Study of An Integrated Security Solution for Network Information System

The Internet-based network information system brings a series of security problems, such as the ability of fault tolerance, the ability of disaster tolerance, the ability of secret communication, secret data storage, clients＇ authentication and so on. In this paper, we study the integrated security of network information system from hardware architecture, data encryption, authentication, firewall and application.     

A topology control algorithm based on D-region fault tolerance

In a wireless network, node failure due to either natural disasters or human intervention can cause network partitioning and other communication problems. For this reason, a wireless network should be fault tolerant. At present, most researchers use k-connectivity to measure fault tolerance, which requires the network to be connected after the failure of any up to k-1 nodes. However, wireless network node failures are usually spatially related, and particularly in military applications, nodes from the same limited area can fail together. As a metric of fault-tolerance, k-connectivity fails to capture the spatial relativity of faults and hardly satisfies the fault tolerance requirements of a wireless network design. In this paper, a new metric of fault-tolerance, termed D-region fault tolerance, is introduced to measure wireless network fault tolerance. A D-region fault tolerant network means that even after all the nodes have failed in a circular region with diameter D, it still remains connected. Based on D-region fault tolerance, we propose two fault-tolerant topology control algorithms--the global region fault tolerance algorithm (GRFT) and the localized region fault tolerance algorithm (LRFT). It is theoretically proven that both algorithms are able to generate a network with D-region fault tolerance. Simulation results indicate that with the same fault tolerance capabilities, networks based on both GRFT and LRFT algorithms have a lower transmission radius and lower logical degree.     

An immune-theory-based model for monitoring inter-domain routing system

The inter-domain routing system faces many serious security threats because the border gateway protocol(BGP) lacks effective security mechanisms.However,there is no solution that satisfies the requirements of a real environment.To address this problem,we propose a new model based on immune theory to monitor the inter-domain routing system.We introduce the dynamic evolution models for the "self" and detection cells,and construct washout and update mechanisms for the memory detection cells.Furthermore,borrowing an idea from immune network theory,we present a new coordinative method to identify anomalous nodes in the inter-domain routing system.In this way,the more nodes working with their own information that join the coordinative network,the greater is the ability of the system to identify anomalous nodes through evaluation between nodes.Because it is not necessary to modify the BGP,the ITMM is easy to deploy and inexpensive to implement.The experimental results confirm the method’s ability to detect abnormal routes and identify anomalous nodes in the inter-domain routing system.     

Survivability Evaluation in Large-Scale Mobile Ad-Hoc Networks

Survivability refers to the ability of a network system to fulfill critical services in a timely manner to end users in the presence of failures and/or attacks.In order to establish a highly survivable system,it is necessary to measure its survivability to evaluate the performance of the system's services under adverse conditions.According to survivability requirements of large-scale mobile ad-hoc networks(MANETs),we propose a novel model for quantitative evaluation on survivability.The proposed model co...     

移动Agent系统构建研究

Mobile agent technology has strong adaptability to the status of network and executing environment, and provides a flexible and uniform framework for Web and distributed applications.Mobile agent system, as the foundation of agent computing, should provide the basic supports like executing support, agent migration, andcommunication, as well the extensive supports like naming service, security, fault tolerance, interoperation,application development and management tools. Based on the analysis of current mobile agent system, this article discusses these supports deeply, and also points out the main challenges to the development of mobile agent system.     

Network security equipment evaluation based on attack tree with risk fusion

Network security equipment is crucial to information systems,and a proper evaluation model can ensure the quality of network security equipment.However,there is only a few models of comprehensive models nowadays.An index system for network security equipment was established and a model based on attack tree with risk fusion was proposed to obtain the score of qualitative indices.The proposed model implements attack tree model and controlled interval and memory (CIM) model to solve the problem of quantifying qualitative indices,and thus improves the accuracy of the evaluation.     

An intelligent online fault diagnostic scheme for nonlinear systems

An online fault diagnostic scheme for nonlinear systems based on neurofuzzy networks is proposed in this paper. The scheme involves two stages. In the first stage, the nonlinear system is approximated by a neurofuzzy network, which is trained offline from data obtained during the normal operation of the system. In the second stage, residual is generated online from this network and is modelled by another neurofuzzy network trained online. Fuzzy rules are extracted from this network, and are compared with those in the fault database obtained under different faulty operations, from which faults are diagnosed. The performance of the proposed intelligent fault scheme is illustrated using a two-tank water level control system under different faulty conditions .     

Analytical Investigation on Computer Network Security System of Colleges and Universities

With the development of network technology,computer systems of colleges and universities gradually use network management and services,which provides comprehensive and convenient information access and management conditions.How ever,in the network environment,the security of the system faces security threats like virus,malicious software and human at tack,which may make the network data of the computer system damaged and tampered,or even lead to network system paraly sis,breakdown of system concerning management and payment,missing and stealing of confidential documents.Therefore,it is of important application significance to promote the security of computer network systems of colleges and universities.This paper conducts comprehensive analysis on the security system of computer network systems of colleges and universities,elaborates its R&D and application status and puts forward specific schemes of prevention and solutions,which provides suggestions and refer ence for its construction.     

WNN-Based Network Security Situation Quantitative Prediction Method and Its Optimization

The accurate and real-time prediction of network security situation is the premise and basis of preventing intrusions and attacks in a large-scale network. In order to predict the security situation more accurately, a quantitative prediction method of network security situation based on Wavelet Neural Network with Genetic Algorithm （GAWNN） is proposed. After analyzing the past and the current network security situation in detail, we build a network security situation prediction model based on wavelet neural network that is optimized by the improved genetic algorithm and then adopt GAWNN to predict the non-linear time series of network security situation. Simulation experiments prove that the proposed method has advantages over Wavelet Neural Network （WNN） method and Back Propagation Neural Network （BPNN） method with the same architecture in convergence speed, functional approximation and prediction accuracy. What is more, system security tendency and laws by which security analyzers and administrators can adjust security policies in near real-time are revealed from the prediction results as early as possible.     

Sensor fault diagnosis for a class of time delay uncertain nonlinear systems using neural network

In this paper, a sliding mode observer scheme of sensor fault diagnosis is proposed for a class of time delay nonlinear systems with input uncertainty based on neural network. The sensor fault and the system input uncertainty are assumed to be unknown but bounded. The radial basis function (RBF) neural network is used to approximate the sensor fault. Based on the output of the RBF neural network, the sliding mode observer is presented. Using the Lyapunov method, a criterion for stability is given in terms of matrix inequality. Finally, an example is given for illustrating the availability of the fault diagnosis based on the proposed sliding mode observer.     

基于容忍入侵的网络安全防护系统设计与分析

文章阐述了新一代网络防护可生存性的重要性,并对容忍入侵概念及功能做了介绍。文中引入容忍入侵的设计思想,采用冗余结构,实现系统即使被入侵或故障发生也能提供正常有效服务的容忍入侵的系统安全防护体系。     

双星定位信息处理系统中的容错设计

信息处理系统是双星定位系统中最为关键的部分,而如何保证信息处理的高可用,是双星定位系统中的难点。本文提出了保证信息处理系统高可用度的全面方案,包括信息处理系统体系结构容错技术、高可用的时钟同步技术和数据库容错技术。从工程实践的运行情况来看,该容错设计方案完全满足系统技术指标要求。     

自律入侵容忍系统的可生存性评估

现有网络系统的评估方法不能很好地满足自律入侵容忍系统可生存性的评估要求。为此,提出一种针对自律入侵容忍系统的可生存性评估方法。根据入侵对系统造成的影响及自律入侵容忍的功能,构建数据机密度、数据完整度、服务可用度和系统自律度4项可生存性评估指标。给出各项指标的量化方法,通过对4项指标的定量计算,动态评估自律入侵容忍系统的可生存性。     

系统可生存性研究综述

系统可生存性是信息安全的新研究方向,是对传统安全观念的突破和创新。本文首先给出了开展系统可生存性研究的必要性以及系统可生存性若干定义;基于此,结合可生存性的评测和增强技术研究,从计算系统可生存性、网络可生存性、服务可生存性以及软件可生存性4个角度,综述了可生存性的研究现状,并进行了国内外对比分析;随后探讨了可生存系统的设计与实现问题,最后描述了系统可生存性的发展趋势。     

一种基于入侵容忍的可生存系统设计方案

与传统的防火墙和入侵检测技术不同,入侵容忍考虑的是在入侵不可避免的情况下系统的生存能力,因此更符合可生存系统的设计要求.提出一种基于入侵容忍技术的系统设计方案,利用容错技术保证系统关键服务的连续性.采用主动秘密共享技术取得了系统中关键数据的机密性和可用性的折衷,使得系统在攻击和故障已发生的情况下,具有较强的可生存性.     

防火墙集群系统的研究与实现

传统防火墙是在单点将内网接入外网，它会因单点失效而成为网络的瓶颈，降低网络的可用性。防火墙集群能够提高防火墙的高可用性。文章阐述了防火墙集群的必要性和方式，提出了负载均衡算法的设计思路和方法，以及防火墙集群系统的容错方法。     

数据库管理系统的入侵容忍技术研究进展

传统数据库安全的研究重点是如何防止非授权用户对数据库的恶意干扰和破坏，事实上根本无法阻止所有的攻击。因此．在信息战语义下，更为紧迫的是如何找到有效的措施来缓解或消除恶意用户的攻击．而入侵容忍(即抗恶意用户攻击和攻击后DBMS的恢复能力)是数据库安全最为重要的。本文概述了信息战中数据库入侵容忍技术研究的现状，指出了目前存在的问题和未来的研究方向。     

AUV内部通讯总线设计

设计了基于CAN协议的AUV内部通讯总线系统．系统通过协议转换器的模块化、可配置性设计满足AUV系统对其内部通讯总线的开放性要求．协议转换器内部的容错处理能力以及紧急事件处理节点的设计为增强AUV系统的可靠性和容错能力、为避免AUV在深海工作环境下丢失增加有力的保障措施．     

水厂自动化监控系统设计及容错技术应用研究

自动化监控系统已成为许多工业企业中非常重要的部分,而容错技术是保证系统可靠性的有效方法。本文以自行研制开发的某水厂自动化监控系统为例,首先介绍了系统的设计和实现方法。该系统采用三层网络结构来完成对水厂各设备的监控,通过PLC实现设备数据的采集,Profibus-DP和以太网实现数据的传送。分析了监控系统中常用容错技术的原理,并详细介绍了系统中容错技术的实现方法。该系统在某水厂得到了成功的应用,取得了满意的效果。     

并行计算机高可用性分析与设计

随着并行计算机系统规模的不断增大,系统的失效率呈线性增长。如何保证大规模并行系统能够提供持续不断的服务,即提高系统的可用性,达到高可用的目标,已成为并行系统设计的重要方面。系统级容错的概念目前已经提出,但系统可用性的度量仍然需要深入研究。本文运用组合模型和马尔科夫过程模型,对系统可靠性和可用性进行了建模模和分析,推导了基于马尔科夫过程的可用性度量公式,得出运用高可用技术可以提高系统的可用性。在此基础上,还给出了一个大规模并行计算机系统的高可用系统结构。