僵尸网络(Botnet)是一种从传统恶意代码形态进化而来的新型攻击方式,为攻击者提供了隐匿、灵活且高效的一对多命令与控制信道(Command and Control channel,C&C)机制,可以控制大量僵尸主机实现信息窃取、分布式拒绝服务攻击和垃圾...僵尸网络(Botnet)是一种从传统恶意代码形态进化而来的新型攻击方式,为攻击者提供了隐匿、灵活且高效的一对多命令与控制信道(Command and Control channel,C&C)机制,可以控制大量僵尸主机实现信息窃取、分布式拒绝服务攻击和垃圾邮件发送等攻击目的。该文提出一种与僵尸网络结构和C&C协议无关,不需要分析数据包的特征负载的僵尸网络检测方法。该方法首先使用预过滤规则对捕获的流量进行过滤,去掉与僵尸网络无关的流量;其次对过滤后的流量属性进行统计;接着使用基于X-means聚类的两步聚类算法对C&C信道的流量属性进行分析与聚类,从而达到对僵尸网络检测的目的。实验证明,该方法高效准确地把僵尸网络流量与其他正常网络流量区分,达到从实际网络中检测僵尸网络的要求,并且具有较低的误判率。展开更多
To solve the problem of distributed tasks-platforms scheduling in holonic command and control(C2) organization,the basic elements of the organization are analyzed firstly and the formal description of organizational e...To solve the problem of distributed tasks-platforms scheduling in holonic command and control(C2) organization,the basic elements of the organization are analyzed firstly and the formal description of organizational elements and structure is provided. Based on the improvement of task execution quality,a single task resource scheduling model is established and the solving method based on the m-best algorithm is proposed. For the problem of tactical decision-holon cannot handle tasks with low priority effectively, a distributed resource scheduling collaboration mechanism based on platform pricing and a platform exchange mechanism based on resource capacities are designed. Finally,a series of experiments are designed to prove the effectiveness of these methods. The results show that the proposed distributed scheduling methods can realize the effective balance of platform resources.展开更多
The subversive nature of information war lies not only in the information itself, but also in the circulation and application of information. It has always been a challenge to quantitatively analyze the function and e...The subversive nature of information war lies not only in the information itself, but also in the circulation and application of information. It has always been a challenge to quantitatively analyze the function and effect of information flow through command, control, communications, computer, kill, intelligence,surveillance, reconnaissance (C4KISR) system. In this work, we propose a framework of force of information influence and the methods for calculating the force of information influence between C4KISR nodes of sensing, intelligence processing,decision making and fire attack. Specifically, the basic concept of force of information influence between nodes in C4KISR system is formally proposed and its mathematical definition is provided. Then, based on the information entropy theory, the model of force of information influence between C4KISR system nodes is constructed. Finally, the simulation experiments have been performed under an air defense and attack scenario. The experimental results show that, with the proposed force of information influence framework, we can effectively evaluate the contribution of information circulation through different C4KISR system nodes to the corresponding tasks. Our framework of force of information influence can also serve as an effective tool for the design and dynamic reconfiguration of C4KISR system architecture.展开更多
为了统一描述军事电子信息系统(command control communication computers intelligence surveil-lance and reconnaissance,C4ISR)系统功能和效能两方面的需求,提出了一种基于统一建模语言/对象约束语言(unified modeling language/obj...为了统一描述军事电子信息系统(command control communication computers intelligence surveil-lance and reconnaissance,C4ISR)系统功能和效能两方面的需求,提出了一种基于统一建模语言/对象约束语言(unified modeling language/object constraint language,UML/OCL)的C4ISR效能概念建模和形式化验证方法。首先,利用效能相关概念扩展了DoDAF 2.0能力元模型,构建一个能够同时引导C4ISR能力的功能分析和效能分析的元模型;将该元模型描述为UML Profile,形成一种基于UML的C4ISR效能概念建模语言,并支持C4ISR效能概念模型检验;最后借助一个假想案例分析说明了该建模语言对C4ISR能力的功能和效能概念建模及模型验证的能力。该方法可弥补UML建模技术在特定领域效能分析方面的不足。展开更多
文摘僵尸网络(Botnet)是一种从传统恶意代码形态进化而来的新型攻击方式,为攻击者提供了隐匿、灵活且高效的一对多命令与控制信道(Command and Control channel,C&C)机制,可以控制大量僵尸主机实现信息窃取、分布式拒绝服务攻击和垃圾邮件发送等攻击目的。该文提出一种与僵尸网络结构和C&C协议无关,不需要分析数据包的特征负载的僵尸网络检测方法。该方法首先使用预过滤规则对捕获的流量进行过滤,去掉与僵尸网络无关的流量;其次对过滤后的流量属性进行统计;接着使用基于X-means聚类的两步聚类算法对C&C信道的流量属性进行分析与聚类,从而达到对僵尸网络检测的目的。实验证明,该方法高效准确地把僵尸网络流量与其他正常网络流量区分,达到从实际网络中检测僵尸网络的要求,并且具有较低的误判率。
基金supported by the National Natural Science Foundation of China(6157301761703425)+2 种基金the Aeronautical Science Fund(20175796014)Shaanxi Province Natural Science Foundation(2016JQ60622017JM6062)
文摘To solve the problem of distributed tasks-platforms scheduling in holonic command and control(C2) organization,the basic elements of the organization are analyzed firstly and the formal description of organizational elements and structure is provided. Based on the improvement of task execution quality,a single task resource scheduling model is established and the solving method based on the m-best algorithm is proposed. For the problem of tactical decision-holon cannot handle tasks with low priority effectively, a distributed resource scheduling collaboration mechanism based on platform pricing and a platform exchange mechanism based on resource capacities are designed. Finally,a series of experiments are designed to prove the effectiveness of these methods. The results show that the proposed distributed scheduling methods can realize the effective balance of platform resources.
基金supported by the Natural Science Foundation Research Plan of Shanxi Province (2023JCQN0728)。
文摘The subversive nature of information war lies not only in the information itself, but also in the circulation and application of information. It has always been a challenge to quantitatively analyze the function and effect of information flow through command, control, communications, computer, kill, intelligence,surveillance, reconnaissance (C4KISR) system. In this work, we propose a framework of force of information influence and the methods for calculating the force of information influence between C4KISR nodes of sensing, intelligence processing,decision making and fire attack. Specifically, the basic concept of force of information influence between nodes in C4KISR system is formally proposed and its mathematical definition is provided. Then, based on the information entropy theory, the model of force of information influence between C4KISR system nodes is constructed. Finally, the simulation experiments have been performed under an air defense and attack scenario. The experimental results show that, with the proposed force of information influence framework, we can effectively evaluate the contribution of information circulation through different C4KISR system nodes to the corresponding tasks. Our framework of force of information influence can also serve as an effective tool for the design and dynamic reconfiguration of C4KISR system architecture.
文摘为了统一描述军事电子信息系统(command control communication computers intelligence surveil-lance and reconnaissance,C4ISR)系统功能和效能两方面的需求,提出了一种基于统一建模语言/对象约束语言(unified modeling language/object constraint language,UML/OCL)的C4ISR效能概念建模和形式化验证方法。首先,利用效能相关概念扩展了DoDAF 2.0能力元模型,构建一个能够同时引导C4ISR能力的功能分析和效能分析的元模型;将该元模型描述为UML Profile,形成一种基于UML的C4ISR效能概念建模语言,并支持C4ISR效能概念模型检验;最后借助一个假想案例分析说明了该建模语言对C4ISR能力的功能和效能概念建模及模型验证的能力。该方法可弥补UML建模技术在特定领域效能分析方面的不足。
