基于GQM模型的工业控制系统风险评估方法

风险评估是保证工业控制系统安全的重要机制，当前，信息安全和功能安全的耦合越来越紧密，考虑到不同组织的业务目标和运营环境多样化程度高，工控系统信息安全风险评估应紧密结合业务目标。基于目标-问题-度量（GQM）模型，从目标确定、问题描述、度量指标定义工控系统风险评估流程，以工控系统所承载的业务目标为指引，基于风险场景模型提出问题，围绕提出的问题收集信息，根据收集的信息和数据对度量指标进行关联分析和评价。最后，以PLC风险评估为实例，具体说明和验证了基于GQM模型的工业控制系统风险评估方法的有效性。     

基于烟草工控系统网络安全风险评估的研究与应用

随着计算机和网络技术的发展,特别是信息化与工业化深度融合以及物联网的快速发展,工业控制系统产品越来越多地采用通用协议、通用硬件和通用软件,以各种方式与互联网等公共网络连接,病毒、木马等威胁正在向工业控制系统扩散,工业控制系统信息安全问题日益突出。一旦工业控制系统信息安全出现漏洞,将对工业生产运行和国家经济安全造成重大隐患。利用AHP方法从资产、威胁点和脆弱性进行风险评估与分析,结合采用工控安全工具对其进行检测得出该系统正处于高风险运行状态下,建议采取相应措施。     

信息系统安全风险评估技术分析

信息系统安全的风险评估是建立信息系统安全体系的基础和前提。在对国内外现有的信息安全风险评估方法与技术进行归纳和较系统的介绍的基础上,指出了目前信息安全风险评估需要解决的问题,对未来信息系统安全风险评估的发展前景进行了分析。     

信息安全风险评估在构筑信息安全保障体系中的作用与地位

近年来,我国面临的信息安全形势十分严峻,对信息安全的保障需求日益提高,从而加大了对信息安全保障体系建设的迫切性。其中,作为衍生于信息安全保障体系建设过程中,又指导着信息安全保障工作开展的信息安全风险评估理论和实践,既是一个重要手段和补充,又是一个安全评估在信息技术领域应用的崭新领域。如何利用信息安全风险评估构筑信息安全保障体系,成为当前信息安全保障工作的重要课题。文章主要从信息安全需求、信息安全保障过程中实际存在的困难以及信息安全风险评估的理论等三个方面的论述,并针对信息安全风险评估在构筑信息安全保障体系中的作用与地位的问题展开探讨和研究,最后阐述了信息安全风险评估的实践理论对信息化安全保障工作的启示意义。     

军校网络信息安全风险评估工作探讨

为了进一步加强军校网络信息系统的安全管理,全面、经常性地开展军校网络信息安全风险评估工作势在必行。结合对军校信息网络安全管理工作的调查研究,从技术和管理角度对网络信息安全风险评估的相关问题进行了探讨：分析了网络信息安全风险评估在军校中的认识误区;总结了开展军校网络信息安全风险评估工作的主要问题;提出了解决现存问题的改进思路。     

煤矿工业互联网信息安全风险评估

针对煤矿工业互联网信息安全防护手段多应用于较小区域、难以对整体信息安全风险进行评估的问题,提出了一种基于静态和动态2个维度的煤矿工业互联网信息安全风险评估方法。该方法根据《信息安全技术网络安全等级保护基本要求》及GB/T 34679—2017《智慧矿山信息系统通用技术规范》,对煤矿信息系统已实施的安全防护条例进行特征化转换,建立各系统中安全防护要求的关联系数矩阵,进而计算出系统实际实施的安全防护条例数量;再结合威胁发生数和发生更高级风险的概率,建立安全风险评估模型,进而对煤矿工业互联网进行信息安全风险评估。测试结果表明,该方法能有效评估煤矿工业互联网信息安全状况,指导煤矿企业进行信息安全风险分析、安全防护规划设计及实施,从而降低煤矿工业互联网信息安全风险。     

专用园区网络系统安全风险评估研究

对网络安全的风险评估不仅是专用网络系统建设的重要内容,也是其园区单位进行网络安全规划、实施与管理的基础.结合园区网络系统安全的现状,阐述了对专用园区网络信息安全风险评估问题的认识,通过构建风险评估模型及量化方法,结合评估过程实例,分析了目前用于专用园区网络系统安全风险评估的主要过程,并针对网络信息安全风险评估结果中存在的问题,研究了相应可行的方法对策.     

要培养自己的风险评估队伍

随着国民经济和社会信息化进程的全面加快,网络和重要信息系统的基础性、全局性作用日益增强,由此产生的信息安全问题也越来越突出。《国家信息化领导小组关于加强信息安全保障工作的意见》(中办发[2003]27号文件)分析了我国当前信息安全保障工作的基本状况,提出了加强信息安全保障工作的总体要求和主要原则,对下一步信息安全保障工作做出了全面部署,将系统安全评估作为一种重要的保障手段之一。在全国信息安全保障工作会议上,黄菊同志指出:“加强信息安全基础性工作和基础设施建设是当务之急”,并要求“抓紧研究制定基础信息网络和重要信息系统风险评估的管理规范,并组织力量提供技术支持。根据风险评估结果,进行相应等级的安全建设和管理。”信息安全风险评估,是信息安全的一项重要基础性工作,是风险管理理论和方法在信息化中的实际运用,也是等级防护思想的具体体现。目前,国内众多部门和行业都开始投入精力进行风险评估工作。可是对于许多单位而言,如何做好风险评估,风险评估实施过程中应该注意什么问题,却不是很清楚。本期CSO沙龙将和您一起探讨这方面的问题。     

军队院校网络信息安全风险评估研究

本文阐述了对信息安全风险评估问题的认识,通过构建风险评估模型及量化方法,结合评估过程实例,分析了目前用于军队院校网络系统安全风险评估的主要过程,并针对网络信息安全风险评估结果中存在的问题,研究了相应可行的方法对策。     

风险评估是用户的事情

随着国民经济和社会信息化进程的全面加快,网络和重要信息系统的基础性、全局性作用日益增强,由此产生的信息安全问题也越来越突出。《国家信息化领导小组关于加强信息安全保障工作的意见》(中办发[2003]27号文件)分析了我国当前信息安全保障工作的基本状况,提出了加强信息安全保障工作的总体要求和主要原则,对下一步信息安全保障工作做出了全面部署,将系统安全评估作为一种重要的保障手段之一。在全国信息安全保障工作会议上,黄菊同志指出:“加强信息安全基础性工作和基础设施建设是当务之急”,并要求“抓紧研究制定基础信息网络和重要信息系统风险评估的管理规范,并组织力量提供技术支持。根据风险评估结果,进行相应等级的安全建设和管理。”信息安全风险评估,是信息安全的一项重要基础性工作,是风险管理理论和方法在信息化中的实际运用,也是等级防护思想的具体体现。目前,国内众多部门和行业都开始投入精力进行风险评估工作。可是对于许多单位而言,如何做好风险评估,风险评估实施过程中应该注意什么问题,却不是很清楚。本期CSO沙龙将和您一起探讨这方面的问题。     

Only connect: teaching, technology and telesis

Abstract This paper describes an approach to the design of interactive multimedia materials being developed in a European Community project. The developmental process is seen as a dialogue between technologists and teachers. This dialogue is often problematic because of the differences in training, experience and culture between them. Conditions needed for fruitful dialogue are described and the generic model for learning design used in the project is explained.     

European Community policy and the market

Abstract This paper starts with some reflections on the policy considerations and priorities which are shaping European Commission (EC) research programmes. Then it attempts to position the current projects which seek to capitalise on information and communications technologies for learning in relation to these priorities and the apparent realities of the marketplace. It concludes that while there are grounds to be optimistic about the contribution EC programmes can make to the efficiency and standard of education and training, they are still too technology driven.     

一种自适应子融合集成多分类器方法

融合集成方法已经广泛应用在模式识别领域,然而一些基分类器实时性能稳定性较差,导致多分类器融合性能差,针对上述问题本文提出了一种新的基于多分类器的子融合集成分类器系统。该方法考虑在度量层融合层次之上通过对各类基多分类器进行动态选择,票数最多的类别作为融合系统中对特征向量识别的类别,构成一种新的自适应子融合集成分类器方法。实验表明,该方法比传统的分类器以及分类融合方法识别准确率明显更高,具有更好的鲁棒性。     

Avoiding semantic and temporal gaps in developing software intensive systems

Development of software intensive systems (systems) in practice involves a series of self-contained phases for the lifecycle of a system. Semantic and temporal gaps, which occur among phases and among developer disciplines within and across phases, hinder the ongoing development of a system because of the interdependencies among phases and among disciplines. Such gaps are magnified among systems that are developed at different times by different development teams, which may limit reuse of artifacts of systems development and interoperability among the systems. This article discusses such gaps and a systems development process for avoiding them.     

Designing economic np control charts: A programmed simulation approach

This paper presents control charts models and the necessary simulation software for the location of economic values of the control parameters. The simulation program is written in FORTRAN, requires only 10K of main storage, and can run on most mini and micro computers. Two models are presented - one describes the process when it is operating at full capacity and the other when the process is operating under capacity. The models allow the product quality to deteriorate to a further level before an existing out-of-control state is detected, and they can also be used in situations where no prior knowledge exists of the out-of-control causes and the resulting proportion defectives.     

The development of robot art

Going through a few examples of robot artists who are recognized worldwide, we try to analyze the deepest meaning of what is called “robot art” and the related art field definition. We also try to highlight its well-marked borders, such as kinetic sculptures, kinetic art, cyber art, and cyberpunk. A brief excursion into the importance of the context, the message, and its semiotics is also provided, case by case, together with a few hints on the history of this discipline in the light of an artistic perspective. Therefore, the aim of this article is to try to summarize the main characteristics that might classify robot art as a unique and innovative discipline, and to track down some of the principles by which a robotic artifact can or cannot be considered an art piece in terms of social, cultural, and strictly artistic interest. This work was presented in part at the 13th International Symposium on Artificial Life and Robotics, Oita, Japan, January 31–February 2, 2008     

Explanation and prediction: an architecture for default and abductive reasoning

Although there are many arguments that logic is an appropriate tool for artificial intelligence, there has been a perceived problem with the monotonicity of classical logic. This paper elaborates on the idea that reasoning should be viewed as theory formation where logic tells us the consequences of our assumptions. The two activities of predicting what is expected to be true and explaining observations are considered in a simple theory formation framework. Properties of each activity are discussed, along with a number of proposals as to what should be predicted or accepted as reasonable explanations. An architecture is proposed to combine explanation and prediction into one coherent framework. Algorithms used to implement the system as well as examples from a running implementation are given.     

Three Process Perspectives: Organizations, Teams, and People

This paper provides the author's personal views and perspectives on software process improvement. Starting with his first work on technology assessment in IBM over 20 years ago, Watts Humphrey describes the process improvement work he has been directly involved in. This includes the development of the early process assessment methods, the original design of the CMM, and the introduction of the Personal Software Process (PSP)^SM and Team Software Process (TSP){^SM}. In addition to describing the original motivation for this work, the author also reviews many of the problems he and his associates encountered and why they solved them the way they did. He also comments on the outstanding issues and likely directions for future work. Finally, this work has built on the experiences and contributions of many people. Mr. Humphrey only describes work that he was personally involved in and he names many of the key contributors. However, so many people have been involved in this work that a full list of the important participants would be impractical.     

基于复小波噪声方差显著修正的SAR图像去噪

提出了一种基于复小波域统计建模与噪声方差估计显著性修正相结合的合成孔径雷达(Synthetic Aperture Radar,SAR)图像斑点噪声滤波方法。该方法首先通过对数变换将乘性噪声模型转化为加性噪声模型,然后对变换后的图像进行双树复小波变换(Dualtree Complex Wavelet Transform,DCWT),并对复数小波系数的统计分布进行建模。在此先验分布的基础上,通过运用贝叶斯估计方法从含噪系数中恢复原始系数,达到滤除噪声的目的。实验结果表明该方法在去除噪声的同时保留了图像的细节信息,取得了很好的降噪效果。     

How do children do mathematics with LOGO?

Abstract  This paper considers some results of a study designed to investigate the kinds of mathematical activity undertaken by children (aged between 8 and 11) as they learned to program in LOGO. A model of learning modes is proposed, which attempts to describe the ways in which children used and acquired understanding of the programming/mathematical concepts involved. The remainder of the paper is concerned with discussing the validity and limitations of the model, and its implications for further research and curriculum development.