简易校园网络实施攻略

"校校通"是教育部提出的信息技术教育新战略,它是实现现代化教育和远程教育的必备手段,也是实现教育资源共享的最大集约化方法之一.校园网络的建设,资金的投入是必要的,但是怎样才能简而易行,即能及时发挥作用又为日后的拓展留有余地,则是我们共同关心的.下面以我校为例,说明简易校园网络的建设实践和功能使用.

工控网络隔离网关在粮食行业中的应用

本文首先阐述了粮食行业工控网络所面临的安全威胁。针对这种威胁,我们研发了工控网络隔离网关,可以对OPC、MODEBUS等工控协议实施拦截和分析,过滤非授权和非安全的数据,从而保护粮食设备和粮食的安全。在示范项目中,该网关被部署在粮食仓库的仓储工控环境进行试用。实验证明,该设备可以适用于粮食工控环境,可以有效阻止来自应用层的攻击。

Network efficiency analysis of Chinese inter-bank market

The inter-bank market network models are constructed based on the inter-bank credit lending relationships, and the network efficiency characters of the Chinese inter-bank market are studied. Since it is impossible to obtain the specific credit data among banks, this paper estimates the inter-bank lending matrix based on the partial information of banks. Thus, directed network models of the Chinese inter-bank market are constructed by using the threshold method. The network efficiency measures and the effects of random attacks and selective attacks on the global efficiency of the inter-bank network are analyzed based on the network models of the inter-bank market. Empirical results suggest that the efficiency measures are sensitive to the threshold, and that the global efficiency is little affected by random attacks, while it is highly sensitive to selective attacks. Properties such as inter-bank market network efficiency would be useful for risk management and stability of the inter-bank market.

Anomaly detection for network traffic flow

This paper presents a mechanism for detecting flooding-attacks. The simplicity of the mechanism lies in its statelessness and low computation overhead, which makes the detection mechanism itself immune to flooding-attacks. The SYN-flooding, as an instance of flooding-attack, is used to illustrate the anomaly detection mechanism. The mechanism applies an exponentially weighted moving average (EWMA) method to detect the abrupt net flow and applies a symmetry analysis method to detect the anomaly activity of the network flow. Experiment shows that the mechanism has high detection accuracy and low detection latency.

AN INTELLIGENT METHOD FOR REAL-TIME DETECTION OF DDOS ATTACK BASED ON FUZZY LOGIC

The paper puts forward a variance-time plots method based on slide-window mechanism tocalculate the Hurst parameter to detect Distribute Denial of Service(DDoS)attack in real time.Basedon fuzzy logic technology that can adjust itself dynamically under the fuzzy rules,an intelligent DDoSjudgment mechanism is designed.This new method calculates the Hurst parameter quickly and detectsDDoS attack in real time.Through comparing the detecting technologies based on statistics andfeature-packet respectively under different experiments,it is found that the new method can identifythe change of the Hurst parameter resulting from DDoS attack traffic with different intensities,andintelligently judge DDoS attack self-adaptively in real time.

Two-Phased Method for Detecting Evasive Network Attack Channels

With the rapid developments of information technology,various industries become much more dependent on networks.Driven by economic interests and the game between countries reflected by growing cyberspace confrontations,evasive network attacks on information infrastructures with high-tech,high concealment and longterm sustainability become severe threats to national security.In this paper,we propose a novel two-phased method for the detection of evasive network attacks which exploit or pretend to be common legal encryption services in order to escape security inspection.Malicious communications which camouflage themselves as legal encryption application are identified in the SSL'session structure verification phase firstly,and then by serverside X.509 certificate based anomaly detection,suspicious attack behaviors are further distinguished effectively.Experiment results show that our method is very useful for detecting the network activities of certain unknown threats or new malwares.Besides,the proposed method can be applied to other similar services easily.

SGuard：A Lightweight SDN Safe-Guard Architecture for DoS Attacks

Software Defined Networking(SDN) is a revolutionary networking paradigm towards the future network,experiencing rapid development nowadays.However,its main characteristic,the separation of control plane and data plane,also brings about new security challenges,i.e.,Denial-of-Service(DoS) attacks specific to Open Flow SDN networks to exhaust the control plane bandwidth and overload the buffer memory of Open Flow switch.To mitigate the DoS attacks in the Open Flow networks,we design and implement SGuard,a security application on top of the NOX controller that mainly contains two modules:Access control module and Classification module.We employ novel six-tuple as feature vector to classify traffic flows,meanwhile optimizing classification by feature ranking and selecting algorithms.All the modules will cooperate with each other to complete a series of tasks such as authorization,classification and so on.At the end of this paper,we experimentally use Mininet to evaluate SGuard in a software environment.The results show that SGuard works efficiently and accurately without adding more overhead to the SDN networks.

Nonlinear Dynamical Behavior in Neuron Model Based on Small World Network with Attack and Repair Strategy

In this paper, we investigate the effect due to the change of topology structure of network on the nonlinear dynamical behavior, by virtue of the OFC neuron evolution model with attack and repair strategy based on the small world. In particular, roles of various parameters relating to the dynamical behavior are carefully studied and analyzed. In addition, the avalanche and EEC-like wave activities with attack and repair strategy are also explored in detail in this work.

Towards a Dynamic Controller Scheduling-Timing Problem in Software-Defined Networking

Controller vulnerabilities allow malicious actors to disrupt or hijack the Software-Defined Networking. Traditionally, it is static mappings between the control plane and data plane. Adversaries have plenty of time to exploit the controller's vulnerabilities and launch attacks wisely. We tend to believe that dynamically altering such static mappings is a promising approach to alleviate this issue, since a moving target is difficult to be compromised even by skilled adversaries. It is critical to determine the right time to conduct scheduling and to balance the overhead afforded and the security levels guaranteed. Little previous work has been done to investigate the economical time in dynamic-scheduling controllers. In this paper, we take the first step to both theoretically and experimentally study the scheduling-timing problem in dynamic control plane. We model this problem as a renewal reward process and propose an optimal algorithm in deciding the right time to schedule with the objective of minimizing the long-term loss rate. In our experiments, simulations based on real network attack datasets are conducted and we demonstrate that our proposed algorithm outperforms given scheduling schemes.

Secure Network Coding Against Intra/Inter-Generation Pollution Attacks

By allowing routers to combine the received packets before forwarding them,network coding-based applications are susceptible to possible malicious pollution attacks.Existing solutions for counteracting this issue either incur inter-generation pollution attacks(among multiple generations)or suffer high computation/bandwidth overhead.Using a dynamic public key technique,we propose a novel homomorphic signature scheme for network coding for each generation authentication without updating the initial secret key used.As per this idea,the secret key is scrambled for each generation by using the generation identifier,and each packet can be fast signed using the scrambled secret key for the generation to which the packet belongs.The scheme not only can resist intra-generation pollution attacks effectively but also can efficiently prevent inter-generation pollution attacks.Further,the communication overhead of the scheme is small and independent of the size of the transmitting files.

A New Localization Scheme with Statistical Estimation against Wormhole Attack in Wireless Sensor Networks

Wormhole attack is one of the most devastating threats for range-free localization in wireless sensor networks. In this paper, we evaluate three statistical estimation methods with the same network model and geographic information obtailaed by the DV-Hop algorithm. We analyze the limits of Minimum Mean Square Estimate （MMSE）, Least Median of Squares （LMS） and Enhanced greedy At- tack-Resistant MMSE （EARMMSE） and propose an improved EARMMSE with the hop-distance relationship, named EARMMSE＋. Simulation results illustrate the performance of MMSE, LMS and EARMMSE＋ with different anchor fraction, the length of wormhole link and the average local neighborhood and show that EARMMSE＋ outperforms MMSE and LMS.

Cost management based security framework in mobile ad hoc networks

Security issues are always difficult to deal with in mobile ad hoe networks. People seldom studied the costs of those security schemes respectively and for some security methods designed and adopted beforehand, their effects are often investigated one by one. In fact, when facing certain attacks, different methods would respond individually and result in waste of resources. Making use of the cost management idea, we analyze the costs of security measures in mobile ad hoc networks and introduce a security framework based on security mechanisms cost management. Under the framework, the network system＇s own tasks can be finished in time and the whole network＇s security costs can be decreased. We discuss the process of security costs computation at each mobile node and in certain nodes groups. To show how to use the proposed security framework in certain applications, we give examples of DoS attacks and costs computation of defense methods. The results showed that more secure environment can be achieved based on the security framework in mobile ad hoc networks.

ADAPTIVE FLIGHT CONTROL SYSTEM OF ARMED HELICOPTER USING WAVELET NEURAL NETWORK METHOD

A discussion is devoted to the design of an adaptive flight control system of the armed helicopter using wavelet neural network method. Firstly, the control loop of the attitude angle is designed with a dynamic inversion scheme in a quick loop and a slow loop. respectively. Then, in order to compensate the error caused by dynamic inversion, the adaptive flight control system of the armed helicopter using wavelet neural network method is put forward, so the BP wavelet neural network and the Lyapunov stable wavelet neural network are used to design the helicopter flight control system. Finally, the typical maneuver flight is simulated to demonstrate its validity and effectiveness. Result proves that the wavelet neural network has an engineering practical value and the effect of WNN is good.

A Novel Formal Theory for Security Protocol Analysis of Denial of Service Based on Extended Strand Space Model

Denial of Service Distributed Denial of Service （DOS） attack, especially （DDoS） attack, is one of the greatest threats to Internet. Much research has been done for it by now, however, it is always concentrated in the behaviors of the network and can not deal with the problem exactly. In this paper, we start from the security of the protocol, then we propose a novel theory for security protocol analysis of Denial of Service in order to deal with the DoS attack. We first introduce the conception of weighted graph to extend the strand space model, then we extend the penetrator model and define the goal of anti-DoS attack through the conception of the DoS-stop protocol, finally we propose two kinds of DoS test model and erect the novel formal theory for security protocol analysis of Denial of Service. Our new formal theory is applied in two example protocols. It is proved that the Internet key exchange （IKE） easily suffers from the DoS attacks, and the efficient DoS- resistant secure key exchange protocol （JFK） is resistant against DoS attack for the server, respectively.

Attack Vulnerability of Network with Duplication-Divergence Mechanism

We study the attack vulnerability of network with duplication-divergence mechanism. Numerical results have shown that the duplication-divergence network with larger retention probability a is more robust against target attack relatively. Furthermore, duplication-divergence network is broken down more quickly than its counterpart BA network under target attack. Such result is consistent with the fact of WWW and Internet networks under target attack. So duplication-divergence model is a more realistic one for us to investigate the characteristics of the world wide web in future. We also observe that the exponent γ of degree distribution and average degree are important parameters of networks, reflecting the performance of networks under target attack. Our results are helpful to the research on the security of network.

A New Anonymity Model for Privacy-Preserving Data Publishing

Privacy-preserving data publishing （PPDP） is one of the hot issues in the field of the network security. The existing PPDP technique cannot deal with generality attacks, which explicitly contain the sensitivity attack and the similarity attack. This paper proposes a novel model, （w,γ, k）-anonymity, to avoid generality attacks on both cases of numeric and categorical attributes. We show that the optimal （w, γ, k）-anonymity problem is NP-hard and conduct the Top-down Local recoding （TDL） algorithm to implement the model. Our experiments validate the improvement of our model with real data.

Decision Cost Feature Weighting and Its Application in Intrusion Detection

This paper introduces the cost-sensitive feature weighting strategy and its application in intrusion detection. Cost factors and cost matrix are proposed to demonstrate the misclassification cost for IDS. How to get the whole minimal risk, is mainly discussed in this paper in detail. From experiments, it shows that although decision cost based weight learning exists somewhat attack misclassification, it can achieve relatively low misclassification costs on the basis of keeping relatively high rate of recognition precision. Key words decision cost - feature weighting - intrusion detection CLC number TP 393. 08 Foundation item: Supported by the National Natural Science Foundation Key Research Plan of China (90104030) and “20 Century Education Development Plan”Biography: QIAN Quan(1972-), male, Ph. D. research direction: computer network, network security and artificial intelligence

Improvements on robust email protocols with perfect forward secrecy

According to the security shortages of two robust practical email protocols with perfect forward secrecy, attacks on the two protocols are analyzed and corresponding improvements on the two protocols are proposed. First, by analyzing the two email protocols, the corresponding man-in-the-middle attacks are proposed, where the adversary forges the messages in the receiving phase to cheat the two communication participants and makes them share the wrong session keys with him. Consequently, the man-in-the-middle attacks can make the two protocols fail to provide perfect forward secrecy. Secondly, by adding corresponding signatures in the receiving phases of the two protocols, two corresponding improvements on the protocols are proposed to overcome the man-in-the-middle attacks on the two protocols and make them provide perfect forward secrecy. Moreover, the two improved protocols can retain all the merits of the former protocols.

A Survey of Security Issues in Cognitive Radio Networks

In the last decade,cognitive radio(CR) has emerged as a major next generation wireless networking technology,which is the most promising candidate solution to solve the spectrum scarcity and improve the spectrum utilization.However,there exist enormous challenges for the open and random access environment of CRNs,where the unlicensed secondary users(SUs) can use the channels that are not currently used by the licensed primary users(PUs) via spectrum-sensing technology.Because of this access method,some malicious users may access the cognitive network arbitrarily and launch some special attacks,such as primary user emulation attack,falsifying data or denial of service attack,which will cause serious damage to the cognitive radio network.In addition to the specifi c security threats of cognitive network,CRNs also face up to the conventional security threats,such as eavesdropping,tampering,imitation,forgery,and noncooperation etc..Hence,Cognitive radio networks have much more risks than traditional wireless networks with its special network model.In this paper,we considered the security threats from passive and active attacks.Firstly,the PHY layer security is presented in the view of passive attacks,and it is a compelling idea of using the physical properties of the radio channel to help provide secure wireless communications.Moreover,malicious user detection is introduced in the view of active attacks by means of the signal detection techniques to decrease the interference and the probabilities of false alarm and missed detection.Finally,we discuss the general countermeasures of security threats in three phases.In particular,we discuss the far reaching effect of defensive strategy against attacks in CRNs.

Managing High Volume Data for Network Attack Detection Using Real-Time Flow Filtering

In this paper, we present Real-Time Flow Filter (RTFF) -a system that adopts a middle ground between coarse-grained volume anomaly detection and deep packet inspection. RTFF was designed with the goal of scaling to high volume data feeds that are common in large Tier-1 ISP networks and providing rich, timely information on observed attacks. It is a software solution that is designed to run on off-the-shelf hardware platforms and incorporates a scalable data processing architecture along with lightweight analysis algorithms that make it suitable for deployment in large networks. RTFF also makes use of state of the art machine learning algorithms to construct attack models that can be used to detect as well as predict attacks.