一种信息系统生存性的量化分析框架

生存性是信息系统在安全性之上必需考虑的问题,对其量化分析可对系统生存性做出更为准确的评价以改进系统。基于有限状态机描述信息系统,利用系统状态转移图来定义生存性分析过程,而系统状态的层次化结构避免了Markov链模型中的列举系统状态问题。在SNA方法的基础上,提出一种便于计算机实现的生存性量化分析框架:通过系统定义、系统生存性测试和生存性计算,最后给出分析报告。其中基于事件分类分级建立的事件库使得测试方案的生成自动化和客观化,系统的生存性通过层次化的方式从可抵抗性、可识别性和可恢复性3个方面进行了量化计算。     

网络抗毁性研究介绍

随着通信网络规模的不断扩大和应用范围的不断拓展,网络抗毁性的研究日益受到重视.阐述了网络抗毁性的定义,介绍了目前网络抗毁性问题的主要研究及内容,指出了网络抗毁性未来研究的主要方向.     

联合火力毁伤下炮兵机动过程生存能力建模

对炮兵机动过程的生存概率进行建模分析,模型建立在一定的作战想定和合理的假设条件下,通过对模型仿真计算结果的分析,近似得出伪装措施、机动时间、机动方式等主要因素对炮兵机动过程生存概率的影响。在未来联合作战环境下,充分利用该类因素,对提高炮兵战时机动过程的生存能力具有良好作用。     

Parallel systems under two sequential attacks

The paper compares the efficiency of single and double attack against a system consisting of identical parallel elements (1-out-of-N system). An attacker tries to maximize the system vulnerability (probability of total destruction). The attacker distributes its constrained resource optimally across two attacks and chooses the number of elements to be attacked in the first attack. The attacker observes which elements are destroyed and not destroyed in the first attack, and applies its remaining resource into attacking the remaining elements in the second attack. First the optimal attack strategy against a system with a fixed number of elements is analyzed. Thereafter a minmax two period game between the attacker and the defender is considered in which the defender distributes its constrained resource between deploying redundant elements and protecting them against the attack.     

华为基金资助项目基于约束马尔可夫决策过程的网络生存性研究*

给出了基于约束马尔可夫决策过程的网络生存性定义,提出了一个多层网络生存性研究框架和一种新的网络生存性设计方法。     

Modeling and optimization of survivable P2P multicasting

Various solutions based on Peer-to-Peer (P2P) multicasting have been gaining much popularity in recent years, since P2P multicasting can effectively support live streaming of various content. In this work we assume that the P2P multicasting is used to distribute content with high reliability requirements, e.g., weather warnings, security updates, financial data, security warnings, etc. The main idea to provide protection of the system against network failures is to establish several (at least two) disjoint multicasting trees. Our discussion in this paper centers on the problem how additional survivability constraints to provide failure-disjoint trees impact the operation of P2P multicasting systems. As the performance metrics we propose to use: streaming cost, maximum delay and throughput. The possible failure scenario we take into account is a single failure of one of the following network elements: streaming server, overlay link, uploading node and ISP link. We examine the topic of survivable P2P multicasting applying offline optimization methods and simulations. In the former case we formulate Mixed Integer Programming (MIP) models and use the CPLEX solver to obtain optimal results. For the streaming cost objective we compare two MIP formulations in terms of the complexity and execution time. Results show that our formulation provides much better performance compared to the classical P2P multicasting formulation proposed in the literature. Moreover, in the case of the streaming cost problem we propose a new evolutionary algorithm that yields results for larger networks than the CPLEX solver. The simulations are run to emulate a distributed network environment, in which each node makes its own decisions. Results obtained using both research methods confirm that the survivability of P2P multicasting can be achieved with relatively low additional system overhead for all three considered performance metrics: streaming cost, maximum delay and system throughput.     

基于漏洞扫描的生存性量化分析算法研究

针对信息系统生存性的概念和生存性评估的可抵抗性、可识别性、可恢复性、自适应性四个基本属性的定义,结合对成熟的网络安全技术--漏洞扫描技术的深入研究,提出了一种网络漏洞扫描和生存性分析攻击情景相结合的生存性分析方法,最终得出基于网络漏洞扫描技术的生存性量化分析是可行的结论.通过对漏洞库相关内容的总结,提出了基于漏洞扫描的生存性分析数据库应扩展的内容,最后,详细阐述了生存性量化分析中四个基本属性分量计算公式的算法研究过程,为信息系统的生存性分析系统的设计提供底层核心算法.     

Design of Reliable IP/GMPLS Networks: An Integrated Approach

The increased bandwidth demand for new Internet applications suggests mapping IP directly over the wavelength-division multiplexing (WDM) layer. Since reliability is such a critical issue in these broadband networks, we propose an integrated design method which addresses the problem of survivability as viewed from the IP/MPLS layers but taking into account the failure mechanisms in the optical layer. This approach is becoming practical because of the emergence of generalized multiprotocol label switching (GMPLS) as a multilayer control plane that can support the signaling required for coordinating the restoration mechanisms in multiple layers.The model relies on network calculus to evaluate a quality of service (QoS) metric as actually perceived by end users and computes a preplanned restoration scheme to recover from failures. We discuss the numerical implementation, the convergence and the solutions produced by the algorithm and show that the resulting network can provide the prescribed QoS guarantees for all failure states.     

基于随机Petri网的电信交换系统可生存性分析

网络系统的可生存性问题是系统安全领域的一个重点研究方向。讨论现有的系统可生存性的一般分析方法,确定系统的可生存属性,并采用随机Petri网(SPN)技术,分析电信交换系统生存性问题的特点。重点利用随机Petri网描述系统的失效-修复分析模型和性能分析模型,给出系统可生存性分析中主要指标的定量计算方法。系统仿真结果表明了该方法的有效、合理性。     

网络生存性研究概述

网络系统逐步成为现在社会系统的关键组成部分,许多方面的关键应用越来越依赖于网络系统的运转,如交通控制和国防信息系统等。然而这种网络依赖性带来的风险和网络系统所面临入侵、事故、失效等的威胁将不仅影响网络系统的本身,而且已扩大到其它的系统领域。主要给出了网络生存性定义及研究内容,并讨论了提高网络系统生存性的解决方法。