摘要
针对基于Java的主动网络系统缺乏代码撤销和防范拒绝服务（DoS）攻击的手段，提出了安全主动网络服务加栽器机制．该机制主要利用字节码重写技术，在不修改主动代码的前提下可以实现服务的强制性终止和针对主体的CPU、内存以及网络带宽的资源监控．CPU监控采用了独立线程的方式，这样可以充分保障CPU资源统计的准确性和有效性，而网络资源的监控利用了过滤器，从而保证了监控的完备性．实验结果表明，所提机制能够提高主动网络的安全性，虽仅为系统带来了大约15％～30%的额外开销，却不会影响主动网络的运行效率．
Due to the lack of code revocation and defense denial of service （DoS） attack in current Java based active network systems, a secure active service loader mechanism is introduced. By means of byte code rewritten, the mechanism can forcibly unload the given service and can monitor main CPU, memory and networking bandwidth resources without modifying any of original code. The single thread serves for monitoring CPU, which can assure the accuracy and efficiency of CPU resource statistics. A filter is used for monitoring of network resource, thus the monitor completeness is guaranteed. The experiments show that the proposed mechanism increases the security of active networks while the extra overhead taken by the loader is only about 15%-30% without effecting the efficiency of active networks.
出处
《西安交通大学学报》
EI
CAS
CSCD
北大核心
2006年第2期157-160,共4页
Journal of Xi'an Jiaotong University
基金
国家自然科学基金资助项目(60173059)
关键词
主动网络
安全
代码撤销
字节码重写
active network
security
code revocation
byte code rewritten
