信息工程大学

USENIX Security 

The USENIX Association is a 501(c)(3) nonprofit organization, dedicated to supporting the advanced computing systems communities and furthering the reach of innovative research. We are known for organizing conferences and publishing research, but our greatest strength lies in building communities in computing systems. We represent the interests of our communities in a variety of ways, including our professional affiliation with the Computing Research Association.

Since 1975, USENIX has brought together the community of engineers, researchers, and practitioners working on the cutting edge of the computing world. USENIX conferences have become the essential meeting grounds for the presentation and discussion of the most advanced information on the development of all aspects of computing systems.

Since 1980, the IEEE Symposium on Security and Privacy has been the premier forum for presenting developments in computer security and electronic privacy, and for bringing together researchers and practitioners in the field.

ACM CCS

The ACM Conference on Computer and Communications Security (CCS) is the flagship annual conference of the Special Interest Group on Security, Audit and Control (SIGSAC) of the Association for Computing Machinery (ACM). The conference brings together information security researchers, practitioners, developers, and users from all over the world to explore cutting-edge ideas and results. 

NDSS

The Network and Distributed System Security (NDSS) Symposium fosters information exchange among researchers and practitioners of network and distributed system security.

Originally the Workshop on Network and Distributed System Security, the NDSS Symposium was first held in 1993 in San Diego, California. It was organized as a workshop of the Privacy and Security Research Group of the Internet Research Task Force (IRTF) and was hosted by the Internet Society and Lawrence Livermore National Laboratory.

The Internet Society has proudly hosted the NDSS Symposium ever since to foster the next generation of Internet security experts and to support open, accessible, and collaborative security to research to help strengthen the Internet.

The symposium is now a five-day hybrid event including three days of the main NDSS Symposium and two days of co-located workshops and symposia. Each event brings together hundreds of security educators, researchers and practitioners from all over the world. The event is designed to encourage and enable the Internet community to apply, deploy, and advance the state of practical security technologies.

ACM ASIACCS

Building on the success of ACM Conference on Computer and Communications Security (CCS), the ACM Special Interest Group on Security, Audit, and Control (SIGSAC) formally established the annual ACM Asia Conference on Computer and Communications Security (ASIACCS). The inaugural ASIACCS was held in Taipei (2006). Since then ASIACCS has been held in Singapore (2007), Tokyo (2008), Sydney (2009), Beijing (2010), Hong Kong (2011), Seoul (2012), Hangzhou (2013), Kyoto (2014), Singapore (2015), Xi’an (2016), Abu Dhabi (2017), Songdo (2018), Auckland (2019), Taipei (2020, virtual), Hong Kong (2021, virtual) and Nagasaki (2022, hybrid).

年度 IEEE/IFIP 可靠系统和网络国际会议 - (DSN)

The Passive and Active Measurement (PAM) conference brings together researchers and operators to discuss novel and emerging work in the area of network measurement and analysis.

SIGCOMM

ACM SIGCOMM 是 ACM 数据通信特别兴趣小组 (SIGCOMM) 的旗舰年度会议

ACM IMC

The Internet Measurement Conference (IMC) is a three-day event focusing on Internet measurement and analysis

ACSAC

The IEEE/ACM Automated Software Engineering (ASE) Conference series is the premier research forum for automated software engineering. Each year, it brings together researchers and practitioners from academia and industry to discuss foundations, techniques, and tools for automating the analysis, design, implementation, testing, and maintenance of large software systems.

ICCC

ICCC会议发起于2015年，由四川省电子学会主办，西南交通大学, 电子科技大学，四川大学，成都理工大学，成都信息工程大学等协办。

Applied Sciences（期刊）

Applied Sciences is an international, peer-reviewed, open access journal on all aspects of applied natural sciences published semimonthly online by MDPI.

Security and Communication Networks（期刊）

ecurity and Communication Networks is an international journal publishing original research and review papers on all security areas including network security, cryptography, cyber security, etc. The emphasis is on security protocols, approaches and techniques applied to all types of information and communication networks, including wired, wireless and optical transmission platforms.

The journal provides a prestigious forum for the R&D community in academia and industry working at the inter-disciplinary nexus of next generation communications technologies for security implementations in all network layers.

Answering the highly practical and commercial importance of network security R&D, submissions of applications-oriented papers describing case studies and simulations are encouraged as well as research analysis-type papers.

战略支援部队信息工程大学毕业论文

毕业论文

周东杰

域名系统（Domain Name System,DNS）作为互联网基础服务,最主要的功能是提供域名和IP地址之间的映射关系。几乎所有的互联网活动都从域名查询开始,域名系统的安全关系到全球互联网的安全稳定运行。然而域名系统的相关协议在设计之初缺乏对安全性的考虑,使其容易遭受攻击。在现实网络中,因为域名服务器的不恰当部署,更加剧了其受到攻击的风险。2019年2月,由Google、ISC、PowerDNS、Cisco、Cloudflare等全球著名域名系统软件与服务提供商联合发起,并推动了扩展DNS机制（Extension Mechanisms for DNS,EDNS0）强制部署的行动。该行动将不支持EDNS0的权威服务器,标记为服务不可用,从而导致域名无法正常解析。目前还缺乏对存在可用性问题的域名服务器数量进行测量和统计的方法,进而评估对全球域名系统服务可用性和效率的影响。网络测量是分析和了解网络运行情况的重要手段之一。对全网进行系统性的测量可以全面了解网络运行状态与安全现状,对维护网络运行安全稳定具有重要意义。在对域名系统开展测量的工作中,存在数据集局限、缺少对域名系统扩展测量以及安全问题测量不全面等缺陷。针对上述缺陷,本文提出了一种对域名系统新型扩展与多种安全问题综合测量方法,设计并实现了基于上述测量方法的测量原型系统,并通过大规模网络范围下的测量研究,验证了测量方法有效性和系统运行的稳定性。针对当前缺少DNS恶意流量数据集与流量数据匿名化工具短缺的问题,本文提出了一套以原型系统流量数据为基础的DNS恶意流量数据生成与匿名化处理的方案。本文的主要工作和成果如下:（1）提出了权威服务器DNS新型扩展和多种安全问题的测量方法。针对已有研究测量数据集局限、安全测量不全面、缺少对DNS扩展测量的问题,研究提出了将Passive DNS数据用作测量数据集的DNS新型扩展与安全问题主动测量方法。Passive DNS积累近四年来网络中出现过的域名,数据集覆盖范围得到极大提高;结合现实网络部署实例,分析了网络中间设备对测量的影响,提出了DNS扩展可用性测量方法;优化了单一安全问题测量中存在的重复步骤,形成了对权威服务器安全问题的综合测量方法,并对测量过程中可能对被测目标带来的影响提出了缓解措施。与已有研究相比,这种测量方法具有快速准确、测量全面和可扩展性强的优势。（2）构建了大规模网络下对域名系统服务器扩展可用性与安全问题测量原型系统。针对Passive DNS数据集原始数据量庞大、数据质量不高的问题,结合域名系统层次化结构的特点,提出了加入二级域名有效性检查的数据清洗方法,有效提高了数据清洗效果,缩小数据集规模;提出多点测量的系统部署方案,通过对各测量点结果的分析融合提高了测量准确性。测量原型系统由域名数据处理模块、网络测量模块和数据库模块组成。通过中国教育网权威服务器测量实验,验证了测量方法的有效性。目前系统已处理超过3亿条Passive DNS数据,实现对中美政府与教育类域名的定期测量,验证了系统大规模网络范围可用性与稳定性。（3）设计并实现了一套DNS恶意流量数据集生成与处理方案。针对多种恶意流量生成困难与流量数据匿名化处理不成熟的问题,本方案从测量原型系统、网络蜜罐、恶意软件沙箱获取恶意流量,从教育网权威服务器以及校园网出入口获取背景流量,尽可能全面还原攻防对抗场景;为了避免数据集中现网流量带来隐私泄露风险,基于数据匿名化的思想,提出从数据链路层到应用层的分层匿名化处理方案。为了避免通过侧信道方式进行恶意流量识别,采取泛化网卡硬件参数与时间戳校正的方法,丰富和深化了匿名化处理方案,在充分保护数据隐私的前提下保留DNS恶意流量特征以便于开展研究分析。在清华大学与奇安信集团的举办DataCon安全大数据竞赛中采用了本方案,验证了数据处理方案有效性。