一种基于OpenFlow的SDN访问控制策略实时冲突检测与解决方法

软件定义网络SDN(Software-Defined Networking)是由美国斯坦福大学Clean Slate研究组提出的一种新型网络创新架构,可通过软件编程的形式定义和控制网络,其控制平面和转发平面分离及开放性可编程的特点,为新型互联网体系结构研究提供了新的实验途径,也极大地推动了下一代互联网的发展.OpenFlow是SDN的主要协议,定义了SDN控制器与交换机之间的通信标准.目前,很多基于OpenFlow的SDN设备已经在实际中得到了部署.但是,基于OpenFlow的SDN却面临很多安全挑战.其中一个重要的挑战是如何建立一个安全可靠的SDN防火墙应用.由于OpenFlow协议的无状态性,现有的SDN防火墙可以被通过改写交换机中的流表项轻松绕过.针对这一安全威胁,作者提出了基于Flowpath的实时动态策略冲突检测与解决方法.通过获取实时的SDN网络状态,能够准确地检测防火墙策略的直接和间接违反,并且一旦发现冲突,可以基于Flowpath进行自动化和细粒度的冲突解决.最后,作者在开源控制器Floodlight上实现了一个安全增强的防火墙应用FlowVerifier,并基于Mininet对FlowVerifier的性能进行了评估.结果表明FlowVerifier能够检测和自动化地解决SDN网络中由于流表改写而引入的策略冲突及其带来的安全威胁.     

基于OpenFlow的SDN技术研究

软件定义网络(software-defined networking,简称SDN)技术分离了网络的控制平面和数据平面,为研发网络新应用和未来互联网技术提供了一种新的解决方案.综述了基于OpenFlow 的SDN 技术发展现状,首先总结了逻辑控制和数据转发分离架构的研究背景,并介绍了其关键组件和研究进展,包括OpenFlow交换机、控制器和SDN技术,然后从4 个方面分析了基于OpenFlow 的SDN 技术目前所面临的问题和解决思路.结合近年来的发展现状,归纳了在校园网、数据中心以及面向网络管理和网络安全方面的应用,最后探讨了未来的研究趋势.     

基于OpenFlow的SDN专利技术分析

软件定义网络(SDN)作为一种新的网络架构,为打破传统的TCP/IP架构提供了可能,实现了控制平面与数据平面的解耦,可以满足未来互联网的需求。基于OpenFlow的SDN可以为新的网络应用与未来互联网技术的发展提供支持。基于此,从专利角度系统梳理基于OpenFlow的SDN技术的专利申请,对国内外专利申请量趋势、重要申请人分布及研究和发展重点进行可视化展示。     

软件定义网络核心原理与应用实践

本书分为核心原理和应用实践两大部分,对软件定义网络(SDN)技术进行了全面剖析和深入解读。第一部分首先阐述了SDN的设计思想与体系架构,详细分析了软件定义网络的控制转发分离和可编程两个突出属性,其次介绍了以OpenFlow为代表的SDN南向接口协议,以及北向和东西向接口协议,接下来根据SDN的层次化架构,依次介绍了SDN数据平面、控制平面以及SDN应用案例,最后梳理总结了SDN标准化进展以     

基于流粒度的OpenFlow分组缓存管理模型

基于OpenFlow的软件定义网络(SDN)技术通过在OpenFlow交换机中建立有效的缓存模型,能够大幅减少控制平面和数据平面的通信负载,但整条数据流的缓存模型会对数据流的传输造成较大延时,降低整个SDN的数据传输性能。针对该问题,引入PiBuffer流缓存模型,构建基于报文分组粒度的分组缓存模型。通过在控制平面建立流路由和流状态的缓存信息,分别对流报文之间和交换机之间的数据传输采用"分组缓存,组内保序"机制和"传输询问,完成通知"机制,并对控制平面和数据平面的通信消息进行优化,以提高数据中心网络的通信性能。软件模拟结果表明,在数据中心基于OpenFlow技术的SDN网络中,该模型比流缓存模型具有更优的通信性能。     

软件定义网络控制平面的研究综述

软件定义网络(Software-defined network,SDN)作为一种新兴的网络范式,通过解耦控制平面与数据转发平面,集中控制并且聚集全网视图,在控制平面与数据平面建立开放接口,启用外部应用使得网络具有可编程性,从而弥补当前网络架构所存在的不足与限制。其中,控制器作为SDN中重要的组成部分,成为了研究的热点。针对软件定义网络控制平面控制器的研究,首先总结了当前SDN控制平面控制器技术发展的现状并对其进行归类;其次着重分析了当前控制器存在的一致性、可扩展性、负载均衡等一系列问题;最后探讨了软件定义网络技术未来的研究发展方向及趋势。     

软件定义网络控制平面可扩展性研究进展

软件定义网络（software-defined networking,简称SDN）遵循控制转发分离的设计原则,其控制平面采用集中的控制逻辑,在提供灵活高效的网络控制的同时,也面临着严重的可扩展性问题.对SDN控制平面可扩展性相关工作进行综述.首先分析控制平面可扩展性的影响因素并给出改善思路;在此基础上,从数据平面缓存优化、高性能控制器、分布式控制平面和控制资源优化分配4种技术路线出发,论述了主要的解决方案和研究进展.最后,给出总结并展望了未来的研究工作.     

SDN交换机转发规则TCAM存储优化综述

软件定义网络(SDN)将传统网络的控制平面和数据平面解耦,通过控制平面的控制器灵活地对网络进行管理,目前应用最广泛的控制协议是OpenFlow.三态内容寻址存储器(TCAM)查找速度快、支持三态掩码存储,在SDN网络中应用广泛.但TCAM成本高、功耗大,并且在存储含有范围字段匹配域的规则时候存在范围膨胀问题,因此交换机中可存储的转发规则数量,尤其是匹配域的数量和类型都比较多的OpenFlow规则数目非常有限,这成为约束SDN网络大规模扩展和应用的瓶颈.研究机构从不同角度提出了针对SDN中交换机转发规则的TCAM存储优化方案.本文从转发规则存储架构优化、本地交换机转发规则压缩、全局转发规则动态优化以及控制器参与的网络转发规则管理四个角度总结了相关研究工作,并提出了适合未来SDN网络的转发规则存储的综合优化方案.     

云计算环境中软件定义网络研究应用

云计算可以根据实际需求提供灵活多样的服务,正成为IT模式的应用趋势,其中大部分采用软件定义网络(SDN)作为其网络架构,控制平面和数据平面相互分离,以简化网络管理、保证网络隔离.该文基于SDN技术的发展现状,介绍了OpenFlow交换、控制器和SDN技术的关键组成和研究进展,及其在网络中的应用.最后,分析了云计算环境中SDN技术存在的问题,并提出相关解决建议.     

对SDN技术的研究与思考

SDN将网络的控制平面从交换机和路由器中的数据平面分离出来,代表着虚拟化从服务器到网络的演变。SDN如今已深入到网络架构的各个方面,其最大优势在于可以动态地为不同的互联网业务分配带宽资源。本文从SDN的定义及内涵入手,归纳SDN的关键技术和标准化研究进程,并结合网络设备商和运营商的SDN部署情况对产业现状进行深入的分析和总结。     

European Community policy and the market

Abstract This paper starts with some reflections on the policy considerations and priorities which are shaping European Commission (EC) research programmes. Then it attempts to position the current projects which seek to capitalise on information and communications technologies for learning in relation to these priorities and the apparent realities of the marketplace. It concludes that while there are grounds to be optimistic about the contribution EC programmes can make to the efficiency and standard of education and training, they are still too technology driven.     

一种自适应子融合集成多分类器方法

融合集成方法已经广泛应用在模式识别领域,然而一些基分类器实时性能稳定性较差,导致多分类器融合性能差,针对上述问题本文提出了一种新的基于多分类器的子融合集成分类器系统。该方法考虑在度量层融合层次之上通过对各类基多分类器进行动态选择,票数最多的类别作为融合系统中对特征向量识别的类别,构成一种新的自适应子融合集成分类器方法。实验表明,该方法比传统的分类器以及分类融合方法识别准确率明显更高,具有更好的鲁棒性。     

煤矿井下安全监控分站的设计及其仿真实现

为了设计一种具有低成本、低功耗、易操作、功能强且可靠性高的煤矿井下安全分站,针对煤矿安全生产实际,文章提出了采用MCS-51系列单片机为核心、具有CAN总线通信接口的煤矿井下安全监控分站的设计方案;首先给出煤矿井下安全监控分站的整体构架设计,然后着重阐述模拟量输入信号处理系统的设计过程,最后说明单片机最小系统及其键盘、显示、报警、通信等各个组成部分的设计;为验证设计方案的可行性与有效性,使用Proteus软件对设计内容进行仿真验证,设计的煤矿井下安全监控分站具有瓦斯、温度等模拟量参数超标报警功能和电机开停、风门开闭等开关量指示功能;仿真结果表明:设计的煤矿井下安全监控分站具有一定的实际应用价值.     

Explanation and prediction: an architecture for default and abductive reasoning

Although there are many arguments that logic is an appropriate tool for artificial intelligence, there has been a perceived problem with the monotonicity of classical logic. This paper elaborates on the idea that reasoning should be viewed as theory formation where logic tells us the consequences of our assumptions. The two activities of predicting what is expected to be true and explaining observations are considered in a simple theory formation framework. Properties of each activity are discussed, along with a number of proposals as to what should be predicted or accepted as reasonable explanations. An architecture is proposed to combine explanation and prediction into one coherent framework. Algorithms used to implement the system as well as examples from a running implementation are given.     

View-based model-driven architecture for enhancing maintainability of data access services

In modern service-oriented architectures, database access is done by a special type of services, the so-called data access services (DAS). Though, particularly in data-intensive applications, using and developing DAS are very common today, the link between the DAS and their implementation, e.g. a layer of data access objects (DAOs) encapsulating the database queries, still is not sufficiently elaborated, yet. As a result, as the number of DAS grows, finding the desired DAS for reuse and/or associated documentation can become an impossible task. In this paper we focus on bridging this gap between the DAS and their implementation by presenting a view-based, model-driven data access architecture (VMDA) managing models of the DAS, DAOs and database queries in a queryable manner. Our models support tailored views of different stakeholders and are scalable with all types of DAS implementations. In this paper we show that our view-based and model driven architecture approach can enhance software development productivity and maintainability by improving DAS documentation. Moreover, our VMDA opens a wide range of applications such as evaluating DAS usage for DAS performance optimization. Furthermore, we provide tool support and illustrate the applicability of our VMDA in a large-scale case study. Finally, we quantitatively prove that our approach performs with acceptable response times.     

A pragmatic multi-method investigation of discrepant technological events: Coping,attributions, and ‘accidental’ learning

Discrepant technological events or situations that entail a problem, a misunderstanding or a difficulty with the Information Technology (IT) being employed, are common in the workplace, and can lead to frustration and avoidance behaviors. Little is known, however, about how individuals cope with these events. This paper examines these events by using a multi-method pragmatic approach informed by coping theory. The results of two studies – a critical incident study and an experiment – serve to build and test, respectively, a theoretical model that posits that individuals use a variety of strategies when dealing with these events: they experience negative emotions, make external attributions, and adopt engagement coping strategies directed at solving the event, eventually switching to a disengagement coping strategy when they feel they have no control over the situation. Furthermore, users’ efforts may result in ‘accidental’ learning as they try to overcome the discrepant IT events through engagement coping. The paper ends with a discussion of the results in light of existing literature, future opportunities for research, and implications for practice.     

Three Process Perspectives: Organizations, Teams, and People

This paper provides the author's personal views and perspectives on software process improvement. Starting with his first work on technology assessment in IBM over 20 years ago, Watts Humphrey describes the process improvement work he has been directly involved in. This includes the development of the early process assessment methods, the original design of the CMM, and the introduction of the Personal Software Process (PSP)^SM and Team Software Process (TSP){^SM}. In addition to describing the original motivation for this work, the author also reviews many of the problems he and his associates encountered and why they solved them the way they did. He also comments on the outstanding issues and likely directions for future work. Finally, this work has built on the experiences and contributions of many people. Mr. Humphrey only describes work that he was personally involved in and he names many of the key contributors. However, so many people have been involved in this work that a full list of the important participants would be impractical.     

The Distributed Time-Triggered Simulation Scheme: Core Principles and Supporting Execution Engine

Distributed real-time simulation is a young technology field but its practice is under increasing demands. In recent years the author and his collaborators have been establishing a new approach called the distributed time-triggered simulation (DTS) scheme which is conceptually simple and easy to use but widely applicable. The concept was initiated in the course of developing a new-generation object-oriented real-time programming scheme called the time-triggered message-triggered object (TMO) programming scheme. Some fundamental issues inherent in distributed real-time simulation that were learned during recent experimental studies are discussed along with some approaches for resolving the issues. An execution engine developed to support both the TMOs engaged in control computation and the TMOs engaged in DTS is also discussed along with its possible extensions that will enable significantly larger-scale DTSs.     

Software-Konfigurationsmanagement in großen Softwareprojekten

Zusammenfassung Mit zunehmender Größe der Softwaresysteme verschärfen sich die für die Software-Herstellung typischen Probleme: Beherrschen großer Objektmengen, Erhalten der Systemkonsistenz, Kontrolle der ständigen Änderungseinflüsse und Gewährleisten einer langen Lebensdauer. Die Disziplin Konfigurationsmanagement bildet den methodischen Ansatz, diese Probleme besser zu beherrschen. Software-Konfigurationsmanagement faßt die Herstellung von Softwaresystemen als eine Abfolge von kontrollierten Änderungen an gesicherten Zwischen- und Endergebnissen auf. Dargestellt werden die Objekte und Funktionen des Software-Konfigurationsmanagements sowie die hierfür in großen Software-Projekten benötigten Methoden, Instanzen und Hilfsmittel.     

基于复小波噪声方差显著修正的SAR图像去噪

提出了一种基于复小波域统计建模与噪声方差估计显著性修正相结合的合成孔径雷达(Synthetic Aperture Radar,SAR)图像斑点噪声滤波方法。该方法首先通过对数变换将乘性噪声模型转化为加性噪声模型,然后对变换后的图像进行双树复小波变换(Dualtree Complex Wavelet Transform,DCWT),并对复数小波系数的统计分布进行建模。在此先验分布的基础上,通过运用贝叶斯估计方法从含噪系数中恢复原始系数,达到滤除噪声的目的。实验结果表明该方法在去除噪声的同时保留了图像的细节信息,取得了很好的降噪效果。