The differences between different protocols are not considered when selecting identification features in the existing statistical feature-based identification methods. In order to solve the problem, a Semi-supervised Subspace-clustering Protocol Identification Approach (SSPIA) was proposed by combining semi-supervised learning and Fuzzy Subspace Clustering (FSC) method. Firstly, the prior constraint condition was obtained by transforming the labeled sample flow into pairwise constraints information. Secondly, the Semi-supervised Fuzzy Subspace Clustering (SFSC) algorithm was proposed on this basis and was used to guide the process of subspace clustering by using the constraint condition. Then, the mapping between class clusters and protocol types was established to obtain the weight coefficient of each protocol feature, and an individualized cryptographic protocol feature library was constructed for subsequent protocol identification. Finally, the clustering effect and identification effect experiments of five typical cryptographic protocols were carried out. Experimental results show that, compared with the traditional K-means method and FSC method, the proposed SSPIA has better clustering effect, and the protocol identification classifier constructed by SSPIA is more accurate, has higher protocol identification rate and lower error identification rate. The proposed SSPIA improves the identification effect based on statistical features.

Since the tourism text for destinations contains semantic noise and different scenic spots, which can not be displayed intuitively, a new scenic spots-topic model based on the probabilistic topic model was proposed. The model assumed that one document included several scenic spots with correlation, and a special scenic spot named "global scenic spot" was introduced to filter the semantic noise. Then Gibbs sampling algorithm was employed to learn the maximum a posteriori estimates of the model and get a topic distribution vector for each scenic spot. A clustering experiment was conducted to indirectly evaluate the effects of the model and analyze the impact of "global scenic spot" on the model. The result shows that the proposed model has better effect than baseline model such as TF-IDF (Term Frequency-Inverse Document Frequency) and Latent Dirichlet Allocation (LDA), and the "global scenic spot" can improve the modeling effect significantly. Finally, scenic spots association graph was employed to display the result visually.

Concerning of the low accurate rate of active defense technology, a heuristic detection system of Trojan based on the analysis of trajectory was proposed. Two kinds of typical Trojan trajectories were presented, and by using the behavioral data on Trojan trajectory the danger level of the suspicious file was detected with the decision rules and algorithm. The experimental results show that the performance of detecting unknown Trojan of this system is better than that of the traditional method, and some special Trojans can also be detected.

In order to solve the difficult problem that the different number of singular values affects the accuracy of fault identification, caused by Singular Value Decomposition (SVD) for different signals. A fault diagnosis method based on dual SVD and Least Squares Support Vector Machine (LS-SVM) was put forward. The proposed method could adaptively choose effective singular values by using the curvature spectrum of singular values for reconstructing a signal. SVD was carried out again to acquire the same number of orthogonal components and its energy entropy was calculated to construct the feature vector. Finally, it could be used in the LS-SVM classification model for fault identification. Compared with the method of using limited principal singular values as feature vector, the results show that the proposed method applied to the bearing fault diagnosis improves the accuracy of 13.34%. Also, it is feasible and valid.

Concerning the low identification precision of Mel Frequency Cepstral Coefficients (MFCC) parameters in high frequency signals and the problem that the influence of each dimension feature parameters has not been considered to identify, the method of extracting features based on MFCC, IMFCC (Inverted MFCC) and MidMFCC (Mid-frequency MFCC) combined with Fisher criterion was adopted. Extracting MFCC, IMFCC and MidMFCC parameters from speech signals and calculating the Fisher ratio of components of three parameters, useful parameters were chosen by using Fisher standard and a mixture feature was constructed to improve mid-frequency and high frequency recognition accuracy. The experimental results show that the new feature has better recognition results compared with MFCC in the same environment.

High pressure piston diaphragm pump is the most important power source of the pipeline transportation. To solve the problem of on-line monitoring on the fault of internal piston, the authors put forward a detection method based on acoustic emission signal's wavelet packet frequency and Kernel Principal Component Analysis (KPCA). Firstly, the author adopted wavelet packet to deal with the acoustic emission data to get each frequency band energy value. Secondly, the authors used KPCA to decompose the energy in high dimensional space to find the feature model, and made use of statistics SPE and T2 in feature model to make detection on fault signal. Finally, the authors conducted experiments to verify the statistics of acoustic emission of GEHO diaphragm pump's check valve. In comparison with the PCA method, the proposed method can make on-line monitoring on fault of internal piston fast and accurate, so it has good application prospect on the domain of the high pressure piston diaphragm pump's non-destructive fault detection.

To resolve the problem of poor robustness when reaching the Terminal sliding mode control, a time-varying sliding mode control method was proposed. A nonlinear time-varying sliding mode surface was designed after analyzing the influences of designed parameters of sliding mode surface to the performances of system. To deal with the disturbances of a class of Multi-Input Multi-Output (MIMO) nonlinear system, a disturbance observer system was constructed. According to the disturbance observer system, the external disturbances were approached on-line by adjusting the weights. The simulation results show that, the settle-time of the proposed scheme is less than that of PID control by 80%. The proposed method has no overshoots. The simulation results demonstrate that the proposed design can be used on the control of MIMO nonlinear system.

Concerning the problem that untrusted sample can be easily introduced in traditional methods, an adaptive model was proposed in this paper. Based on the description of the structural feature of Request-URL, a whole sample set was divided into smaller subsets. The discreteness of a subset was calculated by its properties, which would determine whether the subset is normal. On basis of these, the detection model was created by the improved algorithm with the normal subsets, and dynamic update of model was achieved by Hidden Markov Model (HMM) merging. The experimental results show that the adaptive model built by the proposed method can effectively identify Web-based attacks and reduce false alert ratio.

To efficiently simplify point cloud by multi-resolution, firstly, uniform grids were used to represent the spatial topology relationship of point cloud and calculate the k-nearest neighbors for each data point. Then normal vectors of data points were estimated by constructing covariance matrix, and normal vectors were directed to the outside of the point cloud. Finally, the formulation for measuring the importance of data point was achieved according the effect of this point on eigenvalues spectrum of the Laplace-Beltrami operator, and it was associated with the k-nearest neighbors of this point and normal vectors, and then multi-resolution simplification of point cloud was realized by changing the value of control factor. The experimental result shows that this algorithm has high simplification rate, fast speed, strong stability, and maitains the small detailed information of point cloud.

Gabor uncertainty features fusion can solve the problem that multiscale Gabor features are unsuitable for ARM because of huge data and dimensions in the embedded face recognition system. Multiscale Gabor features were first extracted, and then the uncertain weight was calculated, at last multiscale Gabor features were integrated into one. The embedded face recognition system detected face by using Haar-like features of face, and reduced dimensions by using 2-Dimensional Principal Component Analysis (2DPCA) algorithm. Based on EELiod 270 development board, the performance of face recognition was tested on ORL and Yale. Comparative results with other face recognition algorithms show that a significant decline is got in the amount of arithmetic operations, and a good real-time recognition is obtained while ensuring the recognition rate.

An improved non-iterative Apriori algorithm was proposed to detect Distributed Denail of Service (DDoS) attacks. An one-step intersection operation was used to process network packets within the specific time range, and the strong correlation rules of the packets were studied so as to achieve the quick detection of DDoS atttacks. In comparison with current algorithms, it shows better performance in efficiency and storage space in detection of DDoS attacks. Experimental results on DARPA data-sets show the algorithm is able to detect DDoS effectively.