Focused on the issue that the traditional static detection and dynamic detection methods cannot cope with malicious PDF document attacks using a lot of obfuscation and unknown technologies， a new detection model based on system calls and data provenance， called NtProvenancer， was proposed. Firstly， the system call records during execution of the document were collected by the system call tracing tool. Then， the data provenance technology was used to establish a data provenance graph based on the system calls. After that， the feature segments of system calls were extracted for detection by using the key point algorithm of the graph. The experimental dataset consists of 528 benign PDF documents and 320 malicious ones. The test was carried out on Adobe Reader， and the Term Frequency-Inverse Document Frequency （TF-IDF） and the rarity algorithm in PROVDETECTOR were used to replace the key point algorithm of the graph to conduct the comparative study. The results show that NtProvenancer has better performance on precision and F1 score. Under the optimal parameter setting， the proposed model has the average time of document training and detection stages of 251.51 ms and 60.55 ms respectively， the false alarm rate lower than 5.22%， and the F1 score reached 0.989， showing that NtProvenancer is an efficient and practical model for PDF document detection.

To quickly select and organize relevant manufacturing resources and guarantee the execution of manufacturing tasks under the cloud manufacturing mode, a construction method of cloud manufacturing virtual workshop was proposed for manufacturing tasks. In this method, the manufacturing processes were abstracted into manufacturing task execution chains, in which the nodes were corresponding to manufacturing equipment cloud services or inspection cloud services and the directed edges were corresponding to logistics cloud services. At the same time, the cloud services were organized and managed through the industry domain, location domain and type domain to construct smaller candidate sets of cloud services with reducing the computing amount of function matching, performance matching, price matching and time matching, thus constructing cloud manufacturing virtual workshops rapidly. The numerical example analysis shows that compared to other methods, the proposed method can select cloud services in a shorter time and ensure that the Quality of Service (QoS) of the selected cloud services is better in the relevant domains.

Based on the business process, a composite model of manufacturing cloud services was proposed to improve the successful rate of the manufacturing cloud service composition and match the composite cloud service with the user business demand correctly. As the foundation, formal descriptions were given about concepts such as the manufacturing cloud service, the process node task, the service composability and the process matching. The model consisted of the business process engine, the business process, the selection logic, the evaluation logic, the monitoring logic, the knowledge base and the atomic cloud service set. With the function matching, the composability of optional services was checked. The load, the Quality of Service (QoS) and the business process information were also considered. Then suitable cloud services were selected and integrated into the business process to form the composite manufacturing cloud service. The process of the service composition was described in detail, and the realization method of it was offered. The composite service model was verified through an example. The results prove that the valid cloud service entities can be selected and combined effectively with the model, the successful rate of the service composition is raised, and users' manufacturing activities can be carried out smoothly.

For cloud manufacturing environment, many manufacturing cloud services have the same or similar function, so it is difficult to get the most suitable cloud services. This study designed a selection method of the manufacturing cloud services based on trust evaluation. How to select cloud services was described by abstraction; the reliability, usability, timeliness, price and honesty were used as the trust characteristics together; and the evaluation time and effect of estimators' honesty on the service's credibility were also taken into account; and then the overall credibility was calculated from all above data by weighted average method. Furthermore, with all factors such as the cloud services' function, workload, current state and physical distance considered in package, the method was built to guide the cloud service selection by matching the services' function, workload and price and combining the trust evaluation. The results of simulation experiments show that the service selection method is able to recognize entities of manufacturing cloud services, and it improves the rate of the cloud service trades and meets users' functional and non-functional requests better.

The running time of K-means overly depends on the initial points but the right value of k is unknown and selecting the initial points effectively is also difficult. To solve this problem, depending on the research about initialization deeply, a high effective approach used to select the initial points was presented, which ensured at least one point to be selected in each cluster. Influence factor between clusters was presented to measure the similarity of two clusters, and a new merging algorithm based on it was put forward. This algorithm and the initial points' selection algorithm can automatically and fast give the actual value of k and select the right initial points based on the dataset characters. Finally, Gaussian datasets were used to test the algorithm and a satisfying result was obtained.