Dramatically increasing amounts of digital data are placing huge requirements on storage systems.IP-networked storage systems, such as the network file system （NFS）-based network-attached storage （NAS） systems and...Dramatically increasing amounts of digital data are placing huge requirements on storage systems.IP-networked storage systems, such as the network file system （NFS）-based network-attached storage （NAS） systems and the iSCSl-storage area network （SAN） systems, have become increasingly common in today＇s local area network （LAN） environments. The emergence of new storage techniques, such as object-based storage （OBS） and content aware storage （CAS）, significantly improves the functionality of storage devices to meet further needs for storage sub-systems. However, these may impact system performance. This papercompares the performance of NFS, iSCSI storage, object-based storage devices （OSDs）, and CAS-based storage systems in an environment with no data sharing across host machines. A gigabit ethernet network is used as the storage network. Test results demonstrate that the performances of these systems are compa- rable with CAS being much better than the others for write operations. The performance bottlenecks in these systems are analyzed to provide insight into how future storage systems may be improved and possible optimization methods. The analysis shows how the I/O interfaces in these systems affect the application performance and that network-based storage systems require optimized I/O latency and reduced network and buffer processing in the servers.展开更多
针对传统的IP欺骗攻击缓解方法存在运算开销大、缺乏灵活性等问题,提出了一种基于动态限制策略的软件定义网络(software defined network,SDN)中IP欺骗攻击缓解方法。首先,利用Packet-In消息中三元组信息回溯攻击路径,定位IP欺骗攻击源...针对传统的IP欺骗攻击缓解方法存在运算开销大、缺乏灵活性等问题,提出了一种基于动态限制策略的软件定义网络(software defined network,SDN)中IP欺骗攻击缓解方法。首先,利用Packet-In消息中三元组信息回溯攻击路径,定位IP欺骗攻击源头主机;然后,由控制器制定动态限制策略对连接攻击源头主机的交换机端口的新流转发功能进行限制,待限制期满再恢复其转发新流的功能,限制期的大小随着被检测为攻击源的次数而增长。研究结果表明:这种动态的限制策略可阻隔攻击流进入SDN网络,从而有效避免SDN交换机、控制器以及链路过载;由于在限制期间无需再对这些限制的交换机端口进行实时监测,该方法在应对长时攻击时较传统方法具有更高的缓解效率和更少的资源消耗。展开更多
基金Supported by the National Natural Science Foundation of China(No. 60273006)the Basic Research Foundation of Tsinghua National Laboratory for Information Science and Technology(TNList)
文摘Dramatically increasing amounts of digital data are placing huge requirements on storage systems.IP-networked storage systems, such as the network file system （NFS）-based network-attached storage （NAS） systems and the iSCSl-storage area network （SAN） systems, have become increasingly common in today＇s local area network （LAN） environments. The emergence of new storage techniques, such as object-based storage （OBS） and content aware storage （CAS）, significantly improves the functionality of storage devices to meet further needs for storage sub-systems. However, these may impact system performance. This papercompares the performance of NFS, iSCSI storage, object-based storage devices （OSDs）, and CAS-based storage systems in an environment with no data sharing across host machines. A gigabit ethernet network is used as the storage network. Test results demonstrate that the performances of these systems are compa- rable with CAS being much better than the others for write operations. The performance bottlenecks in these systems are analyzed to provide insight into how future storage systems may be improved and possible optimization methods. The analysis shows how the I/O interfaces in these systems affect the application performance and that network-based storage systems require optimized I/O latency and reduced network and buffer processing in the servers.
文摘针对传统的IP欺骗攻击缓解方法存在运算开销大、缺乏灵活性等问题,提出了一种基于动态限制策略的软件定义网络(software defined network,SDN)中IP欺骗攻击缓解方法。首先,利用Packet-In消息中三元组信息回溯攻击路径,定位IP欺骗攻击源头主机;然后,由控制器制定动态限制策略对连接攻击源头主机的交换机端口的新流转发功能进行限制,待限制期满再恢复其转发新流的功能,限制期的大小随着被检测为攻击源的次数而增长。研究结果表明:这种动态的限制策略可阻隔攻击流进入SDN网络,从而有效避免SDN交换机、控制器以及链路过载;由于在限制期间无需再对这些限制的交换机端口进行实时监测,该方法在应对长时攻击时较传统方法具有更高的缓解效率和更少的资源消耗。
文摘针对现有网络用户位置定位存在的召回率低、响应时间长等问题,提出一种基于大数据相似度模型的定位识别方法.采集并标准化处理基站信号、用户轨迹等多源用户的网络数据,提取多维度特征——时空特征、行为特征与网络特征,基于注意力机制赋予不同维度特征不同的权重系数,构建大数据相似度模型.基于Frechet相似度度量方法、EMD相似度度量方法与余弦相似度度量方法计算时空特征、行为特征与网络特征的相似度,联合注意力权重系数,通过加权求和方式获得综合相似度,并实现对用户网络位置的精确定位识别.实验结果显示:该方法的用户网络位置定位识别最优精度达到99%,用户网络位置定位识别响应时间最小值为0.08 s.
