网络安全可视化可直观地提取网络安全特征、全方位感知网络安全态势,但如何宏观把控网络安全的整体分析流程仍是一大研究难题。为此,引入了数据挖掘中经典的示例-探索-修改-模型-评估(sample-exploremodify-model-assess,SEMMA)分析范式...网络安全可视化可直观地提取网络安全特征、全方位感知网络安全态势,但如何宏观把控网络安全的整体分析流程仍是一大研究难题。为此,引入了数据挖掘中经典的示例-探索-修改-模型-评估(sample-exploremodify-model-assess,SEMMA)分析范式,并结合网络安全可视化提出了一套通用的网络安全事件分析模型,将分析过程划分为数据处理、行为特征探索、异常对象定位、异常事件描述与行为模式关联分析等步骤,规范安全事件探索分析流程。在行为特征探索环节,用模糊C均值算法量化主机行为,识别网络资产结构;提出了用基于协议的节点链接图(protocol-based node link diagram,PBNLD)可视化表征形式构建网络通信模型,以提升大规模节点的绘制质量;以安全事件分析模型为指导,面向多源安全日志实例数据,搭建了网络安全事件可视探索系统,通过多视图协同与故事线回溯的方式实现网络资产划分、网络异常事件提取和攻击事件演化。最后,通过实验证明了分析模型的有效性。展开更多
Inter-domain path computing is one big issue in multi-domain networks. The Hierarchical Path Computing Element (H-PCE) is a semi-central architecture for computing inter-domain path. To facilitate H-PCE in inter-domai...Inter-domain path computing is one big issue in multi-domain networks. The Hierarchical Path Computing Element (H-PCE) is a semi-central architecture for computing inter-domain path. To facilitate H-PCE in inter-domain path computing, this paper proposed a topology aggregation scheme to abstract the edge nodes and their connected inter-domain link as one vertex to achieve more optimal paths and confidentiality guarantee. The effectiveness of the scheme has been demonstrated on solving wavelength routing in multi-domain Wavelength Division Multiplexing (WDM) network via simulation. Simulation results show that this scheme reduces at least 10% inter-domain blocking probability, compared with the traditional Domain-to-the-Node (DtN) scheme.展开更多
Delay/disruption tolerant networking （DTN） is an approach to networking where intermittent connectivity exists： it is often afforded by a store and forward technique. Depending on the capability of intermediary nod...Delay/disruption tolerant networking （DTN） is an approach to networking where intermittent connectivity exists： it is often afforded by a store and forward technique. Depending on the capability of intermediary nodes to carry and forward messages, messages can be eventually delivered to their destination by mobile nodes with an appropriate routing protocol. To have achieved a successful delivery, most DTN routing protocols use message duplication methods. Although messages are rapidly transferred to the destination, the redundancy in the number of message copies increases rapidly. This paper presents a new routing scheme based on a stochastic process for epidemic routing. Message redundancy is efficiently reduced and the number of message copies is controlled reasonably. During the contact process of nodes in the network, the number of message copies changes, and according to the variability in the number of copies, we construct a special Markov chain, birth and death process, on the number of message copies then calculate and obtain a stationary distribution of the birth and death process. Comparing the theoretical model with the simulation we have performed we see similar results. Our method improves on time-to-live （TTL） and antipacket methods, in both redundancy and delivery success efficiency.展开更多
文摘网络安全可视化可直观地提取网络安全特征、全方位感知网络安全态势,但如何宏观把控网络安全的整体分析流程仍是一大研究难题。为此,引入了数据挖掘中经典的示例-探索-修改-模型-评估(sample-exploremodify-model-assess,SEMMA)分析范式,并结合网络安全可视化提出了一套通用的网络安全事件分析模型,将分析过程划分为数据处理、行为特征探索、异常对象定位、异常事件描述与行为模式关联分析等步骤,规范安全事件探索分析流程。在行为特征探索环节,用模糊C均值算法量化主机行为,识别网络资产结构;提出了用基于协议的节点链接图(protocol-based node link diagram,PBNLD)可视化表征形式构建网络通信模型,以提升大规模节点的绘制质量;以安全事件分析模型为指导,面向多源安全日志实例数据,搭建了网络安全事件可视探索系统,通过多视图协同与故事线回溯的方式实现网络资产划分、网络异常事件提取和攻击事件演化。最后,通过实验证明了分析模型的有效性。
基金Acknowledgements This work was supported by Chang Jiang Scholars Program of the Ministry of Education of China, National Science Fund for Distinguished Young Scholars under Grant No.60725104 the National Basic Research Program of China under Grant No. 2007CB310706+2 种基金 the National Natural Science Foundation of China under Ca＇ant No. 60932002, No. 60932005, No. 61071101 the Hi-Tech Research and Development Program of China under Grant No. 2009AA01Z254, No. 2009AA01Z215 NCEF Program of MoE of China, and Sichuan Youth Science and Technology Foundation under Crant No. 09ZQ026-032.
文摘Inter-domain path computing is one big issue in multi-domain networks. The Hierarchical Path Computing Element (H-PCE) is a semi-central architecture for computing inter-domain path. To facilitate H-PCE in inter-domain path computing, this paper proposed a topology aggregation scheme to abstract the edge nodes and their connected inter-domain link as one vertex to achieve more optimal paths and confidentiality guarantee. The effectiveness of the scheme has been demonstrated on solving wavelength routing in multi-domain Wavelength Division Multiplexing (WDM) network via simulation. Simulation results show that this scheme reduces at least 10% inter-domain blocking probability, compared with the traditional Domain-to-the-Node (DtN) scheme.
文摘Delay/disruption tolerant networking （DTN） is an approach to networking where intermittent connectivity exists： it is often afforded by a store and forward technique. Depending on the capability of intermediary nodes to carry and forward messages, messages can be eventually delivered to their destination by mobile nodes with an appropriate routing protocol. To have achieved a successful delivery, most DTN routing protocols use message duplication methods. Although messages are rapidly transferred to the destination, the redundancy in the number of message copies increases rapidly. This paper presents a new routing scheme based on a stochastic process for epidemic routing. Message redundancy is efficiently reduced and the number of message copies is controlled reasonably. During the contact process of nodes in the network, the number of message copies changes, and according to the variability in the number of copies, we construct a special Markov chain, birth and death process, on the number of message copies then calculate and obtain a stationary distribution of the birth and death process. Comparing the theoretical model with the simulation we have performed we see similar results. Our method improves on time-to-live （TTL） and antipacket methods, in both redundancy and delivery success efficiency.
