Improving model prediction capability based on continuously collected data is one of the biggest challenges in a mature, intelligent weather forecasting system. To tackle this problem, we propose an online incremental learning strategy for meteorological models with asynchronous updates. In short, we divide two different meteorological incremental learning settings according to the characteristics of meteorological data, distinguishing between increments within short-term time windows and increments for long-term data. For short-term data, a structure-based incremental learning method with a fast iteration rate is used, and a Residual-Net (R-Net) is proposed to improve the performance of the model; for long-term data, a replay-based incremental learning method called Gradient-based Core-set Selection and Weighting method (GCSW) is proposed, by performing cosine distance and normalization calculations to obtain sample weights and weighting the coreset samples to avoid catastrophic forgetting. The comparative experiments on temperature prediction incremental datasets in Beijing and Xi’an show that our proposed method achieves the best results in both short-term and long-term incremental experimental settings than all other baseline methods, demonstrating the advantages of the algorithm we proposed on meteorological datasets. The code is available as an open source repository on GitHub https://github.com/liujunjiao1/Enhancing-Weather-Model.

Short-to-medium term temperature prediction in high resolution is a very challenging task, involving meteorology, physics, mathematics, geography, and many other subjects. Its purpose is to fit a complex function from historical meteorological data to predict the future 1–5 days temperature, which is a typical spatio-temporal prediction problem. Meteorological data show complex correlations in local space. Most of the existing machine learning methods are based on image pixel-level tasks or spatio-temporal prediction tasks, which model meteorological data without considering the characteristics of meteorological data and use rough global patterns to model local space which would lose many details. To address the above issues, our work fine-grained conditional convolution network (FCCN) proposes a novel grid-level conditional convolution module, including a local geographic adaptive weight (GAW) and a local data adaptive weight (DAW). These two components are integrated into a multiscale meteorological fusion gated recurrent unit (GRU) architecture for the end-to-end temperature prediction. Experiments in real-world datasets from ERA-5 show our FCCN model has a better performance than all other baseline methods.

Industrial Control System (ICS) security has become increasingly important as attacks targeting ICSs are more prominent. Although many off-the-shelf industrial network intrusion detection mechanisms have been presented in the past, attackers have always found unique disguisable ways to bypass detections and disrupt actual industrial control processes. To mitigate this deficiency, we present a novel scheme for the detection of industrial process control attacks, calledShadowPLCs. Specifically, the scheme first automatically analyzes the PLC control code, then extracts key parameters of the PLCs including valid register addresses, valid range of values, and control logic rules as a basis for evaluating attacks. The attack behavior is detected in real-time from different perspectives through active communication with PLCs and passive monitoring of the network traffic. We implemented a prototype system with Siemens S7-300 series PLCs as a case study. Our scheme was evaluated using two Siemens S7-300 PLCs deployed on a gas pipeline network platform. Experiments demonstrate that the presented scheme can accurately detect process control attacks in real-time without affecting the normal operations of PLCs. Compared with the other four representative detection models, our scheme has better detection performance with detection accuracy of 97.3 percent.

Nowadays, we have witnessed the rise of botnet malicious activities. These botnets, as expected, are launched by Domain generation algorithm (DGA) to evade detection. There is a growing concern that the artificially designed DGA detection features are being vulnerable to attackers, where any well-designed manipulations would evade these existing feature-based detection and even the more robust behavior-based detection. One common point of existing evasion for behavior detection is using domain names with low query rate. In this paper, we propose FProbe, a novel technology using co-occurrence matrix and relaxed clustering procedure, which performs excellent performance in the scene of detecting low query rate and multi-domain evasion. We use a simple intuition, that is, DGA queries have a strong correlation between temporal and spatial features, but these temporal and spatial correlations are not very synchronous. The FProbe uses the co-occurrence matrix, which is widely used in the field of product recommendation and word frequency co-occurrence, and use these unsupervised methods to cluster infected hosts. In particular, through this matrix, we can quickly and effectively locate infected hosts in the scene of low query rate, instead of discarding the domain for its high threshold. Then, we use the relax association rules of Frequent Sequence Tree to cluster related domain names, and use supervised learning to determine malicious clusters. The FProbe has been evaluated in the campus network (4000 active users in peak load hours) and ISP DNS traffic (one billion queries per hour). The experimental results ( 96.3% accuracy rate of 1.9% false positive on average) illustrate the efficiency and accuracy of FProbe.

As closed Industrial Control Systems (ICS) gradually evolve toward networking, ICS data and operational processes can be easily tampered with by attackers, causing industrial control equipment to fail or become damaged. Depending on the characteristics of ICS business logic stability, this paper proposes a novel two-level anomaly detection framework to ensure that system data and business logic are safe and reliable. Specifically, basic information is obtained from network traffic. In our framework, the first-level detection uses convolutional neural network (CNN) to feature extraction and anomaly identification. In the second-level detection, we propose a process state transfer algorithm. The feature extracted by the CNN model is invoked as the input of the algorithm to construct the normal state process transfer model of ICS. The model detects whether the current data meets the normal state transition process of the system, and may find unknown attacks or 0-day attacks. Finally, through laboratory gas pipeline network system verification, we found that the anomaly detection framework combined with the two methods has more outstanding performance than several current latest technologies.