校园网策略DNS技术研究

公网用户防问校园网内网服务器需通过CERNET链路,而两者之间的互联带宽瓶颈制约了对服务器的高速访问。在分析多出口校园网路由策略和动态DNS技术的基础上,提出这一问题的解决方案。     

搭建基于Redhat的DNS服务，实现域名解析

DNS是网络中非常重要的Internet服务。它的主要作用是提供IP地址和域名地址的转换,提供两种查询服务：正向查询将名称解析成IP地址,反向查询则将IP地址解析成名称。域名只是便于记忆的地址信息,真正访问某服务器时,仍需将域名转换为IP地址。随着Internet互联网的普及,作为互联网上唯一可识别的地址——IP地址来说,其形式难于记忆,不利于访问,在实际应用中,人们往往通过DNS服务器把不便于记忆的IP地址转换为形如www.google.com这样的便于理解和记忆的助记符地址的形式,从而使网络互访变得轻松起来,这种助记符就被人们称为域名。     

互联网MPLS-VPN技术浅谈

近几年公网IP地址资源消耗严重,本文对现状做了大量的深入分析,针对网络结构、设备性能、路由协议等方面存在的问题进行了攻关,并使用MPLS-VPN技术来提升网络质量和用户体验。     

DNS技术与应用探析

由于友好的名称更容易记住,所以多数用户喜欢使用友好的名称来定位Internet上的网站服务器。但是,计算机使用数字形式的IP地址在网络上通信。DNS的域名服务提供了一种方法,可以使用户友好的计算机或服务名称映射为数字地址。     

校园网受到的威胁及防范措施

一旦校园网接入Internet公网,任何人都可以通过计算机访问校园网络,这就为网络的各种攻击、病毒传播、窃取资料及更改数据等题供可能,因此校园网的安全问题就显得尤为重要。就校园网的安全性进行分析,并提出一些防范措施。     

Linux平台下校园网DHCP服务器的设计与实现

为方便学生快速地接入和退出网络、简化客户机TCP/IP参数配置以及提高IP地址资源的利用率,采用一种自动机制来进行IP地址分配的方法。通过对DHCP工作原理的分析,设计并搭建DHCP服务器系统,实现IP地址的自动分配及合理利用,使DHCP服务在校园网中得到具体有效的应用。     

数据通信网络中VPN用户访问公网的方案探讨

在VPN开局过程中,私网中的用户如何访问公网是必需要考虑的问题,本文详细描述了VPN用户访问公网的几种形式以及相应应用限制,希望能给应用这类业务提供一些经验。     

刍议BGP/VPN快速收敛技术

作为多业务的承载网络,IP/MPLS VPN技术已经成为当前IP/MPLS网络中的基础技术特性。在一个MPLS VPN网络中,业务路由是通过BGP技术来承载的,当前网络中发生链路或者节点故障后,不但需要公网路由进行收敛,同时BGP私网路由也需要重新迭代或者收敛,本文主要描述了BGP/VPN快速收敛的一些技术和方法。     

校园网防范IP地址冲突的管理策略

IP地址冲突是困扰校园网的常见故障,为保证正常使用网络资源、保持校园网高效运行,根据工作经验分析IP地址冲突产生的原因,并从校园网IP地址规划、管理提出解决策略。     

基于策略路由的多出口访问技术的研究与实现

在校园网多出口的拓扑结构中,采用策略路由和动、静态地址转换等关键技术,对网络出口路由进行合理规划,提出一种基于源IP 和目的IP 相结合的校园网出口策略路由方案,利用H3C网络设备对所提出的方案进行实现。实践证明,该方案能够很好的解决内外网互相访问的速率和可靠性问题,提高了网络效率。     

Blockzone: A Decentralized and Trustworthy Data Plane for DNS

The domain name system (DNS) provides a mapping service between memorable names and numerical internet protocol addresses, and it is a critical infrastructure of the Internet. The authenticity of DNS resolution results is crucial for ensuring the accessibility of Internet services. Hundreds of supplementary specifications of protocols have been proposed to compensate for the security flaws of DNS. However, DNS security incidents still occur frequently. Although DNS is a distributed system, for a specified domain name, only authorized authoritative servers can resolve it. Other servers must obtain the resolution result through a recursive or iterative resolving procedure, which renders DNS vulnerable to various attacks, such as DNS cache poisoning and distributed denial of service (DDoS) attacks. This paper proposes a novel decentralized architecture for a DNS data plane, which is called Blockzone. First, Blockzone utilizes novel mechanisms, which include on-chain authorization and off-chain storage, to implement a decentralized and trustworthy DNS data plane. Second, in contrast to the hierarchical authentication and recursive query of traditional DNS, Blockzone implements a decentralized operation model. This model significantly increases the efficiency of domain name resolution and verification and enhances the security of DNS against DDoS and cache poisoning attacks. In addition, Blockzone is fully compatible with the traditional DNS implementation and can be incrementally deployed as a plug-in service of DNS without changing the DNS protocol or system architecture. The Blockzone scheme can also be generalized to address security issues in other areas, such as the Internet of things and edge computing.     

基于相对密度的DNS请求数据流源IP异常检测算法

研究了域名系统(DNS)的异常检测.通过对基于相对密度的离群点检测算法的研究,提出了一种基于相对密度的DNS请求数据流源IP异常检测算法.该算法计算每个源IP的相对密度,并将该密度的倒数作为其异常值评分;在计算相对密度时,从查询次数、源端口熵值、所请求非法域名占比等9个维度来表示一个源IP.试验结果表明,这种基于相对密度的源IP异常检测方法,能正确地根据各个源IP不同的异常程度,给出其相应的异常值评分.     

基于形象IP构建的网络表情符号视觉形态设计

目的探究表情类形象IP的跨媒介叙事能力,分析决定形象IP核心价值的关键设计要素,总结视觉形态设计的原则与方法,丰富网络表情符号IP产业化发展的设计理论基础。方法对具有较高知名度的网络表情类形象IP进行筛选、整理与分析,归纳高价值形象IP的核心内容、艺术特征、视觉形式及其传播方式。在此基础上,面向目标用户进行调研,对用户审美接受度及情感关联要素进行分析,归纳出基于用户认知与情感互动的设计体验要素,并且通过项目设计实践以验证思路和方法的有效性与可靠性。结论具备IP开发价值的网络表情符号具有高度视觉审美性与鲜明形象特征,能集流量和情感认知于一体,具有势能转化与跨平台转移的特点,外在的视觉形态以及内在的情感构建是实现表情类形象IP多渠道价值的核心与关键。     

多出口网络链路负载均衡系统的研究

针对当前广泛使用的多链路技术,研究了多链路网络的运行机制,对多链路的流量特性、负载分配策略进行了分析.将企业网日常的Internet流量分为Outbound流量和Inbound流量,并结合FreeBSD下的PF包过滤和动态DNS解析技术,分别给出了Inbound和Outbound流量的负载均衡策略和模型.基于该模型研制的系统,能成功地依照事先定义的负载均衡策略实现Inbound和Outbound流量的负载均衡,多个Internet链路的合理分配利用而使得总访问带宽扩大,能够很好地消除几大ISP间互访的瓶颈,还为内部网上SERVER提供更高的可靠性和性能.     

基于数据共享的燃气热泵空调网络监控系统

在不改变局域网燃气热泵(GHP)空调监控系统的基础上,采用数据共享和服务器端数据库重建技术,实现GHP空调的网络监控系统。系统管理人员可以通过该监控系统对GHP空调系统进行网络监控、智能化管理和远程服务,并可利用Web服务器对用户开放查看功能,若用户采用空调托管功能,可以避免能耗的浪费。     

基于多字节流水线的POS信号IP包提取算法

针对当今骨干网传输速率较高,现有的硬件设备很难对POS信号直接进行面向字节的IP包提取的问题,本文提出了一种便于FPGA(Field Programmable Gate Array)实现的基于多字节流水线的IP包提取算法,实现了对骨干网POS信号的线速处理.理论分析和实际测试都表明,该方法适应了骨干网数据的高速、大容量的特点,能够满足当前以及今后高速光纤通信中数据提取的需要.     

快速模具网络化制造服务平台的研究与开发

本文提出并建立了快速模具网络化制造服务平台。该平台以快速发展的计算机网络和信息技术为支撑工具，通过在远程用户、服务中心和协同制造企业建立一个协同生产制造的环境，实现制造资源的共享和技术资源的优势互补，缩短了模具的生产制造周期。众多的案例研究表明该系统对提高中小企业新产品的快速开发具有很大的潜能。     

Resource Allocation and Power Control Policy for Device-toDevice Communication Using Multi-Agent Reinforcement Learning

Device-to-Device (D2D) communication is a promising technology that can reduce the burden on cellular networks while increasing network capacity. In this paper, we focus on the channel resource allocation and power control to improve the system resource utilization and network throughput. Firstly, we treat each D2D pair as an independent agent. Each agent makes decisions based on the local channel states information observed by itself. The multi-agent Reinforcement Learning (RL) algorithm is proposed for our multi-user system. We assume that the D2D pair do not possess any information on the availability and quality of the resource block to be selected, so the problem is modeled as a stochastic non-cooperative game. Hence, each agent becomes a player and they make decisions together to achieve global optimization. Thereby, the multi-agent Q-learning algorithm based on game theory is established. Secondly, in order to accelerate the convergence rate of multi-agent Q-learning, we consider a power allocation strategy based on Fuzzy Cmeans (FCM) algorithm. The strategy firstly groups the D2D users by FCM, and treats each group as an agent, and then performs multi-agent Q-learning algorithm to determine the power for each group of D2D users. The simulation results show that the Q-learning algorithm based on multi-agent can improve the throughput of the system. In particular, FCM can greatly speed up the convergence of the multi-agent Q-learning algorithm while improving system throughput.     

VPN技术在IP组播视频会议系统中的应用

 针对IP组播视频会议系统在共网上部署应用时出现的安全性差、费用高、IP组播路由器资源有限等问题,提出在Internet上应用VPN技术来实现IP组播视频会议系统的解决方案,并介绍了系统的VPN网络结构和实施方法.同时,还对VPN技术的基本概念、关键技术及其特点和IP组播视频会议系统的总体设计作了简单阐述.最后在广域网上对该会议系统进行了测试.测试结果表明,实现了在广域网上运行IP组播会议系统,并有效地保证会议数据传输的安全性和可靠性.     

A DDoS Attack Information Fusion Method Based on CNN for Multi-Element Data

Traditional distributed denial of service (DDoS) detection methods need a lot of computing resource, and many of them which are based on single element have high missing rate and false alarm rate. In order to solve the problems, this paper proposes a DDoS attack information fusion method based on CNN for multi-element data. Firstly, according to the distribution, concentration and high traffic abruptness of DDoS attacks, this paper defines six features which are respectively obtained from the elements of source IP address, destination IP address, source port, destination port, packet size and the number of IP packets. Then, we propose feature weight calculation algorithm based on principal component analysis to measure the importance of different features in different network environment. The algorithm of weighted multi-element feature fusion proposed in this paper is used to fuse different features, and obtain multi-element fusion feature (MEFF) value. Finally, the DDoS attack information fusion classification model is established by using convolutional neural network and support vector machine respectively based on the MEFF time series. Experimental results show that the information fusion method proposed can effectively fuse multi-element data, reduce the missing rate and total error rate, memory resource consumption, running time, and improve the detection rate.