基于阴性选择的网络蠕虫抑制模型

基于免疫系统的阴性选择机制,提出一种网络蠕虫抑制模型。通过主机的程序行为异常,检测蠕虫攻击并及时响应,允许主机进行大部分的正常网络通信,防止蠕虫通过主机继续传播。主机发出基于阴性选择过滤的网络服务请求,依据蠕虫的传播特征,网络主机之间相互协同,推断蠕虫所攻击的服务并进行限制。实验结果表明,该模型能有效检测并抑制传统蠕虫及拓扑蠕虫等传播隐秘的新型蠕虫。     

基于本地网的分布式蠕虫检测系统设计

为能有效检测本地网中的已知蠕虫和未知蠕虫,设计了一个分布式蠕虫检测系统.探讨了系统的部署策略和结构,并详细描述了系统检测算法的设计过程.检测算法分为可疑主机检测和感染主机检测两个阶段,前者通过监控主机的网络连接异常发现可疑主机,后者采用误用检测和关联分析判断可疑主机是否为感染主机.仿真实验结果表明了该系统的有效性.     

基于本地网保护的蠕虫防御系统研究

为了阻止外网蠕虫向本地网的传播,设计了一个基于本地网保护的蠕虫防御系统.该系统通过监测外部主机连接本地网的连接强度、端口相似度和失败比率等统计信息预警蠕虫扫描行为和可疑外部主机,通过检测和丢弃来自可疑主机的蠕虫攻击包防御蠕虫向本地网传播.为了提高系统效率和减少系统对正常网络活动的影响,蠕虫攻击包检测采用了源地址跟踪和蠕虫特征匹配两级检测.最后建立了该蠕虫防御系统保护下的本地网蠕虫传播模型,并通过仿真实验验证了系统的有效性.     

基于动态检测隔离机制的网络蠕虫传播模型与分析

提出一种基于动态检测隔离机制的通用网络蠕虫传播模型,该模型定义了蠕虫在隔离阶段的可疑状态,显式地刻画了蠕虫动态检测隔离过程;并利用动态蠕虫感染率和动态主机移除率、主机自动免疫率分别描述了蠕虫传播造成的网络拥塞现象和人类在对抗蠕虫病毒过程中的主观能动性.分析表明,基于动态检测隔离机制系统可有效降低蠕虫传播速度,减少被感染主机数,延迟蠕虫传播峰值出现的时间.     

基于有向图分析的蠕虫早期检测方法

网络蠕虫给互联网带来了巨大的损失,实践证明,越早发现蠕虫的传播行为,就越有利于对蠕虫的遏制。首先分析了网络蠕虫早期传播的特征,然后借鉴GrIDS入侵检测系统的图分析思想,提出了一种利用有向图对网络蠕虫早期传播行为进行检测的蠕虫早期检测方法,并设计了有向图分析算法,对网络蠕虫与P2P应用、网络扫描以及突发访问等类网络蠕虫行为进行了准确识别。实验证明,可以准确检测网络蠕虫的早期传播行为,并定位蠕虫源主机。     

基于网络行为模糊模式识别的蠕虫检测方法

网络蠕虫攻击由于危害大、攻击范围广、传播速度快而成为因特网危害最大的攻击方式之一.如何有效地检测网络蠕虫攻击是当前网络安全研究领域的一个重要方向.通过对网络蠕虫攻击行为的分析和研究,提出了一种根据蠕虫爆发时产生的典型网络行为来检测未知蠕虫的方法.该算法通过分别学习正常主机和受感染主机的网络行为建立相应的标准分类模糊子集,然后利用模糊模式识别法判定待测主机是否感染蠕虫.最后进行实验验证,结果表明,该方法对未知扫描类蠕虫有较好的检测效果.     

基于扫描流量统计的本地网蠕虫检测方法

为了准确检测外网蠕虫对本地网的传播,在研究蠕虫扫描行为模式的基础上,提出一种基于扫描流量统计的本地网蠕虫检测方法,并给出蠕虫检测方法实现的总体思路、关键算法和检侧过程.该检侧方法分为异常流量检测和扫描包特征匹配检测两个步骤,即首先使用马尔科夫和坎泰利不等式在网络边界检测进入本地网的扫描流量,提取异常流量中的可疑扫描包的特征;然后监控本地网,检测与可疑扫描包特征相匹配的本地网扫描活动,进而判定本地网是否感染外网蠕虫.分析与初步实验证明,该方法能够检测准确检测外网蠕虫对本地网的传播.     

蠕虫检测技术研究进展

对蠕虫检测技术的进展进行了研究.由于能检测未知蠕虫,异常检测已成为蠕虫检测的重要发展方向.被动检测采用故意设计为有缺陷的系统HoneyPot,用来吸引攻击者、收集攻击信息并进行深度分析.主动检测对正常主机和蠕虫主机的混和流量进行处理,包括基于连接载荷和基于蠕虫行为的检测.分析并讨论了各类方法的特点和适用性,提出目前的检测技术需要更为有效的蠕虫检测指标,并基于正常主机和蠕虫主机在流量自相似性的差异,给出了相应的实时检测指标选择思路.     

基于主机行为特征的恶意软件检测方法

针对僵尸、远控木马等恶意软件检测问题, 提出一种基于主机行为的异常检测模型。该模型通过持续性分析算法, 判断主机与外部特定目标的通信行为是否具有周期性或连续性, 提取出可疑的网络行为, 并根据网络行为的触发、启动等异常检测规则对这些可疑的网络行为进行分析, 判断主机是否感染恶意软件。实验结果表明, 该模型可有效检测出感染恶意软件的主机, 并具有很低误报率。     

基于组行为特征的恶意域名检测

目前,僵尸网络广泛采用域名变换技术,以避免域名黑名单的封堵,为此提出一种基于组行为特征的恶意域名检测方法。该方法对每个检测周期内网络中主机请求的新域名集合、失效域名集合进行聚类分析,并将请求同一组新域名的主机集合作为检测对象,通过分析集合内主机在请求失效域名、新域名行为上是否具有组特性,提取出网络中的感染主机集合、C&C服务器使用的IP地址集合。对一ISP域名服务器监测的结果表明,该方法可准确提取出感染主机、C&C服务器IP地址。     

Only connect: teaching, technology and telesis

Abstract This paper describes an approach to the design of interactive multimedia materials being developed in a European Community project. The developmental process is seen as a dialogue between technologists and teachers. This dialogue is often problematic because of the differences in training, experience and culture between them. Conditions needed for fruitful dialogue are described and the generic model for learning design used in the project is explained.     

European Community policy and the market

Abstract This paper starts with some reflections on the policy considerations and priorities which are shaping European Commission (EC) research programmes. Then it attempts to position the current projects which seek to capitalise on information and communications technologies for learning in relation to these priorities and the apparent realities of the marketplace. It concludes that while there are grounds to be optimistic about the contribution EC programmes can make to the efficiency and standard of education and training, they are still too technology driven.     

一种自适应子融合集成多分类器方法

融合集成方法已经广泛应用在模式识别领域,然而一些基分类器实时性能稳定性较差,导致多分类器融合性能差,针对上述问题本文提出了一种新的基于多分类器的子融合集成分类器系统。该方法考虑在度量层融合层次之上通过对各类基多分类器进行动态选择,票数最多的类别作为融合系统中对特征向量识别的类别,构成一种新的自适应子融合集成分类器方法。实验表明,该方法比传统的分类器以及分类融合方法识别准确率明显更高,具有更好的鲁棒性。     

Avoiding semantic and temporal gaps in developing software intensive systems

Development of software intensive systems (systems) in practice involves a series of self-contained phases for the lifecycle of a system. Semantic and temporal gaps, which occur among phases and among developer disciplines within and across phases, hinder the ongoing development of a system because of the interdependencies among phases and among disciplines. Such gaps are magnified among systems that are developed at different times by different development teams, which may limit reuse of artifacts of systems development and interoperability among the systems. This article discusses such gaps and a systems development process for avoiding them.     

Designing economic np control charts: A programmed simulation approach

This paper presents control charts models and the necessary simulation software for the location of economic values of the control parameters. The simulation program is written in FORTRAN, requires only 10K of main storage, and can run on most mini and micro computers. Two models are presented - one describes the process when it is operating at full capacity and the other when the process is operating under capacity. The models allow the product quality to deteriorate to a further level before an existing out-of-control state is detected, and they can also be used in situations where no prior knowledge exists of the out-of-control causes and the resulting proportion defectives.     

The development of robot art

Going through a few examples of robot artists who are recognized worldwide, we try to analyze the deepest meaning of what is called “robot art” and the related art field definition. We also try to highlight its well-marked borders, such as kinetic sculptures, kinetic art, cyber art, and cyberpunk. A brief excursion into the importance of the context, the message, and its semiotics is also provided, case by case, together with a few hints on the history of this discipline in the light of an artistic perspective. Therefore, the aim of this article is to try to summarize the main characteristics that might classify robot art as a unique and innovative discipline, and to track down some of the principles by which a robotic artifact can or cannot be considered an art piece in terms of social, cultural, and strictly artistic interest. This work was presented in part at the 13th International Symposium on Artificial Life and Robotics, Oita, Japan, January 31–February 2, 2008     

Explanation and prediction: an architecture for default and abductive reasoning

Although there are many arguments that logic is an appropriate tool for artificial intelligence, there has been a perceived problem with the monotonicity of classical logic. This paper elaborates on the idea that reasoning should be viewed as theory formation where logic tells us the consequences of our assumptions. The two activities of predicting what is expected to be true and explaining observations are considered in a simple theory formation framework. Properties of each activity are discussed, along with a number of proposals as to what should be predicted or accepted as reasonable explanations. An architecture is proposed to combine explanation and prediction into one coherent framework. Algorithms used to implement the system as well as examples from a running implementation are given.     

Three Process Perspectives: Organizations, Teams, and People

This paper provides the author's personal views and perspectives on software process improvement. Starting with his first work on technology assessment in IBM over 20 years ago, Watts Humphrey describes the process improvement work he has been directly involved in. This includes the development of the early process assessment methods, the original design of the CMM, and the introduction of the Personal Software Process (PSP)^SM and Team Software Process (TSP){^SM}. In addition to describing the original motivation for this work, the author also reviews many of the problems he and his associates encountered and why they solved them the way they did. He also comments on the outstanding issues and likely directions for future work. Finally, this work has built on the experiences and contributions of many people. Mr. Humphrey only describes work that he was personally involved in and he names many of the key contributors. However, so many people have been involved in this work that a full list of the important participants would be impractical.     

基于复小波噪声方差显著修正的SAR图像去噪

提出了一种基于复小波域统计建模与噪声方差估计显著性修正相结合的合成孔径雷达(Synthetic Aperture Radar,SAR)图像斑点噪声滤波方法。该方法首先通过对数变换将乘性噪声模型转化为加性噪声模型,然后对变换后的图像进行双树复小波变换(Dualtree Complex Wavelet Transform,DCWT),并对复数小波系数的统计分布进行建模。在此先验分布的基础上,通过运用贝叶斯估计方法从含噪系数中恢复原始系数,达到滤除噪声的目的。实验结果表明该方法在去除噪声的同时保留了图像的细节信息,取得了很好的降噪效果。     

How do children do mathematics with LOGO?

Abstract  This paper considers some results of a study designed to investigate the kinds of mathematical activity undertaken by children (aged between 8 and 11) as they learned to program in LOGO. A model of learning modes is proposed, which attempts to describe the ways in which children used and acquired understanding of the programming/mathematical concepts involved. The remainder of the paper is concerned with discussing the validity and limitations of the model, and its implications for further research and curriculum development.