On measuring the distance between histograms

Abstract

A distance measure between two histograms has applications in feature selection, image indexing and retrieval, pattern classiÿcation and clustering, etc. We propose a distance between sets of measurement values as a measure of dissimilarity of two histograms. The proposed measure has the advantage over the traditional distance measures regarding the overlap between two distributions; it takes the similarity of the non-overlapping parts into account as well as that of overlapping parts. We consider three versions of the univariate histogram, corresponding to whether the type of measurement is nominal, ordinal, and modulo and their computational time complexities are (b), (b) and O(b 2 ) for each type of measurements, respectively, where b is the number of levels in histograms. ?

Pitch-frequency histogram-based music information retrieval for Turkish music

“…(the interested reader is referred to [47] for a review). Here, we discuss a number of popular distance measures which we think are relevant to our problem.…”

“…In pattern recognition literature, template matching method is a simple and robust approach when adequately applied [47,[50][51][52][53]. Temperley [12] also considers the method of tonality finding in literature on western music as template matching.…”

Flow-Based Web Application Brute-Force Attack and Compromise Detection

“…Once we translate this result to network traffic, the unsuitability of the (Euclidean) distance metric becomes clear immediately; The difference between Histogram A and B can easily be caused by variability in the TCP header or differences in username and password lengths, for example, while Histogram C shows significantly different traffic. A solution to this 'problem' is provided in [4], where the Minimum Difference of Pair Assignments (MDPA) distance metric is defined. In a nutshell, MDPA aims at finding the minimum difference of pair assignments between two sets, where sets are histogram bins in our context:…”

“…More formally, we define a tuple as a pair of source and destination IP addresses, source port number and vhost. 4 To qualify for preselection, an attacker must have generated at least N flows towards a target. Note that we refer several times to this number in the remainder of this paper and that the used value for N is explained in Sect.…”

“…After retrieval, flow data that cannot be part of an attack by definition is filtered out. For example, flow records from attacker to target typically feature at least four packets, because every valid HTTP request consists of the following packets at least: 4 Many IPFIX flow exporters extract vhosts, often referred to as HTTP hostname, from HTTP headers. This information is no prerequisite for our detection approach and therefore only used within the Preselection phase.…”