VMM下Guest OS进程级管理工具设计与实现

目前在虚拟监控器VMM(Virtual Machine Monitor)下还没有能高效方便地对Guest OS进程进行管理的工具.以VMM是Lguest,Guest OS是Linux为运行环境,实现了名为GPMU(Guest Processes Management Utilities)的VMM下Guest OS进程级的管理工具原型.GPMU在不改动Guest OS和对VMM性能影响尽可能小这两个前提下,通过直接在VMM中动态地按需获得Guest OS中进程描述符后对其操作来实现Guest OS进程级管理.实验结果表明GPMU的实现是正确有效的.还分析了GPMU的性能瓶颈并做了对应的优化,典型的管理操作时间缩短为原始实现中的41%,大幅提高了性能.     

基于VMM层系统调用分析的软件完整性验证

在虚拟化云计算平台中,如何保证其上运行软件的可信性是云平台广泛应用的关键.完整性测量与验证技术是保证软件系统可信性的一种主要方法.然而,现有的软件完整性验证系统大多需要修改操作系统内核,很难为大规模虚拟机环境中的众多异构系统提供一致解决方案,且无法抵御内核级恶意攻击.针对当前方法在兼容性、安全性以及可管理性上存在的问题,设计并实现了一种在VMM层基于系统调用分析技术来验证软件完整性的方法VMGuard.它通过截获客户操作系统中的系统调用来识别软件加载,并基于系统调用关联性分析和虚拟机文件系统元数据重构技术来验证客户操作系统中软件的完整性.在Qemu和KVM两种主流虚拟化平台上实现了VMGuard,并通过实验评测VMGuard的有效性和性能.实验结果表明,VMGuard能够有效验证客户操作系统中软件的完整性,且性能开销在10%以内.     

基于改进隐马尔可夫模型的系统调用异常检测

针对隐马尔可夫模型计算开销过高的问题,提出了一种新的基于隐马尔可夫模型(Hidden Markov model,HMM)的异常检测方法,利用系统调用执行迹具有的局部规律性,用改进的HMM(Improved HMM,IHMM)学习算法来构建程序正常行为模型.在检测时,首先对待测系统调用数据用滑动窗口划分,并通过正常行为模型来判定异常,根据异常短序列占所有短序列的百分比来判断该进程是否行为异常.实验结果显示该方法训练耗时仅为传统方法的1%.当阈值在一个较大范围内变化时,模型的检测性能始终保持稳定.表明本文方法通过避免对大量相同短序列的重复计算,显著减少了训练时间和计算开销,在实际应用中具有良好的可操作性.     

基于VMM的操作系统隐藏对象关联检测技术

恶意软件通过隐藏自身行为来逃避安全监控程序的检测.当前的安全监控程序通常位于操作系统内部,难以有效检测恶意软件,特别是内核级恶意软件的隐藏行为.针对现有方法中存在的不足,提出了基于虚拟机监控器(virtual machine monitor,简称VMM)的操作系统隐藏对象关联检测方法,并设计和实现了相应的检测系统vDetector.采用隐式和显式相结合的方式建立操作系统对象的多个视图,通过对比多视图间的差异性来识别隐藏对象,支持对进程、文件及网络连接这3种隐藏对象的检测,并基于操作系统语义建立隐藏对象间的关联关系以识别完整攻击路径.在KVM虚拟化平台上实现了vDetector的系统原型,并通过实验评测vDetector的有效性和性能.结果表明,vDetector能够有效检测出客户操作系统(guest OS)中的隐藏对象,且性能开销在合理范围内.     

修改客户操作系统优化KVM虚拟机的I/O性能

目前,运行在虚拟机上的客户操作系统(Guest OS)是面向物理机器开发的普通操作系统,其中存在不适应虚拟化环境的因素,影响虚拟机的I/O性能.作者通过测试发现了影响虚拟机I/O性能的一些问题,针对这些问题提出了优化方法:一方面,通过合并客户操作系统中连续的I/O指令,降低虚拟机的时钟中断频率,从而降低环境切换的开销;另一方面,消除客户操作系统中的冗余操作,包括在虚拟化环境下无效的函数、冗余的I/O调度以及虚拟网卡驱动对NAPI的支持,使虚拟机只执行必要的操作,从而提高系统的性能.     

基于隐马尔可夫模型的内部威胁检测方法

提出了一种基于隐马尔可夫模型的内部威胁检测方法.针对隐马尔可夫模型评估问题的解法在实际应用中存在利用滑动窗口将观测事件序列经过放大处理导致误报率偏高的缺陷,在Windows平台上设计并实现了一个基于系统调用的内部威胁检测原型系统,利用截获Windows Native API的方法,通过程序行为的正常轮廓库来检测程序异常行为模式.实验结果表明,新方法以程序的内在运行状态作为处理对象,正常轮廓库较小,克服了传统评估方法因P(O|λ)值太小而无法有效区分正常与异常的问题,检测性能更好.     

基于虚拟机监控器的Windows剪贴板操作监控

针对现有剪贴板操作监控无法抵御内核层攻击,且所采取的单一保护策略无法满足现实需求的问题,提出一种基于虚拟机监控器(VMM)的文档内容剪贴板操作监控技术,并提出基于剪贴板操作监控的电子文档分级保护策略。首先,通过修改影子寄存器的方法在VMM层截获并识别系统调用;其次,监控文档打开操作建立进程标识符和文档路径之间的映射表,并在截获到剪贴板操作后通过进程标识符解析文档路径;最后,根据电子文档分级保护策略对剪贴板操作进行过滤。实验结果表明,监控系统给客户机文件系统带来的性能损耗随着文件读写块的增大而减小,当读写块大小达到64 KB以上时,客户机性能损耗在10%以内,对用户影响不大。     

一种有效的Return-Oriented-Programming攻击检测方法

Returned-Oriented-Programming (ROP)攻击能突破传统防御机制如DEP和W (+) X.目前ROP攻击检测误报率较高,无法准确区分ROP攻击与正常指令执行.ROP攻击需执行系统调用完成攻击,执行系统调用前寄存器须设置为正确的值,并且每条x86指令对应一个或多个gadget.基于上述特点,提出一种有效的二进制代码级ROP攻击检测方法:截获返回指令并作为起始点计算gadget数目,并在系统调用执行前判断寄存器是否被修改为与其参数类型相同的值.该方法不依赖启发式学习,能准确检测栈溢出的ROP攻击.通过动态插桩工具实现原型系统,对ROP攻击和正常程序进行了测试,实验结果表明系统漏报率和误报率较低,且性能损失较小.     

基于系统调用的Linux系统入侵检测技术研究

提出了一种基于系统调用、面向进程的Linux系统入侵检测方法:利用LKM(Loadable Kernel Modules)技术在Linux内核空间获取检测源数据--所考察进程的系统调用,使用基于极大似然系统调用短序列的Markov模型提取进程的正常行为特征,据此识别进程的异常行为.通过实验表明了此方法的可行性和有效性;并分析了方法在实现中的关键问题.     

一种基于VMM的内核级Rootkit检测技术

针对云平台中的虚拟机内核级Rootkit破坏租户虚拟机完整性的问题,文章提出一种基于VMM(虚拟机监视器,Virtual Machine Monitor)的内核级Rootkit检测技术。该技术以在关键路径设置陷入点的方式构建TML(True Module List),得到虚拟机中真实的内核模块视图,在VMM层利用自下而上的调用方式获取虚拟机用户态视图,并在VMM层获取重构的虚拟机内核态视图,通过交叉对比这三个视图检测隐藏在虚拟机中的Rootkit。最后,利用该技术在KVM(基于内核的虚拟机,Kernel-based Virtual Machine)中实现了原型系统,实验结果表明系统能迅速准确地检测出虚拟机中的Rootkit,并依据TML报告内核级Rootkit的详细信息,系统的综合性能损耗在可接受范围内。     

European Community policy and the market

Abstract This paper starts with some reflections on the policy considerations and priorities which are shaping European Commission (EC) research programmes. Then it attempts to position the current projects which seek to capitalise on information and communications technologies for learning in relation to these priorities and the apparent realities of the marketplace. It concludes that while there are grounds to be optimistic about the contribution EC programmes can make to the efficiency and standard of education and training, they are still too technology driven.     

一种自适应子融合集成多分类器方法

融合集成方法已经广泛应用在模式识别领域,然而一些基分类器实时性能稳定性较差,导致多分类器融合性能差,针对上述问题本文提出了一种新的基于多分类器的子融合集成分类器系统。该方法考虑在度量层融合层次之上通过对各类基多分类器进行动态选择,票数最多的类别作为融合系统中对特征向量识别的类别,构成一种新的自适应子融合集成分类器方法。实验表明,该方法比传统的分类器以及分类融合方法识别准确率明显更高,具有更好的鲁棒性。     

Explanation and prediction: an architecture for default and abductive reasoning

Although there are many arguments that logic is an appropriate tool for artificial intelligence, there has been a perceived problem with the monotonicity of classical logic. This paper elaborates on the idea that reasoning should be viewed as theory formation where logic tells us the consequences of our assumptions. The two activities of predicting what is expected to be true and explaining observations are considered in a simple theory formation framework. Properties of each activity are discussed, along with a number of proposals as to what should be predicted or accepted as reasonable explanations. An architecture is proposed to combine explanation and prediction into one coherent framework. Algorithms used to implement the system as well as examples from a running implementation are given.     

Three Process Perspectives: Organizations, Teams, and People

This paper provides the author's personal views and perspectives on software process improvement. Starting with his first work on technology assessment in IBM over 20 years ago, Watts Humphrey describes the process improvement work he has been directly involved in. This includes the development of the early process assessment methods, the original design of the CMM, and the introduction of the Personal Software Process (PSP)^SM and Team Software Process (TSP){^SM}. In addition to describing the original motivation for this work, the author also reviews many of the problems he and his associates encountered and why they solved them the way they did. He also comments on the outstanding issues and likely directions for future work. Finally, this work has built on the experiences and contributions of many people. Mr. Humphrey only describes work that he was personally involved in and he names many of the key contributors. However, so many people have been involved in this work that a full list of the important participants would be impractical.     

基于复小波噪声方差显著修正的SAR图像去噪

提出了一种基于复小波域统计建模与噪声方差估计显著性修正相结合的合成孔径雷达(Synthetic Aperture Radar,SAR)图像斑点噪声滤波方法。该方法首先通过对数变换将乘性噪声模型转化为加性噪声模型,然后对变换后的图像进行双树复小波变换(Dualtree Complex Wavelet Transform,DCWT),并对复数小波系数的统计分布进行建模。在此先验分布的基础上,通过运用贝叶斯估计方法从含噪系数中恢复原始系数,达到滤除噪声的目的。实验结果表明该方法在去除噪声的同时保留了图像的细节信息,取得了很好的降噪效果。     

How do children do mathematics with LOGO?

Abstract  This paper considers some results of a study designed to investigate the kinds of mathematical activity undertaken by children (aged between 8 and 11) as they learned to program in LOGO. A model of learning modes is proposed, which attempts to describe the ways in which children used and acquired understanding of the programming/mathematical concepts involved. The remainder of the paper is concerned with discussing the validity and limitations of the model, and its implications for further research and curriculum development.     

Editorial: Special issue on recent advances in hybrid control theory and applications

正The demands of a rapidly advancing technology for faster and more accurate controllers have always had a strong influence on the progress of automatic control theory.In recent years control problems have been arising with increasing frequency in widely different areas,which cannot be addressed using conventional control techniques.The principal reason for this is the fact that a highly competitive economy is forcing systems to operate in regimes where     

Information for Authors

正Aim The Journals of Zhejiang University-SCIENCE(A/B/C)areedited by the international board of distinguished Chinese andforeign scientists,and are aimed to present the latest devel-opments and achievements in scientific research in China andoverseas to the world’s scientific circles,especially to stimulateand promote academic exchange between Chinese and for-eign scientists everywhere.     

Enhancing a leaf radiative transfer model to estimate concentrations and in vivo specific absorption coefficients of total carotenoids and chlorophylls a and b from single-needle reflectance and transmittance

The relative concentrations of different pigments within a leaf have significant physiological and spectral consequences. Photosynthesis, light use efficiency, mass and energy exchange, and stress response are dependent on relationships among an ensemble of pigments. This ensemble also determines the visible characteristics of a leaf, which can be measured remotely and used to quantify leaf biochemistry and structure. But current remote sensing approaches are limited in their ability to resolve individual pigments. This paper focuses on the incorporation of three pigments—chlorophyll a, chlorophyll b, and total carotenoids—into the LIBERTY leaf radiative transfer model to better understand relationships between leaf biochemical, biophysical, and spectral properties.Pinus ponderosa and Pinus jeffreyi needles were collected from three sites in the California Sierra Nevada. Hemispheric single-leaf visible reflectance and transmittance and concentrations of chlorophylls a and b and total carotenoids of fresh needles were measured. These data were input to the enhanced LIBERTY model to estimate optical and biochemical properties of pine needles. The enhanced model successfully estimated reflectance (RMSE = 0.0255, BIAS = 0.00477, RMS%E = 16.7%), had variable success estimating transmittance (RMSE = 0.0442, BIAS = 0.0294, RMS%E = 181%), and generated very good estimates of carotenoid concentrations (RMSE = 2.48 µg/cm², BIAS = 0.143 µg/cm², RMS%E = 20.4%), good estimates of chlorophyll a concentrations (RMSE = 10.7 µg/cm², BIAS = − 0.992 µg/cm², RMS%E = 21.1%), and fair estimates of chlorophyll b concentrations (RMSE = 7.49 µg/cm², BIAS = − 2.12 µg/cm², RMS%E = 43.7%). Overall root mean squared errors of reflectance, transmittance, and pigment concentration estimates were lower for the three-pigment model than for the single-pigment model. The algorithm to estimate three in vivo specific absorption coefficients is robust, although estimated values are distorted by inconsistencies in model biophysics. The capacity to invert the model from single-leaf reflectance and transmittance was added to the model so it could be coupled with vegetation canopy models to estimate canopy biochemistry from remotely sensed data.     

Mr. Twinn’s bombes

This article discusses the history and design of the special versions of the bombe key-finding machines used by Britain’s Government Code & Cypher School (GC&CS) during World War II to attack the Enigma traffic of the Abwehr (the German military intelligence service). These special bombes were based on the design of their more numerous counterparts used against the traffic of the German armed services, but differed from them in important ways that highlight the adaptability of the British bombe design, and the power and flexibility of the diagonal board. Also discussed are the changes in the Abwehr indicating system that drove the development of these machines, the ingenious ways in which they were used, and some related developments involving the bombes used by the U.S. Navy’s cryptanalytic unit (OP-20-G).