基于透明同步与随机时隙的SDN网络地址端口跳变方案

将地址端口跳变技术引入SDN网络主动防御中,提出基于透明同步和随机时隙的SDN网络地址端口跳变（TSRI-SNAPH）方案。针对严格时间同步和ACK同步技术存在的严格时间同步难达到、同步报文易被截获分析等问题,充分利用SDN网络逻辑集中控制特性,将跳变功能置于SDN控制器,可实现通信双方的透明跳变同步,不但不需要严格的时间同步,也不需要发送额外的同步报文。针对固定跳变时隙方案易被截获分析的问题,提出基于泊松到达过程的随机跳变时隙方案,可有效增加截获分析的难度和开销。理论分析与实验结果表明,TSRI-SNAPH方案在负载增加较少的情况下,可有效抵御截获分析和拒绝服务攻击,且可有效防范内部威胁。     

基于软件定义网络的反嗅探攻击方法

网络嗅探攻击中,攻击者从网络节点或链路捕获和分析网络通信数据、监视网络状态、窃取用户名和密码等敏感信息。在攻击发生时,攻击者通常处于静默状态,传统的网络防护手段如防火墙、入侵检测系统（IDS）或入侵防御系统（IPS）很难发现并有效抵御攻击。从网络结构入手,提出基于软件定义网络（SDN）的动态路径跳变（DPH）通信机制,依据空间和时间约束条件,动态改变通信节点之间的路径,宏观上将通信流量相对均匀地分布在多条传输链路中,增加网络嗅探攻击中获取完整数据的难度。实验仿真结果说明,在一定的网络规模下,动态路径跳变能够在不明显降低网络传输性能的条件下有效防御嗅探攻击。     

基于双重地址跳变的移动目标防御方法

网络系统的确定性和静态性使得防御处在被动之中,移动目标防御作为一种改变攻守态势的防御理念被提出。针对嗅探和扫描攻击,文章提出一种基于双重地址跳变的移动目标防御方法——DAH。通过双重虚拟地址跳变频率分级,有效解决通信服务质量和跳变频率之间的矛盾,利用低频虚拟地址跳变保证网络可用性,利用高频虚拟地址跳变抵御嗅探攻击。通过检测主机异常通信行为构造欺骗数据包,以实现迷惑并阻断扫描攻击的效果。测试实验表明,DAH既可以保证网络的正常通信时延和CPU负载,又可以有效抵御嗅探和扫描攻击。     

面向智慧医疗云的SDN动态负载均衡方法

文中 引入软件定义网络(Software Defined Network,SDN)对智慧医疗云进行网络管理,并且针对传统SDN控制器存在单点失效和负载均衡的问题,设计了智慧医疗分布式SDN控制器系统。SDN控制系统分为SDN控制器集群、数据转发平面和智慧医疗云服务系统3层。在此基础上,提出一种实时负载动态自调节的快速负载均衡算法DAF(Dynamic Adaptive and Fast Load Balancing)。在该算法中,负载信息感知组件周期性地采集自己的负载信息,自动地进行控制器间的负载信息交互;控制器的负载值超过阈值时,会触发交换机迁移动作,以动态配置交换机与控制器之间的映射关系。实验结果表明,面向智慧医疗云的分布式SDN控制系统的性能良好,且DAF算法能够快速地实现SDN控制器间的负载均衡,提升了智慧医疗云的网络吞吐量。     

面向软件定义网络的两级DDoS攻击检测与防御

分布式拒绝服务(DDoS)攻击一直是互联网的主要威胁之一,在软件定义网络(SDN)中会导致控制器资源耗尽,影响整个网络正常运行。针对SDN网络中的DDoS攻击问题,文章设计并实现了一种两级攻击检测与防御方法。基于控制器北向接口采集交换机流表数据并提取直接特征和派生特征,采用序贯概率比检验(Sequential Probability Ratio Test,SPRT)和轻量级梯度提升机(LightGBM)设计两级攻击检测算法,快速定位攻击端口和对攻击类型进行精准划分,通过下发流表规则对攻击流量进行实时过滤。实验结果表明,攻击检测模块能够快速定位攻击端口并对攻击类型进行精准划分,分类准确率达到98%,攻击防御模块能够在攻击发生后2 s内迅速下发防御规则,对攻击流量进行过滤,有效保护SDN网络的安全。     

基于安全策略的负载感知动态调度机制

针对软件定义网络（SDN）网络控制器流规则篡改攻击等单点脆弱性威胁,传统安全解决方案如备份、容错机制等存在被动防御缺陷,无法从根本上解决控制层安全问题。结合目前移动目标防御、网络空间拟态防御等主动防御技术研究现状,提出一种基于异构冗余结构的动态安全调度机制。建立控制器执行体与调度体调度模型,根据系统攻击异常、异构度等指标,以安全性为原则设计动态调度策略;同时考虑系统负载因素,通过设计调度算法LA-SSA将调度问题转化为动态双目标优化问题,以实现优化的调度方案。仿真结果表明,对比静态结构,动态调度机制在累积异常值、输出安全率等指标上有明显优势,说明安全调度机制中的动态性与多样性能够显著提高系统抵御攻击能力,LA-SSA机制负载方差较安全优先调度更平稳,在实现安全调度的同时避免了负载失衡问题,验证了安全调度机制的有效性。     

端信息跳变技术研究综述

随着计算机网络技术的飞速发展,新型攻击手段层出不穷,而传统的静态被动防御手段难以有效应对.端信息跳变是一项网络动态防御技术,能够主动防御网络攻击,保护重要网络节点.该技术借鉴跳频通信技术的思想,通过伪随机地改变通信双方或一方的端信息,隐藏重要节点,增加攻击者的攻击难度和攻击成本,干扰甚至破环攻击者的攻击,实现网络主动防御.首先进行了端信息跳变技术研究现状的调查,按照跳变项进行分类并分析了优缺点.然后针对现有核心难点技术的用途和优缺点进行了全面概述.最后讨论未来可能的发展方向.     

面向SDN的移动目标防御技术研究进展

软件定义网络是基于开放标准的灵活架构,通过控制层管理网络功能和服务,具有控转分离、集中控制的特性;移动目标防御技术致力于构建一个不断变换的环境以提高网络系统的视在不确定性,需要灵活可定制、集中可控制的网络架构加以实施,因此将移动目标防御与软件定义网络相结合已成为更具应用价值研究热点。首先,分别介绍了软件定义网络和移动目标防御的基本概念,概括了软件定义网络所面临的安全威胁,阐述了面向SDN的移动目标防御的实现模型;其次,分别从SDN数据层、控制层和应用层归纳了移动目标防御的技术方法;最后,总结了现有SDN动态防御面临的挑战,对面向SDN的移动目标防御技术发展方向进行了展望。     

SDN下的动态负载均衡机制

软件定义网络SDN用于解决传统网络存在的垂直整合,难于管理等问题的新模式。在SDN的多域分布式控制平台中,每个域的控制器则作为集中式控制器,当有大量的消息请求时,可能会导致控制器过载。为了缓解控制器的过载,提出SDN下动态负载均衡机制。当控制器负载达到阈值,控制器会优先选择负载较大的消息迁移至负载较小的邻域,防止控制器阻塞。通过实验,结果证明动态负载均衡机制具有更低的阻塞率和更高的控制器利用率。     

面向SDN数据层的双虚假IP地址动态跳变技术

嗅探攻击是一种常见且隐蔽性很强的网络攻击方式,这种攻击方式对通信数据的机密性造成了严重威胁,然而传统的防御手段受制于网络攻防对抗的严重不对称性,难以有效应对这种威胁。文章提出了一种面向SDN数据层的双虚假IP地址动态跳变技术,首先利用双虚假IP地址破坏通信数据在空间维度上的关联性,然后通过周期性IP地址跳变破坏通信数据在时间维度上的关联性,从而提高嗅探攻击者重组通信数据的难度以及成本。抗攻击有效性分析以及仿真实验表明,文章所提技术在提高抗嗅探攻击能力的同时,能保证较低的CPU消耗和通信时延。     

European Community policy and the market

Abstract This paper starts with some reflections on the policy considerations and priorities which are shaping European Commission (EC) research programmes. Then it attempts to position the current projects which seek to capitalise on information and communications technologies for learning in relation to these priorities and the apparent realities of the marketplace. It concludes that while there are grounds to be optimistic about the contribution EC programmes can make to the efficiency and standard of education and training, they are still too technology driven.     

一种自适应子融合集成多分类器方法

融合集成方法已经广泛应用在模式识别领域,然而一些基分类器实时性能稳定性较差,导致多分类器融合性能差,针对上述问题本文提出了一种新的基于多分类器的子融合集成分类器系统。该方法考虑在度量层融合层次之上通过对各类基多分类器进行动态选择,票数最多的类别作为融合系统中对特征向量识别的类别,构成一种新的自适应子融合集成分类器方法。实验表明,该方法比传统的分类器以及分类融合方法识别准确率明显更高,具有更好的鲁棒性。     

煤矿井下安全监控分站的设计及其仿真实现

为了设计一种具有低成本、低功耗、易操作、功能强且可靠性高的煤矿井下安全分站,针对煤矿安全生产实际,文章提出了采用MCS-51系列单片机为核心、具有CAN总线通信接口的煤矿井下安全监控分站的设计方案;首先给出煤矿井下安全监控分站的整体构架设计,然后着重阐述模拟量输入信号处理系统的设计过程,最后说明单片机最小系统及其键盘、显示、报警、通信等各个组成部分的设计;为验证设计方案的可行性与有效性,使用Proteus软件对设计内容进行仿真验证,设计的煤矿井下安全监控分站具有瓦斯、温度等模拟量参数超标报警功能和电机开停、风门开闭等开关量指示功能;仿真结果表明:设计的煤矿井下安全监控分站具有一定的实际应用价值.     

Explanation and prediction: an architecture for default and abductive reasoning

Although there are many arguments that logic is an appropriate tool for artificial intelligence, there has been a perceived problem with the monotonicity of classical logic. This paper elaborates on the idea that reasoning should be viewed as theory formation where logic tells us the consequences of our assumptions. The two activities of predicting what is expected to be true and explaining observations are considered in a simple theory formation framework. Properties of each activity are discussed, along with a number of proposals as to what should be predicted or accepted as reasonable explanations. An architecture is proposed to combine explanation and prediction into one coherent framework. Algorithms used to implement the system as well as examples from a running implementation are given.     

Three Process Perspectives: Organizations, Teams, and People

This paper provides the author's personal views and perspectives on software process improvement. Starting with his first work on technology assessment in IBM over 20 years ago, Watts Humphrey describes the process improvement work he has been directly involved in. This includes the development of the early process assessment methods, the original design of the CMM, and the introduction of the Personal Software Process (PSP)^SM and Team Software Process (TSP){^SM}. In addition to describing the original motivation for this work, the author also reviews many of the problems he and his associates encountered and why they solved them the way they did. He also comments on the outstanding issues and likely directions for future work. Finally, this work has built on the experiences and contributions of many people. Mr. Humphrey only describes work that he was personally involved in and he names many of the key contributors. However, so many people have been involved in this work that a full list of the important participants would be impractical.     

基于复小波噪声方差显著修正的SAR图像去噪

提出了一种基于复小波域统计建模与噪声方差估计显著性修正相结合的合成孔径雷达(Synthetic Aperture Radar,SAR)图像斑点噪声滤波方法。该方法首先通过对数变换将乘性噪声模型转化为加性噪声模型,然后对变换后的图像进行双树复小波变换(Dualtree Complex Wavelet Transform,DCWT),并对复数小波系数的统计分布进行建模。在此先验分布的基础上,通过运用贝叶斯估计方法从含噪系数中恢复原始系数,达到滤除噪声的目的。实验结果表明该方法在去除噪声的同时保留了图像的细节信息,取得了很好的降噪效果。     

How do children do mathematics with LOGO?

Abstract  This paper considers some results of a study designed to investigate the kinds of mathematical activity undertaken by children (aged between 8 and 11) as they learned to program in LOGO. A model of learning modes is proposed, which attempts to describe the ways in which children used and acquired understanding of the programming/mathematical concepts involved. The remainder of the paper is concerned with discussing the validity and limitations of the model, and its implications for further research and curriculum development.     

Editorial: Special issue on recent advances in hybrid control theory and applications

正The demands of a rapidly advancing technology for faster and more accurate controllers have always had a strong influence on the progress of automatic control theory.In recent years control problems have been arising with increasing frequency in widely different areas,which cannot be addressed using conventional control techniques.The principal reason for this is the fact that a highly competitive economy is forcing systems to operate in regimes where     

Information for Authors

正Aim The Journals of Zhejiang University-SCIENCE(A/B/C)areedited by the international board of distinguished Chinese andforeign scientists,and are aimed to present the latest devel-opments and achievements in scientific research in China andoverseas to the world’s scientific circles,especially to stimulateand promote academic exchange between Chinese and for-eign scientists everywhere.     

View-based model-driven architecture for enhancing maintainability of data access services

In modern service-oriented architectures, database access is done by a special type of services, the so-called data access services (DAS). Though, particularly in data-intensive applications, using and developing DAS are very common today, the link between the DAS and their implementation, e.g. a layer of data access objects (DAOs) encapsulating the database queries, still is not sufficiently elaborated, yet. As a result, as the number of DAS grows, finding the desired DAS for reuse and/or associated documentation can become an impossible task. In this paper we focus on bridging this gap between the DAS and their implementation by presenting a view-based, model-driven data access architecture (VMDA) managing models of the DAS, DAOs and database queries in a queryable manner. Our models support tailored views of different stakeholders and are scalable with all types of DAS implementations. In this paper we show that our view-based and model driven architecture approach can enhance software development productivity and maintainability by improving DAS documentation. Moreover, our VMDA opens a wide range of applications such as evaluating DAS usage for DAS performance optimization. Furthermore, we provide tool support and illustrate the applicability of our VMDA in a large-scale case study. Finally, we quantitatively prove that our approach performs with acceptable response times.