Yu Yao

Northeastern University

Author Statistics

Papers

Citation

H-Index

i-10 index

Research Trends

Author Order

Document Type

Co-Authors

Fuxiang Gao

Northeastern University

Wei Yang

Northeastern University

Ge Yu

Northeastern University

Chuan Sheng

Swinburne University of Technology

Qiang Fu

Northeastern University

Hao Guo

China Institute of Atomic Energy

Tongliang Liu

University of Sydney

Gang Niu

Xi'an Jiaotong University

Bo Han

Hong Kong Baptist University

Mingming Gong

University of Melbourne

Cooperative Institutions

Northeastern University

Chinese Academy of Sciences

Harbin Institute of Technology

Lanzhou University

Universidad del Noreste

Huazhong University of Science and Technology

Shanghai Jiao Tong University

University of Chinese Academy of Sciences

Tsinghua University

Pacific Northwest National Laboratory

Author Statistics

Papers

Citation

H-Index

i-10 index

Research Field

The Worm Propagation Model with Dual Dynamic Quarantine Strategy

Communications in computer and information science (2010)

Yu Yao Xiao-wu Xie Hao Guo Fuxiang Gao Ge Yu

Basic reproduction number

10.1007/978-3-642-18134-4_79

Cite

Citations (2)

A Conditional Independence Test in the Presence of Discretization

arXiv (Cornell University) (2024)

Boyang Sun Yu Yao Huangyuan Hao Yumou Qiu Kun Zhang

Testing conditional independence has many applications, such as in Bayesian network learning and causal discovery. Different test methods have been proposed. However, existing methods generally can not work when only discretized observations are available. Specifically, consider $X_1$, $\tilde{X}_2$ and $X_3$ are observed variables, where $\tilde{X}_2$ is a discretization of latent variables $X_2$. Applying existing test methods to the observations of $X_1$, $\tilde{X}_2$ and $X_3$ can lead to a false conclusion about the underlying conditional independence of variables $X_1$, $X_2$ and $X_3$. Motivated by this, we propose a conditional independence test specifically designed to accommodate the presence of such discretization. To achieve this, we design the bridge equations to recover the parameter reflecting the statistical information of the underlying latent continuous variables. An appropriate test statistic and its asymptotic distribution under the null hypothesis of conditional independence have also been derived. Both theoretical results and empirical validation have been provided, demonstrating the effectiveness of our test methods.

Conditional independence

Independence

10.48550/arxiv.2404.17644

Cite

Citations (0)

P2P Worm Propagation Modeling and Analysis under Dynamic Quarantine Defense

Wei Yang Yong Li Guiran Chang Yu Yao

The propagation model of P2P worms can reflect the worm behaviors and identify weakness in the worm propagation which gives guidelines to worm detection and defense. To improve the security of P2P network, a mathematical model is proposed which combines dynamic quarantine and P2P churn. The SIQRW model departs from previous P2P worm models in that considering the dynamic quarantine methods and the peers dynamic join and leave. Using SIQRW model the impact of different parameters on this model is studied. Simulation results show that the performance of our model is significantly better than other models, in terms of decreasing the number of infected hosts and reducing the worm propagation speed.

10.1109/ebiss.2010.5473648

Cite

Citations (2)

An Epidemic Model of Computer Worms with Time Delay and Variable Infection Rate

Security and Communication Networks (2018)

Yu Yao Qiang Fu Wei Yang Ying Wang Chuan Sheng

With rapid development of Internet, network security issues become increasingly serious. Temporary patches have been put on the infectious hosts, which may lose efficacy on occasions. This leads to a time delay when vaccinated hosts change to susceptible hosts. On the other hand, the worm infection is usually a nonlinear process. Considering the actual situation, a variable infection rate is introduced to describe the spread process of worms. According to above aspects, we propose a time-delayed worm propagation model with variable infection rate. Then the existence condition and the stability of the positive equilibrium are derived. Due to the existence of time delay, the worm propagation system may be unstable and out of control. Moreover, the threshold τ0 of Hopf bifurcation is obtained. The worm propagation system is stable if time delay is less than τ0. When time delay is over τ0, the system will be unstable. In addition, numerical experiments have been performed, which can match the conclusions we deduce. The numerical experiments also show that there exists a threshold in the parameter a, which implies that we should choose appropriate infection rate β(t) to constrain worm prevalence. Finally, simulation experiments are carried out to prove the validity of our conclusions.

10.1155/2018/9756982

Cite

Citations (24)

Scanner-Hunter: An Effective ICS Scanning Group Identification System

IEEE Transactions on Information Forensics and Security (2024)

Chuan Sheng Yu Yao Lianxiang Zhao Peng Zeng Jianming Zhao

As the precursor of cyber-attacks, the campaigns of scanning groups are able to reflect the attack target and attack trend to a great extent, which provide highly valuable threat intelligence for cyber defenders to understand the current cyber security situation. However, how to identify scanning groups in the context of limited information, especially in the absence of relevant threat intelligence, remains a challenging problem. In this paper, we utilize the honeynet as the unique data source to propose a scanning group identification system, Scanner-Hunter, which focuses on identifying scanning groups targeting ICS devices. To better characterize scanning patterns, a novel traffic representation scheme for scanning traffic is proposed, which is composed of a set of feature vectors to describe all the ICS request packets. On this basis, we propose a novel self-expanding multi-class classification (SEMCC) model and the IP prefix judgment, which are deliberately integrated to cope with sophisticated scanning groups. Take the Modbus protocol as an example, we implement a prototype of Scanner-Hunter, and use six years of real-world honeynet datasets to evaluate its performance. The experimental results illustrate its effectiveness and superior performance compared with some popular machine learning methods and existing SOTA scanning group identification methods. In addition, Scanner-Hunter is further leveraged to investigate the group distribution and maliciousness of 506 unknown scanners, and some suspicious attack groups with APT characteristics are analyzed. Furthermore, accurate scanning group information will contribute to revealing potential attack organizations and supporting decision making to prevent or interrupt cyber-attacks in time.

Identification

10.1109/tifs.2024.3359002

Cite

Citations (1)

An Industrial Network Intrusion Detection Algorithm Based on IGWO-GRU

Research Square (Research Square) (2023)

Wei Ping Yang Shan Yao jiaxuan wang Yu Yao

Abstract Nowadays, the industrial control system has become open and interconnected, and informatization also increases the risk of network attacks and damage due to frequent intrusion. Research on industrial intrusion detection is ongoing, but many current methods need to consider the characteristics of industrial control flow. Therefore, this paper proposes an industrial network intrusion detection algorithm based on IGWO-GRU: starting from the timing of industrial control network traffic, select the simple architecture of the gated recurrent unit (GRU) as the network model; in view of the problem of the number of network parameters such as neurons and the learning rate, the Grey Wolf Optimizer (GWO) is integrated with conducting autonomous learning to find the optimal parameters of the model and solve the problem of slow convergence rate caused by a large amount of data volume of the industrial control network traffic. However, due to the slow convergence speed and low optimization accuracy of the GWO algorithm and data imbalance, this paper improves an improved grey Wolf optimization algorithm (IGWO) by improving the nonlinear convergence factor and weight adjustment strategy to increase the convergence rate of the algorithm further and avoid falling into the local optimal solution. With the data set of the natural gas pipeline control system, the intrusion detection system is simulated for classifying abnormal flow attacks. The experimental results show that the IGWO-GRU algorithm has obvious advantages in accuracy, false alarm rate, and false report rate, which improves the safety protection ability of industrial control systems.

Industrial control system

10.21203/rs.3.rs-3302312/v1

Cite

Citations (0)

Collection and Analysis of Driving Videos Based on Traffic Participants

Yu Yao

Source

Cite

Citations (0)

A Real-Time Anomaly Detection Method for Industrial Control Systems Based on Long-Short Period Deterministic Finite Automaton

IEEE Internet of Things Journal (2025)

Xuanzi Lin Yu Yao Bo Hu Wei Yang Xiaoming Zhou

Deterministic finite automaton

Timed automaton

10.1109/jiot.2025.3526599

Cite

Citations (0)

Research of a Potential Worm Propagation Model based on Pure P2P Principle

International Conference on Communication Technology (2006)

Yu Yao Xingrui Luo Fuxiang Gao Songling Ai

Based on pure P2P principle, a potential propagating approach of active worm which can achieve fast and self propagation performances through fragmentation mechanism is proposed in this paper. According to the features of P2P and active worm, SEI and SEIR mathematic models are given to describe the dynamical process of propagation without control and under control respectively. Simulations of these two models are carried out with scale-free network as background, since research has pointed out that Internet is very close to the scale-free network. Results of simulation and mathematic analysis prove that worm based on pure P2P principle can be still hidden and propagate effectively, although the size of worm is increased. This worm propagation model which is probably used by attackers in the future should be really paid more attention to.

Scale-free network

10.1109/icct.2006.342006

Cite

Citations (19)

Solving Train Formation Plan Problem in Freight Transportation Corridors

Xinhong Zhang Liujiang Kang Wei Liu Yu Yao

The train formation plan develops the train services and assigns the transportation demands whose optimal solutions are normally difficult to find.In this paper, a new linear programming model for the train formation plan problem is proposed by the use of mixed integer programming methods.In addition, considering the long computing time by the mixed integer programming solver, an effective heuristic algorithm is designed to explore the solution space, where a neighborhood based search method evaluates, selects, and implements the moves.To verify the proposed mixed integer programming model and the solution method, numerical problems have been solved, and results are compared with those obtained by the ILOG CPLEX 12.6 version.

10.2991/esm-16.2016.24

Cite

Citations (1)