This paper proposes a virtual router cluster system based on the separation of the control plane and the data plane from multiple perspectives,such as architecture,key technologies,scenarios and standardization.To som...This paper proposes a virtual router cluster system based on the separation of the control plane and the data plane from multiple perspectives,such as architecture,key technologies,scenarios and standardization.To some extent,the virtual cluster simplifies network topology and management,achieves automatic conFig.uration and saves the IP address.It is a kind of low-cost expansion method of aggregation equipment port density.展开更多
Dynamic bandwidth allocation(DBA)is a fundamental challenge in the realm of networking.The rapid,accurate,and fair allocation of bandwidth is crucial for network service providers to fulfill service-level agreements,a...Dynamic bandwidth allocation(DBA)is a fundamental challenge in the realm of networking.The rapid,accurate,and fair allocation of bandwidth is crucial for network service providers to fulfill service-level agreements,alleviate link congestion,and devise strategies to counter network attacks.However,existing bandwidth allocation algorithms operate mainly on the control plane of the software-defined networking paradigm,which can lead to considerable probing overhead and convergence latency.Moreover,contemporary network architectures necessitate a hierarchical bandwidth allocation system that addresses latency requirements.We introduce a finegrained,hierarchical,and scalable DBA algorithm,i.e.,the HSDBA algorithm,implemented on the programmable data plane.This algorithm reduces network overhead and latency between the data plane and the controller,and it is proficient in dynamically adding and removing network configurations.We investigate the practicality of HSDBA using protocol-oblivious forwarding switches.Experimental results show that HSDBA achieves fair bandwidth allocation and isolation guarantee within approximately 25 packets.It boasts a convergence speed 0.5times higher than that of the most recent algorithm,namely,approximate hierarchical allocation of bandwidth(AHAB);meanwhile,it maintains a bandwidth enforcement accuracy of 98.1%.展开更多
The sea-surface height （SSH） signatures of internal tides extracted from the TOPEX/Poseidon （T/P） altimeter data along satellite tracks are fitted with superposition of several plane waves which have different wav...The sea-surface height （SSH） signatures of internal tides extracted from the TOPEX/Poseidon （T/P） altimeter data along satellite tracks are fitted with superposition of several plane waves which have different wavenumber vectors. The key problem of plane wave fitting with iterative method is how to determine the initial value of wavenumber of each plane wave. The previous solving method is to analyze the internal tidal SSH signatures along each track with wavenumber spectrum. But it is found that the problem cannot be solved completely with the wavenumber spectrum analysis method only. The method based on the combination of wavenumber spectrum analysis method and the exhaustive method is proposed to determine the initial values of wavenumbers for iteration. Numerical results indicate that the proposed method is not only reasonable and feasible but also better than the previous method. The proposed method is an improvement of the previous one, which is beneficial to improving the precision of plane wave fitting of the T/P internal tidal SSH signatures and deepening the understanding of the internal tides in ocean.展开更多
针对实际点云数据中存在的噪点与缺陷对拟合平面时带来的影响,提出一种基于最小平方中值算法(least median of squares,LMedS)与距离加权总体最小二乘法(weighted total least squares based on distance,WTLSD)相结合的平面拟合算法。...针对实际点云数据中存在的噪点与缺陷对拟合平面时带来的影响,提出一种基于最小平方中值算法(least median of squares,LMedS)与距离加权总体最小二乘法(weighted total least squares based on distance,WTLSD)相结合的平面拟合算法。通过最小平方中值算法初步去除点云中的噪点,并基于距离构建初始权重矩阵,利用距离加权总体最小二乘法对点云进行平面拟合,减少平面中凸起与凹陷等缺陷对平面拟合的影响,该算法与传统平面拟合算法相比具备消除异常点与平面缺陷的优点,具备更高的拟合精度;与随机采样一致性算法(random sample consensus,RANSAC)相比具有更高的拟合效率与相近的拟合精度。展开更多
Software-Defined Perimeter(SDP)provides a logical perimeter to restrict access to services.However,due to the security vulnerability of a single controller and the programmability lack of a gateway,existing SDP is fac...Software-Defined Perimeter(SDP)provides a logical perimeter to restrict access to services.However,due to the security vulnerability of a single controller and the programmability lack of a gateway,existing SDP is facing challenges.To solve the above problems,we propose a flexible and secure SDP mechanism named Mimic SDP(MSDP).MSDP consists of endogenous secure controllers and a dynamic gateway.The controllers avoid single point failure by heterogeneity and redundancy.And the dynamic gateway realizes flexible forwarding in programmable data plane by changing the processing of packet construction and deconstruction,thereby confusing the potential adversary.Besides,we propose a Markov model to evaluate the security of our SDP framework.We implement a prototype of MSDP and evaluate it in terms of functionality,performance,and scalability in different groups of systems and languages.Evaluation results demonstrate that MSDP can provide a secure connection of 93.38%with a cost of 6.34%under reasonable configuration.展开更多
End-host address mutation is one of the key network moving target defense mechanisms to defend against reconnaissance.However,frequently changing host addresses increases the transmission de-lay of active sessions,whi...End-host address mutation is one of the key network moving target defense mechanisms to defend against reconnaissance.However,frequently changing host addresses increases the transmission de-lay of active sessions,which may cause serious ram-ifications.In this paper,by leveraging the advanced DPDK technology,we proposed a high-performance MTD gateway framework,called HPMG,which can not only prevent adversaries from reconnaissance ef-fectively,but also retain high-speed data packet pro-cessing capabilities.Firstly,every moving target host is assigned three different IP addresses,called real IP,virtual IP,and external IP,to realize multi-level net-work address architecture.To delay the scanning tech-niques of adversaries,HPMG mutates virtual IP and virtual MAC addresses,and replies with fake host re-sponses.Besides,to be transparent to the end-hosts,HPMG keeps real IP and real MAC unchanged.Fi-nally,we optimized the forwarding and processing performance of the HPMG based on the fast path framework of DPDK.Our theoretical analysis,imple-mentation,and evaluation show that HPMG can effec-tively defend against reconnaissance attacks and de-crease the processing delay caused by address muta-tion.展开更多
可编程数据平面(Programmable Data Plane,PDP)允许用户自定义网络设备的数据包处理方式,支持定制化网络操作,利用PDP的特性实施网络防御,在实时性、灵活性、扩展性等方面取得了良好效果,近年来受到学术界和工业界的广泛关注。本文以基...可编程数据平面(Programmable Data Plane,PDP)允许用户自定义网络设备的数据包处理方式,支持定制化网络操作,利用PDP的特性实施网络防御,在实时性、灵活性、扩展性等方面取得了良好效果,近年来受到学术界和工业界的广泛关注。本文以基于PDP的网络防御技术为主要研究内容,首先介绍了PDP的基本概念,并结合典型案例阐述其应用于网络防御的优势;随后根据实施网络防御的阶段,将基于PDP的网络防御技术分为防护技术、检测技术、响应技术3大类,对各类方案的现有研究进行深入分析、概括总结,归纳不同方法的优缺点;最后,本文对基于PDP的网络防御技术未来的研究方向进行展望。展开更多
结构面分布对岩体的工程与力学性质具有重要影响,准确获取结构面信息对于分析岩体特性及其稳定性具有重要意义。通过三维激光扫描技术获取某高陡岩质边坡三维点云数据,通过对点云数据进行滤波前处理,采用开源程序Discontinuity Set Extr...结构面分布对岩体的工程与力学性质具有重要影响,准确获取结构面信息对于分析岩体特性及其稳定性具有重要意义。通过三维激光扫描技术获取某高陡岩质边坡三维点云数据,通过对点云数据进行滤波前处理,采用开源程序Discontinuity Set Extractor(DSE)对点云数据进行半自动化识别与分类,获取边坡岩体结构面的产状、迹长、间距等关键参数信息及点云聚类信息。通过对点云聚类信息进行拟合分析得到其概率分布模型并建立岩体的离散裂隙网络(DFN)模型,进一步基于点云数据采用“Rhino-Griddle-3DEC”联合建模方法建立了高陡岩质边坡的三维块体离散元模型,通过离散元模拟分析了该边坡的稳定性与潜在失稳区域。结果表明:在重力作用下,边坡整体安全系数约为1.5,坡顶突出危岩体竖向位移较大且安全系数较小,为潜在失稳区域。因此,采用该方法识别获取的结构面参数信息能够较好地反映岩体工程力学性质,对高陡岩质边坡稳定性分析与评价具有重要指导意义。展开更多
基金supported by the Collaboration Research on Key Techniques of Future Network between China,Japan and Korea(2010DFB13470)~~
文摘This paper proposes a virtual router cluster system based on the separation of the control plane and the data plane from multiple perspectives,such as architecture,key technologies,scenarios and standardization.To some extent,the virtual cluster simplifies network topology and management,achieves automatic conFig.uration and saves the IP address.It is a kind of low-cost expansion method of aggregation equipment port density.
基金Project supported by the Strategic Priority Research Program of Chinese Academy of Sciences(No.XDA031050100。
文摘Dynamic bandwidth allocation(DBA)is a fundamental challenge in the realm of networking.The rapid,accurate,and fair allocation of bandwidth is crucial for network service providers to fulfill service-level agreements,alleviate link congestion,and devise strategies to counter network attacks.However,existing bandwidth allocation algorithms operate mainly on the control plane of the software-defined networking paradigm,which can lead to considerable probing overhead and convergence latency.Moreover,contemporary network architectures necessitate a hierarchical bandwidth allocation system that addresses latency requirements.We introduce a finegrained,hierarchical,and scalable DBA algorithm,i.e.,the HSDBA algorithm,implemented on the programmable data plane.This algorithm reduces network overhead and latency between the data plane and the controller,and it is proficient in dynamically adding and removing network configurations.We investigate the practicality of HSDBA using protocol-oblivious forwarding switches.Experimental results show that HSDBA achieves fair bandwidth allocation and isolation guarantee within approximately 25 packets.It boasts a convergence speed 0.5times higher than that of the most recent algorithm,namely,approximate hierarchical allocation of bandwidth(AHAB);meanwhile,it maintains a bandwidth enforcement accuracy of 98.1%.
基金The National Natural Science Foundation of China under contract No. 41076006the State Ministry of Science and Technology of China under contract No. 2008AA09A402the Ministry of Education’s "111" Project of China under contract No. B07036
文摘The sea-surface height （SSH） signatures of internal tides extracted from the TOPEX/Poseidon （T/P） altimeter data along satellite tracks are fitted with superposition of several plane waves which have different wavenumber vectors. The key problem of plane wave fitting with iterative method is how to determine the initial value of wavenumber of each plane wave. The previous solving method is to analyze the internal tidal SSH signatures along each track with wavenumber spectrum. But it is found that the problem cannot be solved completely with the wavenumber spectrum analysis method only. The method based on the combination of wavenumber spectrum analysis method and the exhaustive method is proposed to determine the initial values of wavenumbers for iteration. Numerical results indicate that the proposed method is not only reasonable and feasible but also better than the previous method. The proposed method is an improvement of the previous one, which is beneficial to improving the precision of plane wave fitting of the T/P internal tidal SSH signatures and deepening the understanding of the internal tides in ocean.
文摘针对实际点云数据中存在的噪点与缺陷对拟合平面时带来的影响,提出一种基于最小平方中值算法(least median of squares,LMedS)与距离加权总体最小二乘法(weighted total least squares based on distance,WTLSD)相结合的平面拟合算法。通过最小平方中值算法初步去除点云中的噪点,并基于距离构建初始权重矩阵,利用距离加权总体最小二乘法对点云进行平面拟合,减少平面中凸起与凹陷等缺陷对平面拟合的影响,该算法与传统平面拟合算法相比具备消除异常点与平面缺陷的优点,具备更高的拟合精度;与随机采样一致性算法(random sample consensus,RANSAC)相比具有更高的拟合效率与相近的拟合精度。
基金supported by the National Key Research and Development Program of China(Grant No.2022YFB2901304)。
文摘Software-Defined Perimeter(SDP)provides a logical perimeter to restrict access to services.However,due to the security vulnerability of a single controller and the programmability lack of a gateway,existing SDP is facing challenges.To solve the above problems,we propose a flexible and secure SDP mechanism named Mimic SDP(MSDP).MSDP consists of endogenous secure controllers and a dynamic gateway.The controllers avoid single point failure by heterogeneity and redundancy.And the dynamic gateway realizes flexible forwarding in programmable data plane by changing the processing of packet construction and deconstruction,thereby confusing the potential adversary.Besides,we propose a Markov model to evaluate the security of our SDP framework.We implement a prototype of MSDP and evaluate it in terms of functionality,performance,and scalability in different groups of systems and languages.Evaluation results demonstrate that MSDP can provide a secure connection of 93.38%with a cost of 6.34%under reasonable configuration.
基金supported by National Natural Science Foundation of China(No.61821001)Science and Tech-nology Key Project of Guangdong Province,China(2019B010157001).
文摘End-host address mutation is one of the key network moving target defense mechanisms to defend against reconnaissance.However,frequently changing host addresses increases the transmission de-lay of active sessions,which may cause serious ram-ifications.In this paper,by leveraging the advanced DPDK technology,we proposed a high-performance MTD gateway framework,called HPMG,which can not only prevent adversaries from reconnaissance ef-fectively,but also retain high-speed data packet pro-cessing capabilities.Firstly,every moving target host is assigned three different IP addresses,called real IP,virtual IP,and external IP,to realize multi-level net-work address architecture.To delay the scanning tech-niques of adversaries,HPMG mutates virtual IP and virtual MAC addresses,and replies with fake host re-sponses.Besides,to be transparent to the end-hosts,HPMG keeps real IP and real MAC unchanged.Fi-nally,we optimized the forwarding and processing performance of the HPMG based on the fast path framework of DPDK.Our theoretical analysis,imple-mentation,and evaluation show that HPMG can effec-tively defend against reconnaissance attacks and de-crease the processing delay caused by address muta-tion.
文摘可编程数据平面(Programmable Data Plane,PDP)允许用户自定义网络设备的数据包处理方式,支持定制化网络操作,利用PDP的特性实施网络防御,在实时性、灵活性、扩展性等方面取得了良好效果,近年来受到学术界和工业界的广泛关注。本文以基于PDP的网络防御技术为主要研究内容,首先介绍了PDP的基本概念,并结合典型案例阐述其应用于网络防御的优势;随后根据实施网络防御的阶段,将基于PDP的网络防御技术分为防护技术、检测技术、响应技术3大类,对各类方案的现有研究进行深入分析、概括总结,归纳不同方法的优缺点;最后,本文对基于PDP的网络防御技术未来的研究方向进行展望。
文摘结构面分布对岩体的工程与力学性质具有重要影响,准确获取结构面信息对于分析岩体特性及其稳定性具有重要意义。通过三维激光扫描技术获取某高陡岩质边坡三维点云数据,通过对点云数据进行滤波前处理,采用开源程序Discontinuity Set Extractor(DSE)对点云数据进行半自动化识别与分类,获取边坡岩体结构面的产状、迹长、间距等关键参数信息及点云聚类信息。通过对点云聚类信息进行拟合分析得到其概率分布模型并建立岩体的离散裂隙网络(DFN)模型,进一步基于点云数据采用“Rhino-Griddle-3DEC”联合建模方法建立了高陡岩质边坡的三维块体离散元模型,通过离散元模拟分析了该边坡的稳定性与潜在失稳区域。结果表明:在重力作用下,边坡整体安全系数约为1.5,坡顶突出危岩体竖向位移较大且安全系数较小,为潜在失稳区域。因此,采用该方法识别获取的结构面参数信息能够较好地反映岩体工程力学性质,对高陡岩质边坡稳定性分析与评价具有重要指导意义。
