The payload of Distribute Denial of Service (DDoS) attack changes drastically, the manual intervention of setting warning threshold relies on experience and the signature of abnormal traffic updates not timely, an improved DDoS attack detection algorithm based on Binary Stream Point Bag of Words (BSP-BoW) model was proposed. The Stream Point (SP) was extracted automatically from current network traffic data, the adaptive anomaly detection was carried out for different topology networks, and the labor cost was reduced by decreasing frequently updated feature set. Firstly, the mean clustering was carried out for the existing attack traffic and normal traffic to look for SP in the network traffic. Then, the original traffic was mapped to the corresponding SP for formalized expression by histogram. Finally, the DDoS was detected and classified by Euclidean distance. The experimental results on public database DARPA LLDOS1.0 show that, compared with Locally Weighted Learning (LWL), Support Vector Machine (SVM), Random Tree (RT), Logistic regression analysis (Logistic), Naive Bayes (NB), the proposed algorithm has higher recognition rate of abnormal network traffic. The proposed algorithm based on BoW model has the good recognition effect and generalization ability in abnormal network traffic recognition of denial of service attack, which is suitable for the deployment in the Small Medium Enterprise (SME) network traffic equipment.

In order to solve the subband decomposition problem of the wideband signal with a large spectrum scope, a new method for nun-uniform subband decomposition based on Power Spectral Density (PSD) was proposed to dynamically adjust the number and bandwidth of subband, reasonably control the autocorrelation matrix eigenvalue spread of subband signals and improve the performance and efficiency of subband signal processing. For a given sequence, the number of subbands and the spectrum range of subband were determined through power spectrum estimation. Then the subband signal was shifted to zero frequency using subband modulation to achieve signal decomposition. The eigenvalue spread of subband signal and signal reconstruction performance were analyzed using Matlab. The experimental results show that, compared with the existing methods with equal number of subbands, the proposed one using the distribution information of PSD can effectively control the eigenvalue spread of subband while maintaining well signal reconstruction performance.

The existing methods of constructing Voronoi diagram have low efficiency and high complexity, to remedy the disadvantages, a new method of constructing and updating Voronoi diagram based on the hybrid methods was given to query the nearest neighbor of the given spatial data effectively, and a new method of searching the nearest neighbor based on Voronoi diagram and the minimum inscribed circle was presented. To deal with the frequent, changes of the query point position, the method based on Voronoi diagram and the minimum bounding rectangle was proposed. To improve the efficiency of the dual nearest neighbor pair and closest pair query, a new method was given based on Voronoi polygons and their minimum inscribed circles. The experimental results show that the proposed methods reduce the additional computation caused by the uneven distribution of data and have a large advantage for the big dataset and the frequent query.

To realize the building and controlling of workflow patterns involving multiple instances, a solution was proposed from the perspective of network partition. The implementing method was discussed based on RTWD net proposed by HU Fei-hu, et al. in Patent China 201010114083.9. First, the sub-workflows involving multiple instances should be divided into a subnet. Then the related parameters of multiple instances were defined, and multiple instances were controlled based on it. The paper discussed the controlling of sequential, synchronous and asynchronous parallel workflow patterns involving multiple instances based on the method. Because the divided subnet keeps consistent with the definition of workflow model, multiple instances can be scheduled by original workflow engine, which simplifies the realization of multiple instance patterns.