基于协议分析的IRC僵尸网络检测方法

IRC协议的利用使僵尸网络趋向智能化,给僵尸网络的检测带来很大难度。通过深入研究IRC僵尸网络运行机制和网络行为交互特征,提出了一种基于IRC协议分析的僵尸网络检测方法——BotDetector,采用流量预处理、IRC协议解析还原、控制命令的模式匹配等关键技术,BotDetector实现了高效、快速的IRC僵尸网络实时检测功能。实验结果表明,BotDetector对于IRC僵尸网络的检测行之有效。     

基于通信特征提取和IP聚集的僵尸网络相似性度量模型

IRC僵尸网络(botnet)是攻击者通过IRC服务器构建命令与控制信道方式控制大量主机(bot)组成的网络.IRC僵尸网络中IRC服务器与bot连接具有很强的动态特性,为识别使用不同IRC服务器的同一僵尸网络,文中提取并比对僵尸网络的通信量特征、通信频率特征,建模估算bot重叠率,通过融合以上度量指标,提出了僵尸网络相似性度量模型.实验验证了模型的有效性,计算了其准确率,并分析了僵尸网络的迁移.     

基于通信特征曲线动态时间弯曲距离的IRC僵尸网络同源判别方法

IRC僵尸网络(botnet)是攻击者通过IRC服务器构建命令与控制信道方式控制大量主机(bot)组成的网络.IRC僵尸网络中IRC服务器与bot连接具有很强的动态特性.相关研究采用IRC僵尸网络的服务器域名、服务器IP、控制者ID等信息度量IRC僵尸网络的相似性,再根据相似性值检测同源IRC僵尸网络,但这些信息并不能代表IRC僵尸网络的本质特征,因此误差较大.为识别使用不同IRC控制服务器的同源僵尸网络,提取僵尸网络的通信量特征曲线、通信频率特征曲线,基于通信特征曲线的动态时间弯曲距离判别同源的僵尸网络.为了减小计算量和增加判别准确率,根据通信特征曲线的特点,提取并利用曲线的峰、谷特征点;并提出改进的LB-PAA对动态时间弯曲距离的计算进行优化.实验验证了方法的有效性并计算了各类错误率.     

聚类分析技术在IRC僵尸网络检测系统中的应用

僵尸网络是当前互联网中重大安全威胁之一,黑客通过在互联网中传播僵尸病毒,将大量计算机变成自己可控制的僵尸计算机,从而实现攻击。本文以僵尸网络中最常见的IRC僵尸网络为例,分析了IRC僵尸网络的工作原理,提出利用聚类分析技术中的马氏距离算法和欧氏距离算法对IRC僵尸网络进行检测。     

僵尸网络模型研究

本文首先深入剖析了僵尸网络内部工作机制,根据僵尸网络工作机制将僵尸刚络划分为IRC僵尸网络模型、P2P僵尸网络模型、HTTP僵尸网络模型．并就当前的IRC、HTTP以及P2P式三种僵尸网络模型进行了深入地研究。     

基于动态IP地址去重的IRC僵尸网络大小度量

IRC僵尸网络是攻击者通过IRC服务器构建命令与控制信道方式来控制大量主机组成的网络。IRC僵尸网络的动态性以及动态IP地址的影响,给僵尸网络的大小度量带来很大的困难。本文采用基于概率的动态IP地址去重算法减小动态IP地址的影响,给出僵尸网络大小尽量准确的度量,实验验证了本文方法的有效性。     

基于终端行为特征的IRC僵尸网络检测

目前已有的IRC僵尸网络检测算法存在两个问题:需要先验知识以获取匹配模式,无法满足实时处理需求.为解决这两个问题,文中提出了基于昵称和命令序列这两个终端行为特征的IRC僵尸网络检测算法.文中提出三种属性分别从内容、组成和结构三方面互补的刻画两个昵称的相似性,给出两个昵称相似性的量化因子,根据这量化因子生成弹性TRW算法以进行IRC僵尸网络实时检测.文中还在分析僵尸终端登录服务器的行为的基础上,提出了基于命令序列相似性的检测算法.算法评估实验证明两个算法行之有效.最后将这两个算法用于大规模网络环境中实时检测IRC僵尸网络,在两周内检测到162个僵尸频道.     

中小型局域网中P2P僵尸网络的检测

传统的僵尸网络大多是基于IRC协议的集中式结构,但越来越多的僵尸网络开始转向了分布式的P2P结构,针对IRC信道的检测方法已经不适用于新型的P2P僵尸网络。提出一种面向中小型局域网,根据流量统计特性和恶意攻击活动相结合的P2P僵尸网络检测方法。这种方法对采用随机端口,数据加密等新型手段的Botnets可以进行有效检测。     

僵尸网络的危害及研究方法

僵尸网络是各种恶意软件传播和控制的主要来源,检测僵尸网络对于网络安全非常重要。介绍了僵尸网络的概念、类型以及危害,论述基于IRC协议下的Botnet的研究方法。     

僵尸网络流的识别

僵尸网络已经成为一种常见的互联网应用。本文介绍了采用IRC协议、HTTP协议和P2P协议的僵尸网络的原理和特征,并介绍了包括僵尸网络行为仿真与监控、流量数据特征匹配和网络流特征分析三种僵尸网络流识别方法。     

Research of incoherence rotated chaotic measurement matrix in compressed sensing

Measurement matrix construction is the hot issue of compressed sensing. How to construct a measurement matrix of good performance and easy hardware implementation is the main research problem in compressed sensing. In this paper, we present a novel simple and efficient measurement matrix named Incoherence Rotated Chaotic (IRC) matrix. We take advantage of the well pseudorandom of chaotic sequence, introduce the concept of the incoherence factor and rotation, and adopt QR decomposition to obtain the IRC measurement matrix which is suited for sparse reconstruction. The IRC matrix satisfies the Restricted Isometry Property criterion in sparse reconstruction and has a smaller RIP ratio. Simulations demonstrate IRC matrix has better performance than Gaussian random matrix, Bernoulli random matrix, Fourier matrix and can efficiently work on both natural image and remote sensing image. The peak signal-to-noise ratios of reconstructed images using IRC matrix are improved at 1.5 dB to 2.5 dB at least.     

Reinforcing Web-object Categorization Through Interrelationships

Existing categorization algorithms deal with homogeneous Web objects, and consider interrelated objects as additional features when taking the interrelationships with other types of objects into account. However, focusing on any single aspect of the inter-object relationship is not sufficient to fully reveal the true categories of Web objects. In this paper, we propose a novel categorization algorithm, called the Iterative Reinforcement Categorization Algorithm (IRC), to exploit the full interrelationship between different types of Web objects on the Web, including Web pages and queries. IRC classifies the interrelated Web objects by iteratively reinforcing the individual classification results of different types of objects via their interrelationship. Experiments on a clickthrough-log dataset from the MSN search engine show that, in terms of the F₁ measure, IRC achieves a 26.4% improvement over a pure content-based classification method. It also achieves a 21% improvement over a query-metadata-based method, as well as a 16.4% improvement on F₁ measure over the well-known virtual document-based method. Our experiments show that IRC converges fast enough to be applicable to real world applications.     

Energy- and spectral-efficiency of zero-forcing beamforming in massive MIMO systems with imperfect reciprocity calibration: bound and optimization

In a time-division duplex (TDD) system with massive multiple input multiple output (MIMO), channel reciprocity calibration (RC) is generally required in order to cope with the reciprocity mismatch between the uplink and downlink channel state information. Currently, evaluating the achievable spectral efficiency (SE) and energy efficiency (EE) of TDD massive MIMO systems with imperfect RC (IRC) mainly relies on exhausting Monte Carlo simulations and it is infeasible to precisely and concisely quantify the achievable SE and EE with IRC. In this study, a novel method is presented for tightly bounding the achievable SE of massive MIMO systems with zero-forcing beamforming under IRC. On the basis of the analytical results, we demonstrate key insights for practical system design with IRC in three aspects: the scaling rule for interference power, saturation region of the SE, and the bound on the SE loss. Finally, the trade-off between spectral and energy efficiencies in the presence of IRC is determined with algorithms developed to optimize SE (EE) under a constrained EE (SE) value. The loss of optimal total SE and EE due to IRC is also quantified, which shows that the loss of optimal EE is more sensitive to IRC in a typical range of transmit power values.     

用面向对象方法开发IRC模型和实现技术

本文介绍了用Ｃ＋＋面向对象技术和网络技术开发ＩＲＣ（Ｉｎｔｅｒｎｅｔ Ｒｅｌａｙ Ｃｈａｔ）的模型技术，以及ＩＲＣ与某些特定性能结合从而产生某些异化ＩＲＣ的方式方法，并且作者据此在互连网络上进行了有益的探索，并且产生了预定的效果。     

注意力机制的曲面沉浸式投影系统补偿

目的 沉浸式投影系统已广泛运用于虚拟现实系统之中,然而沉浸式投影系统中的互反射现象严重影响着虚拟现实系统的落地使用。沉浸式投影系统的互反射是指由于投影机光线和屏幕反射光线相互叠加造成的亮度冗余现象,严重影响了投影系统的成像质量和人眼的视觉感受。为此,本文提出一种新的基于互反射通道(inter-reflection channel,IRC)先验和注意力机制的神经网络。方法 IRC先验基于这样一个事实,即大多数受到互反射影响的投影图像都包含一些亮度较高的区域。高亮度区域往往受互反射影响更为严重,而低亮度区域受互反射影响程度较低。根据这一规律,采用IRC先验作为注意力图的监督样本,获取补偿图像的亮度区域信息。同时,为了对投影图像不同区域按影响程度进行差异化补偿,提出一种新的由两个相同子网络构成的补偿网络结构Pair-Net。结果 实验对比了4种现有方法,Pair-Net在ROI(region of interesting)指标分析上取得了明显优势,在人眼感受上有显著的效果提升。结论 本文提出的基于注意力机制的网络模型能够针对不同区域进行差异化补偿,很大程度上消除了互反射影响,提升了沉浸式投影系统的成像质量。     

The visual characteristics of avatars in computer-mediated communication: Comparison of Internet Relay Chat and Instant Messenger as of 2003

This research focuses on computer-mediated communication where users are represented by a graphical avatar. An avatar represents a user's self-identity and desire for self-disclosure. Therefore, the claim is made that there is a relationship between the characteristics of media and the choice of avatar. This study supports the claim by examining the difference between Internet Relay Chat (IRC) avatars and Instant Messenger (IM) avatars as of 2003 when both media had distinct characteristics and popular avatar service in Korea. Users of IRC are generally anonymous and involved with topic-based group discussions, whereas users of IM are known by their “real” names and communicate via one-on-one chitchatting. We found that avatars as symbols for users can have different characteristics in terms of self-identity and self-disclosure in different media. Gender is found to have significant moderation effect on avatar usage, whereas age is shown to have a mixed moderation effect.