This paper proposes an anomaly-detection method using the Fast xFlow Proxy, which enables fine-grained measurement of communication traffic. When a fault occurs in services or networks, communication traffic changes from its normal behavior. Therefore, anomalies can be detected by analyzing their autocorrelations. However, in large-scale carrier networks, packets are generally encapsulated and observed as aggregate values, making it difficult to detect minute changes in individual communication flows. Therefore, we developed the Fast xFlow Proxy, which analyzes encapsulated packets in real time and enables flows to be measured at an arbitrary granularity. In this paper, we propose an algorithm that utilizes the Fast xFlow Proxy to detect not only the anomaly occurrence but also its cause, that is, the location of the fault at the end-to-end. The idea is not only to analyze the autocorrelation of a specific flow but also to apply spatial analysis to estimate the fault location by comparing the behavior of multiple flows. Through extensive simulations, we demonstrate that base station, network, and service faults can be detected without any false negative detections.

Recent localization methods for wireless networks cannot be applied to dynamic networks with unknown topology. To solve this problem, we propose a localization method based on partial correlation analysis in this paper. We evaluate our proposed localization method in terms of accuracy, which shows that our proposed method can achieve high accuracy localization for dynamic networks with unknown topology.

Robustness of complex networks is an essential subject for improving their performance when vertices or links are removed due to potential threats. In recent years, significant advancements have been achieved in this field by many researchers. In this paper we show an overview from a novel statistic perspective. We present a brief review about complex networks at first including 2 primary network models, 12 popular attack strategies and the most convincing network robustness metrics. Then, we focus on the correlations of 12 attack strategies with each other, and the difference of the correlations from one network model to the other. We are also curious about the robustness of networks when vertices are removed according to different attack strategies and the difference of robustness from one network model to the other. Our aim is to observe the correlation mechanism of centralities for distinct network models, and compare the network robustness when different centralities are applied as attacking directors to distinct network models. What inspires us is that maybe we can find a paradigm that combines several high-destructive attack strategies to find the optimal strategy based on the deep learning framework.

Automatic generation of textual stories from visual data representation, known as visual storytelling, is a recent advancement in the problem of images-to-text. Instead of using a single image as input, visual storytelling processes a sequential array of images into coherent sentences. A story contains non-visual concepts as well as descriptions of literal object(s). While previous approaches have applied external knowledge, our approach was to regard the non-visual concept as the semantic correlation between visual modality and textual modality. This paper, therefore, presents new features representation based on a canonical correlation analysis between two modalities. Attention mechanism are adopted as the underlying architecture of the image-to-text problem, rather than standard encoder-decoder models. Canonical Correlation Attention Mechanism (CAAM), the proposed end-to-end architecture, extracts time series correlation by maximizing the cross-modal correlation. Extensive experiments on VIST dataset ( http://visionandlanguage.net/VIST/dataset.html ) were conducted to demonstrate the effectiveness of the architecture in terms of automatic metrics, with additional experiments show the impact of modality fusion strategy.

Objective interestingness measures play a vital role in association rule mining of a large-scaled database because they are used for extracting, filtering, and ranking the patterns. In the past, several measures have been proposed but their similarities or relations are not sufficiently explored. This work investigates sixty-one objective interestingness measures on the pattern of A → B, to analyze their similarity and dissimilarity as well as their relationship. Three-probability patterns, P(A), P(B), and P(AB), are enumerated in both linear and exponential scales and each measure's values of those conditions are calculated, forming synthesis data for investigation. The behavior of each measure is explored by pairwise comparison based on these three-probability patterns. The relationship among the sixty-one interestingness measures has been characterized with correlation analysis and association rule mining. In the experiment, relationships are summarized using heat-map and association rule mined. As the result, selection of an appropriate interestingness measure can be realized using the generated heat-map and association rules.

Temporal behavior is a primary aspect of business process executions. Herein, we propose a temporal outlier detection and analysis method for business processes. Particularly, the method performs correlation analysis between the execution times of traces and activities to determine the type of activities that significantly influences the anomalous temporal behavior of a trace. To this end, we describe the modeling of temporal behaviors considering different control-flow patterns of business processes. Further, an execution time matrix with execution times of activities in all traces is constructed by using the event logs. Based on this matrix, we perform temporal outlier detection and correlation-based analysis.

In this letter, we propose a supervised bimodal emotion recognition approach based on two important human emotion modalities including facial expression and body gesture. A effectively supervised feature fusion algorithms named supervised multiset canonical correlation analysis (SMCCA) is presented to established the linear connection between three sets of matrices, which contain the feature matrix of two modalities and their concurrent category matrix. The test results in the bimodal emotion recognition of the FABO database show that the SMCCA algorithm can get better or considerable efficiency than unsupervised feature fusion algorithm covering canonical correlation analysis (CCA), sparse canonical correlation analysis (SCCA), multiset canonical correlation analysis (MCCA) and so on.

A method for accurate estimation of personalized video preference using multiple users' viewing behavior is presented in this paper. The proposed method uses three kinds of features: a video, user's viewing behavior and evaluation scores for the video given by a target user. First, the proposed method applies Supervised Multiview Spectral Embedding (SMSE) to obtain lower-dimensional video features suitable for the following correlation analysis. Next, supervised Multi-View Canonical Correlation Analysis (sMVCCA) is applied to integrate the three kinds of features. Then we can get optimal projections to obtain new visual features, “canonical video features” reflecting the target user's individual preference for a video based on sMVCCA. Furthermore, in our method, we use not only the target user's viewing behavior but also other users' viewing behavior for obtaining the optimal canonical video features of the target user. This unique approach is the biggest contribution of this paper. Finally, by integrating these canonical video features, Support Vector Ordinal Regression with Implicit Constraints (SVORIM) is trained in our method. Consequently, the target user's preference for a video can be estimated by using the trained SVORIM. Experimental results show the effectiveness of our method.

Network traffic forecasts, as it is well known, can be useful for network resource optimization. In order to minimize the forecast error by maximizing information utilization with low complexity, this paper concerns the difference of traffic trends at large time scales and fits a dual-related model to predict it. First, by analyzing traffic trends based on user behavior, we find both hour-to-hour and day-to-day patterns, which means that models based on either of the single trends are unable to offer precise predictions. Then, a prediction method with the consideration of both daily and hourly traffic patterns, called the dual-related forecasting method, is proposed. Finally, the correlation for traffic data is analyzed based on model parameters. Simulation results demonstrate the proposed model is more effective in reducing forecasting error than other models.

A novel dimensionality reduction method, Fisher Discriminant Locality Preserving Canonical Correlation Analysis (FDLP-CCA), for visualizing Web images is presented in this paper. FDLP-CCA can integrate two modalities and discriminate target items in terms of their semantics by considering unique characteristics of the two modalities. In this paper, we focus on Web images with text uploaded on Social Networking Services for these two modalities. Specifically, text features have high discriminate power in terms of semantics. On the other hand, visual features of images give their perceptual relationships. In order to consider both of the above unique characteristics of these two modalities, FDLP-CCA estimates the correlation between the text and visual features with consideration of the cluster structure based on the text features and the local structures based on the visual features. Thus, FDLP-CCA can integrate the different modalities and provide separated manifolds to organize enhanced compactness within each natural cluster.

An transfer learning method, called Kernel Canonical Correlation Analysis plus (KCCA+), is proposed for heterogeneous Cross-company defect prediction. Combining the kernel method and transfer learning techniques, this method improves the performance of the predictor with more adaptive ability in nonlinearly separable scenarios. Experiments validate its effectiveness.

This paper presents human-centered video feature selection via mRMR-SCMMCCA (minimum Redundancy and Maximum Relevance-Specific Correlation Maximization Multiset Canonical Correlation Analysis) algorithm for preference extraction. The proposed method derives SCMMCCA, which simultaneously maximizes two kinds of correlations, correlation between video features and users' viewing behavior features and correlation between video features and their corresponding rating scores. By monitoring the derived correlations, the selection of the optimal video features that represent users' individual preference becomes feasible.

A brain-computer interface (BCI) translates the brain activity into commands to control external devices. P300 speller based character recognition is an important kind of application system in BCI. In this paper, we propose a framework to integrate channel correlation analysis into P300 detection. This work is distinguished by two key contributions. First, a coefficient matrix is introduced and constructed for multiple channels with the elements indicating channel correlations. Agglomerative clustering is applied to group correlated channels. Second, the statistics of central tendency are used to fuse the information of correlated channels and generate virtual channels. The generated virtual channels can extend the EEG signals and lift up the signal-to-noise ratio. The correlated features from virtual channels are combined with original signals for classification and the outputs of discriminative classifier are used to determine the characters for spelling. Experimental results prove the effectiveness and efficiency of the channel correlation analysis based framework. Compared with the state-of-the-art, the recognition rate was increased by both 6% with 5 and 10 epochs by the proposed framework.

The Virtual Machine Consolidation (VMC) algorithm is the core strategy of virtualization resource management software. In general, VMC efficiency dictates cloud datacenter efficiency to a great extent. However, all the current Virtual Machine (VM) consolidation strategies, including the Iterative Correlation Match Algorithm (ICMA), are not suitable for the dynamic VM consolidation of the level of physical servers in actual datacenter environments. In this paper, we propose two VM consolidation and placement strategies which are called standard Segmentation Iteration Correlation Combination (standard SICC) and Multi-level Segmentation Iteration Correlation Combination (multi-level SICC). The standard SICC is suitable for the single-size VM consolidation environment and is the cornerstone of multi-level SICC which is suitable for the multi-size VM consolidation environment. Numerical simulation results indicate that the numbers of remaining Consolidated VM (CVM), which are generated by standard SICC, are 20% less than the corresponding parameters of ICMA in the single-level VM environment with the given initial condition. The numbers of remaining CVMs of multi-level SICC are 14% less than the corresponding parameters of ICMA in the multi-level VM environment. Furthermore, the used physical servers of multi-level SICC are also 5% less than the used servers of ICMA under the given initial condition.

For compressed sensing, to address problems which do not involve reconstruction, a correlation analysis between measurements and the transform coefficients is proposed. It is shown that there is a linear relationship between them, which indicates that we can abstract the inner property of images directly in the measurement domain.

Most existing outlier detection algorithms only utilized location of trajectory points and neglected some important factors such as speed, acceleration, and corner. To address this problem, we present a Trajectory Outlier Detection algorithm based on Multi-Factors (TODMF). TODMF is improved in terms of distance-based outlier detection algorithms. It combines multi-factors into outlier detection to find more meaningful trajectory outliers. We resort to Canonical Correlation Analysis (CCA) to optimize the number of factors when determining what factors will be considered. Finally, the experiments with real trajectory data sets show that TODMF performs efficiently and effectively when applied to the problem of trajectory outlier detection.

In this letter, we research the method of using face and gesture image sequences to deal with the video-based bimodal emotion recognition problem, in which both Harris plus cuboids spatio-temporal feature (HST) and sparse canonical correlation analysis (SCCA) fusion method are applied to this end. To efficaciously pick up the spatio-temporal features, we adopt the Harris 3D feature detector proposed by Laptev and Lindeberg to find the points from both face and gesture videos, and then apply the cuboids feature descriptor to extract the facial expression and gesture emotion features [1],[2]. To further extract the common emotion features from both facial expression feature set and gesture feature set, the SCCA method is applied and the extracted emotion features are used for the biomodal emotion classification, where the K-nearest neighbor classifier and the SVM classifier are respectively used for this purpose. We test this method on the biomodal face and body gesture (FABO) database and the experimental results demonstrate the better recognition accuracy compared with other methods.

In order to cope with the continuous evolution in cyber threats, many security products (e.g., IDS/IPS, TMS, Firewalls) are being deployed in the network of organizations, but it is not so easy to monitor and analyze the security events triggered by the security products constantly and effectively. Thus, in many cases, real-time incident analysis and response activities for each organization are assigned to an external dedicated security center. However, since the external security center deploys its security appliances to only the boundary or the single point of the network, it is very difficult to understand the entire network situation and respond to security incidents rapidly and accurately if they depend on only a single type of security information. In addition, security appliances trigger an unmanageable amount of alerts (in fact, by some estimates, several thousands of alerts are raised everyday, and about 99% of them are false positives), this situation makes it difficult for the analyst to investigate all of them and to identify which alerts are more serious and which are not. In this paper, therefore, we propose an advanced incident response methodology to overcome the limitations of the existing incident response scheme. The main idea of our methodology is to utilize polymorphic security events which can be easily obtained from the security appliances deployed in each organization, and to subject them to correlation analysis. We evaluate the proposed methodology using diverse types of real security information and the results show the effectiveness and superiority of the proposed incident response methodology.

Network monitoring systems that detect and analyze malicious activities as well as respond against them, are becoming increasingly important. As malwares, such as worms, viruses, and bots, can inflict significant damages on both infrastructure and end user, technologies for identifying such propagating malwares are in great demand. In the large-scale darknet monitoring operation, we can see that malwares have various kinds of scan patterns that involves choosing destination IP addresses. Since many of those oscillations seemed to have a natural periodicity, as if they were signal waveforms, we considered to apply a spectrum analysis methodology so as to extract a feature of malware. With a focus on such scan patterns, this paper proposes a novel concept of malware feature extraction and a distinct analysis method named "SPectrum Analysis for Distinction and Extraction of malware features (SPADE)". Through several evaluations using real scan traffic, we show that SPADE has the significant advantage of recognizing the similarities and dissimilarities between the same and different types of malwares.

A novel video retrieval method based on Web community extraction using audio and visual features and textual features of video materials is proposed in this paper. In this proposed method, canonical correlation analysis is applied to these three features calculated from video materials and their Web pages, and transformation of each feature into the same variate space is possible. The transformed variates are based on the relationships between visual, audio and textual features of video materials, and the similarity between video materials in the same feature space for each feature can be calculated. Next, the proposed method introduces the obtained similarities of video materials into the link relationship between their Web pages. Furthermore, by performing link analysis of the obtained weighted link relationship, this approach extracts Web communities including similar topics and provides the degree of attribution of video materials in each Web community for each feature. Therefore, by calculating similarities of the degrees of attribution between the Web communities extracted from the three kinds of features, the desired ones are automatically selected. Consequently, by monitoring the degrees of attribution of the obtained Web communities, the proposed method can perform effective video retrieval. Some experimental results obtained by applying the proposed method to video materials obtained from actual Web pages are shown to verify the effectiveness of the proposed method.