2) sp – the priority of a semantic group which the semantic
relation belongs to, one of the arguments being UnitCO;
3) pos – the position of UnitCO in the analyzed sentence.
We will say that the element (a, sp, pos) of the described
queue Q has the highest priority if sp value of this element isminimal and pos value is maximal.
Consequently, theelements of the queue with priority are sorted in ascendingorder of priorities of semantic dependencies groups. If thequeue contains several elements with the same priority valuesof semantic groups, then such elements are sorted indescending order by the last UnitCO related to the consideredelement in the analyzed sentence.
Below we describe the rules to add the element (a', sp',pos') into the queue Q with priority for the case when Q
contains the element (a, sp, pos) such that (a = a') and (pos =pos'):
1) (sp'> sp), hence Q = Q\(a, sp, pos)U(a', sp', pos');2) (sp'<= sp), hence Q is not modified.
Basical ontological-semantic patterns
Let us call an ontological-semantic pattern the rule bywhich the expert system finds semantic dependencies between
classes and objects in the analyzed text (where indivisible
sense entities are marked and each of them is refered to acertain class or an object of the ontology). A basical655

ontological-semantic pattern which is a rule of the expert
system consists of the left and the right sides. The left side of
the pattern describes the conditions upon which the actions
described in the right side are executed. So, for example, theleft side of the pattern always describes a biconnected facts
list, and can also describe boolean functions having the facts
from that biconnected list as their arguments.
The right side of the pattern contains the list of actions eachof which can: modify any fact of the ES (by modifying therelation in a corresponding UnitCO); queue for removal a factof the ES having a certain priority of removal; other actions.
Below we provide an example of a basicalontological-semantic pattern that describes how the ontology
is modified if in the analyzed text there has been discovered afact X containing UnitCO being a class of the ontology(defined as a Property in the ontology and containing among
the morphological characteristics the information that it is the
singlular number), and what follows next is some fact Y
containing UnitCO being a class or an object of the ontology,
and it is known that in the text it is preceded by the fact X, andamong the morphological characteristics of Y there isinformation that it is the singlular number of a noun.
when
{
$X
:
Fact
(unitCO.type==“Class”,
unitCO.hsOntAttrs
contains"Property",
hsMorphAttrs contains "singular")$Y : Fact (unitCO.type == "Object" ||unitCO.type == "Class" ,prev == $X,
hsMorphAttrs contains "singular", hsMorphAttrs
contains "noun")}
then{
Logic.insertOrUpdateRelation("Property",$Y.unitCO.id, $X.unitCO.id, 1);
Logic.insertOrUpdateRelation("Property for",$X.unitCO.id, $Y.unitCO.id, 1);
Logic.insertToPriorityQueue ($X, sp);}

After all basical ontological-semantic patterns (with true
left sides) have been found on the current facts of the expert
system, one fact with the highest priority is removed from thequeue for removal and from the working memory of theexpert system. When removing a fact from the working
memory of the expert system, one should update the left andthe right facts for the fact being removed (as shown in Fig. 4).
The Table 1 shows an example of using
theontological-semantic analyzer and how the priority queue (Q)is gradually changing. The analyzed text (AT) is "Yesterday,
the yachting sport school honors left for a camp". Algorithmof ontology learning using the basical ontological-semantic
patterns
Used notations:
1) P – the analyzed sentence;2) pi – i-th indivisible sense entity of the analyzed sentenceP;3) S – the set of all rules of the ES including the basicalontological-semantic patterns;
4) Si – i-th rule of S;
5) Q – the queue with priorities.

Copyright ⓒ 2015 GiRI (Global IT Research Institute)

ICACT Transactions on Advanced Communications Technology (TACT) Vol. 4, Issue 4, July 2015

TABLE IAN EXAMPLE OF USING THE ONTOLOGICAL-SEMANTIC ANALYZER

656

implement the proposed algorithm on the Apache Sparkplatform.
Algorithm:
Step 1. Put in the input of the ontological-semantic analyzer
the preprocessed sentence P (see the architecture of thequestion answering system) in natural language andconsisting of indivisible sense entities pi: P = (p1, p2, p3, …,
pN).
Step 2. Match the indivisible sense entities p1, p2, p3, …, pN
with the ontology data: associate with each pi some UnitCOi— a class or an object from the ontology. Form the facts ofthe ES PFacts, presented using a double-linked list where thefirst and the last facts (Fact0 and FactN+1) are empty, and therest are formed according to the fact definition: that is, Fact icontains UnitCOi, the morphological information about
UnitCOi, the links to the left and the right facts, the fact
position in the text.
Step 3. Add to the knowledge base of the expert system (S)all ontological-semantic patterns and other rules.
Step 4. Initialize the variable i which will store the sequential
number of the considered rule as zero: i := 0.
Step 5. Using fast patterns matching algorithm, form thearray G consisting of pairs (rule, fact list) in which we will put
the rules from S and the corresponding facts from PFacts withtrue left part.
Step 6. Sort the elements of the array G in the order offulfilling the rules by the block of logical derivation.
Step 7. Check whether the value of the loop variable i has
exceeded the limits of array G (i < |G|), which would meanthat all elements of G has been looked through. If i < |G|, go to
Step 8. Else go to Step 10.
Step 8. According to the right side of the rule Gi the following
actions may be performed: update the facts of the ES; add
facts to the queue for removal together with their priorities;
etc.
Step 9. Increase the value of the loop variable i by 1: i :=i + 1. Go to Step 7.
Step 10. Check whether the queue for removal Q is empty: if
the queue is empty (isEmpty(Q) is true), then finish thealgorithm execution.
Step 11. Set the variable b to be equal to the fact being
removed from Q and having the highest priority, that is:element b := remove(Q).
Step 12. Update the links of the fact a (a=b.left) and the fact c(c=b.right) in the following way: a.right=c; c.left=a. In theworking memory of the expert system: update the facts a andc; remove the fact b. Go to Step 4.

Aiming to check the usage possibilities of Apache Sparkplatform, we have implemented the programs for the latter.
The first program computed in a distributed manner the
inverted text index using the Lucene library on a 10-nodes
cluster. After that, a second program executed in a distributedmanner a large number of search queries using Lucene
language to the distributed inverted index. The working
results of the programs allowed to establish the following: a) a
significant profit in working time of distributed operations ofindexing and search in comparison with performing the same
operations on a single computer; b) reasonability toTheproposedworkingalgorithm
oftheontological-semantic analyzer can be implemented in
distributed manner. For instance, the analyzed texts can be
stored in a distributed file system (such as HDFS). The
following tasks can be distributed among the nodes of acomputational cluster: the ontology construction and learningfor each analyzed text; indexing of ontological-semantic
graphs; search for the answers to the questions; etc. A
promising platform for distributed implementation of the
proposed algorithm on a cluster may be the system Apache
Spark. This platform has already been integrated in the
Hadoop ecosystem (HDFS, Hadoop YARN) and is a part ofsuch popular integration projects as Cloudera, HortonWorks,
MapR etc.
Copyright ⓒ 2015 GiRI (Global IT Research Institute)

ICACT Transactions on Advanced Communications Technology (TACT) Vol. 4, Issue 4, July 2015

Aiming to check the usage possibilities of Apache Sparkplatform, we have implemented the programs for the latter.
The first program computed in a distributed manner the
inverted text index using the Lucene library on a 10-nodes
cluster. After that, a second program executed in a distributedmanner a large number of search queries using Lucene
language to the distributed inverted index. The working

Fig. 4. Logical diagram of the algorithm of automated ontology learning.

results of the programs allowed to establish the following: a) a
significant profit in working time of distributed operations ofindexing and search in comparison with performing the same
operations on a single computer; b) reasonability to
implement the proposed algorithm on the Apache Sparkplatform.
V. CONCLUSION
The work is devoted to development of architecture andprototype of a question answering system that uses data fromthe ontology. The structure and the functions to work with the
ontology are described in this paper. A working algorithm ofanontological-semantic
analyzerusing
basicalontological-semantic
patterns
withremovalisprogrammatically realized in Java language. The program has
been registered in the Rospatent [23]. The Drools system, thatuses a fast pattern matching algorithm with PHREAK
patterns, has been used as the expert system. Using the expert
system Drools has ensured high working speed of the
ontological-semantic analyzer. For instance, the describedalgorithm of the ontological-semantic analysis using theDrolls expert system and 2160 basical ontological-semantic
patterns has determined 8213 semantic relations in 6390 ms in
the text of E. T. A. Hoffmann's fairy tale ―The Golden Pot‖.
Without the Drolls expert system, the implementation of thealgorithm of the ontological-semantic analyzer works inaverage 6-8 times slower. The experiments were performedon an Intel Core i3 M CPU 2.27 GHz under OS Ubuntu 12.04.

657

REFERENCES[1]

Moldovan, D. I., Harabagiu, S. M., Pasca, M., Mihalcea, R., Goodrum,
R., Girju, R., and Rus, V.: LASSO – A Tool for Surfing the Answer
Net. TREC-8, pp. 175-183, 1999.
[2] Scott, S., Gaizauskas, R.: QA-LaSIE: A Natural Language Question
Answering System. Proceedings of the 14th Biennial Conference of
the Canadian Society on Computational Studies of Intelligence, 2001.
[3] Monz, C., de Rijke, M.: Tequesta: The University of Amsterdam’s
Textual Question Answering System. TREC, 2001.
[4] Mozgovoy, M. V.: Simple question-answering system, based on
Russian semantic analyzer. Vestnik of the SPb University, series 10,
issue 1, 116-122, 2006.
[5] Rubashkin, V. Sh., Kapustin, V. A.: Using term definitions inencyclopedic dictionaries for automated ontologies learning. XI
All-Russian united conference «The Internet and the modern society»,
SPb, 2008, http://old.conf.infosoc.ru/2008/pdf_CL/Rubashkin&Kapu
stin.pdf[6] Mitrofanova, O. A., Konstantinova, N. S.: Ontologies as systems ofdata storage. All-Russian competitive selection of the review
analytical papers on the priority direction “Information
telecommunication systems”, 54 p., 2008.
[7] Aramaki, E., Imai, T., Kashiwagi, M., Kajino, M., Miyo, K. and Ohe,K.: Toward medical ontology using Natural Language Processing.
http://www.m.u-tokyo.ac.jp/medinfo/ont/paper/2005-aramaki-1.pdf[8] Hovy, E., Knight, K., Junk, M.: Large Resources. Ontologies(SENSUS)and
Lexicons.
www.isi.edu/natural-language/projects/ONTOLOGIES.html[9] Rubashkin, V. Sh.: Ontological semantics. Knowledge. Ontologies.
Ontologically-oriented methods of informational text analysis.
Moscow, Fizmatlit, 2013.
[10] Rabchevsky, E. A.: Automatic ontology construction based on
lexical-syntactic patterns for information retrieval. Proceedings of the
11th All-Russian scientific conference RCDL'2009, Petrozavodsk,
69-77, 2009.
[11] Rubashkin, V. Sh., Bocharov, V. V., Pivovarova, L. M., Chuprin, B.
Yu.: The approach to ontology learning from machine-readable
dictionaries. Dialog — 2010.
http://www.dialog-21.ru/digests/dialog2010/materials/html/63.htm[12] Orobinska, E. A.: Automatic Method Of Domain Ontology
Construction based on Characteristics of Corpora POS-Analysis.
Proceedings of the XV All-Russian united conference «The Internet
and the modern society» (IMS-2012), SPb, 209-212, 2012.
[13] Buitelaar, P., Cimiano, P.: Ontology learning and population bridging
the gap between text and knowledge. Series: Frontiers in artificial
intelligence and applications, V. 167, Amsterdam; Washington, DC :IOS Press, 2008.
[14] Gruber, T. R. A Translation Approach to Portable Ontology
specification. Knowledge Acquition, 5(2), 1993.
[15] DBpedia, http://wiki.dbpedia.org[16] Freebase, http://www.freebase.com[17] Wikidata, https://www.wikidata.org[18] Wikipedia, the free encyclopedia, https://ru.wikipedia.org[19] Wiktionary, the free dictionary, https://ru.wiktionary.org[20] Krizhanovsky, A. A., Smirnov, A. V.: An approach to the automatedconstruction of a general-purpose lexical ontology basing on thewictionary data [in Russian]. Izvestiya RAS, Conntrol theory andsystems, No. 2, 53-63, 2013.
[21] Sokirko, A. V.: Semantical dictionaries in automated text processing:as exemplified by the DIALING system. PhD. tech. sci. diss. [inRussian]. Moscow, 2001.
[22] Downey, A. B. Think Python. O'Reilly Media, 300 p., 2012.
[23] Mochalovа, A. V. Certificate on the state registration of the computer
program “A program of text semantic analysis using basical semantic
patterns with removal”, No. 2015613430, Russia. 28.01.2015
Vladimir Kuznetsov is a scientist, mathematician,Professor, Doctor of technical sciences, Honorary
worker of higher professional education of the RussianFederation, Honored worker of science of the Republicof Karelia. He is the author of over 200 scientific papers
in the field of mathematical modeling and solution of
applied optimization problems, as well as academic
literature on the programming. He is one of the coaches of the teams who
were winners of the world championship on programming (in 2007, 2008,2010). His research interests include optimization techniques, Olympiad
programming.

Copyright ⓒ 2015 GiRI (Global IT Research Institute)

ICACT Transactions on Advanced Communications Technology (TACT) Vol. 4, Issue 4, July 2015

658

Vladimir Mochalov was born in Lyubertsy, Russia in
1985. He received the Ph.D. degree in electronicengineering from Moscow Technical University ofCommunications and Informatics. His research interests
include networks structure synthesis, artificial
intelligence, bio-inspired algorithms, query answeringsystems and Big Data.
Anastasia Mochalova was born in Petrozavodsk,
Russia, in 1987. She received the bachelor's degree atPetrozavodsk State University, the master's degree in St.
Petersburg
State
UniversityofAerospace
Instrumentation. She is an external PhD student intechnical sciences at Petrozavodsk State University. Her
research interests include automated processing of
naturallanguagetexts,
developmentofquestion-answering systems, automation of ontologies creation,
development of the semantic analyzer.

Copyright ⓒ 2015 GiRI (Global IT Research Institute)

ICACT Transactions on Advanced Communications Technology (TACT) Vol. 4, Issue 4, July 2015

659

Functional scheme of the flying sensor networks
architecture design
Mochalov V.A.*, Pschenichnikov A.P.***Institute of Cosmophysical Research and Radio Wave Propagation FEB RAS , Mirnaia str. 7, 684034 Paratunka,
Kamchatka region, Russia**Moscow technical university of communications and informatics, Aviamotornaya str. 8a, 111024 Moscow,
Russiasensorlife@mail.ru, pshenichnikov@mtuci.ru

Abstract— The process of flying sensor networks (FSN)
construction is quite complicated. To date, there has beendeveloped a number of methods and algorithms of solving
separate problems arising in the process of FSN construction,
but the process itself is not formalized as a rigid set of rules,
algorithms and standards following which would guarantee
construction of a FSN satisfying the designer's requirements.
Many problems arising on the mentioned stages of FSN design
are NP-complete and cannot be formalized and solved bytraditional analytical methods due to fuzziness of task
formulation, initial data, criteria and restrictions. In most cases
one does not need to derive the optimal solution of the designtask; usually the task is reduced to obtaining a spectrum ofsolutions satisfying design criteria and to selection of an optimal
one among them, with interactive participation of the designer
in the process of decision making. In this work we propose thefunctional scheme of the FSN architecture design, which can be
the basis for a specialized design support system of flying sensor
networks.

geographically-distributed wireless sensor networks (WSNs).
Information from the latter is collected by mobile robots (inmost applications by unpiloted flying devices and sometimes

Keyword— flying sensor networks, architecture construction,
design support systems.
Fig. 1. Example of the flying sensor network

I. INTRODUCTIONFLYING sensor networks (FSNs) is used for monitoring andcontrolling the arduous zone and the rural area in the lasttime. The applications can include video dissemination via
FSN, military cases. The comparison of different protocols,
methods for reducing energy consumption, and datasynchronization method are the more investigation areas for
FSN [1].
Flying sensor networks include at least two network
segments: the ground one and the flying one [2] (for example
Fig. 1). The ground segment consists of a set of independent———————————————————————
Manuscript received July 9, 2015. This work was supported by RFBR,
research project No15 07-09431A ―Development of the principles of
construction and methods of self-organization for Flying Ubiquitous Sensor
Networks‖.
Mochalov V. A. is with the Institute of Cosmophysical Research andRadio Wave Propagation FEB RAS, Russia (corresponding author toprovide phone: 8-925-833-71-98; fax: 8-(41531)-33718;
e-mail:sensorlife@mail.ru ).
Pschenichnikov A.P. is with the Moscow technical university ofcommunications
andinformatics,
Russia(e-mail:pshenichnikov@mtuci.ru).

above-ground, above-water and underwater devices). Apart
the functions of information collection, mobile robots may
perform: work management of the ground WSN; point

Fig. 2. Several problems arising when constructing the flying sensor network
ground structure.

allocation; dissemination over the territory; movement,
removal and reprogramming of the WSN nodes; charge andreplace of power sources etc.

Copyright ⓒ 2015 GiRI (Global IT Research Institute)

ICACT Transactions on Advanced Communications Technology (TACT) Vol. 4, Issue 4, July 2015

660

Construction of the ground segment of FSNs requires
solving various complicated problems that relate to different
research areas. Some of such problems are given in Fig. 2.
In the work we use a model of the of the ground segment of
FSN structure, where on the functional level the following
types of nodes can be defined: (1) functional nodes (F-nodes)that collect information in some neighborhood of theirlocation; (2) transit nodes (T-nodes) that manage routing andretransmit the information collected by F-nodes to theinformation collection centers (ICC) to be utilized further; (3)ICCs that manage the WSN and process information collectedby the WSN. In general case there can be multiple ICCs in the
WSN, and the information that has arrived into each of themis available to one or multiple users for making decisions andperforming certain actions. It means that information received
by F-nodes should be retransmitted, with a required degree of
reliability, to several ICCs by means of transit nodes allocatedwithin the given object in a certain way.

II. FUNCTIONAL SCHEME OF THE FLYING SENSOR
NETWORKS ARCHITECTURE CONSTRUCTION
A promising approach to FSN design is use of interactive
decision support systems (DSS) [3]. The notion of the DSS
arose in the beginning of 70-s.

Fig. 4. Objectives tree.

Fig. 3. Functional scheme of the flying sensor networks architecture
construction

The main stages of the process of FSN design are analysisof the requirements, formation of the objectives tree,
development of the structural model of the FSN (structuralsynthesis), that is, definition of segments and subnetworks,
topology design of segments and the network as a whole;development of FSN physical model, that is selection ofequipment, protocols and methods of organization of datatransmission channels; simulation modeling and FSN
optimization.
On the basis of functional flow chart of the WSN
construction process [4] in Fig. 3 we propose an extended
functional flow chart of FSN architecture construction
process, which can be the basis for a design support system offlying sensor networks.
Basing on received designer's requirements to an FSN andthe plans on the network development, the objectives tree of
FSN design is formed as well as criteria of achievement of theobjectives and optimization parameters of the FSN design. A
concept of the ―objectives tree‖ was introduced by C.
Churchman and R. Ackoff in 1957. An objectives tree is a
structured, constructed on the hierarchy principle (distributed
into levels, ranged) assembly of project objectives, in which

Copyright ⓒ 2015 GiRI (Global IT Research Institute)

ICACT Transactions on Advanced Communications Technology (TACT) Vol. 4, Issue 4, July 2015

the following ones are emphasized: the general objective(―tree root‖) and the subgoals of the first, second andconsequent levels subject to it (―tree branches‖). In Fig. 4 ageneralized objectives tree is shown. In leaf nodes of the tree,
simple tasks are formed. When designing communication
networks, often the simple tasks are the requirements onachieving the specified thresholds of optimization
parameters.
Examples of optimization parameters may be: probabilityof connection between F-nodes and the ICC; coefficient of
network readiness; viability parameters (for example, number
and fraction of aborted or functioning connections,mathematical expectation and the average fraction of numberof died or survived nodes after a virtual attack on the edges ornodes); the total time of network functioning before themoment of its fault; amount of power consumed by the
network/nodes in a fixed time interval; time to deliver
messages from F-nodes to the ICC; time to deliver messages
from the ICC to network nodes in any time moment; time of
the network self-recovery after nodes faults; confidencecoefficient for the data collected by the network; redundancy
coefficient of the transmitted data; coverage area and thedensity of T-nodes allocation; network protection criteria (forexample, network/nodes vulnerability to attacks, average time
to dispose of the vulnerability, number of network
vulnerabilities, criticality of attacking actions and threats);
monetary cost of the network; monetary expenses for network
allocation and operation etc.
The objectives tree of FSN design is constructed basing on
methods of objectives structuring, knowledge bases about
network structures, expert knowledge and expert systems,
databases of templates of network structures design,
databases of methods and algorithms of network structures
optimization, specialized CAD systems and design support
systems of FSNs.
For quality evaluation of the network design one can use ageneralized indicator that characterizes (in percent) the
degree of designer satisfaction of the designed network. Oneof the methods to produce the generalized indicator collecting
in itself all parameters and requirements to the designed FSN
is using fuzzy logic and applying confidence coefficients.
After having produced the objectives tree, one develops theassignment for FSN design and coordinates it with thedesigner. Next, the iteration process of constructing the flying
sensor networks architecture is performed. The main steps ofthe process are given below.
1) Choose an information collection model to be used by theground segment of the FSN. The functional block of
choice of information collection model provides thedesigner with a list of available-to-use models of
information collection together with their usagereferences. The database related to this block contains thefull information about each information collection model(for example, the usage reference, software
implementation, simulation model, a list ofavailable-to-use routing algorithms and self-organization,
restrictions on model applicability, compatibility with themodels of interaction between the flying and the groundsegments etc.). After having selected the certain
information collection model, the designer uses the FSN
design support system so as to set the concrete parametervalues of the model. A promising approach is the

2)

3)

4)

5)

6)

661

automatic selection of parameter values of the modelfrom the specified search space (in case the search spaceis very large and there are no concise algorithms or
recommendations on selecting the model parameters,
evolution, genetic, bio-inspired and other algorithms may
be used to search for approximate solutions in a large
space of variants).
Choose an information collection model to be used by theflying segment of the FSN. The functional block of thisstep implements choice of a compatible with Step 1
information collection model to be used by the flying
segment of the FSN and operates in a similar way as thefunctional block of the first step.
Choose a model of interaction between the flying and theground segments, compatible with the models chosen at
the first two steps. The functional block of this step
provides the designer with a list of available-to-use
models of interaction between the segments together with
their usage references. The database related to this blockcontains the full information about each model ofinteraction between the flying and the ground segments.
After having selected the certain interaction model, thedesigner uses the FSN design support system so as to set
the concrete parameter values of the model. As well as on
Step 1, the module of automatic selection of model
parameters can be used.
Choose the components of the ground segment of the
FSN to be utilized. The functional block of choosing the
FSN components implements the selection from thedatabase of a set of inter-compatible types of utilized
nodes on the current iteration. Selection of all compatible
nodes is implemented with help of search withrestrictions defined by the designer in the nodes databaseof the ground segment of the FSN. After that, a sorting of
the set of compatible nodes is performed on the criteria
set by the designer. The design support system of the
FSN that implements the functional flowchart (Fig. 2)
must either output a usage reference for the certain nodes
set for the project, or provide the designer the ability toaccomplish the choice themselves. The database related
to this block contains the complete information about allavailable-to-use network nodes.
In accordance with the requirements to the FSN, allocate
F-nodes at the information collection points and at the
points from which it is required to direct the management
actions on external objects.
Allocate the information collection centers and form theclusters of the ground structure of the FSN (for example
Fig. 5). The functional block of segmentation into
clusters forms the clusters basing on the clusterization
algorithms available in the database, requirements for the

Fig. 5. Example of the information collection centers allocation.

Copyright ⓒ 2015 GiRI (Global IT Research Institute)

ICACT Transactions on Advanced Communications Technology (TACT) Vol. 4, Issue 4, July 2015

network and the defined F-nodes allocation. It also
performs the ICC allocation in such a way that each
F-node would be able to connect to at least K ICCs. We
suppose that information delivery from an ICC to an end
user is performed without any losses or distortions andthat the information received by the end user from any
F-node is sufficient for them if it comes from at least oneof the K ICCs with which the F-node is connected.
7) Choose a self-organization algorithm and a routing
algorithm for the ground segment of the FSN (forexample [5], [6]). The database related to this blockcontains the full information about each self-organization
and routing algorithm and their simulation model. As
well as on Step 1, the module of automatic selection ofmodel parameters can be used.
8) Synthesize the structure of the ground segment of the
FSN. The functional block of synthesis of the groundstructure of the FSN (FB-SGS-FSN) allocates T-nodes insuch a way that the synthesized network structure would
satisfy design requirements and goals, that is, would havethe ―desired properties‖ for the designer. The initial dataof the ground structure synthesis are the following:allocation ant type of F-nodes (Fig. 5); allocation andtype of information collection centers (Fig. 5);

662

F-node to be connected with some K ICCs from the total
number of N.
The FB-SGS-FSN in its operation process implements
calculations of exact and approximate estimates of thestructural network parameters, expert evaluation ofintermediate results and simulation modeling of network
operation. The results of the modeling andstructural-parametric estimates of different parameters
are passed onto input of the complex expert system of theground network structure evaluation which is used to
calculate the confidence coefficient KDSTR of all
designer's requirements for a ground structure of the FSN
to be satisfied. In case KDSTR does not satisfy designer's
requirements, one should either continue synthesizing the
ground structure of the FSN on Step 8, or go to selectionof other parameters or models on different levels of the
FSN construction (that is, to one of the steps 1-7).
In the paper [4] author proposes various bio-inspired
algorithms and the functional flow chart of themulti-agent bio-inspired WSN structure design (Fig. 7).

Fig. 6. Example of the designed fault-tolerant ground structure of the
FSN (every F-node has at least 3 independent paths to at least 3 ICC)

description of the object at which the ground segment of the
FSN is to be located at (the size of the object, its plan,
spatial constraints on allocating T-nodes, barriers forelectromagnetic waves expansion and characteristics ofthese barriers; types and characteristics of ready-to-use
T-nodes; adopted self-organization and routing algorithms;
the model of information collection and interaction
between the flying and the ground segments; functional
requirements; optimization parameters; the objectivefunctions; exact and approximate functions to calculate
network parameters; expert systems; simulation models etc.
It is necessary to allocate T-nodes in such way (for example
Fig. 6), that the designed ground segment of the FSN would
have the «desired properties» assigned by a designer.
Example: Let q = q (T) be the known probability of
failure of one ICC in time T. Then the probability of at least
one of K ICCs to be operative is calculated in the following
manner: P(Q)=1-qK. In case the requirement P(Q)>= P* isset, where P* is a defined value, one can define thenecessary ICCs number K solving the inequality 1-qK>=P*
for K. In order to allow the information to be deliveredfrom all F-nodes of the network to the end user upon
failures of any (K-1) ICCs, one needs to construct (withhelp of suitable T-nodes allocation) such WSN structurethat would assure the defined minimal probability of eachFig. 7. Functional flow chart of the multi-agent bio-inspired WSN
structure design [4].

In recent years, the research area of Natural Computing
is rapidly developing. It unites mathematical methods inwhich the principles of natural mechanisms of decision
making are embedded [7]. Scientists have developed
bio-inspired algorithms (BA) modeling animals behavior
for solving various optimization problems that either do
not have exact solution, or the solutions search space isvary large and complex constraints of the objectivefunction are present, as well as NP-complete.
The described recommendations on applying BA andthe proof in [8] that even the constrained variant of the
problem of minimal coverage on plane is NP-complete

Copyright ⓒ 2015 GiRI (Global IT Research Institute)

ICACT Transactions on Advanced Communications Technology (TACT) Vol. 4, Issue 4, July 2015

allow to conclude about the possibility to apply
self-organizing bio-inspired algorithms for aself-organizing WSN structure design.
9) Choose the components of the flying segment of the FSN
to be utilized. The functional block of choosing the flying
segment components operates in a similar way as thefunctional block of the first step.
10) Choose a self-organization algorithm and a routing
algorithm for the flying segment of the FSN (for example[9]). The functional block of the choice of thecomponents of the flying segment operates in a similar
way as the functional block of the Step 7.
11) Perform simulation modeling of the FSN operation as awhole. The modeling results and structural-parametricestimates of different parameters are passed onto input of
the complex expert system of the FSN evaluation which
is used to calculate the confidence coefficient KDALL of all
designer's requirements for the FSN architecture to besatisfied. In case KDALL does not satisfy designer's
requirements, one should either go to Step 9 or to
Step 10.
12) Form the final design of the FSN architecture.

663

Vladimir Mochalov was born in Lyubertsy, Russia
in 1985. He received the Ph.D. degree in electronicengineering from Moscow Technical University ofCommunications and Informatics. His researchinterests include networks structure synthesis,
artificial intelligence, bio-inspired algorithms, queryanswering systems and Big Data.

Anatoliy Pschenichnikov is a scientist, PhD,
Professor, honorary worker of communications of
the Russian Federation, head of "Communication
Networks and Systems" department of Moscow
technical university of communications andinformatics. He is the author of over 200 scientificpapers in the field of communications.

III. CONCLUSION
In this work we propose the functional scheme of the FSN
architecture design, which can be the basis for a specialized
design support system of flying sensor networks. Currently,
the functional block of the FSN ground structure synthesis is
implemented using Java
programming language.
Experimental research has shown the possibility of
constructing the FSN ground structure considering various
objective functions and optimization parameters.
ACKNOWLEDGMENT
This work was supported by RFBR, research project No15
07-09431A ―Development of the principles of construction
and methods of self-organization for Flying Ubiquitous
Sensor Networks‖
REFERENCES
[1]

[2]
[3]

[4]

[5]
[6]

[7]
[8]
[9]

R. Kirichek, A. Paramonov, A. Koucheryavy. Flying Ubiquitous
Sensor Networks as a Queueing System. Proceedings, The IEEE 17th
International Conference on Advanced Communication Technology,
2015. ICACT 2015. Phoenix Park, Korea.
A.E. Koucheryavy, A.G. Vladiko, R.V. Kirichek. Flying sensor
networks. Electrosvyaz, vol.9, pp. 2-5, 2014.
W O’Brien, C Julien, S Kabadayi, X Luo, J Hammer. An architecture
for decision support in ad hoc sensor networks. Electronic Journal of
Information Technology in Construction 14, 309-327
V.A. Mochalov. Multi-agent Bio-inspired Algorithms for WirelessSensor Network Design. Proceedings, The IEEE 17th International
Conference on Advanced Communication Technology, 2015. ICACT
2015. Phoenix Park, Korea.
Jn. Al-Karaki, AE Kamal. Routing techniques in wireless sensor
networks: a survey. Wireless communications, IEEE 11 (6), 6-28.
K. Sha, J. Gehlot, R. Greve. Multipath Routing Techniques in WirelessSensor Networks: A Survey. Wireless Personal Communications. May
2013, Volume 70, Issue 2, pp 807-829.
G. Rozenberg, T. Bäck, J.N. Kok. Handbook of Natural Computing,Springer, ISBN 978-3-540-92909-3, 2012.
R.J. Fowler. ―Optimal packing and covering in the plane are
NP-complete‖, Inf. Process. Lett., vol.12(3), pp.133–137, 1981.
S. Rosati, K. Kruzelecki, G. Heitz, D. Floreano, B. Rimoldi. Dynamic
Routing for Flying Ad Hoc Networks. IEEE Transactions on
Vehicular Technology. 06/2014.

Copyright ⓒ 2015 GiRI (Global IT Research Institute)