Aiming at the problem that the METHONTOLOGY method and the seven-step method, which are more mature than the IEEE 1074-1995 software development standard, do not consider the ontology quality assessment and its response, a new cyclic iterative ontology construction method based on demand assessment and response was proposed. First, based on the software development V-model and ontology testing framework, demand analysis for the constructed ontology was conducted, so as to define a set of ontology test design documents that emphasize meeting the demands rather than knowledge richness. Second, core architecture and architecture knowledge system were refined, and the test documents were updated. Finally, the expressions of knowledge satisfiability on the core architecture, architecture knowledge system and demand analysis were respectively evaluated by using the test documents, and the ontology was updated locally or globally when the expressions of knowledge were not satisfied. Compared with the common methods of ontology construction, the proposed method can realize the evaluation and iterative evolution in the ontology construction process. Furthermore, the government ontology established by this method not only provides a knowledge representation framework for the relevant knowledge of item transaction, but also provides a new idea for the calculation of government knowledge. And the developed government affair process optimization program based on the proposed method has successfully applied in a provincial government affair big data analysis field, so as to confirm the rationality and effectiveness of the method to a certain extent.

Current neighborhood rough sets have been usually used to solve complete information system, not incomplete system. In order to solve this problem, an extended tolerance relation was proposed to deal with the incomplete mixed information system, and associative definitions were provided. The degree of complete tolerance and neighborhood threshold were used as the constraint conditions to find the extended tolerance neighborhood. The attribute importance of the system was got by the decision positive region within the neiborhood, and the attribute reduction algorithm based on the extended tolerance relation was proposed, which was given by the importance as the heuristic factor. Seven different types of data sets on UCI database was used for simulation, and the proposed method was compared with Extension Neighborhood relation (EN), Tolerance Neighborhood Entropy (TRE) and Neighborhood Rough set (NR) respectively. The experimental results show that, the proposed algorithm can ensure accuracy of classification, select less attributes by reduction. Finally, the influence of neighborhood threshold in extended tolerance relation on classification accuracy was discussed.

Since the algorithm of attribute reduction based on positive region is based on the thought of lower approximation, it just considers the right distinguished samples. Using the thought of upper approximation and the concept of neighborhood information granule, the distinguished object set with its basic characteristics was designed and analyzed, then the new attribute importance measurement based on distinguished object set and heuristic attribute reduction algorithm was proposed. The proposed algorithm considered both the relative positive region of information decision table and the influence on boundary samples when growing condition attributes. The feasibility of the algorithm was discussed by instance analysis, and the comparative experiments on UCI data set with attribute reduction algorithm based on positive region were carried out. The experimental results show that the proposed attribute reduction algorithm can get better reduction, and the classification precision of sample set can remain the same or has certain improvement.

Focusing on the underdeveloped robustness when the existing extended rough set model encounters the noise for the incomplete information system, the necessity of adjusting the size of basic knowledge granule as well as introducing the relative degree of misclassification was analyzed. Then the Variable Precision Rough Set model based on Variable-Precision Tolerance Relation (VPRS-VPTR) was established on the basis of the object connection weight matrix, which was proposed according to the lack probability of system attribute value. Moreover, the properties of the VPRS-VPTR model were discussed, the classification accuracy under the basic knowledge granule size and the relative degree of misclassification was analyzed, the corresponding algorithm was depicted and the time complexity analysis was given afterwards. The experimental results show that the VPRS-VPTR model has higher classification accuracy compared with some other research about the expanded rough set, and the change trend of the classification accuracy is similar for the train set and the test set of several groups of incomplete data sets in UCI database. It proves that the proposed model is more precise and flexible, and the algorithm is feasible and effective.

In order to evaluate a systems security and predict the attack actions, an attack model  based on system states aggregation was presented. In the model, the threat was abstracted as the aggregation of the systems states, and the attack process was depicted as the change of the system states aggregation. A method of detecting network attacks and early warning using the model was also described. Based on the model, an early warning prototype was implemented. Our experiment shows that the prototype is able to  detect attack processes effectively and predict the possible risk level the system will reach.

 In traditional monolithic kernel operating systems, all kernel codes run within a common and shared address space, and any vulnerabilities in kernel or any untrusted modules loaded in kernel would compromise the whole system security. The development of a layered and separated secure kernel was described in this paper. Since the powers of kernel are partitioned, the vulnerabilities of kernel are confined, and arbitrarily tampering of kernel by malice codes was prevented. The prototype system is entirely developed from beginning for the i386 architecture.

Network-based intrusion detection system (NIDS) detects attacks by capturing and analyzing network packets. As network band increases, NIDS can hardly keep up with the speed of networks. A method of improving NIDS’ process ability using symmetric multi-processor (SMP) was proposed in the paper. Several CPUs of the system were used to process network packets in parallel to improve the performance. After analyzing NIDS’ process procedure, an effective parallel processing structure was devised, which guaranteed threads on different CPUs running in parallel. Moreover, the synchronization method of threads proposed avoided the mutually exclusive access to the shared resource, which further increased the parallelity of threads, and guaranteed the correctness of the functionality of the program. Experiments show that the NIDS implemented on a SMP system with dual CPUs is almost 80% faster than the one based on a system with unique CPU.