【作者】 张乐君；

【导师】 杨永田；

【作者基本信息】 哈尔滨工程大学 ， 计算机应用技术， 2008， 博士

【摘要】 随着国家信息化带动工业化发展战略的确定，计算机网络与信息系统建设取得了长足的发展，网络系统广泛地应用于工业、商业、政府和国防部门。网络系统内、外部环境日趋复杂使得任何网络系统都不可能是安全的，因此，信息系统的可生存性技术研究，是继系统安全性之后的又一个重要方向。本文所作的主要工作是研究网络信息系统的可生存性评估和增强技术，达到能够分析和定位信息系统可生存性弱点，并在给出量化分析的结果的基础上，提出改进可生存性状况的增强方法。主要包括以下几个方面：首先，利用随机Petri网模型对信息系统可生存性分析进行了建模研究。第一步，将信息系统抽象为请求组件、通信组件、处理组件、和存储组件四个部分，第二步，将信息系统工作流程形式化描述和可生存性分析建模相结合，分别描述了通用信息系统、系统组件失效修复、串联并接、冗余以及具有可生存属性组件的建模方法。第三步，通过模拟的方法实现对信息系统形式化描述的同时对其生存能力做了定性和定量分析。其次，提出了一种信息系统可生存性的层次化评估模型。该模型根据系统中关键服务及其原子服务组件信息，进行漏洞探测，生成网络攻击图和攻击方案，并对系统进行基于真实环境下的可生存性测试，记录攻击中和攻击后的服务质量变化。通过服务质量变化分析系统可生存性的四个关键属性，最终实现对整个网络系统的可生存性量化分析。再次，在系统冗余和多样性的前提条件下，提出了原子组件自组织来增强系统可生存性方法；根据中心极限定理以及系统运行历史数据，获取原子组件可生存性变化曲线，并结合系统服务效率以及服务质量等因素，设计了基于自组织的可生存性增强算法。第四，在介绍了多种连接迁移技术的基础上，设计一个基于连接迁移技术的服务自组织系统。该系统根据服务处理流程将系统组件分解为通信组件、服务分发组件、服务提供组件；备份组件将其可生存性信息实时发送给工作组件，并获取最新服务状态列表，当某一组件可生存性最高时，根据组件的功能及其在体系结构中的位置，通过多种连接迁移技术进行服务自组织，该系统具有对用户透明，配置简单灵活的优点。实验证明，该方法可以有效提高服务质量，并达到增强服务可生存性目的。网络信息系统可生存性技术研究还处于起步阶段，本文针对信息系统设计阶段，提出使用随机Petri网进行建模的方法，该技术研究成果可有效指导系统可生存性设计；其次对于基于网络的信息系统提出了基于层次化的评估模型，可以帮助系统管理员快速定位影响系统生存性的关节点；在生存性增强方面，首先，提出基于服务自组织的可生存性增强算法，设计并实现了一个基于连接迁移的服务可生存性增强系统，该系统基于TCP协议实现，具有良好的通用性，具有重要的应用价值。更多还原

【Abstract】 With the implement of the strategies that national information technologystimulates the development of industrialization,computer networks andinformation systems have made considerable progress;network system is widelyused in industry,commerce,government and defense security.The internal andexternal environment of network system is becoming increasingly complex,whichmakes none of the network systems absolutely safe.As a new direction in networksecurity,survivability is different from traditional network security,it provides uswith a new way to conduct the research of the network security.The present dissertation probes into the evaluation of survivability and thetechnology of enhancing network information system thus the weak points of theinformation system could be analyzed and located,meanwhile the method ofenhancing survivability of the system could be proposed based on the result of thequantitative analysis.The dissertation involved the following aspects:Firstly,the modeling method of information system survivability analysisbased on Stochastic Petri Net(SPN) is presented.In this model,networkinformation system is divided into request modules,communication modules,processing modules and storing modules.And then,combining formal descriptionof system working flow with survivability analysis modeling,the dissertationrespectively describes the SPN modeling method of universal information systemmodel,service disabled,recovery,modules redundancy and survivability attributemodel.Accordingly,makes quality and quantity analysis of system survivability.Secondly,a hierarchical evaluation model of network system survivability isproposed.According to this model,the first step is gathering the information ofkey services and atomic service compositions and then detecting the leakinformation.The second step is building the network attack graph and theattacking scheme.The third is replaying attacking data.Finally,the survivability is quantified according the records of the QoS before and after attacking.Thirdly,based on redundancy and diversity the method of enhancing systemsurvivability is proposed by self-organization.According to the historical data ofaverage response time,survivability curves are drawn.The self-organizationalgorithm is designed based on the survivability of atomic modules,systemefficiency and the quality of service.Fourthly,service self-organization system is put forward based onconnection handoff under the condition of redundant backup.According toservice processing flow,the system is divided into communication,servicedistribution and service supply modules.Backup modules’ survivabilityinformation is send to online modules and gets the list of newest service states.When the survivability of a module is highest,the self-organization strategies areimplemented using multi-handoff technology.The system possesses the meritssuch as transparency to users,flexibility and operability of the configuration.Experiments confirm that this method can enhance the quality of service andimprove service survivability.The research of network information system survivability is still at thestarting phase.The model of information system survivability analysis based onstochastic Petri net is put forward for system design;the result of the research canprovide a direct for survivability design.Then a hierarchical evaluation model ofsurvivability is proposed for networked information system which can helpsystem administrator locate the weak point of information system rapidly.In orderto enhance the system survivability,the service self-organization algorithm isdesigned based on the survivability of atomic modules,and then serviceself-organization system which is based on TCP protocol is put forward based onconnection handoff.The system possesses a sound universality and applicability.更多还原