RU2768543C1 - Data traffic monitoring device - Google Patents

Abstract

FIELD: physics.

SUBSTANCE: invention relates to computer engineering. Information traffic monitoring device comprises current assessment 1 signal generator, assessment value zones discriminator 2, pulse distributor 3, time interval counter 4, switch 5, first 6 and second 7 variable search generators, first 8 and second 9 summing counters, first 10 and second 11 memory units, division unit 12, classifier 13, search strategy register 14, reset signal generator 15, data display and recording unit 16, threshold signal changing unit 17, current day timer 18, truncation threshold generating unit 19, structural analyser 20, third 21, fourth 22, fifth 23 memory units, fuzzy combinations processing unit 24.

EFFECT: high reliability of monitoring information traffic.

1 cl, 4 dwg

Description

The invention relates to computer technology and can be used as a device for structural and statistical analysis of information arrays circulating in a complex, controlled information (information and computing or telecommunications) system in the interests of analytical processing of large arrays of heterogeneous data on information traffic to identify computer incidents in critical network infrastructures.

A device is known (see RF patent No. 2116670 "Information retrieval device", IPC G06F 17/30, published 04/07/1997), containing a pulse distributor, first and second generators of the search variable, summing counters and memory blocks, a search strategy register, a signal generator current assessment, discriminator of assessment values zones, counter of time intervals, commutator, dividing unit, classifier, threshold signal change unit, current day timer, indication unit and reset signal generator.

This device has a narrow scope, since it is impossible to use it to analyze several parallel streams to find combinations of message beginnings.

A device is known (see RF patent No. 2149446 "Information retrieval device", IPC G06F 17/30, published 05/20/2000, Bull. No. 14), which contains a signal generator of the current assessment, a discriminator of assessment value zones, a pulse distributor, a counter of time intervals , switch, first and second search variable generators, first and second summing counters, first and second memory blocks, division block, classifier, search strategy register, reset signal generator, threshold signal changing block, current day timer and truncation threshold generation block.

However, this device provides a low speed of searching for combinations of the beginning of messages and a relatively low information content of traffic indicators that characterize the structure of information arrays.

The closest in technical essence to the claimed device (prototype) is a device for monitoring information traffic (see RF patent No. 2290691"Information traffic monitoring device» IPC G06F 17/18, G06F 17/30, published 27.12.2006, Bull. No. 36), containing the signal generator of the current assessment, the discriminator of the zones of the assessment values, the pulse distributor, the counter of time intervals, the switch, the first and second generators of the search variable, the first and second summing counters, the first and second memory blocks, the division block, the classifier, the strategy register search, reset signal generator, data display and recording unit, threshold signal change unit, current day timer, truncation threshold generation unit, structural analyzer, third, fourth and fifth memory blocks, while the output of the current estimate signal generator is connected to the control input of the switch, the outputs "Change in the state of the situation - Change" and "No change in the state of the situation - Ots" of which are connected to the inputs of the first and second generators of the search variable, the output of the second generator of the search variable is connected to the information input of the second summing counter, the output of which is connected to the information input of the second block memory window and the second information input of the division block, the output of which is connected to the information input of the classifier, the outputs "Change in the state of the situation - P" and "No change in the state of the situation - O" of which are connected to the inputs of the same name and the reset signal generator and to the inputs of the display unit of the same name and data recording, the "Reset" output of the reset signal generator is connected to the "Reset" input of the first memory block, the "Reset" input of the second memory block, the "Reset" input of the time interval counter and the "Reset" input of the truncation threshold generation unit, the output "Maximum number of the time interval interval -N _max» of which is connected to the same-named inputs of the search strategy register, the first and second generators of the search variable, the output of the first generator of the search variable is connected to the information input of the first summing counter, the output of which is connected to the first information input of the dividing block, the outputs "Change in the state of the environment - Change" and " No change in the state of the situation - Ots" of the discriminator of zones of evaluation values are connected to the inputs of the same name of the switch, the first output of the pulse distributor is connected to the synchronization inputs of the signal generator of the current evaluation and the discriminator of zones of evaluation values, as well as to the clock input of the counter of time intervals, the output "Number of the current time interval -N _tech” of which is connected to the same-named inputs of the truncation threshold formation block and the search strategy register, the outputs are “Value of the upper classification threshold - P_kv"and" The value of the lower classification threshold - P_klnwhich are connected to the classifier inputs of the same name, the second output of the pulse distributor is connected to the synchronizing input of the switch, the third output of the pulse distributor is connected to the synchronization inputs of the first and second memory blocks, the outputs of the first and second memory blocks are connected to the signal inputs of the first and second summing counters, the fourth output of the pulse distributor is connected to the synchronizing input of the classifier, the "Time" output of the current day timer is connected to the same-named inputs of the signal generator of the current assessment, the discriminator of the zones of assessment values, the pulse distributor, the block for displaying and recording data and the block for changing threshold signals, the outputs "Upper value of the search threshold - P_in” and “Lower value of the search threshold - P_n» of which are connected respectively to the same-named inputs of the search strategy register and to the same-named inputs of the truncation threshold generation unit, the "Start" and "Threshold" inputs of the threshold signals change block are connected to the same-named inputs of the truncation threshold formation unit and are, respectively, the "Start" and "Threshold" inputs device, input "Numerical value of the unit - 1", input "Maximum number of the time interval -N _max”, and the input “Sample size of the analysis interval –V _select» of the truncation threshold generation unit are the inputs of the same name of the device, the input "Zone 1" of the first shaper of the search variable and the input "Zone 2" of the second shaper of the search variable are the inputs "Zone 1" and "Zone 2" of the device, respectively, the information output of the structural analyzer is connected to the information to the inputs of the signal generator of the current assessment and the discriminator of the zones of assessment values, the input "Deterministic combination", the input "Unknown feature", the input "The desired feature" and the input "Address of the unknown feature - Address NP" of the block for displaying and recording data are connected, respectively, to the outputs of the structural analyzer of the same name , the output "Address" of which is connected to the inputs of the same name of the third, fourth and fifth memory blocks, the output "Data 1" of the third memory block is connected to the inputs of the same name of the block for displaying and recording data and the structural analyzer, the output "Data 2" of the fourth memory block and the output " Data 3 "of the fifth memory block is connected to the inputs of the same name page of the circuit analyzer, the output "Clock pulses" of which is connected to the inputs of the same name of the fourth and fifth memory blocks, the output "Data 1 - recording", the output "Data 2 - recording" and the output "Data 3 - recording" of the block for displaying and recording data are connected to the inputs of the third, fourth and fifth memory blocks, the output "Address 3 - recording" of the data display and recording block is connected to the input of the same name of the fifth memory block, the output "Address 1, 2 - recording" of the display and data recording unit is connected to the inputs of the third and fourth memory blocks, the informational and synchronizing inputs of the structural analyzer are, respectively, the informational and synchronizing inputs of the device.

The prototype implements the possibility of providing a higher speed of searching for combinations of the beginning of messages by adjusting the value of the maximum number of the time interval throughout the entire analysis time. In addition, the prototype device provides an increase in the information content of traffic indicators characterizing the structure of information arrays, due to the structural analysis of deterministic combinations.

However, the prototype has a drawback - a relatively low reliability of the analysis of information arrays in the conditions inherent in the process of monitoring the input information flow circulating in a real complex and controlled information (information-computing or telecommunications) system - in conditions of ambiguity (fuzziness) of the observed and analyzed deterministic combinations characterizing known (sought) or unknown features in the input information flow.

This device allows you to monitor information traffic by structural and statistical analysis of information arrays for which the deterministic combinations characterizing them are given (observed) quantitatively, identified clearly and unambiguously, while the deterministic combinations characterizing the desired or unknown features for a large number of input information flows , actually circulating in complex and branched information (information-computing or telecommunication) systems, can be fuzzy in nature, can only be identified qualitatively, i.e., ambiguously, fuzzy, with the involvement of a linguistic variable. The prototype device allows you to evaluate quantitative informative indicators characterizing the structure of information arrays, while when monitoring data flows in real systems, models [1-5] are widely used, objectively based on qualitatively, fuzzy specified (observed) values of traffic indicators, where observed and analyzed deterministic combinations that characterize known (sought) or unknown features in the input information flow are not only quantitative - unambiguously, clearly identifiable, but also fuzzy (identified only at a qualitative level) in nature, traditionally described using the mathematics of fuzzy sets.

The “deterministic combination” is understood as a q -bit ( q = 1…10) binary number that characterizes the structural and statistical attributes (parameters) of the analyzed input information array - a combination of a certain number of bits that describe the traffic structure, sequence and intensity of data arrival within the information flow .

The aim of the invention is to develop a device that improves the reliability of information traffic monitoring by providing an additional opportunity for structural and statistical analysis (additional verification) of information arrays, taking into account the presence of not only uniquely defined, but also fuzzy (observable, identifiable) deterministic combinations characterizing known ( sought) or unknown signs of input information flows, the creation of an information traffic monitoring device capable of evaluating with high reliability indicators characteristic of real information arrays - when deterministic combinations displaying information about the presence of a known or unknown attribute in the input information flow have both quantitative and and qualitatively, fuzzy (with the involvement of a linguistic variable) expressed physical meaning.

This goal is achieved by the fact that in a well-known device for monitoring information traffic, containing a signal generator of the current assessment, a discriminator of zones of assessment values, a pulse distributor, a counter of time intervals, a switch, the first and second generators of the search variable, the first and second summing counters, the first and second blocks memory block, division block, classifier, search strategy register, reset signal generator, data display and recording block, block for changing threshold signals, current day timer, truncation threshold formation block, structural analyzer, third, fourth and fifth memory blocks, additionally included processing block fuzzy combinations, designed for sequential comparison of deterministic combinations coming in a binary code and making a decision about their mathematical nature - a deterministic combination is specified (identified) parametrically or using a membership function characteristic of fuzzy sets stv, as well as for mathematically correct transformation of deterministic combinations of given (identified) in a fuzzy form (not parametrically) to a form suitable for reliable (clear, unambiguous) parametric estimation of the structural and statistical characteristics of a data flow in the interests of monitoring information traffic. At the same time, the output of the signal generator of the current assessment is connected to the control input of the switch, the outputs "Change in the state of the situation - Change" and "No change in the state of the situation - Ots" of which are connected to the inputs of the first and second generators of the search variable, respectively, the output of the second generator of the search variable is connected to the information the input of the second summing counter, the output of which is connected to the information input of the second memory block and the second information input of the division block, the output of which is connected to the information input of the classifier, the outputs "Change in the state of the situation - P" and "No change in the state of the situation - O" of which are connected respectively to to the same-named inputs of the reset signal generator and to the same-named inputs of the data display and recording unit, the "Reset" output of the reset signal generator is connected to the "Reset" input of the first memory block, the "Reset" input of the second memory block, the "Reset" input of the time interval counter and the input at "Reset" of the truncation threshold generation unit, the output "Maximum number of the time interval - N _max " is connected to the same-named inputs, respectively, of the search strategy register, the first and second generators of the search variable, the output of the first generator of the search variable is connected to the information input of the first summing counter, the output which is connected to the first information input of the division block, the outputs "Change in the state of the situation - Change" and "No change in the state of the situation - Ots" of the discriminator of the zones of evaluation values are connected respectively to the inputs of the switch of the same name, the first output of the pulse distributor is connected to the synchronization inputs, respectively, of the shaper of the signals of the current assessment and the discriminator of zones of evaluation values, as well as to the clock input of the counter of time intervals, the output "Number of the current time interval - N _current " of which is connected to the inputs of the same name, respectively, of the block for forming the truncation threshold and the ka, the outputs "The value of the upper classification threshold - P _klv " and "The value of the lower classification threshold - P _kln " which are connected to the classifier inputs of the same name, the second output of the pulse distributor is connected to the synchronizing input of the switch, the third output of the pulse distributor is connected to the synchronization inputs of the first and second memory blocks, the outputs of the first and second memory blocks are connected to the signal inputs of the first and second summing counters, respectively, the fourth output of the pulse distributor is connected to the synchronizing input of the classifier, the outputs "Upper value of the search threshold - P _in " and "Lower value of the search threshold - P _n " of the block for changing the threshold signals are connected, respectively, to the same-named inputs of the search strategy register and, accordingly, to the same-named inputs of the truncation threshold formation block, the "Start" and "Threshold" inputs of the threshold signals changing block are connected to the same-named inputs of the truncation threshold formation block and are respectively inputs "Start" and "Threshold" of the device, the input "Numerical value of the unit - 1", the input "Maximum number of the time interval - N _max ", and the input "Analysis interval sample size - V _sel " of the truncation threshold formation unit are the same inputs of the device, the input "Zone 1" of the first shaper of the search variable and the input "Zone 2" of the second shaper of the search variable are respectively the inputs "Zone 1" and "Zone 2" of the device, the input "Unknown feature", the input "Searched feature" and the input "Address of unknown feature" - Address NP" of the display and data recording block are connected respectively to the same-named outputs of the structural analyzer, the "Address" output of which is connected to the same-named inputs of the third, fourth and fifth memory blocks, respectively, the "Data 1" output of the third memory block is connected to the same-named inputs of the display block, respectively and data recording and structure analyzer, the output "Data 2" of the fourth memory block and the output "Data 3" of the fifth memory block are connected directly to the same-named inputs of the structural analyzer, the output "Clock pulses" of which is connected to the same-named inputs of the fourth and fifth memory blocks, respectively, the output "Data 1 - recording", the output "Data 2 - recording" and the output "Data 3 - recording" of the display unit and data records are connected to the inputs of the same name of the third, fourth and fifth memory blocks, respectively, the output "Address 3 - record" of the data display and record block is connected to the input of the same name of the fifth memory block, the output "Address 1, 2 - record" of the data display and record block is connected to the same-named inputs of the third and fourth memory blocks, respectively, the information and synchronizing inputs of the structural analyzer are, respectively, the information and synchronizing inputs of the device, the "Time" output of the current day timer is connected to the same-named inputs, respectively, of the current assessment signal generator, the discriminator of assessment value zones, the pulse distributor, the unit display and write data and block changes in threshold signals, the information output of the structural analyzer is connected to the information inputs of the signal generator of the current assessment and the discriminator of zones of assessment values, the output "Deterministic combination" of the structural analyzer is connected to the test input of the fuzzy combination processing unit, the verification output of which is connected to the input "Deterministic combination" of the display unit and data records.

The fuzzy combination processing block consists of a counter, a storage register, a registering counter, an addition calculator, main and auxiliary memory elements, a main and auxiliary intersection calculator, a union calculator and a membership level analyzer, the output of which is combined with the transit output of the storage register and is the verification output of the processing block fuzzy combinations, the input of the counter is the test input of the fuzzy combinations processing unit, the output of the counter is connected to the input of the storage register, the test output of the storage register is connected to the input of the registering counter, the first and second outputs of which are connected respectively to the input of the main storage element and the direct input of the auxiliary storage element, and also, respectively, with the first and second inputs of the add-on calculator, the output of the main storage element and the output of the auxiliary storage element are connected, respectively, to the main input of the main intersection calculator and to the main input of the auxiliary intersection calculator, to the additional inputs of the main and auxiliary intersection calculators, respectively, the first and second outputs of the addition calculator are connected, the outputs of the main and auxiliary intersection calculators are connected respectively to the first and second inputs of the combination calculator, the output of which is connected to the additional input add-on calculator, additional input of the auxiliary storage element and input of the membership level analyzer.

Thanks to a new set of essential features, due to the introduction of a processing unit for fuzzy combinations, which provides a consistent comparison of deterministic combinations arriving in binary code, making a decision about their mathematical nature - a deterministic combination is specified (identified) parametrically or using a membership function characteristic of fuzzy sets, and also mathematically correct transformation of deterministic combinations of given (identified) in a fuzzy form (not parametrically) to a form suitable for reliable (clear, unambiguous) parametric estimation of the structural and statistical characteristics of the information flow, the claimed device achieves the possibility of increasing the reliability of information traffic monitoring by providing the possibility of additional verification of deterministic combinations characterizing known (sought) or unknown features of input information flows, taking into account the presence of not only quantitative, but also fuzzy (with the involvement of a linguistic variable) data on these combinations.

The claimed device is illustrated by drawings, which show:

in fig. 1 - block diagram of the information traffic monitoring device;

in fig. 2 - block diagram of the fuzzy combinations processing unit;

in fig. 3 - structural diagram of the structural analyzer;

in fig. 4 - operation algorithm of the block for displaying and recording data.

The traffic monitoring device shown in FIG. 1, contains current estimate signal generator 1, estimate value zone discriminator 2, pulse distributor 3, time interval counter 4, switch 5, first 6 and second 7 search variable generators, first 8 and second 9 summing counters, first 10 and second 11 blocks memory, division block 12, classifier 13, search strategy register 14, reset signal generator 15, data display and recording block 16, threshold signal change block 17, current day timer 18, truncation threshold generation block 19, structural analyzer 20, third 21, fourth 22, fifth 23 memory blocks and processing unit of fuzzy combinations 24.

The output 014 of the signal generator of the current assessment 1 is connected to the control input 54 of the switch 5, the outputs 56 "Change in the state of the situation - Change" and 57 "No change in the state of the situation - Ots" of which are connected to the inputs 62 and 71, respectively, of the first 6 and second 7 generators of the search variable , the output 74 of the second shaper of the search variable 7 is connected to the information input 92 of the second summing counter 9, the output 91 of which is connected to the information input 111 of the second memory block 11 and the second information input 122 of the division block 12, the output 123 of which is connected to the information input 136 of the classifier 13, outputs 132 "Change in the state of the situation - P" and 133 "No change in the state of the situation - O" which are connected respectively to the same-named inputs 151 and 152 of the reset signal generator 15 and to the same-named inputs 169 and 1610 of the display and data recording unit 16, output 153 "Reset » reset signal generator 15 is connected to input 103 «Reset» first th memory block 10, input 114 "Reset" of the second memory block 11, input 43 "Reset" of the counter of time intervals 4 and input 1910 "Reset" of the truncation threshold formation unit 19, output 198 "Maximum number of the time interval - N _max " which is connected to the same-named inputs 145, 64 and 73, respectively, of the search strategy register 14, the first 6 and second 7 generators of the search variable, the output 63 of the first generator of the search variable 6 is connected to the information input 81 of the first summing counter 8, the output 82 of which is connected to the first information input 121 of the division block 12, outputs 024 "Change in the state of the situation - Change" and 025 "No change in the state of the situation - Ots" of the discriminator of zones of evaluation values 2 are connected, respectively, to the inputs of the same name 52 and 53 of the switch 5, the first output 31 of the pulse distributor 3 is connected to the synchronization inputs 013 and 023 respectively, the signal generator of the current assessment 1 and the discriminator of the zones of assessment values 2, as well as to the tact to the first input 41 of the counter of time intervals 4, output 42 "Number of the current time interval - N _current " which is connected to the same-named inputs 199 and 146, respectively, of the truncation threshold generation unit 19 and the search strategy register 14, outputs 143 "The value of the upper classification threshold - P _clv " and 144 "The value of the lower classification threshold - P _kln " which is connected to the same inputs 134 and 135 of the classifier 13, the second output 32 of the pulse distributor 3 is connected to the synchronizing input 51 of the switch 5, the third output 33 of the pulse distributor 3 is connected to the synchronization inputs 102 and 112 of the first 10 and 12 second memory blocks, outputs 101 and 113, respectively, of the first 10 and 11 second memory blocks are connected to the signal inputs 83 and 93, respectively, of the first 8 and second 9 summing counters, the fourth output 34 of the pulse distributor 3 is connected to the clock input 131 of the classifier 13, the outputs 172 "Upper search threshold value - P _in " and 173 "Lower threshold value search - P _n "of the block for changing the threshold signals 17 are connected, respectively, to the same-named inputs 141 and 142 of the register of the search strategy 14 and, respectively, to the same-named inputs 196 and 197 of the block for forming the truncation threshold 19, inputs 174 "Start" and 175 "Threshold" of the block for changing the threshold signals 17 are connected to the inputs of the same name 191 and 192 of the truncation threshold formation unit 19 and are, respectively, the inputs "Start" and "Threshold" of the device, input 193 "The numerical value of the unit is 1", input 194 "Maximum number of the time interval - N _max ", and the input 195 "Analysis interval sample size - V _sel " of the truncation threshold generation unit 19 are the same inputs of the device, input 61 "Zone 1" of the first generator of the search variable 6 and input 72 "Zone 2" of the second generator of the search variable 7 are, respectively, the inputs of "Zone 1" and "Zone 2" of the device, input 162 "Unknown feature", input 163 "Searched feature" and input 164 "Address of unknown feature - TM address" of the display and recording unit yes data 16 are connected respectively to the same-named outputs 2010, 2011 and 2012 of the structural analyzer 20, the output 204 "Address" of which is connected to the same-named inputs 214, 224 and 234, respectively, of the third 21, fourth 22 and fifth 23 memory blocks, output 213 "Data 1" of the third the memory block 21 is connected to the same-named inputs 165 and 201, respectively, of the block for displaying and recording data 16 and the structure analyzer 20, the output 223 "Data 2" of the fourth memory block 22 and the output 233 "Data 3" of the fifth memory block 23 are connected, respectively, to the same-named inputs 202 and 203 of the structural analyzer 20, the output 205 "Clock pulses" of which is connected to the same-named inputs 225 and 235, respectively, of the fourth 22 and fifth 23 memory blocks, the output 166 "Data 1 - record", the output 167 "Data 2 - record" and the output 168 "Data 3 – record” of the data display and recording block 16 are connected to the inputs of the same name 211, 221 and 231, respectively, of the third 21, fourth 22 and fifth 23 memory blocks, output 1611 “Address 3 - h record" of the data display and record block 16 is connected to the input of the same name 232 of the fifth memory block 23, the output 1613 "Address 1, 2 - record" of the data display and record block 16 is connected to the inputs of the same name 212 and 222, respectively, of the third 21 and fourth 22 memory blocks, information 207 and 208 synchronizing inputs of the structural analyzer 20 are, respectively, informational and synchronizing inputs of the device. The output 181 "Time" of the timer of the current day 18 is connected to the inputs of the same name 011, 022, 35, 1612 and 171, respectively, of the signal generator of the current assessment 1, the discriminator of the zones of the assessment values 2, the pulse distributor 3, the data display and recording unit 16 and the block for changing the threshold signals 17, the information output 206 of the structural analyzer 20 is connected to the information inputs 012 and 021, respectively, of the signal generator of the current assessment 1 and the discriminator of the zones of assessment values 2, the output 209 "Deterministic combination" of the structural analyzer 20 is connected to the test input 241 of the fuzzy combination processing unit 24, the verification output 242 which is connected to the input 161 "Deterministic combination" of the display unit and data recording 16.

The fuzzy combinations processing unit 24 (Fig. 2) is designed for sequential comparison (by the number of binary numbers characterizing any deterministic sequence) of the deterministic combinations arriving in the binary code and making a decision about their mathematical nature - the deterministic combination is set (identified) parametrically or using the function membership characteristic of fuzzy sets, as well as for mathematically correct transformation of deterministic combinations of given (identified) in a fuzzy form (not parametrically) to a form suitable for reliable (clear, unambiguous) parametric estimation of the structural and statistical characteristics of a data flow in the interests of monitoring information traffic .

The fuzzy combination processing unit 24 (Fig. 2) consists of a counter 24.1, a storage register 24.2, a registering counter 24.3, a complement calculator 24.4, a main 24.5 and an auxiliary 24.6 memory elements, a main 24.7 and an auxiliary 24.8 intersection calculator, a union calculator 24.9 and a membership level analyzer 24.10, the output of which 24.10-2 is combined with the transit output 24.2-3 of the storage register 24.2 and is the verification output 242 of the fuzzy combination processing unit 24. 24.2-2 of the storage register 24.2, the test output 24.2-1 of the storage register 24.2 is connected to the input 24.3-1 of the registering counter 24.3, the first 24.3-2 and second 24.3-3 outputs of which are connected respectively to the input 24.5-1 of the main storage element 24.5 and direct input 24.6-1 of the auxiliary storage element 24.6, and also, respectively, with the first 24.4-1 and the second 24.4-2 inputs of the add-on calculator 24.4, the output 24.5-2 of the main storage element 24.5 and the output 24.6-2 of the auxiliary storage element 24.6 are connected respectively to the main input 24.7-1 of the main intersection calculator 24.7 and to the main input 24.8-1 of the auxiliary intersection calculator 24.8 , to the additional inputs 24.7-2 and 24.8-2 of the main 24.7 and auxiliary 24.8 intersection calculators, respectively, the first 24.4-3 and second 24.4-4 outputs of the 24.4 add-on calculator are connected, the outputs 24.7-3 and 24.8-3 of the main 24.7 and 24.8 auxiliary computers of the intersection are connected respectively, to the first 24.9-1 and second 24.9-2 inputs of the 24.9 union calculator, the output 24.9-3 of which is connected to the additional input 24.4-5 of the 24.4 addition calculator, the additional input 24.6-3 of the auxiliary storage element 24.6 and the input 24.10-1 of the membership level analyzer 24.10 .

The counter 24.1 processing unit fuzzy combinations 24 is designed for registration and sequential comparison (in terms of the number of binary numbers characterizing any deterministic sequence) coming in a binary code of deterministic combinations. The technical implementation of the counter 24.1 is possible on the basis of a commercially available synchronous binary counter, as shown in [Averchenkov O.E. Circuit engineering: hardware and software. – M.: DMK Press, 2012. – 588 p., pp. 459-460, fig. 13.5].

The storage register 24.2 of the fuzzy combination processing unit 24 is designed to store data and make a decision about the mathematical nature of this data - a binary code characterizing the incoming deterministic combination, this combination is observed (given, identified) parametrically: quantitatively, probabilistically or qualitatively, using the membership function, characteristic of fuzzy sets. The storage register 24.2 can be implemented on the basis of a typical memory register described in the literature [Averchenkov O.E. Circuit engineering: hardware and software. – M.: DMK Press, 2012. – 588 p., pp. 443-445, fig. 12.8].

The registering counter 24.3 of the fuzzy combinations processing unit 24 is designed to register and sort information in a binary code into two components - according to the initial number of expert opinions (the number of experts is equal to two) about each of the fuzzy observable (given) binary code values characterizing the incoming deterministic combination. The registering counter 24.3 can be technically implemented on the basis of a commercially available binary synchronous counter with serial transfer on T-flip-flops, as described in [Ugryumov E.P. Digital circuitry: textbook. allowance for universities. - 3rd ed., revised. and additional - St. Petersburg: BHV-Petersburg, 2010. - 816 p., S. 240-242, fig. 4.28].

The add-on calculator 24.4 of the fuzzy combinations processing unit 24 is designed to perform the operation of arithmetic subtraction from unity of the values of membership functions of fuzzy sets in binary code. A special case of the technical implementation of the add-on 24.4 calculator can be a typical arithmetic logic unit (ALU), described, for example, in [Fundamentals of Electronics: textbook for open source software / O.V. Milovzorov, I.G. Pankov. 5th ed., revised. and additional – M.: Yurayt Publishing House, 2016. – 407 p. pp. 186-189, fig. 3.8.1].

The main storage element 24.5 of the fuzzy combination processing unit 24 is designed to store fuzzy information from the first expert and transfer the values of membership functions of fuzzy sets in binary code to the main input 24.7-1 of the main intersection calculator 24.7. The main storage element 24.5 is implemented in the form of a typical commercially available dynamic random access memory device, as shown in the literature [Fundamentals of electronics: a textbook for SPO / O.V. Milovzorov, I.G. Pankov. – 5th ed., revised. and additional – M.: Yurayt Publishing House, 2016. – 407 p. pp. 229-231, fig. 4.3.2].

Auxiliary storage element 24.6 of the fuzzy combination processing unit 24 is designed to store fuzzy information from the second expert and transfer the values of membership functions of fuzzy sets in binary code to the main input 24.8-1 of the auxiliary intersection calculator 24.8. The auxiliary storage element 24.6 differs from the main storage element 24.5 only in the presence of an additional input, which technically can be easily combined with a direct input, which allows the implementation of the auxiliary storage element 24.6 similarly to the main storage element 24.5, in the form of a dynamic random access memory device, as described in [ Fundamentals of electronics: a textbook for free software / O.V. Milovzorov, I.G. Pankov. – 5th ed., revised. and additional – M.: Yurayt Publishing House, 2016. – 407 p. pp. 229-231, fig. 4.3.2].

The main intersection calculator 24.7 of the fuzzy combination processing unit 24 is designed to perform in binary code the mathematical operation of crossing the fuzzy set formulated by the first expert with the addition of the fuzzy set formulated by the second expert. The main intersection calculator 24.7 is a digital comparison node described in [Ugryumov E.P. Digital circuitry: textbook. allowance for universities. - 3rd ed., revised. and additional - St. Petersburg: BHV-Petersburg, 2010. - 816 p., S. 102-104, fig. 2.6].

Auxiliary intersection calculator 24.8 of the fuzzy combination processing unit 24 is designed to perform in binary code the mathematical operation of crossing the fuzzy set formulated by the second expert with the addition of the fuzzy set formulated by the first expert. Auxiliary intersection calculator 24.8 is identical to the main intersection calculator 24.7 and can also be technically implemented on the basis of the digital comparison node described in [Ugryumov E.P. Digital circuitry: textbook. allowance for universities. - 3rd ed., revised. and additional - St. Petersburg: BHV-Petersburg, 2010. - 816 p., S. 102-104, fig. 2.6].

The union calculator 24.9 of the fuzzy combination processing block 24 is designed to implement the final cycle of disjunctive summation - to determine the union of fuzzy sets. The union calculator 24.9 is a digital comparison node and can be technically implemented as a commercially available high-speed digital comparator, as shown in [Averchenkov O.E. Circuit engineering: hardware and software. – M.: DMK Press, 2012. – 588 p., pp. 428-429, fig. 11.9].

The membership level analyzer 24.10 of the fuzzy combination processing unit 24 is designed for unambiguous selection (assignment) of quantitative values of the analyzed fuzzy parameters of a deterministic combination - for the final receipt of clear, unambiguous (reliable) values of the parameters of a deterministic combination that determines the structural and statistical characteristics of the data flow in the interests of monitoring information traffic . The 24.10 membership level analyzer is a commercially available programmable TTL comparator of the 74LS85 type, described in the reference [TTL ICs. Volume 1.: Per. with him. - M.: DMK Press, 2001. - 384 p. (reference book), pp. 143-144, fig. w/n].

The current assessment signal generator 1, which is included in the general block diagram, is designed to generate, at the end of the current analysis interval, a binary signal that characterizes the state of the situation and takes on the values "Change" or "Ots". The structure of the current estimate signal generator 1, as well as the algorithm of its operation, are known and described in detail in (see RF patent No. 2116670 "Information retrieval device", IPC G06F 17/30, published on 04/07/1997, Fig. 2).

The evaluation value zone discriminator 2, which is included in the general block diagram, is designed to generate a signal about the zone number of the state in which the input information flow of the corresponding intensity is located. The structure of the discriminator of the zones of evaluation values 2, as well as the algorithm of its operation, are known and described in detail in (see RF patent No.

The pulse distributor 3, included in the overall structural diagram, is designed to synchronize the operation of the entire device by forming four pulse sequences shifted relative to each other by a certain value Δ t . The structure of the pulse distributor 3, as well as the algorithm of its operation, are known and described in detail in (see RF patent No. 2116670 "Information retrieval device", IPC G06F 17/30, published on 04/07/1997, Fig. 4).

The counter of time intervals 4, included in the overall structural diagram, is designed to count the number of observed time intervals and issue a combination of the number of the time interval " N _current ". The time interval counter 4 can be implemented technically on the basis of a commercially available summing counter with controlled reset, the scheme of which is known and described, for example, in [Ugryumov E.P. Digital circuitry: textbook. allowance for universities. - 3rd ed., revised. and additional - St. Petersburg: BHV-Petersburg, 2010. - 816 p., S. 247-248, fig. 3.47].

The switch 5, included in the general block diagram, is designed to switch the signal about the zone number to the input of the corresponding generator of the search variable according to the control signal coming from the signal generator of the current estimate 1 and taking the values "Change" and "Ots". The structure of the switch 5, the algorithm of its operation are known, described in detail in (see RF patent No. 2116670 "Information retrieval device", IPC G06F 17/30, published on 04/07/1997, Fig. 5).

The first 6 and second 7 generators of the search variable, included in the general block diagram, are designed to construct increments of a posteriori integral functions of the probability distribution of the normal F _O ( N ) (the first generator of the search variable 6) and the rejected F _P ( N ) (the second generator of the search variable 7 ) state of the input information flow on the N -th observation interval. The schemes of the first 6 and second 7 shapers of the search variable are identical, their structure, as well as the algorithms of operation, are known, described in (see RF patent No. 6).

The first 8 and second 9 summing counters included in the general block diagram are designed to add the values of the increments F _O ( N ) and F _P ( N ) with the corresponding values of the empirical integral distribution function calculated for N -1 time interval F _O ( N -1 ) and F _P ( N -1). The first 8 and second 9 summing counters are sequential multi-bit arithmetic adders, the circuits of which are known and described, for example, in [Milovzorov O.V., Pankov I.G. Fundamentals of electronics: a textbook for open source software. - 5th ed., revised. and additional - M .: Yurait Publishing House, 2016. - 407 p., S. 182-183, fig. 3.38].

The first 10 and second 11 memory blocks included in the overall block diagram are designed to store increments F _O ( N ) and F _P ( N ) within one analysis interval. The first 10 and second 11 memory blocks are identical and can be implemented technically on the basis of commercially available universal parallel registers, the schemes of which are known and described, for example, in [Milovzorov O.V., Pankov I.G. Fundamentals of electronics: a textbook for open source software. – 5th ed., revised. and additional - M .: Yurait Publishing House, 2016. - 407 p., S. 206-207, fig. 3.52].

The division block 12, which is included in the general block diagram, is designed to divide the increment F _P ( N ) by the increment F _O ( N ) and issue a likelihood ratio. The division block 12 is a device for dividing two q -bit binary numbers without restoring the remainder, the scheme of which is known and described in [Bocharov K.P., Nemshilov N.N., Petrov E.I., Sulin L.I. Computing complexes of automated control systems. - L .: VAS, 1984. - 368 p., S. 88-90, fig. 3.24].

The classifier 13, included in the overall block diagram, is designed to generate signals "Change" or "Ots" based on a comparison of input information with threshold values. The structure of the classifier 13, as well as the algorithm of its operation, are known and described in detail in (see RF patent No. 2116670 "Information retrieval device", IPC G06F 17/30, published on 04/07/1997, Fig. 7).

The search strategy register 14, which is included in the general structural diagram, is designed to generate interval or point values of the classification thresholds, depending on whether the number of the search interval is limiting or not. The structure of the search strategy register 14, as well as the algorithm of its operation, are known and described in detail in (see RF patent No. 2116670 "Information search device", IPC G06F 17/30, published on 04/07/1997, Fig. 8).

The reset signal generator 15, which is part of the overall block diagram, is designed to combine the signals "Meas" and "Ots", their amplification and coordination with subsequent blocks. The reset signal generator 15 can be implemented technically on the basis of a commercially available two-input OR circuit, the structure and operation algorithms of which are known and described, for example, in [Averchenkov O.E. Circuit engineering: hardware and software. – M.: DMK Press, 2012. – 588 p., pp. 39-40, fig. 1.22].

The block for displaying and recording data 16, which is part of the general structural diagram, is designed to display information about the presence of the desired and unknown verified (analyzed and, if necessary, converted in the fuzzy combinations processing block 24) deterministic combinations and changes in the intensity of the input information flow, records are not certain previously known verified deterministic combinations in the fourth memory block 22 with a simultaneous change in the third memory block 21 of the value of the number of known verified deterministic combinations stored in the cells of the fourth memory block 22, records not previously determined previously sought verified deterministic combinations in the fifth memory block 23. Recording in the third 21, fourth 22 and fifth 23 memory blocks is carried out at the address determined by the hash function calculator 20.13 of the structural analyzer 20. The structure of the block for displaying and recording data 16 is known, described in detail in the prototype (cm. RF patent No. 2290691 "Information traffic monitoring device" IPC G06F 17/18, G06F 17/30, published 12/27/2006, Bull. No. 36), this block can be implemented technically on the basis of a microprocessor, as shown in [Ugryumov E.P. Digital circuitry: textbook. allowance for universities. - 3rd ed., revised. and additional - St. Petersburg: BHV-Petersburg, 2010. - 816 p., S. 378-384, fig. 6.21]. The operation algorithm of the data display and recording unit 16 is known, described in detail in the prototype and illustrated in FIG. 4 of this description.

The block for changing the threshold signals 17, which is included in the general block diagram, is designed to change the values of the threshold signals depending on the time of day. The structure of the block for changing the threshold signals 17, as well as the algorithm of its operation, are known and described in detail in (see RF patent No. 2116670 "Information retrieval device", IPC G06F 17/30, published on 04/07/1997, Fig. 9).

The current day timer 18, included in the overall block diagram, is designed to set the time of day of the entire device. The structure of the current day timer 18 is known, described in the prototype (see RF patent No. 2290691"Information traffic monitoring device» IPC G06F 17/18, G06F 17/30, published 27.12.2006, Bull. No. 36), it can be implemented technically according to the scheme of a programmable interval timer, as shown in [Ugryumov E.P. Digital circuitry: textbook. allowance for universities. - 3rd ed., revised. and additional - St. Petersburg: BHV-Petersburg, 2010. - 816 p., S. 486-493, fig. 7.22].

The truncation threshold generation unit 19, which is included in the general block diagram, is designed to adjust the value of the maximum number of the time interval " N _max " adequately to the input information flow throughout the entire analysis interval. The structure of the truncation threshold generation unit 19, as well as the algorithm of its operation, are known and described in detail in .

Structural analyzer 20, which is part of the general structural diagram, is designed to generate a signal to start the operation of the entire device, hashing, recognizing the desired and unknown deterministic combinations, as well as writing these deterministic combinations to the test input of the fuzzy combination processing unit 24 for additional verification (analysis and, if necessary, transformation). The scheme of the structural analyzer 20 is known, described in detail in the prototype (see RF patent No. 2290691"Information traffic monitoring device» IPC G06F 17/18, G06F 17/30, published 27.12.2006, Bull. No. 36, fig. 2) and illustrated in Fig. 3 of this description. The structure analyzer 20 (see Fig. 3) contains an input register 20.1, a decoder 20.2, the first 20.3, the second 20.5 and the third 20.15 parallel registers, the counter 20.4, the first 20.6, the second 20.8 and the third 20.12 comparators, the first 20.7 and the second 20.17 elements And, NOT element 20.9, first 20.10 and second 20.11 OR elements, hash calculator 20.13, RS flip-flop 20.14 and pulse generator 20.16.

The third memory block 21, included in the overall block diagram, is designed to store pre-programmed values about the number of known verified deterministic combinations stored in the cells of the fourth memory block 22. The technical implementation of the third memory block 21 is possible on the basis of a register with read-only memory functions, description of work and the scheme of such registers are known and are given, for example, in the book [Averchenkov O.E. Circuit engineering: hardware and software. – M.: DMK Press, 2012. – 588 p., S. 443-445].

The fourth memory block 22, included in the overall block diagram, is designed to store pre-programmed known verified deterministic combinations. The fourth memory block 22 is a register with read-only memory functions, the scheme of which is known and described in [Averchenkov O.E. Circuit engineering: hardware and software. – M.: DMK Press, 2012. – 588 p., S. 443-445].

The fifth memory block 23, included in the overall block diagram, is designed to store pre-programmed desired verified deterministic combinations. The technical implementation of the fifth memory block 23 is possible on the basis of a register with the functions of a read-only memory device, a description of the operation and scheme of such registers are known and are given, for example, in [Averchenkov O.E. Circuit engineering: hardware and software. – M.: DMK Press, 2012. – 588 p., S. 443-445].

The information traffic monitoring device operates as follows.

It is known [1-5] that from the point of view of verification of observable (identifiable) deterministic combinations characterizing known (sought) or unknown signs of input information flows within the framework of traffic monitoring, it is possible to recognize (determine) these combinations, observed and specified both quantitatively, and qualitatively, fuzzy (with the involvement of a linguistic variable). This possibility is implemented using the mathematics of fuzzy sets, fuzzy computational methods and algorithms that allow, through successive transformations, to make the transition from fuzzy recognized (observable, identifiable) deterministic combinations to a form suitable for a clear, unambiguous decision on the values of the elements of this combination, in within a specific information traffic monitoring scenario. At the same time, a deterministic combination that characterizes known or unknown features of input information flows can be verified on the basis of mathematical decision-making methods in weakly formalizable problems - fuzzy computational methods and algorithms that can be implemented quite simply in hardware.

Fuzzy computational methods and algorithms work on the basis of expert assessments, and to solve the problem of combining expert opinions, whose knowledge is used, for example, to verify observable (identifiable) deterministic combinations, one of the typical computational algorithms of fuzzy set theory is used - the algorithm of disjunctive summation of fuzzy sets. Taking into account the fact that in the prototype there are a set of values of deterministic combinations (i.e., a set of values of q -bit binary numbers characterizing the structural and statistical attributes (parameters) of the analyzed input information array - a set of values of bit combinations describing the traffic structure, sequence and intensity data receipt within the information flow) can be represented as

С = { с ₁ , с ₂ , …, с _S }, (1)

then from the point of view of the considered approach to the recognition (definition) of deterministic combinations, it is possible to represent the values of combinations of bits not only quantitatively, numerically, but also fuzzy, in the form of a fuzzy set of values of these q -bit binary numbers of the form:

, (2)

, (2)

– нечеткое значение комбинаций бит (детерминированной комбинации).where

– fuzzy value of bit combinations (deterministic combination).

In this case, the number S corresponds to the possible number of values of bit combinations (within a deterministic combination) and depends on the number of combinations of these q -bit binary numbers sufficient to identify the deterministic combination and on the number of experts involved in the implementation of the computational fuzzy algorithm for their verification. In our case, S can take values from 2 (two) to 20 (twenty).

In other words, the analysis of the results of works [1-5] makes it possible to provide in the device the possibility of processing deterministic combinations described (observed, identifiable) both quantitatively and fuzzy (with the involvement of a linguistic variable).

Formally, only the key expression (1) will change to expression (2), characterizing, in our case, the fuzzy knowledge of the operators operating the device about the set of values of bit combinations (within a deterministic combination), the elements of which are obtained with the help of experts. This interpretation allows us to introduce an algorithm for sequential reduction of fuzzy identified deterministic combinations to a form that makes it possible to parametrically estimate the structural and statistical attributes (parameters) of the analyzed input information array in the interests of reliable traffic monitoring.

To solve the problem of combining expert opinions about the analyzed deterministic combination (about the values of combinations of bits of the information flow), one of the typical operations on fuzzy sets is used - the operation of disjunctive summation [1-5]. In this case, the disjunctive sum, for example, of two fuzzy sets (by the number of experts), is defined in terms of unions and intersections as follows:

(3)

(3)

– нечеткое множество, характеризующее мнение первого U ₁ (второго U ₂) эксперта о конкретной s-ой (s=

) нечетко заданной (наблюдаемой, идентифицируемой) детерминированной комбинации, т.е., о значении комбинаций бит (q-разрядных двоичных чисел)

, характеризующих структурно-статистические атрибуты (параметры) анализируемого входного информационного потока;

– дополнения этих нечетких множеств.where

is a fuzzy set characterizing the opinion of the firstU _one (secondU ₂) an expert about a particulars-Oh (s=

) a fuzzy (observable, identifiable) deterministic combination, i.e., about the meaning of combinations of bits (q-bit binary numbers)

characterizing the structural and statistical attributes (parameters) of the analyzed input information flow;

are the complements of these fuzzy sets.

характеризует объединенное мнение (в нашем случае двух, U ₁ и U ₂) экспертов о нечетко заданной (наблюдаемой, идентифицируемой) детерминированной комбинации.The resulting disjunctive sum

characterizes the joint opinion (in our case, two, U ₁ and U ₂ ) of experts about a fuzzy (observable, identifiable) deterministic combination.

For the final identification (unambiguous choice) of quantitative values of fuzzy parameters of a deterministic combination, use the function [5]:

, (4)

, (4)

– функции принадлежности (степень уверенности) интегрированного мнения экспертов о каждой из нечетко заданных (наблюдаемых, идентифицируемых) детерминированных комбинаций, т.е., о значениях каждой нечетко заданной комбинации бит (q-разрядных двоичных чисел), характеризующих структурно-статистические атрибуты (параметры) анализируемого входного информационного потока.characterizing the maximum value

- membership functions (degree of confidence) of the integrated opinion of experts about each of the fuzzy (observable, identifiable) deterministic combinations, i.e., about the values of each fuzzy combination of bits ( q -bit binary numbers) characterizing the structural and statistical attributes (parameters ) of the analyzed input information flow.

Thus, the results of the analysis of works [1-5] and the analysis of expressions (1)–(4) allow us to conclude that it is technically possible to implement unambiguous verification of deterministic combinations with quantitatively and fuzzy specified parameters. Considered in [1-4] and described in detail in [5], the computational fuzzy algorithm (algorithm for disjunctive summation of fuzzy sets) makes it possible to mathematically correct the fuzziness of deterministic combinations that characterize the structural and statistical attributes (parameters) of the analyzed input information array, makes it possible to unambiguously recognize (verify ) the true values of each fuzzy (identifiable) combination of bits ( q -bit binary numbers), determined by a specific real array of incoming data at the current time, and ultimately, increase the reliability of the search and determination of known (sought) or unknown signs of input information flows , and, as a result, to increase the reliability of information traffic monitoring under conditions inherent in the real dynamics of the information exchange process in information (information-computing or telecommunication) systems, data transmission networks with packet switching, in social networks and in the global Internet - in conditions of fuzzy data on the true values of traffic parameters.

The input of the computational fuzzy algorithm implemented in the fuzzy combinations processing unit 24 receives data characterizing the deterministic combinations recognized (defined) in the block 20 both quantitatively and fuzzy. It is determined which of the deterministic combinations are quantitatively recognized at a given time, and which are not clearly identified. In order to verify deterministic combinations, it is necessary to mathematically correct, using disjunctive summation of fuzzy sets, to transform the recognized fuzzy combinations. The stages of operation of a computational fuzzy algorithm are described in detail, algorithmically and analytically, in [5]. At the output of the computational fuzzy algorithm, we have an output image - the converted values of the combination of bits ( q -bit binary numbers), which clearly (reliably) characterize the integrated opinion of experts about the belonging of this deterministic combination to the space of reliable, verified combinations that characterize structural and statistical attributes (parameters) analyzed input information flow in the interests of traffic monitoring.

With this in mind, information traffic is monitored in the claimed device with additional verification (analysis and, if necessary, transformation using fuzzy set theory methods) of the desired and unknown deterministic combinations.

The input information stream, synchronized with the clock pulses, is fed to the information input 207 of the structural analyzer 20 (Fig. 1).

In this case, the clock pulses synchronizing the input information flow fix the current time of the traffic analysis interval of the controlled complex information (information-computing or telecommunication) system.

Structural analyzer 20 (Fig. 3) generates a signal to start the operation of the entire device in the presence of a combination of the beginning of the message in the input information stream, and also searches for unknown and predetermined desired initial (not verified) deterministic combinations and, if any, outputs a signal to the output 2010 "Unknown feature" or output 2011 "Desired feature", as well as from its output 209 "Deterministic combination" gives the original deterministic combination characterizing the structural and statistical attributes (parameters) of the analyzed input information flow, to the test input 241 of the fuzzy combination processing unit 24, from the verification output 242 of which the already verified deterministic combination enters the input 161 "Deterministic combination" of the data display and recording block 16. Thus, the recognition object in block 20 for the current analysis interval is the desired and unknown initial (not verified determined) deterministic combinations in the input information flow.

Each original (not verified) deterministic combination, which isq- bit binary number, divided by a predeterminedq-bit binary number with a remainder. The remainder is the hash value. According to the found value of the hash function, which is the address, pre-programmed known deterministic combinations are found in the fourth memory block 22, compared with the original (not verified) received deterministic combination for a match. In case of non-matching of any of the deterministic combinations stored in the fourth memory block 22 with the incoming one, the signal "Unknown sign" is displayed by the data display and recording unit 16. deterministic combinations and compare them with the received original (not verified) deterministic combination for a match. In the event that one of the deterministic combinations stored in the fifth memory block 23 matches the incoming one, the “Desired sign” signal is displayed, displayed by the data display and recording unit 16.

In the input register 20.1 of the structural analyzer 20 (Fig. 3) the original (not verified) the deterministic combination under the action of clock pulses is converted from serial code to parallel and enters the information input 20.2-1 of the decoder 20.2, the information input 20.3-2 of the first parallel register 20.3 and the information input 20.13-1 of the hash function calculator 20.13.

In the decoder 20.2 of the structural analyzer 20 (see Fig. 3), when a combination of the beginning of the message appears on strictly defined output bits and at the output 20.1-3 of the input register 20.1, and then, after decryption, at the output 20.2-2 of the decoder 20.2, a work start signal is generated of the entire device, which is supplied to the control input 20.3-1 of the first parallel register 20.3, input 20.4-2 "Reset" of the counter 20.4, which triggers the input 20.13-2 of the hash function calculator 20.13, input 20.14-2 "Setting 1" of the RS flip-flop 20.14 and to the information output 206 of the structural analyzer 20.

According to this signal, a deterministic combination from the output 20.1-3 of the input register 20.1, except for the decoder, is written to the first parallel register 20.3 and to the hash function calculator 20.13, at the output of the RS flip-flop 20.14, the level of the logical unit is set by the signal from the decoder 20.2. In the first parallel register 20.3, the deterministic combination is stored for one initial (start) analysis interval. From the output 20.3-3 of the first parallel register 20.3, the deterministic combination is supplied to the information input 20.5-2 of the second parallel register 20.5 and the first inputs 20.8-1 and 20.12-1, respectively, of the second 20.8 and third 20.12 comparators.

The counter 20.4 of the structural analyzer 20 (see Fig. 3) counts the number of clock pulses arriving at its input 20.4-1 from the output 20.17-3 of the second element AND 20.17, and outputs a combination to the first comparator 20.6 about the number of received known deterministic combinations from the fourth memory block 22 into the structural analyzer 20 during one analysis interval.

In the first comparator 20.6 of the structural analyzer 20 (see Fig. 3), under the action of clock pulses arriving at its control input 20.6-3 from the second element And 20.17, the operation of comparing two combinations, which are two m -bit binary numbers, is performed, the first of which comes from the output 20.4-3 of the counter 20.4 to the first input 20.6-1 of the first comparator 20.6, and the second - from the output 213 "Data 1" of the third memory block 21 to the second input 20.6-2 of the first comparator 20.6, and if there is a match, at the output 20.6-4 "Equality - A=B" signal "1" is generated, which is fed to the first input 20.7-1 of the first element AND 20.7.

In the second comparator 20.8 of the structural analyzer 20 (see Fig. 3), under the influence of clock pulses arriving at its control input 20.8-3 from the second element And 20.17, the operation of comparing two deterministic combinations, which are two q -bit binary numbers, is performed, the first of which comes from the output 20.3-3 of the first parallel register 20.3 to the first input 20.8-1 of the second comparator 20.8, and the second - from the output 223 "Data 2" of the fourth memory block 22 to the second input 20.8-2 of the second comparator 20.8, and if there is a match , at the output 20.8-4 "Equality - A = B" of the second comparator 20.8, a signal "1" is generated, which is fed to the second input 20.11-2 of the second element OR 20.11 and to the input 20.9-1 of the NOT element 20.9.

If there is no signal "1" (see Fig. 3) at the output 20.8-4 "Equality - A=B" of the second comparator 20.8 at the output 20.9-2 of the NOT element 20.9, a signal "1" is generated, which is fed to the second input 20.7-2 of the first element AND 20.7. In this case, if there is a signal "1" at the first input 20.7-1 of the first element And 20.7, coming from the output 20.6-4 "Equality - A \u003d B" of the first comparator 20.6, at the output 20.7-3 of the first element And 20.7, a signal "1" is generated , arriving at the first inputs 20.10-1 and 20.11-1, respectively, the first 20.10 and second 20.11 elements OR, the control input 20.15-2 of the third parallel register 20.15 and through the output 2010 "Unknown feature" of the structural analyzer 20 to the input 162 "Unknown feature" of the display unit and data records 16.

When a signal "1" (see Fig. 3) is received at any input of the first element OR 20.10 from the output 20.7-3 of the first element AND 20.7 or the output 20.12-4 "Equality - A = B" of the third comparator 20.12, a signal is generated at its output "1" coming to the control input 20.5-1 of the second parallel register 20.5. According to this signal, the deterministic combination is recorded in the second parallel register 20.5 and enters through the output 209 "Deterministic combination" of the structural analyzer 20 to the test input 241 of the fuzzy combination processing unit 24.

The fuzzy combination processing unit 24 can be implemented in accordance with the scheme proposed in FIG. 2. The initial (before verification) deterministic combination characterizing the structural and statistical attributes (parameters) of the analyzed input information flow, from the output 209 "Deterministic combination" of the structural analyzer 20 through the test input 241 of the fuzzy combination processing unit 24 enters the input 24.1-1 of the counter 24.1 , which is designed to register in each cell (digit) one binary number (bit) of incoming information.

Sequential comparison (by the number of binary numbers characterizing any deterministic sequence) of deterministic combinations arriving in a binary code and making a decision about their mathematical nature - a deterministic combination is set (identified) parametrically or using a membership function characteristic of fuzzy sets, is carried out in counter 24.1 and storage register 24.2 processing unit fuzzy combinations 24 as follows.

) детерминированной комбинации, превышает единицу, значит, с точки зрения нечеткой математики – эта s-ая битовая (кодовая) последовательность содержит избыточность (т.к. содержит, кроме прочего, значения функций принадлежности нечетких множеств), обусловливающую нечеткость данных, описывающих эту s-ую детерминированную комбинацию. If the number of binary numbers characterizing anyq-th category of the incomings-Oh (s=

) of a deterministic combination exceeds one, which means that, from the point of view of fuzzy mathematics, thiss-th bit (code) sequence contains redundancy (because it contains, among other things, the values of the membership functions of fuzzy sets), which causes the fuzziness of the data describing thissth deterministic combination.

) детерминированной комбинации: для записи в двоичном коде количественной информации достаточно одного двоичного числа, тогда как нечеткая (качественная) информация несет в себе помимо обычного числа еще и характеристику функции принадлежности, что объективно требует использования более одного двоичного числа для записи и хранения нечеткой информации (неоднозначно (нечетко) заданных значений двоичных чисел, характеризующих любой из разрядов поступающей s-ой детерминированной комбинации). Если поступает одно двоичное число, характеризующее любой из разрядов поступающей s-ой детерминированной комбинации, значит данная детерминированной комбинации не нуждается в верификации, четко (однозначно) описывает известные (искомые) или неизвестные признаки во входном информационном потоке и достоверно определяет структурно-статистические атрибуты (параметры) анализируемых информационных массив в интересах мониторинга трафика.In other words, the initially qualitative and quantitative information coming from the output 209 "Deterministic combination" of the structural analyzer 20 may differ in the number of binary numbers characterizing any of the digits of the incomings-Oh (s=

) deterministic combination: to record quantitative information in a binary code, one binary number is enough, while fuzzy (qualitative) information carries, in addition to the usual number, the characteristic of the membership function, which objectively requires the use of more than one binary number to record and store fuzzy information ( ambiguous (fuzzy) given values of binary numbers characterizing any of the digits of the incomings-Oh deterministic combination). If one binary number is received that characterizes any of the digits of the incomings-Oh deterministic combination, which means that this deterministic combination does not need verification, clearly (unambiguously) describes the known (sought) or unknown features in the input information flow and reliably determines the structural and statistical attributes (parameters) of the analyzed information array in the interests of traffic monitoring.

Taking into account this fact, the counter 24.1 and the storage register 24.2 are built (see Fig. 2). Both of these elements of the fuzzy combinations processing unit 24 are designed for registration, analysis and storage of one binary number characterizing any of the bits of the incoming deterministic combination.

If the number of binary numbers exceeds one, then, from the point of view of fuzzy mathematics, this deterministic combination comes in a fuzzy form. In this case, both the storage register counter 24.1 and the storage register 24.2 of the fuzzy combination processing unit 24 perform the functions of a transit node, moreover, from the test output 24.2-1 of the storage register 24.2, this information in binary code immediately goes to the input 24.3-1 of the registering counter 24.3.

If the input 24.1-1 of the counter 24.1 of the fuzzy combination processing unit 24 receives one binary number in binary code, characterizing any of the digits of the incomings-Oh deterministic combination, then this deterministic combination arrives (identified) in a clear form, has a quantitative meaning, while the counter 24.1 registers this combination and from its output 24.1-2 sends it to the input 24.2-2 of the storage register 24.2, which through its transit output 24.2 -3 sends this information (a deterministic combination specified in a clear form - quantitatively specified data that does not require additional verification, characterizing the structural and statistical attributes (parameters) of the analyzed input information flow) through the verification output 242 of the fuzzy combination processing unit 24 to the input 161 "Deterministic combination » data display and recording unit 16.

Information that requires additional verification (observed and specified in a fuzzy form, a deterministic combination - fuzzy identified data characterizing the structural and statistical attributes (parameters) of the analyzed input information flow), in binary code from the check output 24.2-1 of the storage register 24.2 enters the input 24.3- 1 registering counter 24.3 processing unit fuzzy combinations 24 (Fig. 2). Transformation (transformation) of deterministic combinations given in a fuzzy form to a form suitable for obtaining clear, unambiguous (reliable) data characterizing the structural and statistical attributes (parameters) of the analyzed input information flow occurs as follows. In general, the essence of the further transformation (transformation) of fuzzy deterministic combinations in the fuzzy combinations processing unit 24, from the point of view of mathematics, is the correct calculation of the integrated expert opinion (expression (3)) and the decision on the maximum value of the membership function (degree of confidence) of this integrated opinion (expression (4)), which determines the unambiguous choice of the quantitative value of the fuzzy parameter - the quantitative value a binary number that characterizes any of the digits of the incomings-Oh deterministic combination.

) к пространству истинных (однозначно, четко определенных) детерминированных комбинаций. Первый 24.3-2 и второй 24.3-3 выходы регистрирующего счетчика 24.3 соответствуют данным от первого U ₁ и второго U ₂ экспертов. С первого выхода 24.3-2 регистрирующего счетчика 24.3 информация (соответствует данным от первого U ₁ эксперта) в двоичном коде поступает на вход 24.5-1 основного запоминающего элемента 24.5 и первый вход 24.4-1 вычислителя дополнения 24.4. Со второго выхода 24.3-3 регистрирующего счетчика 24.3 информация (соответствует данным от второго U ₂ эксперта) в двоичном коде поступает на прямой вход 24.6-1 вспомогательного запоминающего элемента 24.6 и второй вход 24.4-2 вычислителя дополнения 24.4. Вычислитель дополнения 24.4 реализует функцию арифметического вычитания из единицы значений функций принадлежности нечетких множеств, в соответствии с алгоритмом, описанным в [1, 5], например, еслиA fuzzy deterministic combination (fuzzy identified (observed, given) values of a binary number that describes any of the digits of this combination, characterizing the structural and statistical attributes (parameters) of the analyzed input information flow), enters the input 24.3-1 of the registering counter 24.3 of the fuzzy combination processing unit 24 (Fig. 2). Registering counter 24.3 registers and sorts information into two components, in accordance with the number of expert opinions (number of experts) on the degree of belonging to a particulars-Oh deterministic combination (

) to the space of true (uniquely, well-defined) deterministic combinations. The first 24.3-2 and second 24.3-3 outputs of the registering counter 24.3 correspond to the data from the firstU _one and secondU ₂experts. From the first output 24.3-2 registering counter 24.3 information (corresponds to data from the firstU _one expert) in binary code is fed to the input 24.5-1 of the main storage element 24.5 and the first input 24.4-1 of the add-on calculator 24.4. From the second output 24.3-3 registering counter 24.3 information (corresponds to data from the secondU ₂ expert) in binary code is fed to the direct input 24.6-1 of the auxiliary storage element 24.6 and the second input 24.4-2 of the add-on calculator 24.4. Addition calculator 24.4 implements the function of arithmetic subtraction from unity of the values of membership functions of fuzzy sets, in accordance with the algorithm described in [1, 5], for example, if

, (5)

, (five)

then

, (6)

, (6)

и

– дополнения нечетких множеств

и

, сформулированных экспертами U ₁ и U ₂ по поводу степени принадлежности конкретной s-ой детерминированной комбинации (

) к пространству истинных (однозначно, четко определенных) детерминированных комбинаций. Основной 24.5 и вспомогательный 24.6 запоминающие элементы хранят нечеткую информацию от эксперта U ₁ и U ₂ и через свои соответствующие выходы 24.5-2 и 24.6-2 в двоичном коде выдают значения функций принадлежности нечетких множеств на главный вход 24.7-1 основного вычислителя пересечения 24.7 и на главный вход 24.8-1 вспомогательного вычислителя пересечения 24.8 соответственно. Каждый из основного 24.7 и вспомогательного 24.8 вычислителей пересечения, получая в двоичном коде на свои дополнительные входы 24.7-2 и 24.8-2 соответственно значения элементов дополнения нечетких множеств с первого 24.4-3 и второго 24.4-4 выходов вычислителя дополнения 24.4, выполняет функцию пересечения нечетких множеств, как описано в [1, 5]: основной вычислитель пересечения 24.7 выполняет операцию пересечения

, а вспомогательный вычислитель пересечения 24.8 выполняет операцию пересечения

. С выхода 24.7-3 основного вычислителя пересечения 24.7 и выхода 24.8-3 вспомогательного вычислителя пересечения 24.8 полученные значения в двоичном коде поступают соответственно на первый 24.9-1 и второй 24.9-2 входы вычислителя объединения 24.9, выполняющего завершающий цикл дизъюнктивного суммирования в соответствии с выражением (3). С выхода 24.9-3 вычислителя объединения 24.9 полученные итоговые значения (обобщенное мнение экспертов о значении)

– функции принадлежности конкретной s-ой нечетко заданной (наблюдаемой) детерминированной комбинации

, к пространству истинных (однозначно, четко определенных) комбинаций, в двоичном коде поступают на вход 24.10-1 анализатора уровня принадлежности 24.10, на дополнительный вход 24.4-5 вычислителя дополнения 24.4 и на дополнительный вход 24.6-3 вспомогательного запоминающего элемента 24.6. where

And

– additions of fuzzy sets

And

, formulated by experts U ₁ and U ₂ regarding the degree of belonging to a particular s -th deterministic combination (

) to the space of true (uniquely, well-defined) deterministic combinations. The main 24.5 and auxiliary 24.6 storage elements store fuzzy information from the expert U ₁ and U ₂ and through their respective outputs 24.5-2 and 24.6-2 in binary code give out the values of membership functions of fuzzy sets to the main input 24.7-1 of the main intersection calculator 24.7 and to main input 24.8-1 auxiliary calculator intersection 24.8, respectively. Each of the main 24.7 and auxiliary 24.8 intersection calculators, receiving in binary code on their additional inputs 24.7-2 and 24.8-2, respectively, the values of the elements of the addition of fuzzy sets from the first 24.4-3 and second 24.4-4 outputs of the calculator of the addition 24.4, performs the function of crossing fuzzy sets, as described in [1, 5]: the main intersection calculator 24.7 performs the intersection operation

, and the auxiliary intersection calculator 24.8 performs the intersection operation

. From the output 24.7-3 of the main calculator of the intersection 24.7 and the output 24.8-3 of the auxiliary calculator of the intersection 24.8, the obtained values in binary code are received respectively on the first 24.9-1 and second 24.9-2 inputs of the calculator of the union 24.9, which performs the final cycle of disjunctive summation in accordance with the expression ( 3). From the output 24.9-3 of the union evaluator 24.9, the total values obtained (generalized expert opinion on the value)

– membership functions of a specific s -th fuzzy (observable) deterministic combination

, to the space of true (uniquely, well-defined) combinations, in binary code, are fed to the input 24.10-1 of the analyzer of the membership level 24.10, to the additional input 24.4-5 of the add-on calculator 24.4 and to the additional input 24.6-3 of the auxiliary storage element 24.6.

The membership level analyzer 24.10 of the fuzzy combination processing unit 24 obtains an unambiguous final result about the degree of membership of a particulars-Oh deterministic combination to the space of true (uniquely, well-defined) deterministic combinations based on expression (4). Being, in fact, a programmable comparison circuit (a programmable TTL comparator of type 74LS85), in which the values of the membership function of a specifics-Oh fuzzy (observable) deterministic combination, the membership level analyzer 24.10, based on the determination of the maximum membership function, unambiguously, clearly and finally assigns (verifies) the numerical value of this combination of bits (q-bit binary numbers) characterizing the structural and statistical attributes (parameters) of the analyzed input information flow.

Transfer of information to the additional input 24.4-5 of the add-on calculator 24.4 and to the additional input 24.6-3 of the auxiliary storage element 24.6 is intended for the case when the number of experts is more than two. In this case, the addition of the fuzzy set obtained from the output 24.9-3 of the union calculator 24.9 in the complement calculator 24.4 is determined and the values obtained from the output 24.9-3 of the union calculator 24.9 are overwritten in the auxiliary storage element 24.6, playing the role of information from the first expert. Information from a new (for example, third) expert is recorded through the registration counter 24.3 in the main storage element 24.5 and the calculation cycle is repeated again.

) нечетко заданной (наблюдаемой, идентифицируемой) детерминированной комбинации. Thus, an unambiguous verification of the quantitative values of the combination of bits (q-bit binary numbers) characterizing the structural and statistical attributes (parameters) of the analyzed input information flow in accordance with expression (4) - the analyzer of the membership level 24.10 outputs at its output 24.10-2 in the binary code a verified, quantitative value of a specifics-Oh (s=

) a fuzzy (observable, identifiable) deterministic combination.

In other words, certain (recognized) fuzzy combinations characterizing the input information flow are transformed into a form suitable for reliable (clear, unambiguous) parametric estimation of the structural and statistical characteristics of the data flow in the interests of information traffic monitoring.

As a result, at the output of the membership level analyzer 24.10 and at the verification output 242 of the fuzzy combination processing unit 24 (see Fig. 2), we obtain information characterizing (based on the analysis of the integrated expert opinion obtained in the framework of fuzzy set mathematics) the true form of the deterministic combination transformed (verified) in the interests of increasing the reliability of monitoring.

The membership level analyzer 24.10 writes, stores and issues from its output 24.10-2 through the verification output 242 of the fuzzy combination processing unit 24 to the input 161 "Deterministic combination" of the display and data recording unit 16 (see Fig. 1) a binary code containing verified results analysis and processing of a deterministic combination - a code that clearly and unambiguously defines the structural and statistical attributes (parameters) of the analyzed input data stream in the interests of reliable monitoring of information traffic.

Further procedures for monitoring information traffic in the claimed device are implemented in accordance with the sequence described in detail in the prototype (see RF patent No. 2290691 "Information traffic monitoring device" IPC G06F 17/18, G06F 17/30, published 12/27/2006, Bull. No. 36), but taking into account the results of additional verification of the desired and unknown deterministic combinations obtained in the fuzzy combinations processing unit 24, as follows.

When a signal "1" (see Fig. 3) is received at any of the three inputs of the second element OR 20.11 from the output 20.7-3 of the first element AND 20.7, outputs 20.8-4 and 20.12-4 "Equality - A \u003d B", respectively, the second 20.8 or third 20.12 comparators, its output generates a signal "1" to the input 20.14-1 "Setting 0" RS-flip-flop 20.14. On this signal, the RS flip-flop 20.14 stops generating a signal "1" to the input 20.17-2 of the second element And 20.17, while clock pulses stop coming from the output 20.17-3 of the second element And 20.17, the work of the structural analyzer 20 at this analysis interval ends.

In the third comparator 20.12 (see Fig. 3) under the action of clock pulses arriving at the control input 20.12-3 from the second element And 20.17, the operation of comparing two verified deterministic combinations is performed, which are two q -bit binary numbers, the first of which comes from the output 20.3-3 of the first parallel register 20.3 to the first input 20.12-1 of the third comparator 20.12, and the second number from the output 233 "Data 3" of the fifth memory block 23 (see Fig. 1) to the second input 20.12-3 of the third comparator 20.12 , and, if there is a match, at the output 20.12-4 "Equality - A=B" of the third comparator 20.12, a signal "1" is generated, which is fed to the second input 20.10-2 of the first element OR 20.10, the third input 20.11-3 of the second element OR 20.11 and through the output 2011 "Desired feature" of the structural analyzer 20 to the input 163 "Desired feature" of the display and data recording unit 16.

The hash function calculator 20.13 of the structural analyzer 20 (see Fig. 3) divides the initial (not verified) deterministic combination received at its information input 20.13-1, which is a q -bit binary number, into a predetermined q -bit binary number by the method restoring the remainder, which is the value of the hash function and is also a q -bit binary number, which is fed to the information input 20.15-1 of the third parallel register 20.15 and through the output 204 "Address" of the structural analyzer 20 (see Fig. 1) to the inputs 214 , 224 and 234 "Address" of the third 21, fourth 22 and fifth 23 memory blocks, respectively.

RS-trigger 20.14 structural analyzer 20 (see Fig. 3) controls the operation of the second element And 20.17, which performs the function of a key. The RS flip-flop 20.14 unlocks the key (second element AND 20.17) when the signal "1" appears at the input 20.14-2 "Setting 1" and locks it when the signal "1" appears at the input 20.14-1 "Setting 0".

When a signal "1" (see Fig. 3) is received at the control input 20.15-1 of the third parallel register 20.15, the address generated by the hash function calculator 20.13 is written to the third parallel register 20.15 and from its output 20.15-3 through the output 2012 "Address NP" of the structural analyzer 20 is fed to the input 164 "Address NP" (see Fig. 1) of the block for displaying and recording data 16.

The pulse generator 20.16 structural analyzer 20 (see Fig. 3) generates pulses that are fed to the second input 20.17-1 of the second element And 20.17. From the output 20.17-3 of the second element And 20.17 in the presence of a signal "1" at the first input from the output 20.14-3 of the RS-flip-flop 20.14, the clock pulses arrive at the information input 20.4-1 of the counter 20.4, at the control inputs 20.6-3, 20.8-3 and 20.12-3, respectively, the first 20.6, second 20.8 and third 20.12 comparators, as well as to the inputs 225 and 235 "Clock pulses" (see Fig. 1), respectively, the fourth 22 and fifth 23 memory blocks of the device.

From the output 213 of the third memory block 21 of the structural analyzer 20 (see Fig. 3), preprogrammed values about the number of known verified deterministic combinations located in the cells of the fourth memory block 22 at the address coming from the output 20.13-3 of the hash function calculator 20.13 are read to the second input 20.6-2 of the first comparator 20.6. From the output 223 of the fourth memory block 22, pre-programmed known verified deterministic combinations located at the address coming from the 20.13-3 output of the hash function calculator 20.13 are sequentially read under the action of clock pulses coming from the output 20.17-3 of the second element And 20.17, to the second input 20.8-2 of the second comparator 20.8. From the output 233 of the fifth memory block 23, pre-programmed desired deterministic combinations located at the address coming from the output 20.13-3 of the hash function calculator 20.13 are sequentially read under the action of clock pulses coming from the output 20.17-3 of the second element And 20.17, to the second input 20.12-2 of the third comparator 20.12. At the same time, the set of known and desired verified deterministic combinations stored respectively in the fourth 22 and fifth 23 memory blocks do not have the same deterministic combinations.

The signal to start the operation of the entire device from the output 20.2-2 of the decoder 20.2, which, among other things, is sent to the information output 206 of the structural analyzer 20 (Fig. 3), is generated for the current time of the traffic analysis interval of a controlled complex information (information-computing or telecommunication) system.

Thus, from the information output 206 of the structural analyzer 20 to the information input 012 of the signal generator of the current assessment 1 and to the information input 021 of the discriminator of the zones of assessment values 2 (see Fig. 1), the logical values of the code that specifies the time values of the analysis interval are received. This, in fact, is a signal to start the operation of the entire traffic analysis device of a controlled complex information (information-computing or telecommunication) system.

Current estimate signal generator 1 and estimate value zone discriminator 2 analyze the intensity of the input stream over the analysis interval. In the current estimate signal generator 1 (see Fig. 1), at the end of the analysis interval time, a binary signal is generated that characterizes the state of the situation. If the deviation of the number of combinations of the beginning of messages from the average value to the upper or lower side is greater than the threshold, at the output 014 of the signal generator of the current estimate 1, the signal "Change" is generated, in other cases, the signal "Otc" is generated. From the output 014 of the signal generator of the current estimate 1, the signal "Change" or "Ots" is fed to the control input 54 of the switch 5. In the zone discriminator of the values of the estimate 2, a signal is generated about the number of the zone of the state in which the input information flow of the corresponding intensity is located on the analysis interval. This zone number corresponds to a more accurate assessment of the state of the situation compared to the assessment obtained in the signal generator of the current assessment 1. inputs 52 "Meas" or 53 "Ots" of the switch 5. In this case, the pulse distributor 3 synchronizes the operation of the entire device by forming four pulse sequences shifted relative to each other by a certain value Δ t , and the time interval counter 4 counts the number of observed time intervals and issues from its output 42 a combination of the number of the time interval to the input 146 " N _current " of the search strategy register 14 and to the input 199 " N _current " of the truncation threshold generation unit 19.

The switch 5 (see Fig. 1) in accordance with the control signal coming to its control input 54 from the signal generator of the current estimate 1, provides the connection of the signal about the number of the state zone "Change" or "Otc", respectively, to the input 62 of the first generator of the search variable 6 or to the input 71 of the second shaper of the search variable 7, where, based on the zone number signalK _m (1<j<m), the largest zone numberK _m and the maximum number of observationsN _maxincrements are builtF _P(N) AndF _ABOUT(N) empirical integral functions of the probability distribution of the rejected and normal traffic state onN-th observation interval:F _P(N) =K _jq (N)/(K _mq ×N _max) AndF _ABOUT(N) =K _{j 0}(N)/(K _{m 0} ×N _max), as described in detail in the prototype device (see RF patent No. 2290691"Information traffic monitoring device» IPC G06F 17/18, G06F 17/30, published 27.12.2006, Bull. No. 36).

In the summing counters 8 and 9 (see Fig. 1) the values of the increments F _P ( N ) and F _O ( N ) are compared with the corresponding values of the empirical integral distribution function calculated for ( N -1) time interval F _P ( N -1 ) and F _O ( N -1), which come from outputs 101 and 113, respectively, of the first 10 and second 11 memory blocks: F _P ( N ) = F _P ( N -1) + F _P ( N ) and F _O ( N ) = F _O ( N -1) + F _O ( N ). Values F _P ( N ) and F _O ( N ) are fed respectively to the inputs 121 and 122 of the block division 12, which performs the operation of arithmetic division L ( N ) = F _P ( N ) / F _O ( N ) and the issuance of the likelihood ratio to the information input 136 classifier 13.

The classifier 13 (see Fig. 1) makes a decision about the state of the situation for the time interval based on a comparison of input information with threshold values and outputs from its outputs 132 or 133 the corresponding signal "P" or "O" to the corresponding inputs 169 or 1610 of the display unit and data records 16 and to the corresponding inputs 151 or 152 of the reset signal generator 15.

The search strategy register 14 (see Fig. 1) generates interval or point values of the classification thresholds depending on whether the number of the search interval is limiting or not. The signal from one of the outputs 143 "P _klv " or 144 "P _kln "of the search strategy register 14 is fed to the corresponding input 134 or 135 of the classifier 13. The reset signal generator 15 generates a "Reset" signal and feeds it to the input 43 of the counter 4, inputs 103 and 114, respectively, the first 10 and second 11 memory blocks, as well as to the input 1910 of the block for the formation of the truncation threshold 19 to transfer them to their original state.

The data display and recording unit 16 (see Fig. 1) displays information about the presence of verified desired and unknown deterministic combinations in the input information flow and changes in the intensity of the input information flow over the analysis interval when signals are received, respectively, from the fuzzy combination processing unit 24 (where verification is carried out ) and a classifier 13. If necessary, the data display and recording unit 16 records previously unverified known deterministic combinations that have not been entered into the fourth memory block 22 and changes the N values of the number of verified known deterministic combinations in the third memory block 21 to N +1 values stored in cells the fourth memory block 22, and also writes the verified, sought-for deterministic combinations that have not been previously entered into the fifth memory block 23. The operation algorithm of the data display and recording unit (hereinafter simply the algorithm) is shown in FIG. 4.

In block 1 of the algorithm (see Fig. 4), according to the data received from the ports P5 ("Change in the state of the situation - P"), P6 ("No change in the state of the situation - O") and P8 ("Time"), the display and recording information about the change in the intensity of the input information flow over the time interval of the analysis.

In block 2 of the algorithm, according to the data received from the ports P11 (“Determ. comb.”), P12 (“Unknown sign”) and P13 (“Seek. sign”), information about the presence of the desired or unknown sign is displayed in the input information flow for the time interval of the analysis.

In block 3 of the algorithm, based on the information received from block 2 of the algorithm, the operator decides whether the verified deterministic combination is an unknown feature. If yes, then go to block 5 of the algorithm. If not, then go to block 4 of the algorithm.

In block 4 of the algorithm, based on the information received from block 2 of the algorithm and data from port P8 ("Time"), a verified deterministic combination is recorded, which is a known sign in time.

In block 5 of the algorithm, based on the information received from block 2 of the algorithm and data from ports P1 ("Data 1"), P8 ("Time"), P10 ("Address NP"), a verified deterministic combination is recorded, which is an unknown sign, address determined by the hash calculator 20.13 and data ("Data 1") in time.

In block 6 of the algorithm, the operator decides to write an unknown feature in the area of the desired features. If yes, then go to block 8 of the algorithm. If not, then go to block 7 of the algorithm.

In block 7 of the algorithm, the operator decides to write an unknown feature in the area of known features. If yes, then go to block 9 of the algorithm, if not, then end.

In block 8 of the algorithm, the verified deterministic combination is defined as the desired one, and the "Address NP" is defined as the address of this combination.

In block 10 of the algorithm, a command is issued to ports P4 (“Data 3 - write”) and P9 (“Address 3 - write”), by which the verified combination received from block 8 of the algorithm is written to the fifth block of memory 23 at the address received from block 8 of the algorithm.

In block 9 of the algorithm, the verified deterministic combination is defined as known, the value of N stored in the third memory block 21 is changed, about the number of known deterministic combinations stored in the fourth memory block 22, to N +1, "Address NP" is defined as the address of this combination and this value.

In block 11 of the algorithm, a command is issued to ports P2 ("Data 1 - write"), P3 ("Data 2 - write") and P7 ("Address 1, 2 - write"), according to which the verified combination and value, received from block 9 of the algorithm, are recorded in the third 21 and fourth 22 memory blocks at the address received from block 9 of the algorithm.

Adaptation of the values of the time intervals (thresholds) of the search to the time of day is carried out in block 17 (see Fig. 1), the outputs of which form the upper and lower values of the thresholds, depending on the time of day. The current time code enters its input from the current day timer 18, which sets the time of day for the entire device.

The truncation threshold generation unit 19 (see Fig. 1) generates a new value “ N _max ” at the end of the current analysis time interval, which is adequate to the characteristics of the input information flow, and outputs it from its output 198 to the input 145 “ N _max ” of the strategy register search 14 and inputs 64 and 73 " N _max ", respectively, the first 6 and second 7 generators of the search variable.

All blocks, devices and elements that process the signal, as well as the lines connecting them, must have a capacity corresponding to the capacity of the input operands and the accuracy of their conversions.

Thus, the proposed device provides increasing the reliability of monitoring information traffic in the conditions inherent in real input information flow circulating in a modern complex and controlled information (information-computing or telecommunication) system - in the conditions of fuzziness of observed and analyzed deterministic combinations characterizing known (sought) or unknown features in the input information array.

Increasing the reliability of monitoring information traffic in the device occurs due to the implemented in the block processing of fuzzy combinations 24 sequential comparison of deterministic combinations arriving in binary code, making a decision about their mathematical nature - the combination is given (identified) parametrically or using the membership function characteristic of fuzzy sets, as well as mathematically correct transformation of deterministic combinations of given (identified) into fuzzy form (not parametrically) to a form suitable for reliable (clear, unambiguous) parametric estimation of the structural and statistical characteristics of the information flow.

This result is due to the receipt of 242 blocks at the verification output processing fuzzy combinations of 24 verified results of analysis and processing of a binary code that clearly and unambiguously defines the structural and statistical attributes (parameters) of the analyzed input data stream in the interests of reliable monitoring of information traffic.

An analysis of the principle of operation of the claimed device shows the obviousness of the fact that, along with the capabilities saved and described in the prototype to increase the speed of searching for combinations of the beginning of messages and increase the information content of traffic indicators, the device is able to carry out a reliable analysis of the input information flow, taking into account fuzzy (observable) deterministic combinations, characterizing known or unknown features of input information flows.

This device provides an increase in the reliability of the implementation of the assessment of traffic indicators characteristic of real information arrays - when monitoring is implemented in conditions of fuzzy data on the true values of the signs of the input information flow, which significantly expands the scope of the device, expands the functionality of control systems focused on monitoring the quality of information exchange and detection of computer incidents in complex information (information-computing or telecommunication) systems, where the claimed information traffic monitoring device will be used.

SOURCES OF INFORMATION

1. Kofman A. Introduction to the theory of fuzzy sets: Per. from French - M.: Radio and communication, 1982, - 432 p.;

2. Fuzzy sets and possibility theory. Recent achievements: Per. from English. / Ed. Yagera R.R. - M.: Radio and communication, 1986, - 408 p.;

3. Voronov M.V. Fuzzy sets in models of organizational management systems. - L.: VMA, 1988, - 54 p.;

4. Martynov V.I. Mathematical foundations of control of primary communication networks using fuzzy parameters. - M .: "Elf-M", 1997, - 48 p.;

5. Parashchuk I.B., Bobrik I.P. Fuzzy sets in problems of analysis of communication networks. - St. Petersburg: VUS, 2001. - 80 p.

Claims (2)

1. An information traffic monitoring device, containing a current estimate signal generator (1), a discriminator of estimate value zones (2), a pulse distributor (3), a time interval counter (4), a switch (5), the first (6) and the second (7 ) search variable generators, first (8) and second (9) summing counters, first (10) and second (11) memory blocks, division block (12), classifier (13), search strategy register (14), reset signal generator (15), block for displaying and recording data (16), block for changing threshold signals (17), timer for the current day (18), block for forming a truncation threshold (19), structural analyzer (20), third (21), fourth (22 ) and the fifth (23) memory blocks, while the output (014) of the current estimate signal generator (1) is connected to the control input (54) of the switch (5), outputs (56) "Change in the state of the situation - Change" and (57) " The absence of a change in the state of the situation - Ots "which is connected to the inputs (62) and (71), respectively, the first (6) and second of the second (7) generators of the search variable, the output (74) of the second generator of the search variable (7) is connected to the information input (92) of the second summing counter (9), the output (91) of which is connected to the information input (111) of the second memory block (11 ) and the second information input (122) of the division block (12), the output (123) of which is connected to the information input (136) of the classifier (13), outputs (132) "Change in the state of the situation P" and (133) "No change in the state of the situation O" of which are connected respectively to the same-named inputs (151) and (152) of the reset signal generator (15) and to the same-named inputs (169) and (1610) of the data display and recording unit (16), output (153) "Reset" of the signal generator reset (15) is connected to the input (103) "Reset" of the first memory block (10), the input (114) "Reset" of the second memory block (11), the input (43) "Reset" of the counter of time intervals (4) and the input ( 1910) “Reset” of the truncation threshold generation block (19), exit (198) “Maximum number of time th interval - N _max "of which is connected to the same-named inputs (145), (64) and (73), respectively, the search strategy register (14), the first (6) and second (7) search variable generators, the output (63) of the first variable generator search (6) is connected to the information input (81) of the first summing counter (8), the output (82) of which is connected to the first information input (121) of the division block (12), outputs (024) "Change in the state of the situation - Change" and ( 025) "No change in the state of the situation - Ots" of the discriminator of zones of evaluation values (2) are connected respectively to the inputs of the same name (52) and (53) of the switch (5), the first output (31) of the pulse distributor (3) is connected to the synchronization inputs (013 ) and (023), respectively, the generator of signals of the current assessment (1) and the discriminator of zones of assessment values (2), as well as to the clock input (41) of the counter of time intervals (4), output (42) "Number of the current time interval - N _current " which is connected to the inputs of the same name (199) and (14 6) respectively, the truncation threshold formation block (19) and the search strategy register (14), the outputs (143) "The value of the upper classification threshold - P _klv " and (144) "The value of the lower classification threshold - P _kln " of which are connected to the inputs of the same name ( 134) and (135) of the classifier (13), the second output (32) of the pulse distributor (3) is connected to the synchronizing input (51) of the switch (5), the third output (33) of the pulse distributor (3) is connected to the synchronization inputs (102) and (112) of the first (10) and second (12) memory blocks, the outputs (101) and (113), respectively, of the first (10) and second (11) memory blocks are connected to the signal inputs (83) and (93), respectively, of the first ( 8) and the second (9) summing counters, the fourth output (34) of the pulse distributor (3) is connected to the synchronizing input (131) of the classifier (13), outputs (172) "Upper value of the search threshold - P _in " and (173) " The lower value of the search threshold - P _n "of the block for changing the threshold signals (17) are connected, respectively, to one nominal inputs (141) and (142) of the search strategy register (14) and, respectively, to the same-named inputs (196) and (197) of the truncation threshold formation block (19), inputs (174) "Start" and (175) "Threshold" of the block changes in threshold signals (17) are connected to the inputs of the same name (191) and (192) of the truncation threshold generation unit (19) and are respectively the inputs "Start" and "Threshold" of the device, input (193) "Numerical value of the unit - 1", input (194) “Maximum number of the time interval N _max ” and input (195) “Sampling of the analysis interval V _sel ” of the truncation threshold generation unit (19) are the inputs of the same name of the device, input (61) “Zone 1” of the first shaper of the search variable (6 ) and the input (72) "Zone 2" of the second generator of the search variable (7) are respectively the inputs "Zone 1" and "Zone 2" of the device, the input (162) "Unknown feature", the input (163) "The desired feature" and the input (164) "Address of an unknown feature - NP Address" of the display and data recording unit (16) are connected, respectively, to the same name these outputs (2010), (2011) and (2012) of the structural analyzer (20), the output (204) "Address" of which is connected to the inputs (214), (224) and (234) of the same name, respectively, the third (21), fourth ( 22) and the fifth (23) memory blocks, the output (213) "Data 1" of the third memory block (21) is connected to the inputs (165) and (201) of the same name, respectively, of the block for displaying and recording data (16) and the structural analyzer (20) , output (223) "Data 2" of the fourth memory block (22) and output (233) "Data 3" of the fifth memory block (23) are connected respectively to the inputs (202) and (203) of the same name of the structural analyzer (20), output ( 205) "Clock" of which is connected to the inputs of the same name (225) and (235), respectively, the fourth (22) and fifth (23) memory blocks, output (166) "Data 1 - write", output (167) "Data 2 - record" and output (168) "Data 3 - record" of the data display and record block (16) are connected to the inputs (211), (221) and (231) of the same name, respectively, the third (21), fourth (22) and fifth (23 ) blo memory, output (1611) "Address 3 - record" of the data display and record block (16) is connected to the input of the same name (232) of the fifth memory block (23), output (1613) "Address 1, 2 - record" of the display block and data record (16) is connected to the inputs (212) and (222) of the same name, respectively, of the third (21) and fourth (22) memory blocks, the information (207) and synchronizing (208) inputs of the structural analyzer (20) are, respectively, the information and synchronizing inputs device, the output (181) "Time" of the timer of the current day (18) is connected to the inputs of the same name (011), (022), (35), (1612) and (171), respectively, the shaper of the signals of the current assessment (1), the discriminator of the zones of values evaluation (2), the pulse distributor (3), the data display and recording unit (16) and the block for changing the threshold signals (17), the information output (206) of the structural analyzer (20) is connected to the information inputs (012) and (021), respectively current estimate signal generator (10) and zone discriminator th evaluation (2), characterized in that an additional fuzzy combination processing unit (24) is introduced, while the output (209) "Deterministic combination" of the structural analyzer (20) is connected to the test input (241) of the fuzzy combination processing unit (24), the verification output (242) of which is connected to the input (161) "Deterministic combination" of the block for displaying and recording data (16). 2. Information traffic monitoring device according to claim 1, characterized in that the fuzzy combination processing unit (24) consists of a counter (24.1), a storage register (24.2), a registering counter (24.3), a complement calculator (24.4), a main (24.5 ) and auxiliary (24.6) storage elements, the main (24.7) and auxiliary (24.8) intersection calculators, the union calculator (24.9) and the membership level analyzer (24.10), the output of which (24.10-2) is combined with the transit output (24.2-3) storage register (24.2) and is the verification output (242) of the fuzzy combination processing unit (24), the input (24.1-2) of the counter (24.1) is the test input (241) of the fuzzy combination processing unit (24), the output (24.1-2) counter (24.1) is connected to the input (24.2-2) of the storage register (24.2), the test output (24.2-1) of the storage register (24.2) is connected to the input (24.3-1) of the registering counter (24.3), the first (24.3-2) and the second (24.3-3) outputs of which are connected respectively with the input (24.5-1) of the main storage element (24.5) and the direct input (24.6-1) of the auxiliary storage element (24.6), as well as with the first (24.4-1) and second (24.4-2) inputs of the add-on calculator (24.4) respectively ), the output (24.5-2) of the main storage element (24.5) and the output (24.6-2) of the auxiliary storage moment (24.6) are connected respectively to the main input (24.7-1) of the main intersection calculator (24.7) and to the main input (24.8- 1) auxiliary intersection calculator (24.8), the first (24.4-3) and second (24.4) -4) the outputs of the complement calculator (24.4), the outputs (24.7-3) and (24.8-3) of the main (24.7) and auxiliary (24.8) intersection calculators are connected respectively to the first (24.9-1) and second (24.9-2) inputs union calculator (24.9), whose output (24.9-3) is connected to an additional input (24.4-5) calculate To supplement (24.4), an additional input (24.6-3) of an auxiliary memory element (24.6) and an input (24.10-1) of a membership level analyzer (24.10).

Images