The Impact of Domain Name Server(DNS)over Hypertext Transfer Protocol Secure(HTTPS)on Cyber Security:Limitations,Challenges,and Detection Techniques

The DNS over HTTPS(Hypertext Transfer Protocol Secure)(DoH)is a new technology that encrypts DNS traffic,enhancing the privacy and security of end-users.However,the adoption of DoH is still facing several research challenges,such as ensuring security,compatibility,standardization,performance,privacy,and increasing user awareness.DoH significantly impacts network security,including better end-user privacy and security,challenges for network security professionals,increasing usage of encrypted malware communication,and difficulty adapting DNS-based security measures.Therefore,it is important to understand the impact of DoH on network security and develop newprivacy-preserving techniques to allowthe analysis of DoH traffic without compromising user privacy.This paper provides an in-depth analysis of the effects of DoH on cybersecurity.We discuss various techniques for detecting DoH tunneling and identify essential research challenges that need to be addressed in future security studies.Overall,this paper highlights the need for continued research and development to ensure the effectiveness of DoH as a tool for improving privacy and security.

The Citron homology domain of MAP4Ks improves outcomes of traumatic brain injury

The mitogen-activated protein kinase kinase kinase kinases(MAP4Ks)signaling pathway plays a pivotal role in axonal regrowth and neuronal degeneration following insults.Whether targeting this pathway is beneficial to brain injury remains unclear.In this study,we showed that adeno-associated virus-delivery of the Citron homology domain of MAP4Ks effectively reduces traumatic brain injury-induced reactive gliosis,tauopathy,lesion size,and behavioral deficits.Pharmacological inhibition of MAP4Ks replicated the ameliorative effects observed with expression of the Citron homology domain.Mechanistically,the Citron homology domain acted as a dominant-negative mutant,impeding MAP4K-mediated phosphorylation of the dishevelled proteins and thereby controlling the Wnt/β-catenin pathway.These findings implicate a therapeutic potential of targeting MAP4Ks to alleviate the detrimental effects of traumatic brain injury.

Interaction of major facilitator superfamily domain containing 2A with the blood-brain barrier

The functional and structural integrity of the blood-brain barrier is crucial in maintaining homeostasis in the brain microenvironment;however,the molecular mechanisms underlying the formation and function of the blood-brain barrier remain poorly understood.The major facilitator superfamily domain containing 2A has been identified as a key regulator of blood-brain barrier function.It plays a critical role in promoting and maintaining the formation and functional stability of the blood-brain barrier,in addition to the transport of lipids,such as docosahexaenoic acid,across the blood-brain barrier.Furthermore,an increasing number of studies have suggested that major facilitator superfamily domain containing 2A is involved in the molecular mechanisms of blood-brain barrier dysfunction in a variety of neurological diseases;however,little is known regarding the mechanisms by which major facilitator superfamily domain containing 2A affects the blood-brain barrier.This paper provides a comprehensive and systematic review of the close relationship between major facilitator superfamily domain containing 2A proteins and the blood-brain barrier,including their basic structures and functions,cross-linking between major facilitator superfamily domain containing 2A and the blood-brain barrier,and the in-depth studies on lipid transport and the regulation of blood-brain barrier permeability.This comprehensive systematic review contributes to an in-depth understanding of the important role of major facilitator superfamily domain containing 2A proteins in maintaining the structure and function of the blood-brain barrier and the research progress to date.This will not only help to elucidate the pathogenesis of neurological diseases,improve the accuracy of laboratory diagnosis,and optimize clinical treatment strategies,but it may also play an important role in prognostic monitoring.In addition,the effects of major facilitator superfamily domain containing 2A on blood-brain barrier leakage in various diseases and the research progress on cross-blood-brain barrier drug delivery are summarized.This review may contribute to the development of new approaches for the treatment of neurological diseases.

防护性DNS服务关键技术研究综述

域名系统(domain name system,DNS)作为互联网资源的名字标识服务,提供了从域名到IP地址的查询转换功能,是用户访问互联网应用的入口,也是用户侧安全威胁感知与防御的关键点。用户侧常见的DNS滥用及相关安全威胁有:网络钓鱼、域名不良应用、恶意软件以及利用DNS进行攻击等。防护性DNS(protective DNS,PDNS)服务是一种利用DNS协议和架构的网络安全防护技术,通过对DNS查询进行威胁检测与处置,能够从源头上阻止用户对网络钓鱼网站、不良网站、恶意软件的访问。目前学界对PDNS服务还缺少系统的介绍与研究。对PDNS已有研究工作、应用现状及架构与功能进行系统梳理,对PDNS所涉及的关键技术进行系统综述,主要包括域名威胁处置技术、DNS异常检测技术、威胁情报管理技术和数据存储管理技术,分析PDNS目前面临的问题与挑战,并对PDNS未来发展趋势与研究方向提出了展望。

基于威胁情报的DNS助力医院网络安全建设实践

目的利用威胁情报和域名解析系统(DNS)加强医院网络安全。方法在医院互联网出口配置基于威胁情报的安全DNS策略,让医院终端及互联网信息系统通过安全DNS访问互联网。结果应用安全DNS后,医院对外的恶意域名访问被100%拦截,能有效拦截和阻断高级持续性威胁。结论通过应用基于威胁情报的安全DNS,提升了医院对网络安全漏洞的定位能力,缩短了响应时间,降低了处置成本,这对于做好医院网络安全加固和提升医院安全整体水平具有借鉴意义。

多校区校园网一体化DNS网络架构研究

高校多校区一体化管理中,校区间人员流动频繁,如何保证学校师生在不同校区获得一致的上网体验成为一个难题。除了加快建设多活数据中心,实现重要信息系统的容灾备份体系之外,网络基础设施服务域名系统(Domain Name System,DNS)的一体化部署也面临新挑战。以河海大学南京校区和常州校区为例,通过多活容灾网络架构等技术手段部署一体化智能DNS服务,有效解决网络拥塞和信息系统访问瓶颈的问题,同时提升DNS管理的便捷性和服务的安全可靠性,对相关应用场景具有一定参考价值。

湍流燃烧二阶矩模型DNS检验研究进展的回顾

现有的湍流燃烧模型中,有的缺乏普适性,也有的用于大涡模拟的计算量太大.一种基于湍流流动模拟思路的统计矩方法被提出来,称为二阶矩(second-order moment,SOM)燃烧模型,用于非预混射流火焰和旋流火焰的雷诺平均模拟(Reynolds-averaged Navier-Stokes modeling,RANS)和大涡模拟(large-eddy simulation,LES),以及钝体后方预混火焰的大涡模拟,已经得到实验结果的良好检验.进一步的研究是该模型的直接数值模拟(direct numerical simulation,DNS)检验.本文对作者以及文献中报导的SOM模型DNS检验的研究进展进行了回顾.

基于RF-RNN模型的DNS隐蔽信道检测方法

为提高检测隐蔽信道的灵敏度,提出一种基于随机森林(Random Forest,RF)和循环神经网络(Recurrent Neural Network,RNN)的域名系统(Domain Name System,DNS)隐蔽信道检测方法。该方法采用域名检测作为主要手段,使用RF模型对域名进行分类,通过深度学习方法挖掘更高阶的特征表示。实验结果表明,与单一模型相比,该方法在检测准确性和健壮性方面均取得了显著提升。

DNS信道传输加密技术:现状、趋势和挑战

DNS作为重要的互联网基础设施,其明文传输的特点带来很多隐私安全风险.DoH、DoT、DoQ等DNS信道传输加密技术致力于防止DNS数据被泄露或篡改,并保证DNS消息来源的可靠性.首先从DNS消息格式、数据存储和管理、系统架构和部署等6个方面分析明文DNS存在的隐私安全问题,并对已有的相关技术和协议进行总结.其次分析DNS信道传输加密技术的实现原理及应用现状,进而基于多角度评测指标对各加密协议在不同网络条件下的性能表现进行讨论.同时通过填充机制的局限性、加密流量识别和基于指纹的加密活动分析等方向探讨DNS信道传输加密技术的隐私保护效果.此外从部署规范、恶意流量对加密技术的利用和攻击、隐私和网络安全管理之间的矛盾,以及加密后影响隐私安全的其他因素等方面总结DNS信道传输加密技术存在的问题、挑战和相关解决方案.最后总结加密DNS服务的发现、递归解析器到权威服务器之间的加密、服务器端的隐私保护、基于HTTP/3的DNS等后续需要着重关注的研究方向.

递归侧DNS安全研究与分析

因特网用户在访问网络应用前都需要通过DNS进行解析,DNS安全是保障网络正常运行的第1道门户,如果DNS的安全不能得到有效保证,即使网络其他系统安全防护措施级别再高,攻击者也可以通过攻击DNS系统使网络无法正常使用.目前DNS恶性事件仍有上升趋势,DNS攻击检测和防御技术的发展仍不能满足现实需求.从直接服务用户DNS请求的递归解析服务器视角出发,将DNS安全事件通过两种分类方法,全面梳理和总结DNS工作过程中面临的安全问题,包括由攻击或系统漏洞等引起各类安全事件,各类安全事件的具体检测方法,各类防御保护技术.在对各类安全事件、检测和防御保护技术总结的过程中,对相应典型方法的特点进行分析和对比,并对未来DNS安全领域的研究方向进行展望.

DNS核心稳定训练结合局部针刺运动对脑卒中后偏瘫患者步行及姿势控制能力的影响

目的:探讨动态神经肌肉稳定技术(Dynamic Neuromuscular Stabilization,DNS)下的核心稳定训练结合局部针刺运动方案对脑卒中后偏瘫患者步行及姿势控制能力的影响。方法:选取2022年3月~2022年9月在郴州市第一人民医院就诊的脑卒中患者90例,按随机数字表分为对照组(n=45)和观察组(n=45),对照组采用常规康复训练,观察组在此基础上增加DNS核心稳定训练结合局部针刺运动疗法。治疗8周后,对比并分析治疗前后两组患者步态时空参数中步长、步速、步频参数;步态时相参数中双支撑相占步态周期百分比、患侧单支撑相占步态周期百分比、步行周期参数;脑卒中患者姿势控制量表(Posture assessment of stoke scale,PASS)量表、Tinnetti(Performance-Oriented Assessment of Mobility)量表及Fugl-Meyer下肢运动功能(FMA-LE)量表评分数据。结果:治疗后,两组步长、步速、步频参数、双支撑相占步态周期百分比、患侧单支撑相占步态周期百分比、Tinnetti评分、PASS评分及FMA评分均显著高于治疗前(P<0.05),步行周期显著低于治疗前(P<0.05),且观察组治疗后步长、步速、步频参数、双支撑相占步态周期百分比、患侧单支撑相占步态周期百分比、PASS评分、Tinnetti评分及FMALE评分均显著高于对照组(P<0.05),步行周期则低于对照组(P<0.05)。结论:DNS核心稳定训练结合局部针刺运动可提高脑卒中后偏瘫患者核心稳定及姿势控制能力,改善步行功能。

一种基于DNS的零信任增强认证系统设计

针对当前大量HTTPS应用复用证书存在安全风险问题,借鉴了零信任模型中安全策略动态授权的思路,提出了一种基于现有互联网基础设施DNS来扩展增强认证功能的方案,通过在现有DNS权威服务器上额外配置增强的认证信息来对HTTPS访问请求进行动态认证,从而能实时验证当前HTTPS证书的安全状态。该方案通过可信易得的DNS基础设施解决了当前普遍存在的HTTPS证书复用带来的安全问题,是一种灵活高效并且可扩展的零信任安全增强认证架构。

Diabetic retinopathy identification based on multi-sourcefree domain adaptation

AIM:To address the challenges of data labeling difficulties,data privacy,and necessary large amount of labeled data for deep learning methods in diabetic retinopathy(DR)identification,the aim of this study is to develop a source-free domain adaptation(SFDA)method for efficient and effective DR identification from unlabeled data.METHODS:A multi-SFDA method was proposed for DR identification.This method integrates multiple source models,which are trained from the same source domain,to generate synthetic pseudo labels for the unlabeled target domain.Besides,a softmax-consistence minimization term is utilized to minimize the intra-class distances between the source and target domains and maximize the inter-class distances.Validation is performed using three color fundus photograph datasets(APTOS2019,DDR,and EyePACS).RESULTS:The proposed model was evaluated and provided promising results with respectively 0.8917 and 0.9795 F1-scores on referable and normal/abnormal DR identification tasks.It demonstrated effective DR identification through minimizing intra-class distances and maximizing inter-class distances between source and target domains.CONCLUSION:The multi-SFDA method provides an effective approach to overcome the challenges in DR identification.The method not only addresses difficulties in data labeling and privacy issues,but also reduces the need for large amounts of labeled data required by deep learning methods,making it a practical tool for early detection and preservation of vision in diabetic patients.

Estimation-free spatial-domain image reconstruction of structured illumination microscopy

Structured illumination microscopy(SIM)achieves super-resolution(SR)by modulating the high-frequency information of the sample into the passband of the optical system and subsequent image reconstruction.The traditional Wiener-filtering-based reconstruction algorithm operates in the Fourier domain,it requires prior knowledge of the sinusoidal illumination patterns which makes the time-consuming procedure of parameter estimation to raw datasets necessary,besides,the parameter estimation is sensitive to noise or aberration-induced pattern distortion which leads to reconstruction artifacts.Here,we propose a spatial-domain image reconstruction method that does not require parameter estimation but calculates patterns from raw datasets,and a reconstructed image can be obtained just by calculating the spatial covariance of differential calculated patterns and differential filtered datasets(the notch filtering operation is performed to the raw datasets for attenuating and compensating the optical transfer function(OTF)).Experiments on reconstructing raw datasets including nonbiological,biological,and simulated samples demonstrate that our method has SR capability,high reconstruction speed,and high robustness to aberration and noise.

基于Sketch的重要DNS查询缓存方法

在网络信息技术快速发展背景下,域名系统作为互联网应用的入口,其性能和安全对网络服务的质量尤为关键。然而,从缓存的角度来看,当前域名解析器的域名缓存项管理机制尚不完善。为此,提出了一种基于Sketch技术的域名缓存管理方法,创新地引入了“重要度”评估指标,将网络测量方法应用于缓存管理,实现对缓存项的时间和频率两方面特征的综合度量,满足动态划定重要域名需求。实验结果表明,该缓存方法能够从真实网络环境产生的海量域名查询请求中,针对性地将重要域名添加到缓存予以保护,平均解析时间相比现有域名缓存解决方案减少超过18%。所提方法不仅能够对域名缓存实施更灵活的操作,提高域名系统的用户侧可用性和管理侧可维护性,更为域名缓存管理的研究提供了新的视角和解决方案。

WAP网关TOP Domain DNS容灾优化方案

文章针对WAP网关DNS查询故障导致WAP业务受阻的问题,深入分析了WAP网关DNS查询流程,设计并实现了WAP网关TOP Domain DNS容灾优化方案,有效提高了WAP网关系统容灾能力。

Fast solution to the free return orbit's reachable domain of the manned lunar mission by deep neural network

It is important to calculate the reachable domain(RD)of the manned lunar mission to evaluate whether a lunar landing site could be reached by the spacecraft. In this paper, the RD of free return orbits is quickly evaluated and calculated via the classification and regression neural networks. An efficient databasegeneration method is developed for obtaining eight types of free return orbits and then the RD is defined by the orbit’s inclination and right ascension of ascending node(RAAN) at the perilune. A classify neural network and a regression network are trained respectively. The former is built for classifying the type of the RD, and the latter is built for calculating the inclination and RAAN of the RD. The simulation results show that two neural networks are well trained. The classification model has an accuracy of more than 99% and the mean square error of the regression model is less than 0.01°on the test set. Moreover, a serial strategy is proposed to combine the two surrogate models and a recognition tool is built to evaluate whether a lunar site could be reached. The proposed deep learning method shows the superiority in computation efficiency compared with the traditional double two-body model.

基于动态域名水印的IPv6 DNS服务发现方法

IPv6环境下的域名系统(DNS,domain name system)服务发展迅速,开展IPv6环境下DNS服务发现方法研究,对分析DNS服务在IPv6环境下的全球发展态势,提升服务可靠性具有非常重要的意义。基于IPv4和IPv6的合作解析关系,通过跨栈服务关联发现IPv6 DNS服务是一种有效的方法。然而,现有基于跨栈服务关联的IPv6 DNS服务发现方法受DNS探测包长度限制,探测能力有限。针对此问题,提出一种基于动态域名水印的IPv6 DNS服务发现方法。该方法利用自建权威服务器构建动态域名资源记录,绕过探测包长度限制。相比传统方法,该方法发现的IPv6 DNS服务数量提升接近98%;同时,通过解析水印日志记录,发现了解析器间存在大量解析依赖和集中化现象。

递归侧DNSSEC错误配置检测能力大规模探测分析

DNSSEC(domain name system security extensions)是一种域名系统(DNS,domain name system)的安全扩展协议,通过为DNS记录添加签名来增加DNS的安全性。域名递归服务器能否有效验证DNSSEC配置的正确性,并且在配置错误时返回相应的错误类型,对保障整个DNS的安全至关重要。为此,基于RFC 8914标准,选择了8种在权威侧可配置的DNSSEC错误类型,并在8个不同的子域分别配置了相应的DNSSEC错误。接下来,面向全球范围内的公共DNS服务器,筛选出其中支持DNSSEC的递归服务器作为探测对象,针对上述8个子域发起解析请求,对探测结果进行了收集、分析及可视化。探测结果表明,对于部分错误,多数支持DNSSEC的递归服务器可以正确地检测出域名的DNSSEC错误配置,并且返回相应的错误类型,如signature_expired、signature_not_valid、RRSIG_missing、DNSKEY_missing等错误。对当前全球范围内重要递归服务器检测DNSSEC错误配置的能力开展了大规模测量分析,可有效指导未来DNSSEC广泛部署中递归侧的能力建设。

基于智能DNS与反向代理实现Web应用系统IPv6网络部署与IPv4网络安全加固

基于下一代互联网核心技术IPv6具有地址空间足够大、安全性更高、服务质量更好、支持终端设备移动等特性,高校的信息化发展在逐步推进IPv6网络部署与信息系统的IPv6网络应用。然而,在高校推进应用系统的IPv6网络部署访问过程中,仍然存在部分底层网络设备不支持IPv6协议、安全设备无法做到全面管控等问题。为尽可能不改变当前学校网络架构,不影响当前学校应用系统的IPv4网络访问,提出了基于智能DNS与反向代理设备实现高校Web应用系统IPv6网络部署与访问的技术方法。该技术方法具有实现原理简单、稳定性强、安全性高、易维护等特性,通过联动部署,实现了学校应用系统的IPv6网络访问与IPv4访问安全加固,为高校校园网IPv6网络应用部署提供了参考实践。