Security Monitoring and Management for the Network Services in the Orchestration of SDN-NFV Environment Using Machine Learning Techniques

Software Defined Network(SDN)and Network Function Virtualization(NFV)technology promote several benefits to network operators,including reduced maintenance costs,increased network operational performance,simplified network lifecycle,and policies management.Network vulnerabilities try to modify services provided by Network Function Virtualization MANagement and Orchestration(NFV MANO),and malicious attacks in different scenarios disrupt the NFV Orchestrator(NFVO)and Virtualized Infrastructure Manager(VIM)lifecycle management related to network services or individual Virtualized Network Function(VNF).This paper proposes an anomaly detection mechanism that monitors threats in NFV MANO and manages promptly and adaptively to implement and handle security functions in order to enhance the quality of experience for end users.An anomaly detector investigates these identified risks and provides secure network services.It enables virtual network security functions and identifies anomalies in Kubernetes(a cloud-based platform).For training and testing purpose of the proposed approach,an intrusion-containing dataset is used that hold multiple malicious activities like a Smurf,Neptune,Teardrop,Pod,Land,IPsweep,etc.,categorized as Probing(Prob),Denial of Service(DoS),User to Root(U2R),and Remote to User(R2L)attacks.An anomaly detector is anticipated with the capabilities of a Machine Learning(ML)technique,making use of supervised learning techniques like Logistic Regression(LR),Support Vector Machine(SVM),Random Forest(RF),Naïve Bayes(NB),and Extreme Gradient Boosting(XGBoost).The proposed framework has been evaluated by deploying the identified ML algorithm on a Jupyter notebook in Kubeflow to simulate Kubernetes for validation purposes.RF classifier has shown better outcomes(99.90%accuracy)than other classifiers in detecting anomalies/intrusions in the containerized environment.

Cross-Domain Authentication Scheme Based on Blockchain and Consistent Hash Algorithm for System-Wide Information Management

System-wide information management(SWIM)is a complex distributed information transfer and sharing system for the next generation of Air Transportation System(ATS).In response to the growing volume of civil aviation air operations,users accessing different authentication domains in the SWIM system have problems with the validity,security,and privacy of SWIM-shared data.In order to solve these problems,this paper proposes a SWIM crossdomain authentication scheme based on a consistent hashing algorithm on consortium blockchain and designs a blockchain certificate format for SWIM cross-domain authentication.The scheme uses a consistent hash algorithm with virtual nodes in combination with a cluster of authentication centers in the SWIM consortium blockchain architecture to synchronize the user’s authentication mapping relationships between authentication domains.The virtual authentication nodes are mapped separately using different services provided by SWIM to guarantee the partitioning of the consistent hash ring on the consortium blockchain.According to the dynamic change of user’s authentication requests,the nodes of virtual service authentication can be added and deleted to realize the dynamic load balancing of cross-domain authentication of different services.Security analysis shows that this protocol can resist network attacks such as man-in-the-middle attacks,replay attacks,and Sybil attacks.Experiments show that this scheme can reduce the redundant authentication operations of identity information and solve the problems of traditional cross-domain authentication with single-point collapse,difficulty in expansion,and uneven load.At the same time,it has better security of information storage and can realize the cross-domain authentication requirements of SWIM users with low communication costs and system overhead.KEYWORDS System-wide information management(SWIM);consortium blockchain;consistent hash;cross-domain authentication;load balancing.

Fortifying the Digital Bastion: Pioneering Cybersecurity with Dynamic Secrets Management and CMDB Fusion in the Enterprise

In the relentless quest for digital sovereignty, organizations face an unprecedented challenge in safeguarding sensitive information, protecting against cyber threats, and maintaining regulatory compliance. This manuscript unveils a revolutionary blueprint for cyber resilience, empowering organizations to transcend the limitations of traditional cybersecurity paradigms and forge ahead into uncharted territories of data security excellence and frictionless secrets management experience. Enter a new era of cybersecurity innovation and continued excellence. By seamlessly integrating secrets based on logical environments and applications (assets), dynamic secrets management orchestrates and automates the secrets lifecycle management with other platform cohesive integrations. Enterprises can enhance security, streamline operations, fasten development practices, avoid secrets sprawl, and improve overall compliance and DevSecOps practice. This enables the enterprises to enhance security, streamline operations, fasten development & deployment practices, avoid secrets spawls, and improve overall volume in shipping software with paved-road DevSecOps Practices, and improve developers’ productivity. By seamlessly integrating secrets based on logical environments and applications (assets), dynamic secrets management orchestrates and automates the application secrets lifecycle with other platform cohesive integrations. Organizations can enhance security, streamline operations, fasten development & deployment practices, avoid secrets sprawl, and improve overall volume in shipping software with paved-road DevSecOps practices. Most importantly, increases developer productivity.

数字资源如何赋能企业低碳发展?——以伟明环保为例

“双碳”背景下,如何进行数字化转型已成为企业追求低碳发展中迫切需要解决的问题。对此,主要基于资源编排理论,对伟明环保智能环卫处理项目展开纵向案例研究,试图探讨企业从资源到能力再到可持续竞争优势的过程机理。研究结果表明:(1)企业转型的一轮资源编排过程可以抽象为“零散资源元素—资源结构化—数字赋能化—价值杠杆化”,而在此基础上的阶段性产出又会与外部动态环境相结合,以重构元素的形式反馈于新一轮的结构化环节,由此迭代编排以实现数字化转型,并在此过程中不断促进企业的低碳发展;(2)组织层面的低碳管理能力也是连接数字资源编排全过程的关键要素,管理者能够通过低碳资源的再部署,实现更具有绿色意义的资源管理。

银行业DAO数字化安全运营体系研究

在网络威胁呈爆发式增长的当下,随着业务模式数字化重塑与业务持续性增长,银行业面临因网络安全防线持续扩大所导致的安全设备冗杂、安全运营任务繁重、实战能力不足等问题.对银行业金融机构在安全运营中所面临的挑战进行分析,提出了融合平战一体化安全运营机制的银行业DAO(defence,ability and operation)数字化安全运营体系,重点研究纵深化防护基础、原子化能力中枢、数字化运营总台3层次架构,以及针对常态化、高强度、无间断防护目标的平战一体机制实施路径.

A New Solution to Intrusion Detection Systems Based on Improved Federated-Learning Chain

In the context of enterprise systems,intrusion detection(ID)emerges as a critical element driving the digital transformation of enterprises.With systems spanning various sectors of enterprises geographically dispersed,the necessity for seamless information exchange has surged significantly.The existing cross-domain solutions are challenged by such issues as insufficient security,high communication overhead,and a lack of effective update mechanisms,rendering them less feasible for prolonged application on resource-limited devices.This study proposes a new cross-domain collaboration scheme based on federated chains to streamline the server-side workload.Within this framework,individual nodes solely engage in training local data and subsequently amalgamate the final model employing a federated learning algorithm to uphold enterprise systems with efficiency and security.To curtail the resource utilization of blockchains and deter malicious nodes,a node administration module predicated on the workload paradigm is introduced,enabling the release of surplus resources in response to variations in a node’s contribution metric.Upon encountering an intrusion,the system triggers an alert and logs the characteristics of the breach,facilitating a comprehensive global update across all nodes for collective defense.Experimental results across multiple scenarios have verified the security and effectiveness of the proposed solution,with no loss of its recognition accuracy.

算网大脑智能化水平分级方法研究

算网大脑是算力网络的智能中枢,是实现算网多要素融合编排调度的关键系统,智能化是算网大脑实现和提升业务灵活、敏捷、高效编排管理与运营能力的核心。通信产业界各方在前期算网大脑产品实现的基础上,聚焦算网大脑的智能化技术引入,并对算网大脑未来智能化演进提出了较高期望。然而,当前尚未形成体系化的算网大脑智能化水平评估方法,无法较好地评估当前算网大脑产品所处智能化水平等级、可提升环节及待优化关键指标等内容。基于业界已有工作和需求分析,研究算网大脑智能化演进目标和阶段能力,提出了一种算网大脑智能化水平分级方法,包含评估对象选择、评估流程分解、约束指标考量等细化步骤,以及一套完整适配算网大脑智能化级别评估的规则,并在最后给出了具体应用示例。该方法可有效量化算网大脑系统所处的具体级别以及向下一级演进的方向与指标,为业界分级评估和系统建设提供参考。

Cyber Resilience through Real-Time Threat Analysis in Information Security

This paper examines how cybersecurity is developing and how it relates to more conventional information security. Although information security and cyber security are sometimes used synonymously, this study contends that they are not the same. The concept of cyber security is explored, which goes beyond protecting information resources to include a wider variety of assets, including people [1]. Protecting information assets is the main goal of traditional information security, with consideration to the human element and how people fit into the security process. On the other hand, cyber security adds a new level of complexity, as people might unintentionally contribute to or become targets of cyberattacks. This aspect presents moral questions since it is becoming more widely accepted that society has a duty to protect weaker members of society, including children [1]. The study emphasizes how important cyber security is on a larger scale, with many countries creating plans and laws to counteract cyberattacks. Nevertheless, a lot of these sources frequently neglect to define the differences or the relationship between information security and cyber security [1]. The paper focus on differentiating between cybersecurity and information security on a larger scale. The study also highlights other areas of cybersecurity which includes defending people, social norms, and vital infrastructure from threats that arise from online in addition to information and technology protection. It contends that ethical issues and the human factor are becoming more and more important in protecting assets in the digital age, and that cyber security is a paradigm shift in this regard [1].

工业互联网背景下制造企业绿色技术创新的实现路径研究——基于量子管理范式和资源编排理论的组态分析

基于工业互联网平台的资源编排组合克服资源利用局限性,协同供应链上下游进行技术共享。但目前专门针对合理编排利用不同类别的资源以促进绿色技术创新的研究缺乏,且对于数字场景的探讨并不深入。而在互联网时代,量子管理范式促进企业进化为网络化的生命共同体,逐渐形成企业平台化、员工创客化、用户个性化的发展趋势。为此,以量子管理为视角,综合考虑工业互联网情境下制造业的资源类型,深入探究传统、数字与绿色的资源和能力之间的匹配对于绿色技术创新的影响。针对中国机床企业管理人员进行问卷调查,基于151份有效问卷,首先采用必要条件分析(NCA)方法分析资源和能力如何构成绿色技术创新的必要条件,然后运用fs QCA方法探究资源和能力与绿色技术创新之间的充分性关系,为制造企业有效编排组合资源和能力进而实现绿色技术创新提供参考与借鉴。结果表明:3种资源和能力均不是必要条件,但是数字平台能力发挥促进实现绿色技术创新的显著作用;绿色技术创新的多元路径可以归纳为传统数字驱动型、数字驱动型以及绿色助力的传统数字驱动型,其中绿色助力的传统数字驱动型的经验相关性最强。据此,制造企业在具备实物资源、大数据资源和数字平台能力条件下,可以通过强化绿色资源获取能力实现绿色技术创新;同时,制造企业要与其他平台成员之间在平台的支持下实现更好的资源共享和协同创新。

多厂商云管网络及系统设计研究

在云化时代,企业数字化转型需求迅速增长,传统企业的网络管理存在如开通慢、运维成本高等问题,无法达到转型目的。研究分析了云管网络的能力及其优势,并提出一种SD-Branch系统方案,解决了多厂商融合配置编排、统一运维管理的痛点,实现多厂商全生命周期的统一网络云管。

专精特新中小企业高层管理者认知对精一创业能力影响机理研究

专精特新中小企业通过不断提升自身的精一创业能力,保持细分行业竞争优势。以专精特新中小企业为研究对象,开发精一创业能力测量量表,构建并检验专精特新中小企业高层管理者认知对精一创业能力的影响模型,揭示不同维度专精特新中小企业高层管理者认知对精一创业能力的作用机制。基于385份问卷调研数据,采用逐步回归方法开展实证研究,分析发现:(1)专精特新中小企业高层管理者的配置认知、意愿认知和能力认知对精一创业能力具有显著正向作用;(2)资源编排在专精特新中小企业高层管理者认知与精一创业能力之间发挥中介作用;(3)高层管理者学习导向正向调节专精特新中小企业高层管理者认知与资源编排间关系。最后,为专精特新中小企业提升精一创业能力提出实践建议。

网络编排理论研究评述与展望

价值创造的场所已由单个组织转向网络、生态系统或平台,企业亟须有目的地构建和管理外部依赖关系。网络编排作为确保外部资源有利分配进而创造并获取价值的理论,有助于理解枢纽组织从网络中创造价值和提取价值时采取的一系列有意识、有目的的行动。但当前相关研究处于初期探索阶段,研究主题相当分散,尚未形成成熟的理论体系。本文通过梳理网络编排理论的起源、发展脉络和最新研究成果,系统阐述了其内涵和外延。还根据网络编排相关研究提炼出编排要素的含义、作用和相互关系,建立网络编排理论的逻辑框架,为未来研究的理论定位、研究方向和研究范围等提供基本依据。此外,本文基于中国国情和所处的复杂国际环境,提出目前的研究缺口和亟须解决的问题,并建议从网络编排与企业家、资源和战略的交叉领域出发,为未来企业的网络编排研究提供指引。

5G网络切片研究进展

作为5G及未来通信网络的关键使能技术,网络切片凭借其在垂直行业定制、服务质量保障、灵活性、可靠性等方面的潜在优势,获得了运营商和学术界的广泛关注和认可。目前,已有不少相关组织以专题报告的形式呈现了其对网络切片的理解及未来发展设想。但是,这些报告的侧重点各有不同且相关术语尚未规范统一,此类问题的存在给研究人员理解网络切片带来了诸多阻碍。为便于研究人员把握网络切片的发展脉络、技术架构,以及管理编排等具体内容,文中对相关研究进行了综述。首先介绍了网络切片的产生背景、具体含义以及功能特性。其次,针对端到端网络切片的实现,分别就接入网切片、承载网切片以及核心网切片这3方面的内容,对近年来的网络架构发展、技术突破以及标准化成果展开了论述。而后就网络切片管理与编排的具体内容进行了介绍与分析,并依据切片场景的不同对相关研究进行了分类梳理与比较。最后,结合网络切片的发展需求和现实困境,指出了目前研究所面临的一些开放性挑战。

基于云编排的抽水蓄能电站作业标准化现场应用研究

随着社会信息化和工业化的交融,5G通信、互联网+、云计算等技术也被运用在抽水蓄能电站中以建设“智慧电厂”。结合江西洪屏抽水蓄能电站实况,阐明了云编排在抽水蓄能电站标准化现场应用的关键技术。基于国家电网统一应用平台(SG-UAP)开发了检修、巡检、定检、调试、消缺等模块。研究结果证明了云编排技术在抽水蓄能电站现场作业应用中的可用性和高效性,为后续水电开发建设提供了决策支持。

BIdM:A Blockchain-Enabled Cross-Domain Identity Management System

Reliable identity management and authentication are significant for network security.In recent years,as traditional centralized identity management systems suffer from security and scalability problems,decentralized identity management has received considerable attention in academia and industry.However,with the increasing sharing interaction among each domain,management and authentication of decentralized identity has raised higher requirements for cross-domain trust and faced implementation challenges galore.To solve these problems,we propose BIdM,a decentralized crossdomain identity management system based on blockchain.We design a decentralized identifier(DID)for naming identities based on the consortium blockchain technique.Since the identity subject fully controls the life cycle and ownership of the proposed DID,it can be signed and issued without a central authentication node’s intervention.Simultaneously,every node in the system can participate in identity authentication and trust establishment,thereby solving the centralized mechanism’s single point of failure problem.To further improve authentication efficiency and protect users’privacy,BIdM introduces a one-way accumulator as an identity data structure,which guarantees the validity of entity identity.We theoretically analyze the feasibility and performance of BIdM and conduct evaluations on a prototype implementation.The experimental results demonstrate that BIdM achieves excellent optimization on cross-domain authentication compared with existing identity management systems.

基于原子化设备及资产管理的SOAR实践研究

网络攻击手段持续进化,规模及频率持续增长,国家及企业面临的网络安全威胁日趋严峻,在这一背景下,安全编排自动化与响应(security orchestration automation and response, SOAR)技术通过固化自动化场景为企业平衡“安全、成本及效率”提供了解决方案.针对SOAR实践中安全设备能力接入及调用、网络资产信息录入及关联的动态化和敏捷化需求,提出了围绕标准安全编排动作及安全属性资产集的集成概念的原子化设备及资产管理策略.通过设备能力及资产属性的原子化、实例化以及基于知识图谱的标准安全编排动作及安全属性资产集集成,实现安全设备、网络资产能力敏捷集成、资源高效调配、信息关联存储,以应对网络威胁、防护需求动态变化的场景.同时,对基于该策略的多个SOAR自动化场景实践进行了研究及讨论.

制造企业采购与供应管理实践的组态类型实证研究

引入组态理论研究我国制造企业采购策略和相关管理实践的设计与实施问题。理论分析提出采购与供应管理实践的系统分析框架之后,运用问卷调查方法,对408份制造业企业样本数据进行聚类分析及分类稳定性检验。研究结果表明,当408个企业样本被划分为三种类型时,聚类系数变化百分比达到了最大值。借助单因素方差分析和二次聚类程序,分类稳定性得到验证。最终借助对聚类中心的分析,命名得到交易型、协作型和发掘型三种采购与供应管理实践的组态类型。在这三种类型之间,供应商和采购职能参与企业产品价值形成的方式存在较大差异;同时单一类型内各管理实践之间存在相互影响和相互依赖关系。

网络功能虚拟化标准及技术探讨

指出基于网络功能虚拟化(NFV)的核心网代表着信息发展的重要趋势,中国在其标准化进展、架构及应用方面均取得显著进展。基于NFV的核心网需要解决一些关键问题才能进行部署,包括标准化问题、可靠性问题、安全性问题、性能问题等。强调对于电信和IT融合的统一资源协同编排能力的建设、新型数据中心组网的云化网络体系架构的研究以及网络演进和创新对于运营商是极大的挑战。

中国联通边缘云平台架构与业务能力开放

首先讨论边缘云在三层通信云架构的部署位置。未来,中国联通将部署边缘云至边缘数据中心和综合接入机房,以满足不同用户的需求。同时,介绍中国联通商用部署边缘云平台与架构,该平台开源、开放,API接口友好,提供丰富的平台能力。最后,介绍边缘云所提供的各类平台能力。中国联通边缘业务平台能力开放可以安全高效地将基础网络服务能力提供给第三方应用消费,还可在第三方应用之间实现服务能力的可靠共享,促进丰富的边缘应用生态,以满足各种边缘应用场景。

基于开源技术的NFV平台架构研究

NFV涉及包括底层基础设施资源、虚拟网络功能、综合管理、业务编排、网管等诸多领域,搭建一套完整的NFV平台是一个较为复杂的系统工程。文章参考ETSI NFV整体架构,分析NFV各模块的开源支撑技术,结合运营商网络业务特点,提出一个利用开源平台搭建NFV实验平台的通用架构,为今后开展相关NFV验证及测试提供支撑。