网络安全事件的关联分析方法的比较研究

随着当前攻击手段和技术的日益复杂化,一次入侵事件往往需要多个步骤才能完成,这些步骤都是彼此相关的。但是传统的入侵检测集中于检测底层的入侵或异常,所检测到的结果也仅仅是一次完整入侵的一部分,所以不能将不同的报警结合起来以发现入侵的逻辑步骤或者入侵背后的攻击策略。关联分析技术将不同分析器上产生的报警进行融合与关联分析,极大地减少了报警的数量,降低了入侵检测的误报率,并且适当的减少了入侵检测的漏报率。文中在对网络安全事件关联分析方法的系统结构进行分析后,着重介绍了当前比较流行的几种网络安全事件关联分析方法,最后对各种方法进行了比较研究。     

网络管理中事件关联检测机制的研究

网络事件的关联检测是网络管理需要解决的一个关键问题,本文根据分布式网络管理的特点,首次明确定义了网络事件的基本关联关系,在此基础上提出了一种基于Petri Net的事件关联检测机制,实现了基于事件内容的细粒度关联检测,并且在事件检测中充分考虑了时间因素,有效地提高了事件关联检测的准确性。     

CD++: a toolkit to develop DEVS models

The features of a toolkit for modeling and simulation based on the DEVS formalism are presented. The tool is built as a set of independent software pieces running on different platforms. Not only are the main characteristics of the environment presented, a focus on its use is also considered by inclusion of application examples for a variety of problems. Many models can be defined in an automated fashion, simplifying the construction of new models and easing their verification. The use of this formal approach has allowed the development of safe and cost‐effective simulations, significantly reducing development time. Copyright © 2002 John Wiley & Sons, Ltd.     

基于Delphi的报童模型的实现与动态仿真

已往库存论中的决策模型,它是把现实过程用数学的方法进行分析,得到决策值,但不能看到决策的过程,不能反映出现实生活中的不确定性、动态性。运用Delphi 7.0和SQL server 2000对销售过程进行了动态仿真,利用Newsboy模型的推广(S,s)订购策略来监控库存并做出决策,这样就体现出此过程的不确定性、动态性;且举出了一个仿真商品销售的实例,对其中的一些关键技术,如何仿真、算法的实现等进行了阐述。     

非串行生产线的建模,分析及设计

本文利用等效工作站理论和工件流平衡原理，推导出非串行离散事件生产线可以等价于串联系统，并归结为装配和拆卸两条定理，解决了系统的建模、分析与设计问题。     

An investigation of the relation between the temperature dependences of the initial unbalance and the output signal of resistance strain sensor bridge circuits

The relation between the initial unbalance and the output signal of bridge circuits when acted upon simultaneously by the physical factor being measured and the temperature of the surroundings when the bridge is supplied from a voltage or current source is investigated. Analytic relations are obtained which explain the temperature dependence of the useful output voltage under external physical action. __________ Translated from Izmeritel’naya Tekhnika, No. 1, pp. 48–49, 2007.     

Locked discrete event systems: How to model and how to unlock

To model qualitative aspects of discrete event systems, i.e., the order of the events is of sole importance, we use a triple consisting of the set of all possible events (the alphabet), the set of all behavior (possible strings of events), and the set of all tasks (completed behavior). We use this view to model synchronous as well as asynchronous connection of systems. Moreover, it is easy to define notions like deadlock and livelock in this view. We give a method to construct a second system that, in connection with the original system, gets rid of its deadlock and/or livelock. A state-space representation is introduced. In this representation computations can be done effectively.     

具有初曲率板弯曲的边界元分析

由于具有初曲率板弯曲问题的控制微分方程较复杂，直接求解原问题基本解推导边界积分方程较为困难。本文通过引入等效荷载，将此问题的控制微分方程化成与普通板弯曲基本方程形式相同的微分方程，利用一般求解板弯曲问题的边界元法迭代求解，建立了分析具有初曲率板弯曲问题的边界元法。算例表明本方法理论准确、精度良好。     

扩展有限递归进程模型

主要讨论离散事件动态系统的建模问题。由ＫＩｎａｎ和ＰＶａｒａｉｙａ提出的有限递归进程（ＦＲＰ）是描述并发离散事件动态系统的有力工具，但在其ＦＲＰ中，没有定义对数据变量的操作和条件转移算子。本文扩展ＦＲＰ包括这两方面内容。最后举例说明扩展ＦＲＰ的描述能力。