# Historical Feature Pattern Extraction Based Network Attack Situation Sensing Algorithm

Authors: Yong Zeng; Dacheng Liu; Zhou Lei
Journal: The Scientific World Journal
 (2014)

---

## Abstract

The situation sequence contains a series of complicated and multivariate random trends, which are very sudden, uncertain, and difficult to recognize and describe its principle by traditional algorithms. To solve the above questions, estimating parameters of super long situation sequence is essential, but very difficult, so this paper proposes a situation prediction method based on historical feature pattern extraction (HFPE). First, HFPE algorithm seeks similar indications from the history situation sequence recorded and weighs the link intensity between occurred indication and subsequent effect. Then it calculates the probability that a certain effect reappears according to the current indication and makes a prediction after weighting. Meanwhile, HFPE method gives an evolution algorithm to derive the prediction deviation from the views of pattern and accuracy. This algorithm can continuously promote the adaptability of HFPE through gradual fine-tuning. The method preserves the rules in sequence at its best, does not need data preprocessing, and can track and adapt to the variation of situation sequence continuously.


---

## Body

## 1. Introduction

With attacks becoming more prevalent, the traditional static passive defense and whole system consolidation are hard to keep up with the changing rhythms, which have huge amounts of investment and affect the network performance. In this case, the dynamic, proactive, and targeted defending measures have been presented, most of which rely on attack situation forecast, that is, network attack situation sensing (NASS) [1, 2]. NASS aims at forecasting future evolution trend of network attack situation based on historical features and current attack indications, guiding dynamic defense, and allowing administrators to take corresponding measures in advanced, and effective manner to quickly respond to the complex and ever-changing attack threats [3, 4].Rarely studying attack situation forecast, previous researches mostly using existing methods, such as autoregressive moving average model (ARMA), grey model (GM), and radial basis function neural network (RBFNN) [5–8]. ARMA identifies the dependence relationship and autocorrelation of situation sequences and establish mathematical prediction model [9]. It requests that situation sequences or their certain step difference satisfies the steady suppose, which is too strict to increase suitable scope. As one of GMs, GM(1,1) firstly weakens the randomness of situation sequences by using accumulation, secondly fits the born sequence through index curve, and then does regressive restitution after prediction, which can embody monotonously and slowly changing trend but hardly reflect some characteristics such as random rove and periodic fluctuation [10, 11]. Grey Verhulst is suitable to describe the situation sequences with swing development according to “S” or anti-“S” form [12], and the method dividing the changing line into several stages does not lack rationality, but the difficulty is how to predict the occurrence moment and lasting time of each stage [13]. RBFNN utilizes the nonlinear characteristic to describe the regulation contained in situation sequences [14]. However, evolving regulation of attack situation is infinite and changeable; a practical type neural network with small scale cannot solve well [15, 16].Situation sequence contains massive complex and inconstant evolution trends, beyond the expression and prediction capability of traditional methods only by some formulas, functions or via some training [17, 18]. Most traditional methods suffer from the confliction among training samples, rely on data preprocessing and artificial intervention heavily, do not support incremental training, and need to rebuild model once situation sequence changes [19–21]. Therefore, a situation prediction method based on historical feature pattern extraction (HFPE) is presented. The method measures the similarity between historical feature from the aspects of pattern and accuracy and utilizes multiple order difference operation to discriminate trends. It searches similar indications from recorded historical situation sequence, measures the link intensity of occurred indication upon subsequent effect, and infers the recurrence possibilities of some effects according to current indication. An evolution algorithm is introduced to measure prediction deviation and improve the adaptability of prediction algorithm continuously via gradual fine-tuning.This paper proceeds as follows: Section2 discusses algorithm principle for HFPE. Section 3 clarifies algorithm establishment and analysis. Section 4 presents the experiment results and Section 5 concludes the paper.


## 2. Algorithm Principle

### 2.1. Basic Definition

Looking from mathematical form, the continuous time-varied curve,z
=
f
(
t
), is commonly applied to describe the evolving process of attack situation. This curve is carried out by computer through sampling method, that is, to sample situation values with time interval τ, and then obtains discrete time sequences composed by (
t
k
,
z
k
), where z
k represents the situation value at moment t
k. To facilitate the research, a basic definition is made as follows: let G
(
i
,
m
) be the segmental subimage with m neighboring segments from moment t
i, let q
k be the segmental gradient, let Q
(
i
,
m
) be the gradient sequence, let (
q
i
,
q
i
+
1
,
…
,
q
i
+
m
-
1
), L
(
i
,
m
) be the characteristic spectrum of Q
(
i
,
m
), let O be zero vector; then
(1)
q
k
=
z
k
+
1
-
z
k
t
k
+
1
-
t
k
,
L
(
i
,
m
)
=
O
,
Q
(
i
,
m
)
=
O
,
L
(
i
,
m
)
=
Q
(
i
,
m
)
∥
Q
(
i
,
m
)
∥
,
Q
(
i
,
m
)
≠
O
.
For the kth component product of L
(
i
,
m
), l
i
+
k, the angle of inclination, θ
i
+
k, can be defined as
(2)
θ
i
+
k
=
arctan
l
i
+
k
,
-
π
2
<
θ
i
+
k
<
π
2
.The stretch rate fromQ
(
i
,
m
) to Q
(
j
,
m
) can be calculated by f
σ
(
i
,
j
,
m
), which is defined as
(3)
f
σ
(
i
,
j
,
m
)
=
1
,
Q
(
i
,
m
)
=
O
,
Q
(
j
,
m
)
=
O
,
f
σ
(
i
,
j
,
m
)
=
∥
Q
(
j
,
m
)
∥
∥
Q
(
i
,
m
)
∥
,
Q
(
i
,
m
)
≠
O
,
Q
(
j
,
m
)
≠
O
,
not
exist
,
other
conditions
.
γ
[
i
,
m
,
ρ
] is utilized to adjust the stretch rate, where ρ is the prediction steps.The following three theorems through further analysis can be easily obtained: (1)L
(
i
,
m
) does not change with G
(
i
,
m
); (2) if L
(
i
,
m
)
=
L
(
j
,
m
), then Q
(
i
,
m
) is linear correlative with Q
(
j
,
m
); (3) if L
(
i
,
m
)
=
L
(
j
,
m
), then G
(
i
,
m
) can be the same with G
(
j
,
m
) through translating and magnifying.


### 2.2. Prediction Principle

Looking from probability theory and statistics, similar situation curve shapes are more probably derived from similar origin, mechanism, and impact, subsequently resulting in a similar subsequent effect. From the point of view of statistics, when the precedence relations of sequences in time appear frequently, it usually meant that the logical causal relationship exists in a certain degree.It is supposed thatG
(
i
,
m
) and G
(
j
,
m
) are known historical feature subpatterns, from the same pattern, t
i
<
t
j, and the further trend after t
>
t
j
+
m is unknown and needed to be predicted. If G
(
i
,
m
) is similar with G
(
j
,
m
), then it can be deduced that the origin, mechanism, and impact in [
t
j
,
t
j
+
m
) are similar with those in [
t
i
,
t
i
+
m
), and the history after t
i
+
m may be repeated after t
j
+
m with some differences. According to this principle, the slope of the line segment behind can be forecasted by
(4)
q
^
j
+
m
+
k
=
f
σ
(
i
,
j
,
m
)
×
q
i
+
m
+
k
.
ρ is utilized to control the predicting steps. When k
=
0,1
,
2
,
…
,
ρ
-
1, the trend prediction curve can be recurred by τ and q
^
j
+
m
+
k.


### 2.3. Measurement System

#### 2.3.1. Fitting Degree

Firstly calculate the angle cosine similarity between slope vectors, secondly introduce more order difference operators to obtain the trend difference of qualitative change and quantitative change, and then acquire the narrowing fitting degree by the difference of similarity degree and trend difference.Letϕ
θ
(
i
,
j
,
m
) represent the angle cosine similarity between Q
(
i
,
m
) and Q
(
j
,
m
); then
(5)
ϕ
θ
(
i
,
j
,
m
)
=
1
,
Q
(
i
,
m
)
=
O
,
Q
(
j
,
m
)
=
O
,
ϕ
θ
(
i
,
j
,
m
)
=
Q
(
i
,
m
)
×
Q
T
(
j
,
m
)
∥
Q
(
i
,
m
)
∥
×
∥
Q
(
j
,
m
)
∥
,
a
a
a
a
a
a
a
Q
(
i
,
m
)
≠
O
,
Q
(
j
,
m
)
≠
O
ϕ
θ
(
i
,
j
,
m
)
=
0
,
Q
(
i
,
m
)
=
O
,
Q
(
j
,
m
)
≠
O
ϕ
θ
(
i
,
j
,
m
)
=
aaa
0
or
Q
(
i
,
m
)
≠
O
,
Q
(
j
,
m
)
=
O
.The trend differences of qualitative change and quantitative change are denoted byϕ
1
(
x
) and ϕ
2
(
x
), respectively, and the former of which stands for the pattern difference, and the latter stands for the accuracy difference. The above two parameters can be derived by
(6)
ϕ
1
(
x
)
=
{
+
1
,
x
>
0
0
,
x
=
0
-
1
,
x
<
0
,
ϕ
2
(
x
)
=
sin
x
.
Thus the composite trend, ϕ
⊥
(
x
), can be defined by
(7)
ϕ
⊥
(
x
)
=
0.2
×
ϕ
1
(
x
)
+
0.8
×
ϕ
2
(
x
)
.Let∇ represent backward difference operator, and define
(8)
∇
0
θ
k
=
θ
k
,
and then the α order differential recursive equation can be obtained by
(9)
∇
α
θ
k
=
0.5
×
(
∇
α
-
1
θ
k
-
∇
α
-
1
θ
k
-
1
)
,
in which α is a positive integer, and (9) meets
(10)
π
2
<
∇
α
θ
k
<
π
2
.Letϕ
∇
(
i
,
j
,
m
) denote the trend difference between the feature patterns L
(
i
,
m
) and L
(
j
,
m
); then
(11)
ϕ
∇
(
i
,
j
,
m
)
=
2
∑
α
=
0
m
-
1
∑
k
=
α
m
-
1
|
ϕ
⊥
(
∇
α
θ
i
+
k
)
-
ϕ
⊥
(
∇
α
θ
j
+
k
)
|
m
(
m
+
1
)
.The fitting degree function,ϕ
(
i
,
j
,
m
), can be defined by
(12)
ϕ
(
i
,
j
,
m
)
=
ϕ
θ
(
i
,
j
,
m
)
-
ϕ
∇
(
i
,
j
,
m
)
,
where the large value of ϕ
(
i
,
j
,
m
) represents a fine fitting, and for -
1
<
ϕ
θ
(
i
,
j
,
m
)
≤
1 and 0
<
ϕ
θ
(
i
,
j
,
m
)
≤
2, it can be derived that
(13)
-
3
<
ϕ
θ
(
i
,
j
,
m
)
≤
1
.
The occurrence probability of ϕ
θ
(
i
,
j
,
m
)
>
0 may be 50% statistically, which is too big. Therefore, it is necessary to subtract the penalty term, ϕ
∇
(
i
,
j
,
m
), and filter ϕ
(
i
,
j
,
m
) by the threshold ε
ϕ
(
0
<
ε
ϕ
<
1
) to narrow the fitting degree.


#### 2.3.2. Universality Degree

Divide the attack situation subsequence into two parts, that is, occurred indication and subsequent effect; the values of the domination intensity of the former to the latter (or call link intensity between the two parts) may be high or low, some of which have a far-ranging representative, and some just have rare earth especially instance. If all the values are treated evenly, then the prediction accuracy will be affected seriously, so it is important to outstand inevitable link of the high intensity and weaken accidental link of the low intensity.Letχ
[
k
,
m
,
ρ
] be the universality value of Q
(
k
,
m
+
ρ
) in the historical feature pattern G
(
0
,
n
), where χ
max
⁡ can be derived by
(14)
χ
max
⁡
=
max
⁡
{
χ
[
k
,
m
,
ρ
]
∣
0
≤
k
<
n
-
m
}
.
The value of χ
max
⁡ will be updated with the change of χ
[
k
,
m
,
ρ
] and can be accessed directly without waiting to calculate.The universality value can be shined upon to universality degree in(
0
,
n
-
m
] by function f
χ
(
k
,
m
,
ρ
), which is shown as follows:
(15)
f
χ
(
k
,
m
,
ρ
)
=
(
n
-
m
)
×
(
1
+
2
π
-
1
arctan


(
χ
[
k
,
m
,
ρ
]
-
χ
max
⁡
)
)
.
The larger value of universality degree reflects finer representativeness of Q
(
k
,
m
) and its extension and more exact patterns predicted by Q
(
k
,
m
+
ρ
). Otherwise, Q
(
k
,
m
+
ρ
) is just a special example, and the prediction effect is worse.


#### 2.3.3. Contrast Degree

The predication results of situation are usually impacted by link intensity of several different weights. The function mechanism often changes; that is, sometimes they work with a community decision and sometimes with an individual domination. Therefore, it is necessary to trace and adjust between outstanding statistics effect and showing individual advantage.It is supposed thatw
~
1
,
w
~
2
,
…
,
w
~
n are not normalized weights, which can be adjusted to w
~
1
η
,
w
~
2
η
,
…
,
w
~
n
η by sensitization index η (η
>
0). Then the standardized weight w
k can be derived by
(16)
w
k
=
w
~
k
η
∑
k
=
1
n
w
~
k
η
,
and comparison degree w
i
/
w
j can be obtained by
(17)
w
i
w
j
=
w
~
i
η
w
~
j
η
.
If w
~
i
≠
w
~
j, we can suppose w
~
i
<
w
~
j; then five generalized cutoff points can be acquired; that is, 0
<
w
~
i
/
w
~
j
<
1
<
w
~
j
/
w
~
i
<
∞.Equation (16) can be derived into the form of w
~
k
η
=
w
k
×
ξ by
(18)
w
~
k
η
×
x
∑
k
=
1
n
w
~
k
η
×
x
=
(
w
k
×
ξ
)
x
∑
k
=
1
n
(
w
k
×
ξ
)
x
=
w
k
x
∑
k
=
1
n
w
k
x
,
where η is utilized to adjust comparison degree; that is, 0
<
η
<
1 outstands statistics effect, η
>
1 shows individual advantage, and η
=
1 maintains the present status.


## 2.1. Basic Definition

Looking from mathematical form, the continuous time-varied curve,z
=
f
(
t
), is commonly applied to describe the evolving process of attack situation. This curve is carried out by computer through sampling method, that is, to sample situation values with time interval τ, and then obtains discrete time sequences composed by (
t
k
,
z
k
), where z
k represents the situation value at moment t
k. To facilitate the research, a basic definition is made as follows: let G
(
i
,
m
) be the segmental subimage with m neighboring segments from moment t
i, let q
k be the segmental gradient, let Q
(
i
,
m
) be the gradient sequence, let (
q
i
,
q
i
+
1
,
…
,
q
i
+
m
-
1
), L
(
i
,
m
) be the characteristic spectrum of Q
(
i
,
m
), let O be zero vector; then
(1)
q
k
=
z
k
+
1
-
z
k
t
k
+
1
-
t
k
,
L
(
i
,
m
)
=
O
,
Q
(
i
,
m
)
=
O
,
L
(
i
,
m
)
=
Q
(
i
,
m
)
∥
Q
(
i
,
m
)
∥
,
Q
(
i
,
m
)
≠
O
.
For the kth component product of L
(
i
,
m
), l
i
+
k, the angle of inclination, θ
i
+
k, can be defined as
(2)
θ
i
+
k
=
arctan
l
i
+
k
,
-
π
2
<
θ
i
+
k
<
π
2
.The stretch rate fromQ
(
i
,
m
) to Q
(
j
,
m
) can be calculated by f
σ
(
i
,
j
,
m
), which is defined as
(3)
f
σ
(
i
,
j
,
m
)
=
1
,
Q
(
i
,
m
)
=
O
,
Q
(
j
,
m
)
=
O
,
f
σ
(
i
,
j
,
m
)
=
∥
Q
(
j
,
m
)
∥
∥
Q
(
i
,
m
)
∥
,
Q
(
i
,
m
)
≠
O
,
Q
(
j
,
m
)
≠
O
,
not
exist
,
other
conditions
.
γ
[
i
,
m
,
ρ
] is utilized to adjust the stretch rate, where ρ is the prediction steps.The following three theorems through further analysis can be easily obtained: (1)L
(
i
,
m
) does not change with G
(
i
,
m
); (2) if L
(
i
,
m
)
=
L
(
j
,
m
), then Q
(
i
,
m
) is linear correlative with Q
(
j
,
m
); (3) if L
(
i
,
m
)
=
L
(
j
,
m
), then G
(
i
,
m
) can be the same with G
(
j
,
m
) through translating and magnifying.


## 2.2. Prediction Principle

Looking from probability theory and statistics, similar situation curve shapes are more probably derived from similar origin, mechanism, and impact, subsequently resulting in a similar subsequent effect. From the point of view of statistics, when the precedence relations of sequences in time appear frequently, it usually meant that the logical causal relationship exists in a certain degree.It is supposed thatG
(
i
,
m
) and G
(
j
,
m
) are known historical feature subpatterns, from the same pattern, t
i
<
t
j, and the further trend after t
>
t
j
+
m is unknown and needed to be predicted. If G
(
i
,
m
) is similar with G
(
j
,
m
), then it can be deduced that the origin, mechanism, and impact in [
t
j
,
t
j
+
m
) are similar with those in [
t
i
,
t
i
+
m
), and the history after t
i
+
m may be repeated after t
j
+
m with some differences. According to this principle, the slope of the line segment behind can be forecasted by
(4)
q
^
j
+
m
+
k
=
f
σ
(
i
,
j
,
m
)
×
q
i
+
m
+
k
.
ρ is utilized to control the predicting steps. When k
=
0,1
,
2
,
…
,
ρ
-
1, the trend prediction curve can be recurred by τ and q
^
j
+
m
+
k.


## 2.3. Measurement System

### 2.3.1. Fitting Degree

Firstly calculate the angle cosine similarity between slope vectors, secondly introduce more order difference operators to obtain the trend difference of qualitative change and quantitative change, and then acquire the narrowing fitting degree by the difference of similarity degree and trend difference.Letϕ
θ
(
i
,
j
,
m
) represent the angle cosine similarity between Q
(
i
,
m
) and Q
(
j
,
m
); then
(5)
ϕ
θ
(
i
,
j
,
m
)
=
1
,
Q
(
i
,
m
)
=
O
,
Q
(
j
,
m
)
=
O
,
ϕ
θ
(
i
,
j
,
m
)
=
Q
(
i
,
m
)
×
Q
T
(
j
,
m
)
∥
Q
(
i
,
m
)
∥
×
∥
Q
(
j
,
m
)
∥
,
a
a
a
a
a
a
a
Q
(
i
,
m
)
≠
O
,
Q
(
j
,
m
)
≠
O
ϕ
θ
(
i
,
j
,
m
)
=
0
,
Q
(
i
,
m
)
=
O
,
Q
(
j
,
m
)
≠
O
ϕ
θ
(
i
,
j
,
m
)
=
aaa
0
or
Q
(
i
,
m
)
≠
O
,
Q
(
j
,
m
)
=
O
.The trend differences of qualitative change and quantitative change are denoted byϕ
1
(
x
) and ϕ
2
(
x
), respectively, and the former of which stands for the pattern difference, and the latter stands for the accuracy difference. The above two parameters can be derived by
(6)
ϕ
1
(
x
)
=
{
+
1
,
x
>
0
0
,
x
=
0
-
1
,
x
<
0
,
ϕ
2
(
x
)
=
sin
x
.
Thus the composite trend, ϕ
⊥
(
x
), can be defined by
(7)
ϕ
⊥
(
x
)
=
0.2
×
ϕ
1
(
x
)
+
0.8
×
ϕ
2
(
x
)
.Let∇ represent backward difference operator, and define
(8)
∇
0
θ
k
=
θ
k
,
and then the α order differential recursive equation can be obtained by
(9)
∇
α
θ
k
=
0.5
×
(
∇
α
-
1
θ
k
-
∇
α
-
1
θ
k
-
1
)
,
in which α is a positive integer, and (9) meets
(10)
π
2
<
∇
α
θ
k
<
π
2
.Letϕ
∇
(
i
,
j
,
m
) denote the trend difference between the feature patterns L
(
i
,
m
) and L
(
j
,
m
); then
(11)
ϕ
∇
(
i
,
j
,
m
)
=
2
∑
α
=
0
m
-
1
∑
k
=
α
m
-
1
|
ϕ
⊥
(
∇
α
θ
i
+
k
)
-
ϕ
⊥
(
∇
α
θ
j
+
k
)
|
m
(
m
+
1
)
.The fitting degree function,ϕ
(
i
,
j
,
m
), can be defined by
(12)
ϕ
(
i
,
j
,
m
)
=
ϕ
θ
(
i
,
j
,
m
)
-
ϕ
∇
(
i
,
j
,
m
)
,
where the large value of ϕ
(
i
,
j
,
m
) represents a fine fitting, and for -
1
<
ϕ
θ
(
i
,
j
,
m
)
≤
1 and 0
<
ϕ
θ
(
i
,
j
,
m
)
≤
2, it can be derived that
(13)
-
3
<
ϕ
θ
(
i
,
j
,
m
)
≤
1
.
The occurrence probability of ϕ
θ
(
i
,
j
,
m
)
>
0 may be 50% statistically, which is too big. Therefore, it is necessary to subtract the penalty term, ϕ
∇
(
i
,
j
,
m
), and filter ϕ
(
i
,
j
,
m
) by the threshold ε
ϕ
(
0
<
ε
ϕ
<
1
) to narrow the fitting degree.


### 2.3.2. Universality Degree

Divide the attack situation subsequence into two parts, that is, occurred indication and subsequent effect; the values of the domination intensity of the former to the latter (or call link intensity between the two parts) may be high or low, some of which have a far-ranging representative, and some just have rare earth especially instance. If all the values are treated evenly, then the prediction accuracy will be affected seriously, so it is important to outstand inevitable link of the high intensity and weaken accidental link of the low intensity.Letχ
[
k
,
m
,
ρ
] be the universality value of Q
(
k
,
m
+
ρ
) in the historical feature pattern G
(
0
,
n
), where χ
max
⁡ can be derived by
(14)
χ
max
⁡
=
max
⁡
{
χ
[
k
,
m
,
ρ
]
∣
0
≤
k
<
n
-
m
}
.
The value of χ
max
⁡ will be updated with the change of χ
[
k
,
m
,
ρ
] and can be accessed directly without waiting to calculate.The universality value can be shined upon to universality degree in(
0
,
n
-
m
] by function f
χ
(
k
,
m
,
ρ
), which is shown as follows:
(15)
f
χ
(
k
,
m
,
ρ
)
=
(
n
-
m
)
×
(
1
+
2
π
-
1
arctan


(
χ
[
k
,
m
,
ρ
]
-
χ
max
⁡
)
)
.
The larger value of universality degree reflects finer representativeness of Q
(
k
,
m
) and its extension and more exact patterns predicted by Q
(
k
,
m
+
ρ
). Otherwise, Q
(
k
,
m
+
ρ
) is just a special example, and the prediction effect is worse.


### 2.3.3. Contrast Degree

The predication results of situation are usually impacted by link intensity of several different weights. The function mechanism often changes; that is, sometimes they work with a community decision and sometimes with an individual domination. Therefore, it is necessary to trace and adjust between outstanding statistics effect and showing individual advantage.It is supposed thatw
~
1
,
w
~
2
,
…
,
w
~
n are not normalized weights, which can be adjusted to w
~
1
η
,
w
~
2
η
,
…
,
w
~
n
η by sensitization index η (η
>
0). Then the standardized weight w
k can be derived by
(16)
w
k
=
w
~
k
η
∑
k
=
1
n
w
~
k
η
,
and comparison degree w
i
/
w
j can be obtained by
(17)
w
i
w
j
=
w
~
i
η
w
~
j
η
.
If w
~
i
≠
w
~
j, we can suppose w
~
i
<
w
~
j; then five generalized cutoff points can be acquired; that is, 0
<
w
~
i
/
w
~
j
<
1
<
w
~
j
/
w
~
i
<
∞.Equation (16) can be derived into the form of w
~
k
η
=
w
k
×
ξ by
(18)
w
~
k
η
×
x
∑
k
=
1
n
w
~
k
η
×
x
=
(
w
k
×
ξ
)
x
∑
k
=
1
n
(
w
k
×
ξ
)
x
=
w
k
x
∑
k
=
1
n
w
k
x
,
where η is utilized to adjust comparison degree; that is, 0
<
η
<
1 outstands statistics effect, η
>
1 shows individual advantage, and η
=
1 maintains the present status.


## 2.3.1. Fitting Degree

Firstly calculate the angle cosine similarity between slope vectors, secondly introduce more order difference operators to obtain the trend difference of qualitative change and quantitative change, and then acquire the narrowing fitting degree by the difference of similarity degree and trend difference.Letϕ
θ
(
i
,
j
,
m
) represent the angle cosine similarity between Q
(
i
,
m
) and Q
(
j
,
m
); then
(5)
ϕ
θ
(
i
,
j
,
m
)
=
1
,
Q
(
i
,
m
)
=
O
,
Q
(
j
,
m
)
=
O
,
ϕ
θ
(
i
,
j
,
m
)
=
Q
(
i
,
m
)
×
Q
T
(
j
,
m
)
∥
Q
(
i
,
m
)
∥
×
∥
Q
(
j
,
m
)
∥
,
a
a
a
a
a
a
a
Q
(
i
,
m
)
≠
O
,
Q
(
j
,
m
)
≠
O
ϕ
θ
(
i
,
j
,
m
)
=
0
,
Q
(
i
,
m
)
=
O
,
Q
(
j
,
m
)
≠
O
ϕ
θ
(
i
,
j
,
m
)
=
aaa
0
or
Q
(
i
,
m
)
≠
O
,
Q
(
j
,
m
)
=
O
.The trend differences of qualitative change and quantitative change are denoted byϕ
1
(
x
) and ϕ
2
(
x
), respectively, and the former of which stands for the pattern difference, and the latter stands for the accuracy difference. The above two parameters can be derived by
(6)
ϕ
1
(
x
)
=
{
+
1
,
x
>
0
0
,
x
=
0
-
1
,
x
<
0
,
ϕ
2
(
x
)
=
sin
x
.
Thus the composite trend, ϕ
⊥
(
x
), can be defined by
(7)
ϕ
⊥
(
x
)
=
0.2
×
ϕ
1
(
x
)
+
0.8
×
ϕ
2
(
x
)
.Let∇ represent backward difference operator, and define
(8)
∇
0
θ
k
=
θ
k
,
and then the α order differential recursive equation can be obtained by
(9)
∇
α
θ
k
=
0.5
×
(
∇
α
-
1
θ
k
-
∇
α
-
1
θ
k
-
1
)
,
in which α is a positive integer, and (9) meets
(10)
π
2
<
∇
α
θ
k
<
π
2
.Letϕ
∇
(
i
,
j
,
m
) denote the trend difference between the feature patterns L
(
i
,
m
) and L
(
j
,
m
); then
(11)
ϕ
∇
(
i
,
j
,
m
)
=
2
∑
α
=
0
m
-
1
∑
k
=
α
m
-
1
|
ϕ
⊥
(
∇
α
θ
i
+
k
)
-
ϕ
⊥
(
∇
α
θ
j
+
k
)
|
m
(
m
+
1
)
.The fitting degree function,ϕ
(
i
,
j
,
m
), can be defined by
(12)
ϕ
(
i
,
j
,
m
)
=
ϕ
θ
(
i
,
j
,
m
)
-
ϕ
∇
(
i
,
j
,
m
)
,
where the large value of ϕ
(
i
,
j
,
m
) represents a fine fitting, and for -
1
<
ϕ
θ
(
i
,
j
,
m
)
≤
1 and 0
<
ϕ
θ
(
i
,
j
,
m
)
≤
2, it can be derived that
(13)
-
3
<
ϕ
θ
(
i
,
j
,
m
)
≤
1
.
The occurrence probability of ϕ
θ
(
i
,
j
,
m
)
>
0 may be 50% statistically, which is too big. Therefore, it is necessary to subtract the penalty term, ϕ
∇
(
i
,
j
,
m
), and filter ϕ
(
i
,
j
,
m
) by the threshold ε
ϕ
(
0
<
ε
ϕ
<
1
) to narrow the fitting degree.


## 2.3.2. Universality Degree

Divide the attack situation subsequence into two parts, that is, occurred indication and subsequent effect; the values of the domination intensity of the former to the latter (or call link intensity between the two parts) may be high or low, some of which have a far-ranging representative, and some just have rare earth especially instance. If all the values are treated evenly, then the prediction accuracy will be affected seriously, so it is important to outstand inevitable link of the high intensity and weaken accidental link of the low intensity.Letχ
[
k
,
m
,
ρ
] be the universality value of Q
(
k
,
m
+
ρ
) in the historical feature pattern G
(
0
,
n
), where χ
max
⁡ can be derived by
(14)
χ
max
⁡
=
max
⁡
{
χ
[
k
,
m
,
ρ
]
∣
0
≤
k
<
n
-
m
}
.
The value of χ
max
⁡ will be updated with the change of χ
[
k
,
m
,
ρ
] and can be accessed directly without waiting to calculate.The universality value can be shined upon to universality degree in(
0
,
n
-
m
] by function f
χ
(
k
,
m
,
ρ
), which is shown as follows:
(15)
f
χ
(
k
,
m
,
ρ
)
=
(
n
-
m
)
×
(
1
+
2
π
-
1
arctan


(
χ
[
k
,
m
,
ρ
]
-
χ
max
⁡
)
)
.
The larger value of universality degree reflects finer representativeness of Q
(
k
,
m
) and its extension and more exact patterns predicted by Q
(
k
,
m
+
ρ
). Otherwise, Q
(
k
,
m
+
ρ
) is just a special example, and the prediction effect is worse.


## 2.3.3. Contrast Degree

The predication results of situation are usually impacted by link intensity of several different weights. The function mechanism often changes; that is, sometimes they work with a community decision and sometimes with an individual domination. Therefore, it is necessary to trace and adjust between outstanding statistics effect and showing individual advantage.It is supposed thatw
~
1
,
w
~
2
,
…
,
w
~
n are not normalized weights, which can be adjusted to w
~
1
η
,
w
~
2
η
,
…
,
w
~
n
η by sensitization index η (η
>
0). Then the standardized weight w
k can be derived by
(16)
w
k
=
w
~
k
η
∑
k
=
1
n
w
~
k
η
,
and comparison degree w
i
/
w
j can be obtained by
(17)
w
i
w
j
=
w
~
i
η
w
~
j
η
.
If w
~
i
≠
w
~
j, we can suppose w
~
i
<
w
~
j; then five generalized cutoff points can be acquired; that is, 0
<
w
~
i
/
w
~
j
<
1
<
w
~
j
/
w
~
i
<
∞.Equation (16) can be derived into the form of w
~
k
η
=
w
k
×
ξ by
(18)
w
~
k
η
×
x
∑
k
=
1
n
w
~
k
η
×
x
=
(
w
k
×
ξ
)
x
∑
k
=
1
n
(
w
k
×
ξ
)
x
=
w
k
x
∑
k
=
1
n
w
k
x
,
where η is utilized to adjust comparison degree; that is, 0
<
η
<
1 outstands statistics effect, η
>
1 shows individual advantage, and η
=
1 maintains the present status.


## 3. Algorithm Establishment and Analysis

### 3.1. Prediction Algorithm

The prediction algorithm flow is given in Figure1. According to historical feature pattern G
(
0
,
n
-
1
) and occurred indication G
(
n
-
m
,
m
), the algorithm can predict subsequent effect G
^
(
n
,
ρ
) through two main stages, that is, preparation stage and prediction stage, which are marked in the chart.Figure 1
Prediction algorithm flow chart.As shown in the figure, the preparation part circularly promotes the sliding windowG
(
i
,
m
), selects poor values of fitting degree Q
(
i
,
m
) to reject, and sensitizes the product of universality degree f
χ
(
i
,
m
,
ρ
) and fitting degree ϕ
(
i
,
j
,
m
), which is assigned to w. The prediction part first checks whether historical feature pattern set ψ has record. What calls for special attentions is that the value of Q
(
i
,
m
) in the sliding window or the fitting degree value of it with Q
(
j
,
m
) in the occurred indication cannot be too small, because the smaller the above value, the poorer the contribution to prediction value q
^
n
+
k.


### 3.2. Evolution Algorithm

Evolution algorithm is introduced to measure predicting deviation from the views of pattern and accuracy, which can be fine-tuned to raise the adaptability of prediction algorithm.The accuracy of adjustingη to η
×
x can be derived by
(19)
f
k
(
x
)
=
∑
(
i
,
w
,
σ
)
∈
ψ
(
w
x
×
ϕ
(
i
+
m
,
n
,
ρ
)
)
∑
(
i
,
w
,
σ
)
∈
ψ
w
x
,
which is based on current weight set and (18) and meets -
3
<
f
k
(
x
)
≤
1. And the definition can be popularized to f
Λ
(
x
1
,
x
2
,
…
), only when f
k
(
x
i
) is the largest value first met in {
f
k
(
x
1
)
,
f
k
(
x
2
)
,
…
}, which is in ascending order by k of x
k; it can be obtained that
(20)
f
Λ
(
x
1
,
x
2
,
…
)
=
x
i
.As shown in Figure2, the evolution algorithm carries on the variables and results of the prediction algorithm and works to promote adaptability after acquiring measured value. Δ
ε
ϕ is an adjustment variable for ε
ϕ and meets -
n
-
1
≤
Δ
ε
ϕ
≤
n
-
1. If n rises or the distance between |
ψ
| and ln
⁡
n drops, then the adjustment amplitude becomes lower, else becomes higher. If |
ψ
|
<
ln
⁡
n, then decrease the threshold to soften the terms, else increase the threshold. Δ
χ is calculated through fitting degree, ϕ
(
i
,
j
,
m
), selected by the prediction algorithm, and meeting 0
<
ϕ
(
i
,
j
,
m
)
≤
1. When the fitting of Q
(
i
,
m
) and Q
(
j
,
m
) is poor, the adjustment to χ
[
i
,
m
,
ρ
] needs to be cautious; that is, if ϕ
(
i
+
m
,
n
,
ρ
)
>
0, then it needs to raise the value of χ
[
i
,
m
,
ρ
], and if the extension value Q
(
i
+
m
,
ρ
) approximates Q
(
n
,
ρ
), then the prediction according to Q
(
i
+
m
,
ρ
) is accurate, and the value raising can be large. To determine η, select the best one among value lowering by 5%, current value, and value rising by 5%, and restrict it by a reasonable range to prevent passivating or sharpening.Figure 2
Evolution algorithm flow chart.


### 3.3. Example Analysis

Figure3 gives an example of predicting G
^
(
13,2
) according to the historical feature pattern G
(
0,13
), in which the value of (
n
,
m
,
ρ
) is (
13,3
,
2
), ε
ϕ
=
0.2, χ
[
i
,
m
,
ρ
]
=
0.0, χ
max
⁡
=
0.0, γ
[
i
,
m
,
ρ
]
=
1.0, and η
=
1.0.Figure 3
Trend prediction illustration.According to the prediction algorithm, it can be known through comparing all the values ofQ
(
i
,
3
) with Q
(
10,3
) that when i
=
0 and ϕ
(
0,10,3
)
=
1.00, so Q
(
0,3
) is selected, and when i
=
5 and ϕ
(
5,10,3
)
=
0.42, so Q
(
5,3
)is also selected, and other values are excluded for they meet ϕ
(
i
,
10,3
)
≤
ε
ϕ, which are partly listed in Table 1. When i
=
5, the slope becomes larger at t
=
7 and smaller at t
=
12, which are reflected through ∇
1
θ
7
>
0 and ∇
1
θ
12
<
0 derived by (9), and the relative penalty value is recorded by ϕ
∇
(
5,10,3
). And through normalization process, the elements of set ψ are (
0,0.705,0.67
) and (
5,0.295,0.98
). Thus, the prediction value q
^
13 is equal to 0.705
×
0.67
×
(
-
1.29
)
+
0.295
×
0.98
×
0.50, and so forth, and ρ step trend can be predicted. It can be seen that this scheme has the ability to identify multiple long-range correlation contained in the same situation sequence.Table 1
Similarity metric and punishment value.
i
0
2
3
5
6
8
ϕ
Θ
1.00
−0.85
0.42
0.72
0.32
−0.32
ϕ
∇
0.00
1.01
0.34
0.30
0.30
0.68This part is analyzed according to evolution algorithm. Assuming thatq
13
=
-
0.86 and q
14
=
0.00, so |
ψ
|
=
2, which is smaller than ln
⁡
13; thus, the value of ε
ϕ needs to be lower, and once |
ψ
|
>
2, then raise the value of ε
ϕ. It can be known that the changing value of universality degree χ
[
0,3
,
2
] is 1.00
×
1.00, and raising this degree can strengthen the role of vector Q
(
0,5
). The changing value of χ
[
5,3
,
2
] is 0.42
×
(
-
1.85
), and lowering this value can weaken the interference of vector Q
(
5,5
). To bridge the gap between epitaxial scale and measured scale, γ
[
0,3
,
2
] is adjusted to (
1
-
0.20
)
×
1.00
+
0.20
×
0.67
/
0.67, and γ
[
5,3
,
2
] is adjusted to (
1
-
0.08
)
×
1.00
+
0.08
×
1.72
/
0.98. And for (
f
κ
(
0.95
)
,
f
κ
(
1.00
)
,
f
κ
(
1.05
)
)
=
(
0.13,0.16,0.19
), the value of η needs to rise. Table 2 shows that f
χ
(
5,3
,
2
) becomes smaller, and η becomes larger with continued evolution, which results in rapid rise of w
0
/
w
5, and approach between prediction value and measured value.Table 2
Effects of prediction and evolution.
1
3
5
7
9
ω
0
0.71
0.95
0.98
0.99
1.00
ω
5
0.29
0.05
0.02
0.01
0.00
q
^
13
−0.46
−0.78
−0.83
−0.85
−0.86
q
^
14
0.00
0.00
0.00
0.00
0.00
ε
ϕ
0.19
0.17
0.15
0.13
0.11
f
χ
(
0,3
,
2
)
10.00
10.00
10.00
10.00
10.00
f
χ
(
5,3
,
2
)
3.27
1.18
0.72
0.51
0.40
γ
[
0,3
,
2
]
1.00
1.00
1.00
1.00
1.00
γ
[
5,3
,
2
]
1.06
1.17
1.27
1.35
1.41
η
1.05
1.16
1.28
1.41
1.55With the passage of time,m and ρ keep unchanged, n grows linearly, and the algorithm can delete stale data, save recent data, and correct fitting threshold and universality degree. The above process can be complicated not only by autonomous evolution, but also by artificially modified parameters.


## 3.1. Prediction Algorithm

The prediction algorithm flow is given in Figure1. According to historical feature pattern G
(
0
,
n
-
1
) and occurred indication G
(
n
-
m
,
m
), the algorithm can predict subsequent effect G
^
(
n
,
ρ
) through two main stages, that is, preparation stage and prediction stage, which are marked in the chart.Figure 1
Prediction algorithm flow chart.As shown in the figure, the preparation part circularly promotes the sliding windowG
(
i
,
m
), selects poor values of fitting degree Q
(
i
,
m
) to reject, and sensitizes the product of universality degree f
χ
(
i
,
m
,
ρ
) and fitting degree ϕ
(
i
,
j
,
m
), which is assigned to w. The prediction part first checks whether historical feature pattern set ψ has record. What calls for special attentions is that the value of Q
(
i
,
m
) in the sliding window or the fitting degree value of it with Q
(
j
,
m
) in the occurred indication cannot be too small, because the smaller the above value, the poorer the contribution to prediction value q
^
n
+
k.


## 3.2. Evolution Algorithm

Evolution algorithm is introduced to measure predicting deviation from the views of pattern and accuracy, which can be fine-tuned to raise the adaptability of prediction algorithm.The accuracy of adjustingη to η
×
x can be derived by
(19)
f
k
(
x
)
=
∑
(
i
,
w
,
σ
)
∈
ψ
(
w
x
×
ϕ
(
i
+
m
,
n
,
ρ
)
)
∑
(
i
,
w
,
σ
)
∈
ψ
w
x
,
which is based on current weight set and (18) and meets -
3
<
f
k
(
x
)
≤
1. And the definition can be popularized to f
Λ
(
x
1
,
x
2
,
…
), only when f
k
(
x
i
) is the largest value first met in {
f
k
(
x
1
)
,
f
k
(
x
2
)
,
…
}, which is in ascending order by k of x
k; it can be obtained that
(20)
f
Λ
(
x
1
,
x
2
,
…
)
=
x
i
.As shown in Figure2, the evolution algorithm carries on the variables and results of the prediction algorithm and works to promote adaptability after acquiring measured value. Δ
ε
ϕ is an adjustment variable for ε
ϕ and meets -
n
-
1
≤
Δ
ε
ϕ
≤
n
-
1. If n rises or the distance between |
ψ
| and ln
⁡
n drops, then the adjustment amplitude becomes lower, else becomes higher. If |
ψ
|
<
ln
⁡
n, then decrease the threshold to soften the terms, else increase the threshold. Δ
χ is calculated through fitting degree, ϕ
(
i
,
j
,
m
), selected by the prediction algorithm, and meeting 0
<
ϕ
(
i
,
j
,
m
)
≤
1. When the fitting of Q
(
i
,
m
) and Q
(
j
,
m
) is poor, the adjustment to χ
[
i
,
m
,
ρ
] needs to be cautious; that is, if ϕ
(
i
+
m
,
n
,
ρ
)
>
0, then it needs to raise the value of χ
[
i
,
m
,
ρ
], and if the extension value Q
(
i
+
m
,
ρ
) approximates Q
(
n
,
ρ
), then the prediction according to Q
(
i
+
m
,
ρ
) is accurate, and the value raising can be large. To determine η, select the best one among value lowering by 5%, current value, and value rising by 5%, and restrict it by a reasonable range to prevent passivating or sharpening.Figure 2
Evolution algorithm flow chart.


## 3.3. Example Analysis

Figure3 gives an example of predicting G
^
(
13,2
) according to the historical feature pattern G
(
0,13
), in which the value of (
n
,
m
,
ρ
) is (
13,3
,
2
), ε
ϕ
=
0.2, χ
[
i
,
m
,
ρ
]
=
0.0, χ
max
⁡
=
0.0, γ
[
i
,
m
,
ρ
]
=
1.0, and η
=
1.0.Figure 3
Trend prediction illustration.According to the prediction algorithm, it can be known through comparing all the values ofQ
(
i
,
3
) with Q
(
10,3
) that when i
=
0 and ϕ
(
0,10,3
)
=
1.00, so Q
(
0,3
) is selected, and when i
=
5 and ϕ
(
5,10,3
)
=
0.42, so Q
(
5,3
)is also selected, and other values are excluded for they meet ϕ
(
i
,
10,3
)
≤
ε
ϕ, which are partly listed in Table 1. When i
=
5, the slope becomes larger at t
=
7 and smaller at t
=
12, which are reflected through ∇
1
θ
7
>
0 and ∇
1
θ
12
<
0 derived by (9), and the relative penalty value is recorded by ϕ
∇
(
5,10,3
). And through normalization process, the elements of set ψ are (
0,0.705,0.67
) and (
5,0.295,0.98
). Thus, the prediction value q
^
13 is equal to 0.705
×
0.67
×
(
-
1.29
)
+
0.295
×
0.98
×
0.50, and so forth, and ρ step trend can be predicted. It can be seen that this scheme has the ability to identify multiple long-range correlation contained in the same situation sequence.Table 1
Similarity metric and punishment value.
i
0
2
3
5
6
8
ϕ
Θ
1.00
−0.85
0.42
0.72
0.32
−0.32
ϕ
∇
0.00
1.01
0.34
0.30
0.30
0.68This part is analyzed according to evolution algorithm. Assuming thatq
13
=
-
0.86 and q
14
=
0.00, so |
ψ
|
=
2, which is smaller than ln
⁡
13; thus, the value of ε
ϕ needs to be lower, and once |
ψ
|
>
2, then raise the value of ε
ϕ. It can be known that the changing value of universality degree χ
[
0,3
,
2
] is 1.00
×
1.00, and raising this degree can strengthen the role of vector Q
(
0,5
). The changing value of χ
[
5,3
,
2
] is 0.42
×
(
-
1.85
), and lowering this value can weaken the interference of vector Q
(
5,5
). To bridge the gap between epitaxial scale and measured scale, γ
[
0,3
,
2
] is adjusted to (
1
-
0.20
)
×
1.00
+
0.20
×
0.67
/
0.67, and γ
[
5,3
,
2
] is adjusted to (
1
-
0.08
)
×
1.00
+
0.08
×
1.72
/
0.98. And for (
f
κ
(
0.95
)
,
f
κ
(
1.00
)
,
f
κ
(
1.05
)
)
=
(
0.13,0.16,0.19
), the value of η needs to rise. Table 2 shows that f
χ
(
5,3
,
2
) becomes smaller, and η becomes larger with continued evolution, which results in rapid rise of w
0
/
w
5, and approach between prediction value and measured value.Table 2
Effects of prediction and evolution.
1
3
5
7
9
ω
0
0.71
0.95
0.98
0.99
1.00
ω
5
0.29
0.05
0.02
0.01
0.00
q
^
13
−0.46
−0.78
−0.83
−0.85
−0.86
q
^
14
0.00
0.00
0.00
0.00
0.00
ε
ϕ
0.19
0.17
0.15
0.13
0.11
f
χ
(
0,3
,
2
)
10.00
10.00
10.00
10.00
10.00
f
χ
(
5,3
,
2
)
3.27
1.18
0.72
0.51
0.40
γ
[
0,3
,
2
]
1.00
1.00
1.00
1.00
1.00
γ
[
5,3
,
2
]
1.06
1.17
1.27
1.35
1.41
η
1.05
1.16
1.28
1.41
1.55With the passage of time,m and ρ keep unchanged, n grows linearly, and the algorithm can delete stale data, save recent data, and correct fitting threshold and universality degree. The above process can be complicated not only by autonomous evolution, but also by artificially modified parameters.


## 4. Experiment Results Analysis

The traditional indexes utilized to measure the prediction accuracy include mean absolute error (MAE), standard deviation error (SDE), and mean absolute percentage error (MAPE) [21] derived by
(21)
MAPE
=
1
ρ
∑
k
=
n
+
1
n
+
ρ
|
z
^
k
-
z
k
z
k
|
.This section selects MAPE to obtain the relative error between prediction pattern and measured pattern, which is denoted byE
r. The standard deviation of ρ relative error components is denoted by E
std.


### 4.1. Experiment  1

Figure4 is a critical subsequence selected from actual network attack situation records, which includes various features such as ascent trend, saturation trend, decline trend, periodic fluctuation, and stochastic disturbance.Figure 4
Historical records of network attack situation.From the view of the experimental prediction results, the relative errors of HFPE, ARMA, GM(1,1), and RBFNN are 3.28%, 5.89%, 7.18%, and 16.11%, respectively. As shown in Figure5, in the experiment, ARMA, GM(1,1), and RBFNN need to be artificially identified and protected against cyclical situation fluctuations. The difference transformation utilizes 12 as the distance and is restored after prediction to prevent poor prediction effect; otherwise, the relative errors of GM(1,1) and RBFNN may reach 59.67% and 73.99%, respectively. However, the above method is special, cannot be spread for that data preprocessing of these algorithms does not exist in universal law. On the contrary, HFPE can maintain adaptation to complicated and changeable trends but does not need data preprocessing or artificial cognition.Figure 5
Prediction results of network attack situation.


### 4.2. Experiment  2

This experiment is to randomly choose subsequences with similar parts, repeat 20 times, and then calculate the average value.From the view of the experimental prediction results, the relative errors of HFPE, ARMA, GM(1,1), and RBFNN are 8.09%, 20.89%, 44.89%, and 34.75%, respectively. If the situation sequence selected does not exist in any principle, then the relative errors will be 3.96%, 21.72%, 37.47%, and 53.54%, respectively. Figure6 shows one group of data, in which t
=
42 is a boundary for historical feature pattern and prediction feature pattern.Figure 6
Prediction results of network attack situation.If put all groups of the historical feature patterns into a new long sequence, and repeat above prediction, then the performance of ARMA and GM(1,1) drops rapidly, and that of HFPE does not change much for that longer sequence containing more correlation is benefit to prediction.


### 4.3. Experiment  3

To compare differences among four algorithms, random data are utilized to simulate situation sequences. First, extract random data withξ bits from the entropy pool of Windows 7 system. Then randomly gather subsequence with 16 bits, the former 8 bits of which are occurred indication and the latter 8 bits are subsequent effect. Thirdly, splice occurred indication behind the random sequence to form a historical feature pattern and treat the subsequent effect as a prediction feature pattern. Let us make 100 groups of experiments to test each algorithm’s capacity in resisting random interference and in identifying the correlation with far distance. The average results are listed in Table 3.Table 3
Prediction effects of network attack situation.
ξ
ε
ϕ
E
r
E
std
HFPE
1.2
×
1
0
2
0.930
2.49
0.09
1.2
×
1
0
3
0.980
1.75
0.09
1.0
×
1
0
6
0.998
1.88
0.09
ARMA
1.2
×
1
0
2
—
32.96
0.15
GM(1,1)
1.2
×
1
0
2
—
49.32
0.20
1.2
×
1
0
3
—
51.06
0.18
RBFNN
1.2
×
1
0
2
—
27.87
0.23It can be found from the table data that HFPE has the best performance among the four algorithms. When the scale of experiment is large, this conclusion can be repeated well. And ARMA and RBFNN cannot deal with the random sequences with long bits, while HFPE can perform smoothly.


## 4.1. Experiment  1

Figure4 is a critical subsequence selected from actual network attack situation records, which includes various features such as ascent trend, saturation trend, decline trend, periodic fluctuation, and stochastic disturbance.Figure 4
Historical records of network attack situation.From the view of the experimental prediction results, the relative errors of HFPE, ARMA, GM(1,1), and RBFNN are 3.28%, 5.89%, 7.18%, and 16.11%, respectively. As shown in Figure5, in the experiment, ARMA, GM(1,1), and RBFNN need to be artificially identified and protected against cyclical situation fluctuations. The difference transformation utilizes 12 as the distance and is restored after prediction to prevent poor prediction effect; otherwise, the relative errors of GM(1,1) and RBFNN may reach 59.67% and 73.99%, respectively. However, the above method is special, cannot be spread for that data preprocessing of these algorithms does not exist in universal law. On the contrary, HFPE can maintain adaptation to complicated and changeable trends but does not need data preprocessing or artificial cognition.Figure 5
Prediction results of network attack situation.


## 4.2. Experiment  2

This experiment is to randomly choose subsequences with similar parts, repeat 20 times, and then calculate the average value.From the view of the experimental prediction results, the relative errors of HFPE, ARMA, GM(1,1), and RBFNN are 8.09%, 20.89%, 44.89%, and 34.75%, respectively. If the situation sequence selected does not exist in any principle, then the relative errors will be 3.96%, 21.72%, 37.47%, and 53.54%, respectively. Figure6 shows one group of data, in which t
=
42 is a boundary for historical feature pattern and prediction feature pattern.Figure 6
Prediction results of network attack situation.If put all groups of the historical feature patterns into a new long sequence, and repeat above prediction, then the performance of ARMA and GM(1,1) drops rapidly, and that of HFPE does not change much for that longer sequence containing more correlation is benefit to prediction.


## 4.3. Experiment  3

To compare differences among four algorithms, random data are utilized to simulate situation sequences. First, extract random data withξ bits from the entropy pool of Windows 7 system. Then randomly gather subsequence with 16 bits, the former 8 bits of which are occurred indication and the latter 8 bits are subsequent effect. Thirdly, splice occurred indication behind the random sequence to form a historical feature pattern and treat the subsequent effect as a prediction feature pattern. Let us make 100 groups of experiments to test each algorithm’s capacity in resisting random interference and in identifying the correlation with far distance. The average results are listed in Table 3.Table 3
Prediction effects of network attack situation.
ξ
ε
ϕ
E
r
E
std
HFPE
1.2
×
1
0
2
0.930
2.49
0.09
1.2
×
1
0
3
0.980
1.75
0.09
1.0
×
1
0
6
0.998
1.88
0.09
ARMA
1.2
×
1
0
2
—
32.96
0.15
GM(1,1)
1.2
×
1
0
2
—
49.32
0.20
1.2
×
1
0
3
—
51.06
0.18
RBFNN
1.2
×
1
0
2
—
27.87
0.23It can be found from the table data that HFPE has the best performance among the four algorithms. When the scale of experiment is large, this conclusion can be repeated well. And ARMA and RBFNN cannot deal with the random sequences with long bits, while HFPE can perform smoothly.


## 5. Conclusion

This paper proposes a prediction method based on historical feature pattern, that is, HFPE. The main principle of this algorithm is shown as follows. Fitting degree is introduced to measure the similarity among subsequences from the views of pattern and accuracy. Universality degree is utilized to test the representation of subsequence and its epitaxy. Contrast of the weight system is adjusted by sensitized index, which gives prominence to statistical effect in passivation area and highlights individual strengths in sharpening area. Prediction algorithm and evolution algorithm are proposed to predict situation results according to historical feature patterns. HFPE algorithm maximally reserves the rules in the situation sequences, does not need data preprocessing, and can adapt to the situation changes automatically. The experiment results prove the performance of HFPE.



---

*Source: 473504-2014-04-27.xml*