Herein, we analytically derive the effective index and field distribution of the LP01 mode of a step-index N-sided regular-polygonal-core fiber. To do this, we utilize the lowest-order non-anomalous approximation of the π/N expansion. These properties are also calculated numerically and the results are compared the with approximations.

In this letter, we investigate the price-based power allocation for non-orthogonal multiple access (NOMA) networks, where the base station (BS) can admit the users to transmit by pricing their power. Stackelberg game is utilized to model the pricing and power purchasing strategies between the BS and the users. Based on backward induction, the pricing problem of the BS is recast into the non-convex power allocation problem, which is equivalent to the rate allocation problem by variable replacement. Based on the equivalence problem, an optimal price-based power allocation algorithm is proposed to maximize the revenue of the BS. Simulation results show that the proposed algorithm is superior to the existing pricing algorithm in items of the revenue of BS and the number of admitted users.

System logs are useful to understand the status of and detect faults in large scale networks. However, due to their diversity and volume of these logs, log analysis requires much time and effort. In this paper, we propose a log event anomaly detection method for large-scale networks without pre-processing and feature extraction. The key idea is to embed a large amount of diverse data into hidden states by using latent variables. We evaluate our method with 12 months of system logs obtained from a nation-wide academic network in Japan. Through comparisons with Kleinberg's univariate burst detection and a traditional multivariate analysis (i.e., PCA), we demonstrate that our proposed method achieves 14.5% higher recall and 3% higher precision than PCA. A case study shows detected anomalies are effective information for troubleshooting of network system faults.

This paper proposes an anomaly prediction method based on k-means clustering that assumes embedded devices with memory constraints. With this method, by checking control system behavior in detail using k-means clustering, it is possible to predict anomalies. However, continuing clustering is difficult because data accumulate in memory similar to existing k-means clustering method, which is problematic for embedded devices with low memory capacity. Therefore, we also propose k-means clustering to continue clustering for infinite stream data. The proposed k-means clustering method is based on online k-means clustering of sequential processing. The proposed k-means clustering method only stores data required for anomaly prediction and releases other data from memory. Due to these characteristics, the proposed k-means clustering realizes that anomaly prediction is performed by reducing memory consumption. Experiments were performed with actual data of control system for anomaly prediction. Experimental results show that the proposed anomaly prediction method can predict anomaly, and the proposed k-means clustering can predict anomalies similar to standard k-means clustering while reducing memory consumption. Moreover, the proposed k-means clustering demonstrates better results of anomaly prediction than existing online k-means clustering.

The number of Internet-of-Things (IoT) devices will increase rapidly. In next-generation mobile communication systems, a base station (BS) must effectively accommodate massive numbers of IoT devices. To address this problem, we have proposed a novel up-link non-orthogonal multiple access (NOMA) system that can also be utilized for low latency communication. We have developed and evaluated the system through computer simulation. This paper describes experiments conducted on a prototype system in actual environments. The paper shows results of the experiments when 3 fixed user equipments (UEs) and 2 mobile UEs transmitted signals simultaneously to a BS and then the BS separated superimposed signals using successive interference cancellation (SIC). We also evaluated repetition transmission (RT) and space receive diversity (SD) techniques employed to enhance the signal separation performance for NOMA systems. The results of the experiments confirm that the system using neither SD nor RT could separate 3.5 UEs' signals on average while employing either SD or RT could make the number increase to 4.1 and 4.0, respectively. When both SD and RT were employed, the number rose to 4.4.

Since cyber attacks such as cyberterrorism against Industrial Control Systems (ICSs) and cyber espionage against companies managing them have increased, the techniques to detect anomalies in early stages are required. To achieve the purpose, several studies have developed anomaly detection methods for ICSs. In particular, some techniques using packet flow regularity in industrial control networks have achieved high-accuracy detection of attacks disrupting the regularity, i.e. normal behaviour, of ICSs. However, these methods cannot identify scanning attacks employed in cyber espionage because the probing packets assimilate into a number of normal ones. For example, the malware called Havex is customised to clandestinely acquire information from targeting ICSs using general request packets. The techniques to detect such scanning attacks using widespread packets await further investigation. Therefore, the goal of this study was to examine high performance methods to identify anomalies even if elaborate packets to avoid alert systems were employed for attacks against industrial control networks. In this paper, a novel detection model for anomalous packets concealing behind normal traffic in industrial control networks was proposed. For the proposal of the sophisticated detection method, we took particular note of packet flow regularity and employed the Markov-chain model to detect anomalies. Moreover, we regarded not only original packets but similar ones to them as normal packets to reduce false alerts because it was indicated that an anomaly detection model using the Markov-chain suffers from the ample false positives affected by a number of normal, irregular packets, namely noise. To calculate the similarity between packets based on the packet flow regularity, a vector representation tool called word2vec was employed. Whilst word2vec is utilised for the culculation of word similarity in natural language processing tasks, we applied the technique to packets in ICSs to calculate packet similarity. As a result, the Markov-chain with word2vec model identified scanning packets assimulating into normal packets in higher performance than the conventional Markov-chain model. In conclusion, employing both packet flow regularity and packet similarity in industrial control networks contributes to improving the performance of anomaly detection in ICSs.

Detecting anomalies, such as network failure or intentional attack in Internet, is a vital but challenging task. Although numerous techniques have been developed based on Internet traffic, detecting anomalies from the perspective of Internet topology structure is going to be possible because the anomaly detection of structured datasets based on complex network theory has become a focus of attention recently. In this paper, an anomaly detection method for the large-scale Internet topology is proposed to detect local structure crashes caused by the cascading failure. In order to quantify the dynamic changes of Internet topology, the network path changes coefficient (NPCC) is put forward which highlights the Internet abnormal state after it is attacked continuously. Furthermore, inspired by Fibonacci Sequence, we proposed the decision function that can determine whether the Internet is abnormal or not. That is the current Internet is abnormal if its NPCC is out of the normal domain calculated using the previous k NPCCs of Internet topology. Finally the new Internet anomaly detection method is tested against the topology data of three Internet anomaly events. The results show that the detection accuracy of all events are over 97%, the detection precision for three events are 90.24%, 83.33% and 66.67%, when k=36. According to the experimental values of index F1, larger values of k offer better detection performance. Meanwhile, our method has better performance for the anomaly behaviors caused by network failure than those caused by intentional attack. Compared with traditional anomaly detection methods, our work is more simple and powerful for the government or organization in items of detecting large-scale abnormal events.

This paper studies a wireless powered communication network (WPCN) with non-orthogonal multiple access (NOMA) under successive interference cancellation (SIC) constraints, where the users first harvest energy from the power station and then transmit data to the information receiver simultaneously. Under this setup, we investigate the system throughput maximization problem. We first formulate an optimization problem for a general case, which is non-convex. To derive the optimal solution, new variables are introduced to transform the initial problem into a convex optimization problem. For a special case, i.e., two-user case, the optimal solution is derived as a closed-form expression. Simulations on the effect of SIC constraints show the importance of the distinctness among users' channels for the proposed model.

In this letter, we consider the power allocation scheme with rate proportional fairness to maximize energy efficiency in the downlink the non-orthogonal multiple access (NOMA) systems. The optimization problem of energy efficiency is a non-convex optimization problem, and the fractional programming is used to transform the original problem into a series of optimization sub-problems. A two-layer iterative algorithm is proposed to solve these sub-problems, in which power allocation with the fixed energy efficiency is achieved in the inner layer, and the optimal energy efficiency of the system is obtained by the bisection method in the outer layer. Simulation results show the effectiveness of the proposed algorithm.

Small delay caused by a resistive open is difficult to test since circuit delay varies depending on various factors such as process variations and crosstalk even in fault-free circuits. We consider the problem of discriminating a resistive open by anomaly detection using delay distributions obtained by the effect of various input signals provided to adjacent lines. We examined the circuit delay in a fault-free circuit and a faulty circuit by applying electromagnetic simulator and circuit simulator for a line structure with adjacent lines under consideration of process variations. The effectiveness of the method that discriminates a resistive open is shown for the results obtained by the simulation.

In this letter, we investigate the price-based power allocation with rate proportional fairness constraint in downlink non-orthogonal multiple access (NOMA) systems. The Stackelberg game is utilized to model the interaction between the base station (BS) and users. The revenue maximization problem of the BS is first converted to rate allocation problem, then the optimal rate allocation for each user is obtained by variable substitution. Finally, a price-based power allocation with rate proportional fairness (PAPF) algorithm is proposed based on the relationship between rate and transmit power. Simulation results show that the proposed PAPF algorithm is superior to the previous price-based power allocation algorithm in terms of fairness index and minimum normalized user (MNU) rate.

Recently, non-orthogonal multiple access (NOMA) has gained a great deal of attention due to its ability to simultaneously transmit multiple streams. Device-to-device (D2D) relaying can increase the spectral efficiency via direct communication between two devices, and extends coverage by relaying signals from the base station. In this letter, we propose applying the NOMA technique for D2D relay where D2D relaying and D2D communication can be done simultaneously in the power domain. The proposed scheme can achieve higher spectral efficiency, and its performance is evaluated through extensive simulations in multiple-cell environments, compared with conventional D2D relay schemes.

As advances in networking technology help to connect industrial control networks with the Internet, the threat from spammers, attackers and criminal enterprises has also grown accordingly. However, traditional Network Intrusion Detection System makes significant use of pattern matching to identify malicious behaviors and have bad performance on detecting zero-day exploits in which a new attack is employed. In this paper, a novel method of anomaly detection in industrial control network is proposed based on RNN-GBRBM feature decoder. The method employ network packets and extract high-quality features from raw features which is selected manually. A modified RNN-RBM is trained using the normal traffic in order to learn feature patterns of the normal network behaviors. Then the test traffic is analyzed against the learned normal feature pattern by using osPCA to measure the extent to which the test traffic resembles the learned feature pattern. Moreover, we design a semi-supervised incremental updating algorithm in order to improve the performance of the model continuously. Experiments show that our method is more efficient in anomaly detection than other traditional approaches for industrial control network.

In this paper, we study robust Principal Component Analysis (PCA)-based anomaly detection techniques in network traffic, which can detect traffic anomalies by projecting measured traffic data onto a normal subspace and an anomalous subspace. In a PCA-based anomaly detection, outliers, anomalies with excessively large traffic volume, may contaminate the subspaces and degrade the performance of the detector. To solve this problem, robust PCA methods have been studied. In a robust PCA-based anomaly detection scheme, outliers can be removed from the measured traffic data before constructing the subspaces. Although the robust PCA methods are promising, they incure high computational cost to obtain the optimal location vector and scatter matrix for the subspace. We propose a novel anomaly detection scheme by extending the minimum covariance determinant (MCD) estimator, a robust PCA method. The proposed scheme utilizes the daily periodicity in traffic volume and attempts to detect anomalies for every period of measured traffic. In each period, before constructing the subspace, outliers are removed from the measured traffic data by using a location vector and a scatter matrix obtained in the preceding period. We validate the proposed scheme by applying it to measured traffic data in the Abiline network. Numerical results show that the proposed scheme provides robust anomaly detection with less computational cost.

Detecting traffic anomalies is an indispensable component of overall security architecture. As Internet and traffic data with more sophisticated attacks grow exponentially, preserving security with signature-based traffic analyzers or analyzers that do not support massive traffic are not sufficient. In this paper, we propose a novel method based on combined sketch technique and S-transform analysis for detecting anomalies in massive traffic streams. The method does not require any prior knowledge such as attack patterns and models representing normal traffic behavior. To detect anomalies, we summarize the entropy of traffic data over time and maintain the summarized data in sketches. The entropy fluctuation of the traffic data aggregated to the same bucket is observed by S-transform to detect spectral changes referred to as anomalies in this work. We evaluated the performance of the method with real-world backbone traffic collected at the United States and Japan transit link in terms of both accuracy and false positive rates. We also explored the method parameters' influence on detection performance. Furthermore, we compared the performance of our method to S-transform-based and Wavelet-based methods. The results demonstrated that our method was capable of detecting anomalies and overcame both methods. We also found that our method was not sensitive to its parameter settings.

Anomaly detection has several practical applications in different areas, including intrusion detection, image processing, and behavior analysis among others. Several approaches have been developed for this task such as detection by classification, nearest neighbor approach, and clustering. This paper proposes alternative clustering algorithms for the task of anomaly detection. By employing a weighted kernel extension of the least squares fitting of linear manifolds, we develop fuzzy clustering algorithms for kernel manifolds. Experimental results show that the proposed algorithms achieve promising performances compared to hard clustering techniques.

We outline a number of high temperature superconducting Josephson junction-based devices including superconducting quantum interference devices (SQUIDs) developed for a wide range of applications including geophysical exploration, magnetic anomaly detection, terahertz (THz) imaging and microwave communications. All these devices are based on our patented technology for fabricating YBCO step-edge junction on MgO substrates. A key feature to the successful application of devices based on this technology is good stability, long term reliability, low noise and inherent flexibility of locating junctions anywhere on a substrate.

We propose an anomaly detection method for finding patterns in network traffic that do not conform to legitimate (i.e., normal) behavior. The proposed method trains a baseline model describing the normal behavior of network traffic without using manually labeled traffic data. The trained baseline model is used as the basis for comparison with the audit network traffic. This anomaly detection works in an unsupervised manner through the use of time-periodic packet sampling, which is used in a manner that differs from its intended purpose – the lossy nature of packet sampling is used to extract normal packets from the unlabeled original traffic data. Evaluation using actual traffic traces showed that the proposed method has false positive and false negative rates in the detection of anomalies regarding TCP SYN packets comparable to those of a conventional method that uses manually labeled traffic data to train the baseline model. Performance variation due to the probabilistic nature of sampled traffic data is mitigated by using ensemble anomaly detection that collectively exploits multiple baseline models in parallel. Alarm sensitivity is adjusted for the intended use by using maximum- and minimum-based anomaly detection that effectively take advantage of the performance variations among the multiple baseline models. Testing using actual traffic traces showed that the proposed anomaly detection method performs as well as one using manually labeled traffic data and better than one using randomly sampled (unlabeled) traffic data.

With the consideration of real-time stream processing technology, it's important to develop high availability mechanism to guarantee stream-based application not interfered by faults caused by potential anomalies. In this paper, we present a novel online prediction technique for predicting some anomalies which may occur in the near future. Concretely, we first present a value prediction which combines the Hidden Markov Model and the Mixture of Expert Model to predict the values of feature metrics in the near future. Then we employ the Support Vector Machine to do anomaly identification, which is a procedure to identify the kind of anomaly that we are about to alarm. The purpose of our approach is to achieve a tradeoff between fault penalty and resource cost. The experiment results show that our approach is of high accuracy for common anomaly prediction and low runtime overhead.

We quantitatively evaluate how sampling and spatio/temporal granularity in traffic monitoring affect the detectability of anomalous traffic. Those parameters also affect the monitoring burden, so network operators face a trade-off between the monitoring burden and detectability and need to know which are the optimal paramter values. We derive equations to calculate the false positive ratio and false negative ratio for given values of the sampling rate, granularity, statistics of normal traffic, and volume of anomalies to be detected. Specifically, assuming that the normal traffic has a Gaussian distribution, which is parameterized by its mean and standard deviation, we analyze how sampling and monitoring granularity change these distribution parameters. This analysis is based on observation of the backbone traffic, which exhibits spatially uncorrelated and temporally long-range dependence. Then we derive the equations for detectability. With those equations, we can answer the practical questions that arise in actual network operations: what sampling rate to set to find the given volume of anomaly, or, if the sampling is too high for actual operation, what granularity is optimal to find the anomaly for a given lower limit of sampling rate.