一种防火墙规则冲突检测算法

在入侵检测系统和状态检测防火墙等应用中,规则冲突检测及冲突解析算法是影响安全性及服务质量的关键。首先对防火墙过滤规则之间的关系进行了建模和分类。然后在过滤规则关系分类的基础上提出了一种冲突检测算法。该算法能够自动检测、发现规则冲突和潜在的问题,并且能够对防火墙过滤规则进行无冲突的插入、删除和修改。实现该算法的工具软件能够显著简化防火墙策略的管理和消除防火墙的规则冲突。     

基于信息流的作战体系结构建模

为综合描述体系作战信息流结构,细致刻画作战活动、作战单元之间复杂动态的信息处理与交互情况,引入信息流分析方法,定义了实体、关系、属性等3类信息流要素,解析了实体要素之间的对应关联关系,以信息流为主线,设定了活动→活动、活动→节点、节点→活动和节点→节点4种信息映射规则,结合建模基本流程,分别构建了基于信息流的作战活动模型、作战节点模型和信息交互模型。最后,以空中突击作战为例,进行了仿真验证。结果表明,提出的方法和模型是可行、有效的,能够描述作战体系内部复杂多样的信息交互关系,展现信息流贯穿作战活动的动态全过程,为作战体系建模和信息需求分析提供了新的方法和手段。     

关联规则格的渐进式维护算法

关联规则发现作为数据挖掘中核心任务之一,已经得到了广泛的研究。由二元关系导出的概念格是一种非常有用的形式化工具,适于发现数据中潜在的概念。在分析了概念格和关联规则之间的关系的基础上,根据需要对概念格结构——关联规则格进行了修改,同时,采用了带头尾指针的链表作为整体的数据结构,从而提出了基于关联规则格的关联规则渐进式维护算法。该算法可以根据预先给定的置信度∮,在渐进式增加和删除节点时,动态更新关联规则。     

联机分析处理中的非规则维建模

预聚集技术通过预先计算并保存原始数据上的查询结果以实现联机分析处理系统的快速查询响应能力．然而，在实际应用中，许多非规则维的结构难以使用传统多维模型进行建模，从而影响了预聚集技术的使用．为此，基于子级别到父级别的部分映射定义级别之间的部分序关系，进而提出了一个支持非覆盖、非映上等非规则雏中维级别关系建模的维模型．同时，在维模型基础上，定义了支持非规则维的立方体模型以及典型的联机分析处理操作．多维模型与关系模式的转换定义和实例分析证明了该多维模型可以实现对各种非规则维的建模支持，保证了预聚集技术在联机分析处理中的使用．     

一种基于Hadoop的关联规则挖掘算法

传统的并行关联规则算法对每一次迭代都定义一个MapReduce任务,以实现候选项集的生成和计数功能,但多次启动MapReduce任务会带来极大的性能开销。文中定义了一种并行关联规则挖掘算法PST-Apriori,该算法采取分治策略,在每个分布式计算节点定义一个前缀共享树,通过递归调用的方式将事务T生成的候选项集逐层压缩到前缀共享树(PST)中。然后广度遍历PST,逐层将每个节点对应的〈key,value〉作为map函数的输入,并由Map-Reduce框架自动按照key值进行聚集。最后调用reduce函数对多个任务的处理结果进行汇总,得到满足最小支持度阈值的频繁项集。算法只使用两个MapReduce任务,且PST按照key值排序便于Mapper端的shuffle操作,提高了运行效率。     

SDN网络虚拟化中规则映射研究

软件定义网络（SDN）为网络虚拟化提供了新的解决方案,通过网络虚拟化技术可以将一套基础设施虚拟化为多个逻辑网络从而满足不同的网络需求.本文研究了SDN网络虚拟化时多个物理交换机虚拟为一个大虚拟交换机的过程中,虚拟网络规则与物理网络规则的映射问题.综合考虑链路负载、规则分布以及节点负载,提出了三段式规则映射优化算法.首先根据虚拟网络的规则请求生成组播源节点和目的节点集,采用MPH算法生成规则映射树;然后采用入节点最近原则,将虚拟网络规则请求的指令序列部署到规则映射树中的中间节点和叶子节点中;最后考虑节点负载,对规则部署进行微调,最终生成虚拟规则映射策略.通过仿真实验,与直接边缘节点部署相比,平均降低了网络节点规则总数量40%以上.     

防火墙过滤规则的建模和全面优化

防火墙的管理在今天的企业网络环境中是一个复杂和易出错的任务,网络管理员不能仅仅依靠自己的经验和知识来配置防火墙,而必须使用有效的工具和技术,在系统的方法学的指导下来完成。论文采用几何技术对防火墙的配置进行建模,每个过滤规则被映射为多维空间中的一个几何体,从而使得防火墙的配置可视化和易于理解。该方法可以对防火墙的现有规则库进行彻底的重写,从而实现全面的优化。另外,该文还将通常定义在两个规则之间的规则冲突的概念和分类扩展到多个规则之间。     

基于业务规则的工作流任务分派设计与实现

任务分派反映了企业的人力资源管理与利用水平,是工作流系统的重要内容.任务分派实现是否有效,直接影响了企业的经济效益与发展.在分析以往工作流任务分派定义灵活性与扩展性不足的基础上引入业务规则,以提高任务分派逻辑定义的效率和质量.本工作流任务分派系统充分利用了现有规则引擎Drools,并在此基础上进行了面向业务层面的改进与扩展,以提高系统开发效率.为基于业务规则的工作流系统开发打下坚实的理论与实践基础.     

基于规则信息量的规则提取及规则约简

在提出规则信息量的基础上,分析了可能性规则的定义,并利用规则信息量对条件属性类和决策属性类间的概率因果关系进行了描述,重新定义了可能性规则.同时,进一步提出了能充分利用决策表信息系统中统计信息的规则提取算法LRE.本文还基于规则信息量得到了一种新的规则约简算法,这种算法是在对原有的粗集规则约简定义进行合理推广的基础上建立起来的,能很好地抵抗数据中的噪声.     

面向过程的需求建模

提出目标、角色、需求任务建模方法,将软件系统高层目标层层分解、精化成操作化目标,分配给角色作为角色目标,在需求工程过程中,用具体的需求任务实现角色目标。定义了3个单一化规则对建模过程进行约束,可以避免操作化目标、角色和具体的需求任务之间的冲突。定义了操作化目标与角色目标之间的映射函数、角色目标与具体的需求任务之间的映射函数以及它们的复合函数,将操作化目标与具体的需求任务直接关联,使软件系统目标与需求工程过程紧密结合,可以更加直观、形象、准确地对系统需求建模,通过聚集需求任务实现系统高层目标。     

Modelling and solving grid resource allocation problem with network resources for workflow applications

A problem of allocating resources of a grid to workflow applications is considered. The problem consists, generally, in allocating distributed grid resources to tasks of a workflow in such a way that the resource demands of each task are satisfied. Grid resources are divided into computational resources and network resources. Computational tasks and transmission tasks of a workflow are distinguished. We present a model of the problem, and an algorithm for finding feasible resource allocations. A numerical example is included, showing the importance of the resource allocation phase on a grid. Some conclusions and directions for future research are given.     

Utility-driven solution for optimal resource allocation in computational grid

Optimal resource allocation is a complex undertaking due to large-scale heterogeneity present in computational grid. Traditionally, the decision based on certain cost functions has been used in allocating grid resource as a standard method that does not take resource access cost into consideration. In this paper, the utility function is presented as a promising method for grid resource allocation. To tackle the issue of heterogeneous demand, the user's preference is represented by utility function, which is driven by a user-centric scheme rather than system-centric parameters adopted by cost functions. The goal of each grid user is to maximize its own utility under different constraints. In order to allocate a common resource to multiple bidding users, the optimal solution is achieved by searching the equilibrium point of resource price such that the total demand for a resource exactly equals the total amount available to generate a set of optimal user bids. The experiments run on a Java-based discrete-event grid simulation toolkit called GridSim are made to study characteristics of the utility-driven resource allocation strategy under different constraints. Results show that utility optimization under budget constraint outperforms deadline constraint in terms of time spent, whereas deadline constraint outperforms budget constraint in terms of cost spent. The conclusion indicates that the utility-driven method is a very potential candidate for the optimal resource allocation in computational grid.     

面向事件处置的信息服务集成调度模型

以电子政务、电子商务等城市应用为背景,针对这些应用中跨领域事件处置所涉及的异构、分布式资源、服务集成调度以及跨领域知识共享问题,提出了一个面向事件处置的、基于规则的信息服务集成调度模型.该集成调度模型具有4个分层结构,包括资源层(resource layer)、知识层(knowledge layer)、业务层(business layer)和表示层(representation layer).重点就知识层形式化业务规则的定义、资源和服务的引用以及规则引擎等给出了详细的设计和实现.最后,对该模型进行了验证,实现了一个城市应急联动应用中的统一接警事件处置原型系统.     

基于资源约束和局部启发搜索的规划系统

针对如何充分发挥车间设备的资源潜力，完成企业下达的生产任务，使完成任务所需时间和生产成本尽可能的少和智能规划中资源规划所要解决的典型问题，提出了基于资源约束和局部搜索相结合的规划方法。并且在资源的分配上采用了优先级分派原则，在局部搜索中通过约束表达引导搜索的启发式信息，施行规则控制下的启发式搜索，提高了车间资源规划的效率。根据上述恩想，结合顺特电气线圈生产车间资源规划的实际问题。研究开发了车间资源规划系统，实际运行例子表明，所提出的思想是有实用价值的。     

Constraint-Based Rule Mining in Large, Dense Databases

Constraint-based rule miners find all rules in a given data-set meeting user-specified constraints such as minimum support and confidence. We describe a new algorithm that directly exploits all user-specified constraints including minimum support, minimum confidence, and a new constraint that ensures every mined rule offers a predictive advantage over any of its simplifications. Our algorithm maintains efficiency even at low supports on data that is dense (e.g. relational tables). Previous approaches such as Apriori and its variants exploit only the minimum support constraint, and as a result are ineffective on dense data due to a combinatorial explosion of “frequent itemsets”.     

面向优先级任务的移动边缘计算资源分配方法

目前移动边缘计算中的资源分配方法,多数按照任务请求计算卸载的时间顺序分配计算资源,未考虑实际应用中任务存在优先级的问题。针对此类情况下的计算需求,提出一种面向优先级任务的资源分配方法。根据任务平均处理价值赋予其相应的优先级,对不同优先级的任务进行计算资源加权分配,在保证高优先级任务获取充足计算资源的同时,减少完成所有任务计算的总时间及能耗,从而提高服务质量。仿真结果表明,与平均分配、按任务数据量分配和本地计算方法相比,该方法的计算时延分别降低83.76%、15.05%和99.42%,能耗分别降低84.78%、17.37%和87.69%。     

Developing security-aware resource management strategies for workflows

This paper investigates the resource allocation problem for a type of workflow in pervasive computing. These workflows are abstracted from the enterprise-level applications in the business or commerce area. The activities in these workflows require not only computing resources, but also human resources. Human involvement introduces additional security concerns. When we plan/allocate resource capacities, we often assume that when a task is allocated to a resource, the resource will accept the task and start the execution once the processor becomes available. However, the security policies impose further constraints on task executions, and therefore may affect both application- and system-oriented performance. Authorization is an important aspect in security. This paper investigates the issue of allocating resources for running workflows under the role-based authorization control, which is one of the most popular authorization mechanisms. By taking into account the authorization constraints, the resource allocation strategies are developed in this paper for both human resources and computing resources. In the allocation strategy for human resources, the optimization equation is constructed subject to the constraint of the budget available to hire human resources. Then the optimization equation is solved to obtain the number of human resources allocated to each authorization role. The allocation strategy for computing resources calculates not only the number of computing resources, but also the proportion of processing capacity in each resource allocated to serve the tasks assuming each role. The simulation experiments have been conducted to verify the effectiveness of the developed allocation strategies. The experimental results show that the allocation strategy developed in this paper outperforms the traditional allocation strategies, which do not consider authorization constraints, in terms of both average response time and resource utilization.     

Application of stochastic control theory to resource allocation under uncertainty

The subject of this paper is the application of stochastic control theory to resource allocation under uncertainty. In these problems it is assumed that the results of a given allocation of resources are not known with certainty, but that a limited number of experiments can be performed to reduce the uncertainty. The problem is to develop a policy for performing experiments and allocating resources on the basis of the outcome of the experiments such that a performance index is optimized. The problem is first analyzed using the basic stochastic dynamic programming approach. A computationally practical algorithm for obtaining an approximate solution is then developed. This algorithm preserves the "closed-loop" feature of the dynamic programming solution in that the resulting decision policy depends both on the results of past experiments and on the statistics of the outcomes of future experiments. In other words, the present decision takes into account the value of future information. The concepts are discussed in the context of the general problem of allocating resources to repair machines where it is possible to perform a limited number of diagnostic experiments to learn more about potential failures. Illustrative numerical results are given.     

KOALA: a co‐allocating grid scheduler

In multicluster systems, and more generally in grids, jobs may require co‐allocation, that is, the simultaneous or coordinated access of single applications to resources of possibly multiple types in multiple locations managed by different resource managers. Co‐allocation presents new challenges to resource management in grids, such as locating sufficient resources in geographically distributed sites, allocating and managing resources in multiple, possibly heterogeneous sites for single applications, and coordinating the execution of single jobs at multiple sites. Moreover, as single jobs now may have to rely on multiple resource managers, co‐allocation introduces reliability problems. In this paper, we present the design and implementation of a co‐allocating grid scheduler named KOALA that meets these co‐allocation challenges. In addition, we report on the results of an analysis of the performance in our multicluster testbed of the co‐allocation policies built into KOALA . We also include the results of a performance and reliability test of KOALA while our testbed was unstable. Copyright © 2007 John Wiley & Sons, Ltd.     

扩展合同网方法在远程协同诊断中的应用

诊断任务分配是远程协同诊断的一个内容和难点;在经典合同网分配方法基础上,提出的扩展合同网分配方法依据诊断任务的相似范例推理和阈值规则确定投标诊断资源联盟,以满意效用并经过协商来签订和执行合同.该效用由多约束模糊系数法确定;给出了扩展合同网分配方法的算法描述和UML执行流程,通过一个FMS诊断任务分配过程验证了该方法是一个动态、有效的智能诊断任务分配方法;在结论中指出了进一步研究点。