木马恶意软件的电子数据勘查与取证分析初探

木马等恶意软件已经成为网络违法犯罪分子经常利用的作案工具。勘查木马恶意软件可以掌握木马行为、传播机理和信息窃取途径,进而为涉网案件侦办工作提供有价值的情报线索。文章简要分析了木马的功能特点、工作机理和关键技术,针对木马恶意软件的技术特点,紧密结合公安机关网络安全保卫部门的工作实际,研究探讨了木马勘查取证的基本流程、常用工具与方法,并用实例讲述了木马勘查分析技术在涉网案件侦办中的应用。     

MS-DOC文件文本提取研究

关键词搜索广泛应用于情报分析、搜索引擎和计算机取证,对MS DOC文件进行关键词搜索可能漏判,明明存在的关键词却找不到。微软复合文档结构由一系列流组成,流以扇区为单位存储,通过目录结构和扇区分配表对流及其存储空间进行管理。MS DOC文件中的文本存储在WordDocument流中,文本存储不一定连续,通过Table流记录分块情况。关键词可能跨越不相邻扇区,即使在相邻扇区,一个关键词可能一部分是压缩存储,另一部分是非压缩存储,这些都是关键词搜索漏判的原因。根据Table流中的分块信息提取WordDocument流中的文本,并统一编码格式,进而进行关键词搜索,就可以避免漏判。     

雷电侵害核电站DCS的原因及改进措施

以IEC61312规范为指导,对岭澳#3/4机组烟囱流量信号DCS侧保险在雷暴天气期间被烧毁,同时机组出现异常报警信息的事件进行分析,明确雷电侵害DCS的途径及影响,并提出改进措施.     

Structural drivers controlling sulfur solubility in alkali aluminoborosilicate glasses

If the direct feed approach to vitrify the Hanford's tank waste is implemented, the low activity waste (LAW) will comprise higher concentrations of alkali/alkaline-earth sulfates than expected under the previously proposed vitrification scheme. To ensure a minimal impact of higher sulfate concentrations on the downstream operations and overall cost of vitrification, advanced glass formulations with enhanced sulfate loadings (solubility) are needed. While, the current sulfate solubility predictive models have been successful in designing LAW glasses with sulfate loadings <2 wt.%, it will be difficult for them to design glass compositions with enhanced loadings due to our limited understanding of the fundamental science governing these processes. In this pursuit, this article unearths the underlying compositional and structural drivers controlling the sulfate solubility in model LAW glasses. It has been shown that the preferentially removes non-framework cations from the modifier sites in the silicate network, thus, leading to the polymerization in the glass network via the formation of ring-structured borosilicate units. Furthermore, though the sulfate solubility slightly decreases with increasing Li⁺/Na⁺ in the glasses, the prefers to be charge compensated by Na⁺, as it is easier for to break Na–O bonds instead of Li–O bonds.     

磷改性ZSM-5分子筛物化性质和裂解制乙烯性能的研究

The physicochemical features of phosphorus-modified ZSM-5 zeolites (SiO2/Al2O3 molar ratio is 25) were characterized by XRD(X-ray diffraction), BET(Brunauer, Emmett and Teller spcific surface area measurement), NH3-TPD(ammonia temperature-programmed desorption) and MASNMR(magic angle spinning nuclear magnetic resonance), and the performance on catalytic pyrolysis to produce ethylene was investigated with a light hydrocarbon fixed bed micro-reactor with n-octane as feed. The results show that the acid site density, acid intensity and hydrothermal stability of ZSM-5 zeolite were improved by phosphorus modification. When P205 content in ZSM-5 zeolite is higher than 2.5%, phosphorus modification can prevent ZSM-5 zeolite crystal structure transformation from orthorhombic to monoclinic. In addition, the dealumination of ZSM-5 zeolite framework was moderated by phosphorus modification under high temperature hydrothermal treatment. The results of n-octane pyrolysis on phosphorus-modified ZSM-5 zeolites show that ethylene yields of zeolites with different phosphorus content are almost the same under the same n-octane conversion. However, the modified zeolites with higher pyrolysis activity give lower yield of propene, butene and total olefin than lower pyrolysis activity under the same n-octane conversion.     

Structural characterization of 1,2-polybutadiene by 13C-n.m.r. spectroscopy: 2. Sequence distribution of 1,2-unit in hydrogenated polybutadienes

The configurational sequences of 1,2-unit in a series of hydrogenated syndiotactic 1,2-polybutadienes were determined in relation to the sequence distribution of 1,2- and 1,4-units on the basis of the ¹³C-n.m.r. signal assignment of the methyl carbons. The observed triad distributions of 1,2- and 1,4-units and configurational distributions of the 1,2-unit are in good agreement with the calculated distributions from transition probabilities. The number average sequence lengths of the 1,2-unit and the 1,2-unit in the racemic addition are 5.7 to 8.0 and 4.1 to 5.4, respectively. From the extrapolation of the plot of the number average sequence length against the crystallinity of the starting 1,2-polybutadienes, the minimum sequence length for crystallization is estimated to be 3.7 for the 1,2-unit in the racemic addition.     

两种分层方式对温排水三维数值模拟的影响研究

三维数学模型近年来越来越多地被用于研究滨海电厂温排水环境影响问题。海域自由面随潮波动、地形复杂多变,垂向网格的划分方式在一定程度上会影响流场、温度场计算结果。本文以某滨海核电厂为例,采用MIKE 3软件开发斜压三维水动力水温模型,在总分层数即算力保持一致的情况下探究纯sigma分层和垂向混合分层两种分层方式对计算结果的影响。结果表明：两种垂向分层模式对海域潮位的计算精度影响不大,但对有垂向流速梯度的流场刻画会产生一定影响,在近岸海域采用sigma分层模式有利于捕捉垂向流速的变化特征;同时,纯sigma分层方案下,4 ℃最大温升包络面积约为混合分层的4倍,表明不同垂向分层模式可能会对高温升包络面积计算结果产生较为显著的影响。     

引入动态内存分析的微信撤回消息恢复方法

作为广受用户青睐的即时通信系统,微信在给人们生活带来极大便利的同时,也给不法分子提供了违法犯罪的新手段、新工具。微信聊天记录作为我国法律中明确列出的电子证据类型,其有效性引起广泛关注,使得微信聊天记录的恢复成为相关领域的研究热点。针对现有的聊天记录恢复研究多集中于删除消息的恢复,撤回消息的恢复尚未取得有效进展,通过研究PC版微信运行过程中的动态内存管理机制,分析撤回消息在动态内存中的特征字符及字段结构,对比文本、表情、图片等不同类型的消息在内存中的存储原理,提出一种基于动态内存分析的微信撤回消息恢复方法。利用Python语言编写的工具实现了对微信撤回消息原文、撤回状态、撤回方微信ID等内容的批量恢复,验证了该方法的有效性。     

基于改进U-Net的宫颈细胞核图像分割

原始的U-Net采用跳跃结构结合高低层的图像信息,使得U-Net模型有良好的分割效果,但是分割结果在宫颈细胞核边缘依然存在分割欠佳、过分割和欠分割等不足.由此提出了改进型U-Net网络图像分割方法.首先将稠密连接的DenseNet引入U-Net的编码器部分,以解决编码器部分相对简单,不能提取相对抽象的高层语义特征.然后对二元交叉熵损失函数中的宫颈细胞核和背景给予不同的权重,使网络更加注重细胞核特征的学习.最后在池化操作过程中,对池化域内的像素值分配合理的权值,解决池化层丢失信息的问题.实验证明,改进型U-Net网络使宫颈细胞核分割效果更好,模型也越鲁棒,过分割和欠分割比率也越少.显然,改进型U-Net是更有效的图像分割方法.     

基于压实度保证率的砾石土压实度快速检测法优化

砾石土心墙料压实度指标是砾石土心墙大坝工程质量控制的一个关键指标,常借助核子密度仪进行快速检测。鉴于砾石土的非均质特性,常规方法利用最大干密度均值求取的压实度为近似值,当实际最大干密度大于最大干密度均值时,压实度计算值偏大,易引起误判,影响工程质量。提出了压实度保证率概念,通过压实度及压实度保证率双控指标,对常规方法进行优化,明确了优化方法的评定流程及判定准则。并结合两河口水电站工程实例,论证了常规方法仅为优化方法的一种特殊表现形式。通过两河口水电站工程2019年3月份实测数据对比分析发现：采用常规方法检测的压实度均一次检验合格,而采用优化方法检测时,存在个别不合格点,需进一步复测。优化方法较常规方法更为严格,提高了工程安全裕度,保障了工程质量。