Theoretical Framework for a Polymorphic Network Environment

The question of whether an ideal network exists with global scalability in its full life cycle has always been a first-principles problem in the research of network systems and architectures.Thus far,it has not been possible to scientifically practice the design criteria of an ideal network in a unimorphic network system,making it difficult to adapt to known services with clear application scenarios while supporting the ever-growing future services with unexpected characteristics.Here,we theoretically prove that no unimorphic network system can simultaneously meet the scalability requirement in a full cycle in three dimensions—the service-level agreement(S),multiplexity(M),and variousness(V)—which we name as the“impossible SMV triangle”dilemma.It is only by transforming the current network development paradigm that the contradiction between global scalability and a unified network infrastructure can be resolved from the perspectives of thinking,methodology,and practice norms.In this paper,we propose a theoretical framework called the polymorphic network environment(PNE),the first principle of which is to separate or decouple application network systems from the infrastructure environment and,under the given resource conditions,use core technologies such as the elementization of network baselines,the dynamic aggregation of resources,and collaborative software and hardware arrangements to generate the capability of the“network of networks.”This makes it possible to construct an ideal network system that is designed for change and capable of symbiosis and coexistence with the generative network morpha in the spatiotemporal dimensions.An environment test for principle verification shows that the generated representative application network modalities can not only coexist without mutual influence but also independently match well-defined multimedia services or custom services under the constraints of technical and economic indicators.

Introduction to Wireless Endogenous Security and Safety:Problems, Attributes, Structures and Functions

The information security and functional safety are fundamental issues of wireless communications sytems.The endogenous security principle based on Dynamic Heterogeneous Redundancy provides a direction for the development of wireless communication security and safety technology.This paper introduces the concept of wireless endogenous security from the following four aspects.First,we sorts out the endogenous security problems faced by the current wireless communications system,and then analyzes the endogenous security and safety attributes of the wireless channel.After that,the endogenous security and safety structure of the wireless communications system is given,and finally the applications of the existing wireless communication endogenous security and safety functions are listed.

An Aware-Scheduling Security Architecture with Priority-Equal Multi-Controller for SDN

Current SDN controllers suffer from a series of potential attacks. For example, malicious flow rules may lead to system disorder by introducing unexpected flow entries. In this paper, we propose Mcad-SA, an aware decision-making security architecture with multiple controllers, which could coordinate heterogeneous controllers internally as a "big" controller. This architecture includes an additional plane, the scheduling plane, which consists of transponder, sensor, decider and scheduler. Meanwhile it achieves the functions of communicating, supervising and scheduling between data and control plane. In this framework, we adopt the vote results from the majority of controllers to determine valid flow rules distributed to switches. Besides, an aware dynamic scheduling(ADS) mechanism is devised in scheduler to intensify security of Mcad-SA further. Combined with perception, ADS takes advantage of heterogeneity and redundancy of controllers to enable the control plane operate in a dynamic, reliable and unsteady state, which results in significant difficulty of probing systems and executing attacks. Simulation results demonstrate the proposed methods indicate better security resilience over traditional architectures as they have lower failure probability when facing attacks.

EARS: Intelligence-Driven Experiential Network Architecture for Automatic Routing in Software-Defined Networking

Software-Defined Networking(SDN)adapts logically-centralized control by decoupling control plane from data plane and provides the efficient use of network resources.However,due to the limitation of traditional routing strategies relying on manual configuration,SDN may suffer from link congestion and inefficient bandwidth allocation among flows,which could degrade network performance significantly.In this paper,we propose EARS,an intelligence-driven experiential network architecture for automatic routing.EARS adapts deep reinforcement learning(DRL)to simulate the human methods of learning experiential knowledge,employs the closed-loop network control mechanism incorporating with network monitoring technologies to realize the interaction with network environment.The proposed EARS can learn to make better control decision from its own experience by interacting with network environment and optimize the network intelligently by adjusting services and resources offered based on network requirements and environmental conditions.Under the network architecture,we design the network utility function with throughput and delay awareness,differentiate flows based on their size characteristics,and design a DDPGbased automatic routing algorithm as DRL decision brain to find the near-optimal paths for mice and elephant flows.To validate the network architecture,we implement it on a real network environment.Extensive simulation results show that EARS significantly improve the network throughput and reduces the average packet delay in comparison with baseline schemes(e.g.OSPF,ECMP).

Cyberspace Endogenous Safety and Security

Uncertain security threats caused by vulnerabilities and backdoors are the most serious and difficult problem in cyberspace.This paper analyzes the philosophical and technical causes of the existence of so-called"dark functions"such as system vulnerabilities and backdoors,and points out that endogenous security problems cannot be completely eliminated at the theoretical and engineering levels;rather,it is necessary to develop or utilize the endogenous security functions of the system architecture itself.In addition,this paper gives a definition for and lists the main technical characteristics of endogenous safety and security in cyberspace,introduces endogenous safety and security mechanisms and characteristics based on dynamic heterogeneous redundancy(DHR)architecture,and describes the theoretical implications of a coding channel based on DHR.

MimicCloudSim:An Environment for Modeling and Simulation of Mimic Cloud Service

In recent years,an increasing number of application services are deployed in the cloud.However,the cloud platform faces unknown security threats brought by its unknown vulnerabilities and backdoors.Many researchers have studied the Cyber Mimic Defense(CMD)technologies of the cloud services.However,there is a shortage of tools that enable researchers to evaluate their newly proposed cloud service CMD mechanisms,such as scheduling and decision mechanisms.To fill this gap,we propose MimicCloudSim as a mimic cloud service simulation system based on the basic functionalities of CloudSim.MimicCloudSim supports the simulation of dynamic heterogeneous redundancy(DHR)structure which is the core architecture of CMD technology,and provides an extensible interface to help researchers implement new scheduling and decision mechanisms.In this paper,we firstly describes the architecture and implementation of MimicCloudSim,and then discusses the simulation process.Finally,we demonstrate the capabilities of MimicCloudSim by using a decision mechanism.In addition,we tested the performance of MimicCloudSim,the conclusion shows that MimicCloudSim is highly scalable.

Anti-Attacking Modeling and Analysis of Cyberspace Mimic DNS

With the rapid development of information technology,the cyberspace security problem is increasingly serious.Kinds of dynamic defense technology have emerged such as moving target defense and mimic defense.This paper aims to describe the architecture and analyze the performance of Cyberspace Mimic DNS based on generalized stochastic Petri net.We propose a general method of anti-attacking analysis.For general attack and special attack model,the available probability,escaped probability and nonspecial awareness probability are adopted to quantitatively analyze the system performance.And we expand the GSPN model to adjust to engineering practice by specifying randomness of different output vectors.The result shows that the proposed method is effective,and Mimic system has high anti-attacking performance.To deal with the special attack,we can integrate the traditional defense mechanism in engineering practice.Besides,we analyze the performance of mimic DNSframework based on multi-ruling proxy and input-output desperation,the results represent we can use multi ruling or high-speed cache servers to achieve the consistent cost of delay,throughput compared with single authorized DNS,it can effectively solve 10%to 20%performance loss caused by general ruling proxy.

Solve the False-Positive Problem of the Mimic System Based on the Best Mimic Component Set

At present,there is a problem of false positives caused by the too vast mimic scope in mimic transformation technology.Previous studies have focused on the“compensation”method to deal with this problem,which is expensive and cannot fundamentally solve it.This paper provides new insights into coping with the situation.Firstly,this study summarizes the false-positive problem in the mimic transformation,analyzes its possible harm and the root causes.Secondly,three properties about the mimic scope are proposed.Based on the three properties and security quantification technology,the best mimic component set theory is put forward to solve the false-positive problem.There are two algorithms,the supplemental method and the subtraction method.The best mimic component set obtained by these two algorithms can fundamentally solve the mimic system’s false-positive problem but reduce the cost of mimic transformation.Thus make up for the lack of previous researches.

SecMVX:Analysis on the Vulnerability of Multi-Variant Execution

As an active defenses technique,multivariant execution(MVX)can detect attacks by monitoring the consistency of heterogeneous variants with parallel execution.Compared with patch-style passive defense,MVX can defend against known and even unknown vulnerability-based attacks without relying on attack feature information.However,variants generated with software diversity technologies will introduce new vulnerabilities when they execute in parallel.First,we analyze the security of MVX theory from the perspective of formal description.Then we summarize the general forms and techniques for attacks against MVX,and analyze the new vulnerabilities arising from the combination of variant generation technologies.We propose SecMVX,a secure MVX architecture and variant generation technology.Experimental evaluations based on CVEs and SPEC 2006 benchmark show that SecMVX introduces 11.29%of the average time overhead,and avoids vulnerabilities caused by the improper combination of variant generation technologies while keeping the defensive ability of MVX.

从SoC到SDSoW:微电子发展的新范式

微电子在智能时代正迎来新一轮技术与产业的重大变革期.本文从智能时代的科学方法论、系统集成的工程技术路线和微电子摩尔定律(Moore’s law)的维度扩展3个层面导入,提出了网络极大化节点极小化的复杂巨系统构造、异构异质芯粒的晶上拼装集成、硬件资源的领域专用软硬件协同定义,形成了软件定义晶上系统的新发展范式,对微电子的设计方法、系统集成、应用开发、经济性指标等进行了内涵升级,可全面刷新信息基础设施的技术物理形态,贡献一条“晶圆级硅基直连”的系统集成工程技术路线,并有望打造出智能涌现的物理底座.

通用分组网络寻址路由与标识演进方法及系统

未来的网络通信需求动态多样,网络层功能也应适时而变,因此对网络可演进性的研究具有重要意义.多标识网络作为一种兼容性极强的网络架构,网络层功能十分丰富,但仍缺少网络演进性设计.本文为多标识网络设计了一种通过标识扩展来支持网络体系不断演进的方案,包括对标识空间进行形式化定义,设计标识回退候选标识的优先级排序算法以及设计支持标识扩展的路由转发协议;并且在ndnSIM网络仿真环境和多标识网络测试床中实现了上述方案,评估了标识扩展方案的可行性和性能.实验结果表明相比于标识扩展机制给网络架构带来的益处,其性能损失在可接受的范围内.

多边共管的多模态网络标识域名生成管理解析原型系统

面对新形势下互联网蓬勃发展给现有网络体系带来的挑战,现有单边主义下的域名管理系统(DNS)在专业化服务质量和安全管控方面已力不从心.本文从分析现有网络体系问题出发,结合世界网络发展趋势,明确新型网络基本技术特征,以高安全、高鲁棒、高效能和高可用性为导向,提出新型多模态域名管理技术框架,实现融合多边共管的投票管理和多模态网络下标识域名互访和互隧道功能的原型系统.原型系统通过现网测试验证了理论的正确性和可行性.该系统可以方便地应用于自主多模态标识空间下的主权网及高安全专网,为全世界对网络共管共治的诉求提供了中国方案.

计算体系架构研究综述与思考

随着摩尔定律(Moore's law)与迪纳德(Dennard)缩放定律逐步走向终结,依靠集成电路制程工艺的进步提升计算系统性能与效能越来越困难,计算体系架构的演进成为了未来计算系统发展的重要技术途径.本文首先从应用适应性、计算驱动方式、系统重心变化、计算核心构成,以及计算逻辑使用等不同的角度回顾了体系架构的发展历程,总结了不同体系架构的优缺点;然后着重分析了在人工智能、大数据等应用飞速发展的条件下未来计算系统的能力需求特征;最后提出了软件定义计算体系架构,并梳理了其重点研究内容与关键技术,为未来计算体系架构的发展提供了一条可行的技术途径.

融合广义随机Petri网的二维拟态安全评估模型

―为应对网络空间中的未知安全漏洞,拟态防御系统作为一种动态异构冗余的新型防御架构破茧而出.拟态系统根据网络环境自发进行重配置,扭转了传统静态网络攻防不对等的局面.然而目前仍缺乏有说服力的能够定量评估并比较不同的安全防御系统有效性的实用方案.本文深入研究拟态架构,提出了一种二维分析模型,该模型将系统配置细节计算为量化结果,以比较不同动态网络的可靠性,且该模型在不同网络配置间可保持良好的可扩展性.具体来说,在分析的第1维度即单节点攻击分析时,我们详细介绍了系统配置,使用广义随机Petri网模型对攻击者和防御者的行为分别进行描述建模,刻画其对系统状态的影响.结合泊松过程、常见漏洞和暴露以及常见漏洞评分系统,我们对其影响设计函数进行赋值、量化计算.在分析的第2个维度即链路攻击中,我们采用马尔可夫(Markov)链,并用鞅理论进行计算,量化表达了攻击难度即攻击得手时长和网络配置之间的关系.最后,给出日常防御下和攻击情景下的安全度量方案,验证了拟态防御的有效性,为拟态系统的设计提供了理论指导.

Dynamic changes in soil chemical properties and microbial community structure in response to different nitrogen fertilizers in an acidified celery soil

To determine the effects of different kinds of nitrogen fertilizer,especially high-efficiency slowrelease fertilizers,on soil pH,nitrogen(N)and microbial community structures in an acidic celery soil,four treatments(CK,no N fertilizer;NR,urea;PE,calcium cyanamide fertilizer;and SK,controlled-release N fertilizer)were applied,and soil pH,total soil N,inorganic N,and soil microbial biomass C were analyzed.Phospholipid fatty acids(PLFAs)were extracted and detected using the MIDI Sherlock microbial identification system.The PE treatment significantly improved soil pH,from 4.80 to>6.00,during the whole growth period of the celery,and resulted in the highest celery yield among the four treatments.After 14 d application of calcium cyanamide,the soil nitrate content significantly decreased,but the ammonium content significantly increased.The PE treatment also significantly increased soil microbial biomass C during the whole celery growth period.Canonical variate analysis of the PLFA data indicated that the soil microbial community structure in the CK treatment was significantly different from those in the N applied treatments after 49 d fertilization.However,there was a significant difference(P<0.05)in soil microbial community structure between the PE treatment and the other three treatments at the end of the experiment.Calcium cyanamide is a good choice for farmers to use on acidic celery land because it supplies sufficient N,and increases soil pH,microbial biomass and the yield of celery.

Discussion on a new paradigm of endogenous security towards 6G networks

The sixth-generation mobile communication(6G)networks will face more complex endogenous security problems,and it is urgent to propose new universal security theories and establish new practice norms to deal with theªunknown unknownºsecurity threats in cyberspace.This paper first expounds the new paradigm of cyberspace endogenous security and introduces the vision of 6G cyberspace security.Then,it analyzes the security problems faced by the 6G core network,wireless access network,and emerging associated technologies in detail,as well as the corresponding security technology development status and the integrated development of endogenous security and traditional security.Furthermore,this paper describes the relevant security theories and technical concepts under the guidance of the new paradigm of endogenous security.

Problems and solutions regarding generalized functional safety in cyberspace

The common endogenous security problems in cyberspace and related attack threats have posed subversive challenges to conventional theories and methods of functional safety.In the current design of the cyber physical system(CPS),functional safety and cyber security are increasingly intertwined and inseparable,which evolve into the generalized functional safety(S&S)problem.The conventional reliability and cybersecurity technologies are unable to provide security assurance with quanti able design and veri cation metrics in response to the cyberattacks in hardware and software with common endogenous security problems,and the functional safety of CPS facilities or device has become a frightening ghost.The dynamic heterogeneity redundancy(DHR)architecture and coding channel theory(CCT)proposed by the cyberspace endogenous security paradigm could handle random failures and uncertain network attacks in an integrated manner,and its generalized robust control mechanism can solve the universal problem of quantitative design for functional safety under probability or improbability perturbation.As a generalized functional safety enabling structure,DHR opens up a new direction to solve the common endogenous security problems in the cross-disciplinary elds of cyberspace.

On integrated security and safety

With the ubiquitous application of digital,intelligent,and network technologies,the connotation and denotation of functional safety have gone beyond the conventional reliability scope of dealing with func­tional or system failures caused by random ineffectiveness in the mechanical and electric age.In order to guarantee the functional safety for cyber physical systems(CPS)in cyberspace in the information age,it is impossible to avoid challenges of cyber security,especially"unknown unknown"network threats and attack events aimed at CPS systems,software/hardwrare facility vulnerabilities or loopholes and backdoors.Such challenges have a terrible ghost-haunted nature and attributes that cannot be expressed through mathematical models.They have gone beyond the random hypothetical premises of classical functional safety theories and mathematical nature to be expressed through probability,as well as shaken the foundations of conventional reliability theories,technological methodologies,and practice norms.