僵尸网络(Botnet)是一种从传统恶意代码形态进化而来的新型攻击方式,为攻击者提供了隐匿、灵活且高效的一对多命令与控制信道(Command and Control channel,C&C)机制,可以控制大量僵尸主机实现信息窃取、分布式拒绝服务攻击和垃圾...僵尸网络(Botnet)是一种从传统恶意代码形态进化而来的新型攻击方式,为攻击者提供了隐匿、灵活且高效的一对多命令与控制信道(Command and Control channel,C&C)机制,可以控制大量僵尸主机实现信息窃取、分布式拒绝服务攻击和垃圾邮件发送等攻击目的。该文提出一种与僵尸网络结构和C&C协议无关,不需要分析数据包的特征负载的僵尸网络检测方法。该方法首先使用预过滤规则对捕获的流量进行过滤,去掉与僵尸网络无关的流量;其次对过滤后的流量属性进行统计;接着使用基于X-means聚类的两步聚类算法对C&C信道的流量属性进行分析与聚类,从而达到对僵尸网络检测的目的。实验证明,该方法高效准确地把僵尸网络流量与其他正常网络流量区分,达到从实际网络中检测僵尸网络的要求,并且具有较低的误判率。展开更多
The subversive nature of information war lies not only in the information itself, but also in the circulation and application of information. It has always been a challenge to quantitatively analyze the function and e...The subversive nature of information war lies not only in the information itself, but also in the circulation and application of information. It has always been a challenge to quantitatively analyze the function and effect of information flow through command, control, communications, computer, kill, intelligence,surveillance, reconnaissance (C4KISR) system. In this work, we propose a framework of force of information influence and the methods for calculating the force of information influence between C4KISR nodes of sensing, intelligence processing,decision making and fire attack. Specifically, the basic concept of force of information influence between nodes in C4KISR system is formally proposed and its mathematical definition is provided. Then, based on the information entropy theory, the model of force of information influence between C4KISR system nodes is constructed. Finally, the simulation experiments have been performed under an air defense and attack scenario. The experimental results show that, with the proposed force of information influence framework, we can effectively evaluate the contribution of information circulation through different C4KISR system nodes to the corresponding tasks. Our framework of force of information influence can also serve as an effective tool for the design and dynamic reconfiguration of C4KISR system architecture.展开更多
To solve the problem of distributed tasks-platforms scheduling in holonic command and control(C2) organization,the basic elements of the organization are analyzed firstly and the formal description of organizational e...To solve the problem of distributed tasks-platforms scheduling in holonic command and control(C2) organization,the basic elements of the organization are analyzed firstly and the formal description of organizational elements and structure is provided. Based on the improvement of task execution quality,a single task resource scheduling model is established and the solving method based on the m-best algorithm is proposed. For the problem of tactical decision-holon cannot handle tasks with low priority effectively, a distributed resource scheduling collaboration mechanism based on platform pricing and a platform exchange mechanism based on resource capacities are designed. Finally,a series of experiments are designed to prove the effectiveness of these methods. The results show that the proposed distributed scheduling methods can realize the effective balance of platform resources.展开更多
To analyze the behavioral model of the command,control,communication,computer,intelligence,surveillance,reconnaissance(C4ISR)architecture,we propose an executable modeling and analyzing approach to it.First,the meta c...To analyze the behavioral model of the command,control,communication,computer,intelligence,surveillance,reconnaissance(C4ISR)architecture,we propose an executable modeling and analyzing approach to it.First,the meta concept model of the C4ISR architecture is introduced.According to the meta concept model,we construct the executable meta models of the C4ISR architecture by extending the meta models of fUML.Then,we define the concrete syntax and executable activity algebra(EAA)semantics for executable models.The semantics functions are introduced to translating the syntax description of executable models into the item of EAA.To support the execution of models,we propose the executable rules which are the structural operational semantics of EAA.Finally,an area air defense of the C4ISR system is used to illustrate the feasibility of the approach.展开更多
文摘僵尸网络(Botnet)是一种从传统恶意代码形态进化而来的新型攻击方式,为攻击者提供了隐匿、灵活且高效的一对多命令与控制信道(Command and Control channel,C&C)机制,可以控制大量僵尸主机实现信息窃取、分布式拒绝服务攻击和垃圾邮件发送等攻击目的。该文提出一种与僵尸网络结构和C&C协议无关,不需要分析数据包的特征负载的僵尸网络检测方法。该方法首先使用预过滤规则对捕获的流量进行过滤,去掉与僵尸网络无关的流量;其次对过滤后的流量属性进行统计;接着使用基于X-means聚类的两步聚类算法对C&C信道的流量属性进行分析与聚类,从而达到对僵尸网络检测的目的。实验证明,该方法高效准确地把僵尸网络流量与其他正常网络流量区分,达到从实际网络中检测僵尸网络的要求,并且具有较低的误判率。
基金supported by the Natural Science Foundation Research Plan of Shanxi Province (2023JCQN0728)。
文摘The subversive nature of information war lies not only in the information itself, but also in the circulation and application of information. It has always been a challenge to quantitatively analyze the function and effect of information flow through command, control, communications, computer, kill, intelligence,surveillance, reconnaissance (C4KISR) system. In this work, we propose a framework of force of information influence and the methods for calculating the force of information influence between C4KISR nodes of sensing, intelligence processing,decision making and fire attack. Specifically, the basic concept of force of information influence between nodes in C4KISR system is formally proposed and its mathematical definition is provided. Then, based on the information entropy theory, the model of force of information influence between C4KISR system nodes is constructed. Finally, the simulation experiments have been performed under an air defense and attack scenario. The experimental results show that, with the proposed force of information influence framework, we can effectively evaluate the contribution of information circulation through different C4KISR system nodes to the corresponding tasks. Our framework of force of information influence can also serve as an effective tool for the design and dynamic reconfiguration of C4KISR system architecture.
基金supported by the National Natural Science Foundation of China(6157301761703425)+2 种基金the Aeronautical Science Fund(20175796014)Shaanxi Province Natural Science Foundation(2016JQ60622017JM6062)
文摘To solve the problem of distributed tasks-platforms scheduling in holonic command and control(C2) organization,the basic elements of the organization are analyzed firstly and the formal description of organizational elements and structure is provided. Based on the improvement of task execution quality,a single task resource scheduling model is established and the solving method based on the m-best algorithm is proposed. For the problem of tactical decision-holon cannot handle tasks with low priority effectively, a distributed resource scheduling collaboration mechanism based on platform pricing and a platform exchange mechanism based on resource capacities are designed. Finally,a series of experiments are designed to prove the effectiveness of these methods. The results show that the proposed distributed scheduling methods can realize the effective balance of platform resources.
文摘To analyze the behavioral model of the command,control,communication,computer,intelligence,surveillance,reconnaissance(C4ISR)architecture,we propose an executable modeling and analyzing approach to it.First,the meta concept model of the C4ISR architecture is introduced.According to the meta concept model,we construct the executable meta models of the C4ISR architecture by extending the meta models of fUML.Then,we define the concrete syntax and executable activity algebra(EAA)semantics for executable models.The semantics functions are introduced to translating the syntax description of executable models into the item of EAA.To support the execution of models,we propose the executable rules which are the structural operational semantics of EAA.Finally,an area air defense of the C4ISR system is used to illustrate the feasibility of the approach.
