Proactive vs Reactive
The_Seven_Habits-七个习惯
HABIT 2: Begin with the End in Mind
• All Things Are Created Twice Plan well. Think things through. The carpenter's rule is "measure twice, cut once."
HABIT 2: Begin with the End in Mind
• Identifying Your Center What is your center? What determines your mood? If it is determined by your work, then you are centered on work. If it is determined by your spouse, then you are centered on your spouse. If it is determined by your church, then you are centered on your church. Covey suggests that you instead center yourself on your principles.
The 7 Habits of Highly Effective People
by Steven Covey
高效能人士的七个习惯
富兰克林柯维
PRIVATE VICTORY 个人的成功------从依赖到独立
• HABIT 1: Be Proactive 积极主动—个人愿景的原则 • HABIT 2: Begin with the End in Mind 以终为始—自我领导的原则 • HABIT 3: Put First Things First 要事第一—自我管理的原则
亡羊补牢的寓意告诉我们什么道理英语作文
亡羊补牢的寓意告诉我们什么道理英语作文全文共6篇示例，供读者参考篇1What Does "Closing the Pen After the Sheep Are Lost" Really Mean?You know that feeling when your mom yells at you for leaving your bike in the driveway after it got stolen? Or when your teacher scolds the whole class for being loud and rowdy after you already got in trouble for it? That's kind of what the Chinese saying "closing the pen after the sheep are lost" (亡羊补牢) is all about.It's an idiom that means taking precautions too late, after the damage is already done. Like locking the gate after all the animals have escaped and run away. Pretty silly, right? Why bother locking it then?My grandpa loves using old proverbs and idioms like this one to teach me lessons. I remember one time I accidentally broke my aunt's really expensive vase when I was throwing a ball inside the house (which I knew I wasn't supposed to do). After my aunt got mad and my parents scolded me, my grandpapulled me aside. With a kind but serious look, he said, "Drew, locking the door after the robbery is pointless. The damage is already done."I felt really awful because I knew he was talking about the vase situation. By the time they tried to punish me and prevent it from happening again, I had already broken the vase. It was too late. Hearing that old saying put things in perspective for me.My grandpa went on to explain that the idiom "closing the pen after the sheep are lost" originated a long time ago in ancient China when most people worked as farmers or shepherds. Back then, if you didn't properly lock up your sheep pen at night, the sheep could wander off and get lost or eaten by wolves. So it was really important to secure the pen before nightfall. Otherwise, you'd be foolish to lock it up after all your livestock had already escaped or gotten killed!That visual of locking up an empty pen with no sheep left really hammered the message home for me. It's about taking preventative measures before bad things happen, not just reacting after the fact when it's already too late. My grandpa told me it's the same idea as the English sayings "locking the barn door after the horse is gone" or "an ounce of prevention is worth a pound of cure."Looking back, there were so many instances growing up where that proverb could have applied to me. Like when I waited until the last minute to study for a test and bombed it. Or when I kept putting off my chores until my mom freaked out on me for letting my room get so messy. Sometimes I wish I had learned the meaning of "closing the pen after the sheep are lost" sooner!These days, I try to think ahead and take precautions before potentially bad situations, instead of regretting my actions later. Like making sure to pack an umbrella if rain is in the forecast, rather than ending up soaked and cold. Or buckling my seatbelt as soon as I get into the car, not waiting until I've already started driving. It's about being proactive instead of reactive.I see examples of this idiom's message all around me too. Like when a house with a weak roof waits until after a huge storm to fix it, rather than getting it repaired beforehand. Or when someone parties too hard and ends up with a monster hangover, wishing they had chugged some water between drinks. It's "closing the pen after the sheep are lost" taken to the extreme!Procrastinating on things just leads to more headaches down the road. The more I've learned to apply "closing the pen after the sheep are lost" to my life, the better I've gotten at avoiding unnecessary issues. Taking preventative steps ends upsaving so much time, money, and hassle compared to cleaning up after the fact.I know I'm just a kid and still have a lot to learn. But I'd like to think I've become a bit wiser from having that old Chinese idiom ingrained in me. Planning ahead, staying prepared, and taking precautions are so important if you want to avoid misfortune or disasters. Once something bad has already happened, it篇2The Lesson of Locking the Pen After the Sheep are LostHave you ever heard the saying "locking the pen after the sheep are lost"? It's an old Chinese idiom that basically means taking action too late, after the damage is already done. It paints a picture of a shepherd who doesn't secure the gate to the sheep pen until after all the sheep have already escaped and run away. Pretty silly, right?Well, this funny little phrase actually teaches us a really important life lesson that I think is super valuable, especially for kids like you and me. The moral of the story is that we need to be proactive and take preventative measures, instead of just reacting after something bad has already happened.Let me give you an example to help explain what I mean. Let's say you have a really important math test coming up on Friday. You've been slacking off and not really studying or paying attention in class. Then, Thursday night rolls around and you suddenly realize "Oh no, the test is tomorrow and I'm totally unprepared!" So you try to cram everything in at the last minute.But is that really the best strategy? Probably not. It would have been way smarter to start preparing little by little each day, reviewing your notes, doing practice problems, and asking your teacher for help if you're struggling with any concepts. That way, by the time the test day arrives, you're feeling cool, calm, and confident instead of stressed and scrambling.You're basically locking the pen (doing your work) before the sheep get out (preventing yourself from bombing the test). Make sense? Taking that proactive approach gives you your best chance at success.Now, I know what you might be thinking - "Sure, Timmy, that all sounds good in theory. But let's be real, I'm just a kid! I get distracted and procrastinate sometimes. We all do!" And you're absolutely right, that's just part of being human. None of us are perfect.The key is to develop habits and strategies to help us be a little more proactive in life. For example, you could set reminders for yourself to review class material every night after dinner. Or make a checklist of all the steps you need to take to prepare for that big project. Or just practice better time management skills in general.When we take a proactive mindset and get ahead of potential problems, it's kind of like we're "locking the pen" and preventing future headaches and stress for ourselves. It helps us perform at a higher level and achieve better results.On the flip side, a reactive mindset is what gets us into trouble. We let things slide until it's too late and then we're frantically trying to dig ourselves out of a hole. Like that shepherd who doesn't secure the gate until the sheep have already escaped - he's forced to run around like a madman trying to gather them all back up. What a mess!Now, I'm not saying you can prevent every single bad thing from ever happening. Life throws curveballs sometimes that are out of our control. In those cases, yeah, we have to be reactive and deal with the situation as best we can. But a lot of time, a little proactiveness can go a long way in avoiding preventable problems.The good news is, it's never too late to start implementing this philosophy! Why not pick one thing you've been slacking on, like cleaning your room or studying for an upcoming vocabulary quiz? Make a plan to be proactive - set reminders, make a checklist, whatever tools work best for your learning style. Prove to yourself and your parents that you've got what it takes to "lock the pen before the sheep get out!"Remember, we're all works in progress. Even adults mess up and drop the ball sometimes. But having a proactive mindset becomes a habit, just like any other good habit we try to build, like brushing our teeth, eating healthy foods, or being kind to others. The more we practice it, the better we get at avoiding those reactive scrambles.So the next time you hear that funny old saying about the shepherd and his lost sheep, let it remind you of the power in being proactive. Whether it's with schoolwork, chores, sports practice, you name it - taking care of business ahead of time puts you in the driver's seat and increases your chances of success. After all, an ounce of prevention is worth a pound of cure, right?Those are just some of my thoughts, but I'd love to hear your perspective too! How else could we apply this "locking the pen" lesson in our daily lives as students? Are there any areas whereyou tend to be more reactive instead of proactive? I'm certainly still working on building better habits myself.Developing a proactive mindset takes practice, but it's a skill that will serve us well not just in school, but in life. So let's all try to be a little more like the smart shepherd who secures the gate ahead of time - saving us a whole lot of running around and stress in the long run!篇3What Does "Closing the Pen After Losing the Sheep" Really Mean?You know that saying your grandma always uses when someone tries to fix something after it's already too late? "Closing the pen after losing the sheep." I never really understood what it meant until my dad explained it to me. It's one of those old sayings that has a really good lesson hidden inside.Basically, it means that it's no use trying to prevent something bad from happening after it has already occurred. Like if you left the gate to the sheep pen open, and all the sheep wandered out and got lost. Then you closed the gate after theywere already gone. Duh! You should have closed it before they escaped!My dad gave me a real-life example to help me understand. Last summer, we went camping and didn't put our food away properly at night. We just left the cooler and snacks out in the open. In the morning, we woke up to a huge mess! Raccoons had gotten into everything and there were potato chip crumbs and smashed granola bars all over the campsite. My dad had to spend hours cleaning it all up. He said we were "closing the pen after losing the sheep" by putting the food away neatly after the raccoons had already made the mess.So the expression is trying to teach you an important lesson - be prepared and do things the right way from the start instead of waiting until it's too late. That way you can prevent problems before they happen instead of having to fix or clean up a mess afterwards.At school, we sometimes talk about "closing the pen after losing the sheep" without even realizing it. Like when we forget to study for a test, then after we get a bad grade we promise to study harder next time. Well, duh! We should have been studying all along instead of waiting until we failed the test. That's closing the pen after the sheep got out.Or when we forget to bring a snack or water bottle to soccer practice, then we're crazy hungry and thirsty at the end. We should have prepared properly before practice started instead of whining about it after. That's closing the pen in the wrong order.My mom is always using that expression around the house too. Like if I make a giant mess with my toys, art supplies, or games, then she has to spend forever cleaning up after me. She'll say "This is like closing the pen after the sheep got out! You need to clean up after yourself AS you go instead of waiting until the end." Then I have to stop what I'm doing and tidy up right away. It's a pain, but she's right. It's way easier to keep cleaning up a little bit at a time instead of letting it all pile up into one huge mess.I think "closing the pen after losing the sheep" is a really smart way to remind me and my family to be responsible, prepared, and do things in the proper order. If we had closed the pen (or cooler) properly BEFORE the sheep (or raccoons) got out, we wouldn't have had any problems to deal with later. Doing things right from the start prevents so many headaches in the long run!So now when I hear that strange old expression, I smile because I know what important lesson it's teaching me. Don't bethe person closing the pen after it's too late. Take precautions, show up prepared, and do things the right way ahead of time. That's the wise way to live and not get stuck having to chase down a whole flock of lost sheep!篇4What the Idiom 'Mending the Pen After Losing the Sheep' Teaches UsHave you ever heard the Chinese saying "Mang Yang Bu Lao" before? It means "mending the pen after losing the sheep." At first, it might not make much sense. Why would someone fix a pen after their sheep ran away? Let me explain what this funny idiom really means and the important lesson it teaches.Imagine you are a shepherd taking care of a big flock of woolly sheep out in the fields. You have a pen made of wooden fences where the sheep stay safe and sleep at night. One day, you accidentally leave the gate to the pen wide open while going about your chores. Before you realize your mistake, several of the sheep wander out of the open gate and get lost! You scramble to chase after the missing sheep, but they have wandered too far away into the hills and woods. After hours of searching, youfinally give up for the day, defeated. Those poor sheep are gone for good.When you get back to the pen, suddenly you realize - the gate is still open! If any more sheep escape during the night, you'll lose your whole flock. So what do you do? You quickly shut and lock the gate, making sure it is nice and secure. As the idiom says, you are "mending the pen after losing the sheep." Pretty silly, right? Why didn't you just close the gate in the first place before any sheep went missing?This is exactly the lesson the idiom is meant to teach. It is criticizing the idea of only fixing a problem after something bad has already happened, instead of taking precautions in advance. Closing the gate earlier would have prevented those sheep from getting lost at all. Taking action beforehand is always better than waiting until disaster strikes.Imagine if you didn't mend the pen gate at all after those first sheep escaped. The very next night, the rest of your flock could have wandered out the open gate too! Then you'd lose your entire flock of sheep, just from one little mistake. That would be terrible for your family that depends on the sheep's wool and milk to survive. All because you didn't learn from your first mistake quickly enough.The idiom "mending the pen after losing the sheep" shows the importance of:Learning from your mistakes right awayTaking action to prevent future issuesNot letting problems snowball out of controlIt teaches the value of being proactive, not reactive. If there is a problem or risk, it's better to take steps to fix it immediately instead of waiting until the damage is already done. Closing the barn door after the horse runs away does no good - the sensible thing is to shut the door before the horse even has a chance to escape!Let me give you some more examples to help this lesson stick:What if there was a leak in your roof during a rain storm? Would you wait for even more rain to pour in before fixing the leak and letting your house get water damaged? Of course not! As soon as you noticed the dripping, you'd put out buckets to catch the water and call a roofer right away to patch the leak. Not waiting until the problem gets even worse is "mending the pen before losing the sheep."Or let's say you forgot to study for a big math test at school. When you got the test back with a failing grade, would you just shrug it off? No way! After seeing your poor score, you'd learn your lesson and study twice as hard for the next test so you don't fail again. Adjusting your habits after a failure is "mending the pen after losing the sheep."Every day, we all have many chances to be proactive and prevent bigger issues, just like mending that pen gate. If you're having trouble with a subject at school, asking your teacher for extra help stops your grades from slipping later. Cleaning your room stops toys and clothes from piling up into a huge mess over time. Following your parent's rules helps you avoid punishment down the road.The idiom reminds us it's smart to fix problems when they are still small and manageable, before they turn into bigger disasters. A little anti-proactive effort saves you a lot more work and headache later on. It's just like my mom always says: "An ounce of prevention is worth a pound of cure!"So don't be the foolish shepherd who let all the sheep run away, then belatedly mended the pen anyway. Use this wise old saying as a reminder to stay on top of problems, rather thanscrambling to clean up avoidable messes after the fact. An ounce of precaution goes a very long way!篇5The Lesson of Closing the Pen After Losing the SheepHave you ever heard the saying "closing the pen after losing the sheep"? It's an old Chinese idiom that teaches us an important lesson about being prepared and taking action before it's too late.In English, we might say "locking the barn door after the horse has bolted." It means the same thing - trying to fix a problem after the damage has already been done instead of preventing the problem in the first place.Let me tell you a story to explain what this idiom means:Once upon a time, there was a shepherd boy named Li Xiaoming who took care of his family's flock of sheep. Every morning, he would lead the woolly animals out to the pasture to graze on the fresh green grass.One sunny day, Xiaoming was feeling lazy. Instead of counting to make sure all the sheep were there before opening the pen gate, he just swung it wide open without a secondthought. The sheep happily wandered out to munch on the clover.A few hours later, Xiaoming looked up from the comic book he had been reading and did a double take. There was one sheep missing! He searched high and low, but the lost lamb was nowhere to be found.Xiaoming felt terrible. He knew his parents would be very upset with him for losing one of their precious sheep. As night fell, he sadly headed back to the pen, closing and locking the gate tightly behind him.But it was too late - the sheep was gone for good. Xiaoming had closed the pen after losing the sheep. If only he had been more careful and made sure the whole flock was there before opening the gate that morning!This little story shows why the idiom "closing the pen after losing the sheep" is used to remind us not to do things too late. Just like Xiaoming, we often don't think about taking precautions until after something bad has already happened.For example, imagine you have a report due for school tomorrow, but you spent all weekend playing video games instead of working on it. Now it's too late to get it done properly.That's kind of like closing the pen after the sheep got out - you didn't do what you were supposed to do at the right time.Or let's say you lost your new smartphone because you didn't put it in a safe place. After searching everywhere for it, you decide to be more careful about where you leave your valuables from now on. But it's too late because your phone is already gone!Whenever you find yourself doing something to fix a problem or make a situation better after the main issue has already occurred, you are closing the pen after losing the sheep. The right time to take action was earlier, before things went wrong.The moral of this idiom is: be prepared, pay attention, and don't put things off until it's too late! If we make a habit of thinking ahead and doing what needs to be done at the right time, we can prevent a lot of problems and trouble.It's like my mom always says: "An ounce of prevention is worth a pound of cure." Or as another English saying goes: "A stitch in time saves nine." Both of these proverbs remind us to take care of things quickly before they become bigger issues.So the next time you find yourself rushing to make up for a mistake or trying to fix something at the last minute, remember poor Shepherd Boy Xiaoming closing the pen's gate after his sheep had already wandered off. Don't be like him! Instead, take action upfront so you don't have to face the consequences later. It's a lesson we can all learn from this wise Chinese idiom.篇6The Old Saying: Closing the Pen After Losing the SheepThere's an old saying in English that goes "It's no use closing the pen after losing the sheep." At first, it might sound kind of funny or even a bit silly. Why would someone try to close up a pen (which is basically just a small fenced-in area) after all the sheep have already escaped and run away? That would be pointless! But if you stop and think about the deeper meaning behind this old phrase, it actually teaches us an important life lesson that can help make us wiser and more responsible.The saying is really using the image of farm animals like sheep as a metaphor. The "sheep" represent something valuable that you previously had but then carelessly lost or let slip away through your own negligence or lack of proper precautions. The "pen" symbolizes the security measures, safeguards, orpreventative steps you should have taken earlier to protect your valuable possessions or opportunities from being lost or squandered in the first place. So to try putting up strong fences and barriers after everything is already gone is a futile gesture —it's too little, too late at that point.Let me give you a few examples to better illustrate what this saying is getting at:Imagine a young boy who receives an beautiful antique pocket watch from his grandfather as a cherished family heirloom. But the boy is pretty irresponsible with his belongings. He carelessly leaves the treasured watch lying around the house, drops it on the floor, forgets where he put it, and eventually the precious watch gets lost for good. Only after it's gone does the boy's father exclaim in frustration, "It's no use locking up the house securely now — the sheep is already out of the pen!"Or let's say there's a teenage girl who has always dreamed of becoming a professional ballet dancer. But instead of diligently practicing her ballet exercises and working hard in her dance classes, she goofs off and hardly puts in any real effort. Then one day she fails the difficult audition for admission to the elite ballet academy she wanted to attend. It's only after blowing her bigchance at her dream that she finally realizes "Oh no, I've lost my sheep — it's too late to start taking ballet seriously now!"Here's one more example that might hit closer to home: Let's say you've been slacking off in math class all year. You don't pay close attention to the lessons, you neglect to do your homework regularly, and you don't bother asking the teacher for help when you're struggling to understand something. So, by the time the big end-of-year math test rolls around, you're completely unprepared and you bomb it miserably. After failing the crucial test, your parents ground you and exclaim in exasperation, "Well, it's no use cracking down on your behavior now — the sheep is already out of the pen on your math grade for the year!"In each of these cases, the "sheep" represents something of great value and importance — the antique watch, the ballet dancing dream, or the chance to do well in math class. And the "pen" stands for the precautions, hard work, and responsible actions that should have been taken ahead of time to safeguard and protect those valuable things from being squandered or lost. But by neglecting to be diligent, dedicated, and conscientious early on, the chances or opportunities slipped away before any belated efforts could salvage the situation. As my grandmawould say, "The barn door got locked after the horses already ran out."So what's the big lesson this clever old saying wants us to learn? It's all about being proactive rather than reactive when it comes to things that truly matter to us. Whether it's taking proper care of our treasured possessions, working hard to achieve our biggest goals and ambitions, or just knuckling down on our school responsibilities — we have to stay on top of what's important before it's too late to make a difference. "An ounce of prevention is worth a pound of cure," as another wise saying reminds us. It's so much easier to safeguard our valuables and opportunities from the start through hard work, discipline, advanced planning, and taking all the right precautions early on. That way we never end up in the miserable position of trying in vain to fruitlessly lock up the pen after our prized "sheep" have already escaped due to our own lack of vigilance.As young students, we're still at an age where we can really take this valuable life lesson about being proactive to heart. When we feel unmotivated to do mundane chores or homework, we should picture those tasks as the "pen" we need to diligently reinforce to protect something more meaningful down the road — like a future goal or opportunity that could easily slip away ifwe drop the ball. And when we're tempted to goof off rather than focus on responsibilities that may seem boring or unimportant in the moment, we'd be wise to visualize that sacrifice compounding until we've carelessly "lost our sheep" in the long run.There's a reason why certain old sayings and figures of speech have stuck around for so many generations. While the specific wording and imagery may be a bit antiquated, the fundamental wisdom and guidance imbued in thesepassed-down expressions can truly enrich our lives and decision-making. And the proverb about not locking the pen too late after the sheep have already escaped is one of those enduring pieces of folk wisdom that can inspire all of us — from young kids up through older adults — to be more watchful, hardworking, and accountable when it comes to diligently pursuing and protecting our most cherished dreams, possessions, and opportunities in life. It's never too early to start heeding that advice so we don't ever arrive at that disappointing point of "shutting the barn door after the cows have already fled." Taking responsible action in a timely manner is the surest way to avoid that sinking feeling of trying fruitlessly to close the pen once all our "sheep" are already long gone.。
proactive
proactiveProactive: Embracing a Proactive Approach for SuccessIntroductionIn today's fast-paced world, being reactive is simply not enough. To excel in any field, whether it's business, personal growth, or relationships, one must adopt a proactive mindset. The concept of being proactive is not new, but its significance and impact on our lives cannot be overstated. In this document, we will explore the essence of being proactive, its benefits, and strategies to incorporate proactive habits into our daily lives.Understanding ProactivityBeing proactive means taking responsibility for one's actions and outcomes rather than waiting for situations to unfold and then reacting to them. It involves actively identifying and seizing opportunities, rather than being passive and allowing circumstances to dictate our lives. Proactivity is about taking the initiative, being forward-thinking, and actively creating the future we desire.Benefits of Being Proactive1. Increased Productivity: Proactive individuals are not bound by external circumstances but take control of their time and resources. They plan ahead, set goals, and prioritize tasks, resulting in improved productivity and efficiency.2. Personal Growth: By being proactive, we open doors to personal growth and development. We actively seek new challenges and opportunities, thereby expanding our skills, knowledge, and experiences. This leads to enhanced self-confidence and a greater sense of achievement.3. Effective Problem Solving: Proactive individuals anticipate potential problems and take preventive measures to avoid them. However, if a problem does arise, proactive thinkers respond quickly and effectively, finding innovative solutions and minimizing their impact.4. Stronger Relationships: Proactivity enhances our relationships by promoting effective communication and collaboration. By taking the initiative to understand others'needs and concerns, we can build stronger connections and resolve conflicts proactively.Strategies for Incorporating Proactive Habits1. Set Clear Goals: Establishing clear, specific, and achievable goals provides a roadmap for taking proactive actions. Break these goals into smaller, manageable tasks, and consistently review and track progress.2. Prioritize and Plan Ahead: Identify the most important tasks and prioritize them accordingly. Plan your activities in advance, allocating time for specific tasks and projects, while considering potential obstacles and challenges.3. Develop a Positive Mindset: Cultivate a positive attitude towards challenges and setbacks, viewing them as opportunities for growth rather than obstacles. Embrace a growth mindset, focusing on possibilities and adapting to change.4. Take Initiative: Be proactive in seeking opportunities and embracing new challenges. Volunteer for projects, suggest improvements, and take ownership of your responsibilities.5. Continuous Learning: Stay curious and committed to learning. Engage in ongoing education, both formal and informal, to enhance your skills and knowledge. Seek feedback and constructive criticism to continually improve.6. Effective Time Management: Manage your time effectively by setting boundaries, eliminating distractions, and using productivity tools. Break larger tasks into smaller, manageable chunks, and allocate specific time blocks to work on them.7. Embrace Collaboration: Proactivity does not imply independence. Actively collaborate with others, seeking their perspectives and input. Work towards win-win solutions that benefit all parties involved.ConclusionEmbracing a proactive approach is a game-changer in all aspects of our lives. By taking responsibility for our actions, focusing on our goals, and being proactive in our thinking, we can unlock our true potential and create the future we desire. So, let us step out of our comfort zones and beproactive in every walk of life to achieve success and fulfillment. Remember, being proactive is not just a mindset; it is a way of life.。
积极的活跃的英语单词
积极的活跃的英语单词
1.active
2.proactive (人或政策)积极主动的，先发制人的
In order to survive the competition a company should be proactive not reactive.
要在竞争中生存下来，公司不应该消极应变，而应当先发制人。
3.hyperactive (儿童及其行为)过分活跃的，多动的
His research was used in planning treatments for hyperactive children.
他的研究被用来为多动的儿童治疗设计方案。
4.feisty 活跃的，精力充沛的
At 66, she was as feisty as ever.
66岁的她还和从前一样精神矍铄。
5.be working overtime (informal）非常活跃，过分活跃
There was nothing to worry about. It was
just her imagination working overtime.没什么可担心的。
那只是她的想象力太丰富了。
6.motivation n.积极性
He’s intelligent enough but helacks motivation.
他很聪明，但缺乏积极性。
一个支持proactive特性的通用型事件监控系统
第32卷 第4期2009年4月计 算 机 学 报C HIN ESE J OU RNAL OF COM PU TERSVol.32No.4Apr.2009收稿日期:2008212208;最终修改稿收到日期:2009201215.本课题得到国家“八六三”高技术研究发展计划项目基金(2006AA01Z451,2007AA01Z474)、信息产业部电子发展基金(信部运[2006]634号)资助.刘家红,男,1980年生,博士研究生,主要研究方向为分布对象计算、面向服务的计算、事件流处理.E 2mail :kahon @.吴泉源,男,1941年生,教授,博士生导师,主要研究领域为分布对象计算、人工智能.ProSPer :一个支持proactive 特性的通用型事件监控系统刘家红 吴泉源(国防科学技术大学计算机学院网络与信息安全研究所 长沙 410073)摘 要 大规模网络安全监控应用中需要对网络安全态势进行动态评估,在网络出现重大安全风险前进行proac 2tive 特性的有效防范.把网络安全监控系统建模为事件监控系统,对满足复合时序和属性值逻辑关系的多个事件进行关联,把多个原子事件复合为语义更丰富、更抽象的复合安全事件.已有研究提出了不同的复合事件检测模型,但缺乏proactive 的事件监控能力.基于时序关系并不能提高事件监控的预测能力的假设,设计了基于top 2k 复合事件检测模型的事件监控系统ProSPer ,为网络安全监控等应用系统提供proactive 特性的事件监控能力.与已有的复合事件检测系统相比,ProSPer 检测复合事件时无需读取全部成分事件,这种proactive 特性是非常有意义的设计.关键词 网络安全;事件监控;事件流处理;复合事件;proactive 特性中图法分类号TP311 DOI 号:10.3724/SP.J.1016.2009.00773ProSPer :A Proactive Event Monitor for G eneral PurposesL IU Jia 2Hong WU Quan 2Yuan(I nstit ute of N et w ork Technolog y &I nf ormation S ecurit y ,S chool of Com puter ,N ational Universit y of Def ense Technolog y ,Changsha 410073)Abstract Network security monitor of large scale demands dynamic ,continuous evaluation of security sit uation ,proactive protection against app roaching network risks.If t he aut hors model security monitors as continuo us Event Monitor Systems ,t hat is to say ,to correlate multiple e 2vent s in complex temporal relationship and att ribute logic relationship to richer semantic ,more abst ract complex event in security domain.Much works has st udied to design complex event de 2tection model but t hey lack t he proactive capability to monitor event.Based on t he assumption t hat temporal relationship does not improve t he p redictive ability of event monitor ,t he aut hors design a p roactive event monitor system Pro SPer for application do mains like sit uation evaluation for network security and present a fast top 2k based algorit hm to detect complex event s.Current event detection techniques require t he f ully read of relevant records ,while t he new met hod only needs partial read ,t hus t his p roactive capability is desirous.K eyw ords network security ;event monitor ;event st ream processing ;complex event ;p roactive capability1 引 言Proactive 特性是与reactive 相对的,指能感知状态变化,并在这些变化产生对自身的影响前主动采取行动的一种特性.在基于监控的应用中,存在很多需要p roactive 特性的需求.例如,大规模网络安全监控应用中需要对网络安全态势进行动态评估,在网络出现重大安全风险前进行有效防范以减小损失.实时企业为了主动、准确且详细地获取关于库存、生产、市场等相关信息,以便企业能及时决策,实现企业最大效益,通常会使用RFID 、无线传感器网络等智能物件来对生产、物流情况进行全局把握和预测[1];使用业务流程监控系统来主动地获取业务运营情况,以保证业务流程的合规性,留住客户,同时还可以发现潜在客户,拓展业务[2].这些应用通过对连续到达的领域信息进行分析处理,为了最大化收益和最小化损失,通常需要proactive 特性的处理能力.2 动 机事件监控系统处理的通常都是连续到达的信息,需要对这些信息进行实时、连续的监控和分析.事件流处理是对快速连续到达的事件进行计算的技术,用于事件系统运行时对事件进行监控以及辅助构造事件驱动系统.根据应用领域的不同需求,事件流处理对连续到达的信息有不同的数据模型以及相应的处理模型.这些模型在结构模型和处理模型上都是事件驱动处理的特例,区别在于其对连续到达信息的速率的承受能力和对一致性的保证[3].连续到达的信息的复合时序关系和时序关系上值属性的逻辑关系代表上层应用感兴趣的复合事件,体现了上层应用的业务逻辑,事件流处理系统依此对这些复合事件进行检测,连续输出经过复合后的结果事件,以触发相应的后继处理[3].目前,在线事件流处理系统通常采用图1所示的体系结构.对复合事件E =A op B 的检测过程大致如下,其复合事件的检测是观察到复合事件的终结事件(成分事件中时序上最后一个事件)时开始的:(1)当事件类型B 的实例b 进入系统时,监控器注意到复合事件E 的终结事件实例出现,告知事件处理器;(2)事件处理检查复合事件表达式,获知复合事件由两个顺序的原子事件组成,即A ,B ;(3)根据事件表达式,考察事件历史,以检查是否事件类型A 的实例在历史中;(4)在历史中找到a ,执行事件实例消费,并更新事件历史;(5)检测复合事件实例e 成功,输出.图1 在线事件流处理体系结构 当外部输入速率高,注册的复合事件表达式数目多时,复合事件的检测存在以下问题:①对复合事件的检测依赖于终结事件,其监控缺乏主动式的proac 2tive 特性;②每个复合事件表达式在内存中都会载入一个监控器,内存开销大,只要有新的输入事件到达监控器时都会去搜索复合事件表达式,效率低下.计算资源是有限的,把所有可能发生的复合事件都检测出来不太实际,有时也没有必要.一个可能的解决方案是:只列出k 个最可能发生的复合事件,即为了尽早评估复合事件发生与否,支持proactive 特性的事件流处理,使用索引技术找出外部事件到达时可能受影响的复合事件,并根据连续到达的输入事件对复合事件发生的影响累积概率,在索引上执行top 2k 选择,找出目前为止发生概率较大即较可能发477计 算 机 学 报2009年生的复合事件,实现proactive 的事件监控能力.网络安全中,主动防御包含两方面的含义:一是能检测出未知的安全威胁,二是能在安全威胁发生前预警.Pro SPer 这两方面对主动防御的支持如下.2.1 未知模式的检测图2 ProSPer 系统结构基于统计分析的方法是检测未知安全威胁非常具有代表性的方法,主要通过已经收到的历史告警信息,基于概率来建立关于告警事件的预测模型.然后,通过训练出的预测模型去计算新告警信息与哪个正处于关联过程中的攻击序列最接近,从而完成整个告警关联的工作.该方法引入了基于时间序列分析的预测方法[4].本文也是基于类似的机制,区别在于Pro SPer 弱化处理时序信息,另外ProSPer 的检测模型是基于数据流的实时、连续方式,并使用了索引技术来提高检测性能.2.2 预警以安全模型P2DR [5]为例探讨Pro SPer 的预警能力.P2DR 是目前信息安全领域具有代表性的安全模型,基本原理为:信息安全相关的所有活动,不管是攻击行为、防护行为、检测行为和响应行为等,都与时间密切相关,因此可以用时间来衡量一个体系的安全性和安全能力.如果防护时间大于检测时间和响应的时间的和,即P t >D t +R t ,也就是在入侵者对攻击目标造成实际的危害之前就能被检测到,若及时处理,则系统是安全的.如前所述,若把安全威胁建模为复合事件,则其不需所有成分事件全部发生,即安全威胁出现苗头但又未发生前,ProSPer 通过动态评估发生概率最大的top 2k 个安全威胁的形式,尽早报告最可能发生的安全威胁告警.基于此动机,本文设计并实现了支持proactive 特性的事件监控系统ProSPer (Proactive Stream Processer ).ProSPer 构建在服务计算平台上,可对运行时服务和服务计算平台本身进行监控.第3节给出本文设计的假设以及ProSPer 的系统结构;第4节给出ProSPer 用于复合事件检测的top 2k 算法TCHy 2brid ,给出了正确性证明和示例;随后给出了算法的实验性能;最后对相关工作进行总结.3 假设与ProSPer 系统结构3.1 假 设麻省理工大学的T apia 在其硕士论文中使用复合事件检测来实现基于对象的活动识别,其研究表明,原子事件的顺序并不提高复合事件检测算法的预测能力[6].本文基于此结论,在事件监控系统的复合事件检测中,把时间上相邻发生的事件看作一个整体,而不考究其复合时序关系.另外,上层应用感兴趣的复合事件对应用的重要程度显然是不同的,因此应5774期刘家红等:ProSPer :一个支持proactive 特性的通用型事件监控系统当在复合事件检测中引入事件的重要性这一因素.最后,本文借鉴信息检索中的相关技术,把检测时需要查找的元数据均存储在数据库中,为其构建索引,以提高检测性能.3.2 系统结构ProSPer构建和运行在面向服务计算平台InforSI B上.InforSI B基于Java开发,是一个支持服务总线和事件通信的面向服务的应用集成开发和运行平台[7].ProSPer对外部触发的应用层事件、业务流程和流程内部服务触发的事件均能进行监控.如图2所示,安全监控等业务领域的应用通过管理控制台向ProSPer注册其感兴趣的安全态势即复合事件.Pro SPer为管理控制台构建底层的事件监控查询表达式,结合查询描述文件中定义的用于检索的元数据,动态生成相应的索引列表.外部事件流输入后,也可以触发相应的索引列表构建动作,同时ProSPer会为其构建时间窗口.时间窗口划分为多个等分时长的更小单元,初始化后每次滑动的单位为一个小单元,如此时间窗口可以重用其中的多个小单元.Top2k处理器根据构建的时间窗口中到达的原子事件来查找索引列表,根据查找的概率以及重要性信息,动态评估此时最可能发生的k个安全态势的发生概率.结果返回到管理控制台,同时复合事件还可持久化,便于之后的离线分析.4 用于复合事件检测的top2k算法传统的基于聚集排序top2k查询算法[8]中,排序访问是指对已排序序列至顶向下的依次访问,随机访问是指从序列中随机获取某个对象的值.FA 必须在排序访问阶段得到至少k个匹配才会停止,不适合proactive特性的事件监控;TA算法至少要比FA停止得早,但是其随机访问开销大;NRA无随机访问,不能用于最后精确输出top2k个复合事件;CA算法权衡了随机访问和排序访问的代价,可看作TA与NRA算法的结合,然而其需要内存来记录很多的中间结果,会加重算法的内存消耗,因此也不适合直接应用于复合事件检测.使用top2k算法进行复合事件检测存在以下两个难点:(1)top2k数据集是多维的,包含了引发事件发生的主体.事件元组的关键字属性和引发主体的组合是区分元组唯一性的要素;(2)top2k查询是根据用户指定的单调聚集函数从数据集中找出函数值最高的前k个结果.简单的概率累加函数是不满足聚集函数性质的.因此,下文先给出复合事件定义的元数据、为复合事件设计的内部数据结构和聚集函数,然后再讨论两阶段算法.4.1 事件元数据在事件监控系统的复合事件检测过程中需要查找事件元数据,其中包括用于触发事件发生的事件主体、原子事件描述、复合事件描述、复合事件重要性、原子事件发生对复合事件发生的条件概率.这些元数据用数据库模式表示,如图3所示.图3 事件定义用到的数据库表4.2 内部数据结构时间窗口中的top2k查询项是原子事件实例,而被查询的数据结构是按事件类型保存的,内部数据结构作为中间层,以桥接事件实例和事件类型定义.另外,到达的安全事件作为原子,还与导致其发生的主体有关,相同主体上发生的原子事件间相互关联,组合成安全态势即复合事件.因此,需要内部数据结构来区分不同的安全事件主体.如图2所示,原始事件流输入到Pro SPer后,Pro SPer为之构建相应的、由多个等长的小单元组成的时间窗口.每个小单元中发生的原子事件均有指针指向索引列表.索引列表分为两层,事件主体为区分事件的第一层,另外,再根据态势即复合事件的步骤数来对数据进行第二层索引,如图4所示.内部数据结构维护top2k查询执行时的运行数据,根据top2k查询来cache数据,保存在cache的数据能提高访问的速度.另外内部数据结构还负责访问数据库.为了进一步提高访问速度,同一事件类型的所有实例共享一个数据库连接(cache).提供的内部数据结构具体如图4所示.677计 算 机 学 报2009年图4 内部数据结构4.3 Top 2k 聚集函数设每个原子事件都对应一张概率表,表示其发生时相应的复合事件发生的条件概率,表按降序排列.复合事件由多个原子事件组合而成.假设原子事件的发生不是互斥的,则原子事件都发生时复合事件发生的概率依据条件概率计算公式来计算.但条件概率的计算不是单调的,因此不能用来进行top 2k 事件查找.另一种方案则把复合事件看为原子事件所代表的不同子阶段的组合,每个子阶段的权重是平等的,把所有子阶段的概率累加,以得到复合事件发生的概率.此时的函数是单调的.设复合事件C x 由n 个原子事件E 1,…,E n (n Ε1)组合而成,C x 的重要性为I m p.C x 的发生概率可定义为∑ni =1Pi+I m p.因为每个复合事件其含有的原子事件个数n 是不定的,可考虑复合事件发生概率计算为∑ni =1P i /n +I m p.在事件检测过程中,假设E 1,…,E m (1Φm Φn )是已经发生的原子事件,C x 的发生概率可通过连续地计算∑mi =1P i /n +I m p 得到.但m 是不确定的,最后修正聚集函数为∑mi =1S i +I m p ,其中S i 是指对复合事件出现概率的实时打分值,将在后面详细介绍.4.4 两阶段算法:TCH ybrid两阶段算法介于TA 算法和CA 算法[8]之间.第一阶段使用排序访问来找出可能的复合事件候选列表,第二阶段使用随机访问来剪枝候选列表以得到最后的k 个复合事件.一方面,排序访问阶段尽量剔除无关的复合事件,因此随机访问阶段所基于的候选列表比TA 算法更具选择性,另一方面,与CA 相比,并不使用周期性的排序和随机访问,因此记录的中间结果要少.TC Hybrid 算法可分为5步,其中语句1,2,3对应步骤1,用于创建并初始化候选列表.语句3调用初始化候选列表算法,在随后详细给出.语句4对应步骤2,根据得到的候选列表计算阈值τ.阈值τ表示当前候选列表中第k 个最大的打分值.语句5与6对应步骤3,维护一个矩阵,矩阵中每个单元根据不同事件主体和事件的子阶段数来区分.矩阵的每个单元包含综合打分值最高的分组,每个分组是一个索引列表.W H IL E 循环中的语句8用于处理对应的最高打分值的分组g .循环语句中的其余语句对应步骤5,用于更新候选列表、阈值、最高分数.当最高打分值低于阈值或索引列表均扫描完毕时循环中止.算法TCHybrid输入:时间窗口tw输出:包含k 个元素的复合事件候选列表topList 1.OwnerListByStage olbs =getOwnerListByStage (tw ,MAX_PECOUN T -1)2.T opList topList =new TopList (k Value ,elbs.getOwnerListSize (),MAX_PECOUN T -1)7774期刘家红等:ProSPer :一个支持proactive 特性的通用型事件监控系统3.initialize TopList(elbs,topList)4.float threshold=topList.get Threshold()5.Coordinates co=topList.getNext FetchItem()6.float next High=co.get HighValue()7.W HIL E((next High>=threshold)&&(!topList.isFinished()))8.processAccording ToCo(co,elbs,topList,timeWindow.get TypeList())9.co=topList.getNext FetchItem()10.threshold=topList.get Threshold()11.next High=co.get HighValue()12.ENDW HIL E13.randomPhase(topList,elbs)4.4.1 排序访问排序访问主要是对复合事件候选列表进行初始化.循环包含两个主要的步骤:第1步对应代码第3～17行,获得当前需处理的原子事件对应的索引列表,包括相应的概率索引列表和重要性索引列表,对所有这些列表进行处理,根据索引列表中的信息,若综合打分值高于阈值,则创建相应的复合事件实例,若在候选列表topList中已有相应的复合事件实例,则更新其打分值和综合打分值;第2步对应18～28行,返回最高的综合打分值,对由主体和子阶段所分组的矩阵进行维护,因此下一次循环可以知道从哪个扫描深度进行.4.4.2 随机访问随机访问阶段同时使用了对候选列表进行剪枝的两种方法.第1种剪枝方法是初步剪枝,把综合打分值低于阈值的复合事件从候选列表中删除.第2种剪枝方法包括两个步骤:首先对候选列表进行预处理,把候选列表分为两个按综合打分值降序排列的表,一个表包含k个最高的值,另一个表包含其余的项;其后的操作对bl进行处理,提取bl 中综合打分值最高的复合事件实例,然后检查内存中的数据并随机访问以得到此事件实例的分数,如果综合打分值高于阈值τ,则此复合事件被插入到tl 中,同时更新τ,如果bl尾部的项的综合打分值低于新阈值τ,剪枝这些项.第2步将循环执行,直至bl 为空.算法Initialize TopList输入:时间窗口tw输出:复合事件候选列表topList1.FOR i=0to olbs.getOwnerListSize()2.FOR j=0to olbs.getNumberOf Stages()3.peT ype=olbs.getOwnerStageList(i).getInverted2ListsOfStage(j)4.High TypeList htl=new High TypeList()float highValueForOwnerStage=0f5.//构造High Value List,得到分数高的列表6.FOR n=0to pe Types.size()7.htl.insert(((Stage TypeList)pe Types.get(n)).get2PEType(),((Stage TypeList)pe Types.get(n)).getCachedRowAt(0).get Probability())8.EL SE typeIndicator++9.W HIL E((htl.get Pointer()!=null)&&(times<j+2))10.highValueForOwnerStage+=htl.get Pointer().get H2ighValue()11.times++;htl.step Forward()12.ENDW HIL E13.htl.reset Pointer()14.//获得重要性列表索引,更新打分值,把hvl表中最高的j个值和重要性值累加15.IF(getCachedImp RowSets(j).size()>0)16.topList.insertByParas(…)17.highValueForOwnerStage+=getCachedImp Row(j,0).get Importance()18.//对每个原子事件对应的索引列表,执行初始化,候选列表按打分值降序排列19.FOR n=0to pe Types.size()20.IF(((Stage TypeList)pe Types.get(n)).getNum2berOfCachedRows()>0)21.ceid=…;probability=…;peid=…22.topList.insertByParas(ceid,j+2,olbs.getOwnerStageList(i).get EventObject(),probability,peid,htl,getCachedImp Row(j,0).get Importance())23.ENDIF24.ENDFOR25.topList.set Indicator(i,j,highValueForOwner2Stage)26.IF(typeIndicator<pe Types.size())27.topList.set FetchDepth(i,j,0)28.EL SE topList.addOne To FinishedCount()29.ENDFOR30.ENDFOR4.4.3 检测结果的正确性证明定理1. 最终的top2k个复合事件输出肯定在排序访问阶段结束后得到的候选列表中.证明. 通过逆否命题来证明.(1)在候选列表topList中,可以得到阈值τ,其意义为第k大的当前打分值.因此在候选列表to2 pList中有k个可能的复合事件,其最终打分值不小于τ.(2)取不属于topList的复合事件ce0,其包含p 个原子事件,其所在的索引列表分组在g p中.因此ce0的最终打分值为S ce=∑pi=1S cei+I ce.(3)在索引分组g p中会一直扫描,直到组中其余项的最高打分值小于τ.因此,设当前组g p的扫描深度为d,则有∑pi=1S dm axi+I d<τ.877计 算 机 学 报2009年 (4)所有成分事件中g p 分组深度d 之前的复合事件均已添加到候选列表.设ce 0的任何成分事件被扫描到的深度为d 0,则d 0不小于d.设ce 0在组g p 中对应的索引列表为l 1,…,l p ,由于列表是降序排列的,则Πi ∈{1,2,…,p},S d 0i ΦS di 且I ce 0ΦI d .累加函数是单调的,因此∑pi =1S ce i Φ∑pi =1S d 0i Φ∑pi =1S d 0i .由(3),∑pi =1Sdm ax i+I d <τ,S dm ax i 是组g p 中深度d 扫描的最大值,因此∑pi =1Sd iΦ∑pi =1S dm ax i .与(2)、(4)结合,则S ce 0=∑pi =1Sce i+I ce 0Φ∑pi =1Sd i+I d Φ∑pi =1Sdm ax i+I d Φτ.又由(1),已有k 个复合事件其打分值大于τ,因此ce 0肯定不在最后的top 2k 集合中.定理1得证.证毕.定理2. 随机访问阶段结束后,最终能从候选列表中找到top 2k 个复合事件证明. 随机访问阶段首先把候选列表topList 分成两个列表,当前打分值最大的k 个复合事件放在列表tl 中,并按打分值降序排列.候选列表中其余的项放在另一列表bl 中.通过对bl 继续扫描更新打分值,如果其实际打分值比tl 表中最小的值要高,把tl 表中的最小值项替换为此项,并从bl 中剪枝此项.更新tl 的阈值.任选候选列表中的元素ce 且ce |tl ,有两种方式来剪枝ce ,或者直接从候选列表中直接剪枝,或者从tl 中剪枝.第1种剪枝方法中,ce 的综合打分值小于当前阈值τ.不需计算,显然ce 的实际打分值S ce 不会大于估计的综合打分值B S ce ,而B S ce 小于τ,因此ce 必定不在最终的k 个结果中.第2种剪枝方法中,ce 的实际打分值S ce 需要计算出来,但其小于τ,不在最终的k 个结果中.定理2得证.证毕.算法RandomPhase输入:候选列表topList ,分组的主体类型列表olbs 输出:包含最终k 个复合事件项的排序列表tl1.first Filter (topList )2.ReviewedCEMap rcm =new ReviewedCEMap ()//访问过的复合事件cache3.ReviewedImpMap rim =new ReviewedImpMap ()//重要性cache 4.ReviewedProbMap rpm =new ReviewedProbMap ()//概率cache 5.//第1步6.SortedList tkl =new SortedList ()7.SortedList bsl =new SortedList ()plexEvent InstanceIncomplete ceii9.FOR i =0to topList.get K ()10.ceii =topList.removeFirst ()11.IF (ceii !=null )//访问过的复合事件12.//添加概率13.//添加重要性14.topList.insert (new SortedObject (ceii ,ceii.getCur 2rentScore ()))15.ENDIF16.EL SE //未访问过的复合事件17.String exp =rs.getString ("expression")18.rcm.insertMapping (ceid ,exp )19.//查找数据库中的复合事件表达式,判断原子事件是否在复合事件表达式中,同时查找其它概率和重要性信息,并添加进来20.ENDFOR 21.//第2步22.float kthScore =tkl.get KthScore (k )23.W HIL E (tl.getSize ()>0)24.ceii =tl.removeFirst ()25.bsl.insert (new S ortedObject (ceii ,ceii.getBestScore ()))26.ENDW HIL E27.W HIL E ((bsl.getSize ()>0)&&(bsl.getLargestScore ()>kthScore ))28.ceii =bsl.removeFirst ()29.//余下操作类同于第一步,忽略30.…31.ENDW HIL E4.4.4 算法的proactive 特性要分析TCHybrid 算法的p roactive 预警能力,只需分析算法的检测窗口内,对于检测出的k 个,各含有n i (i =1,2,…,k )个成分事件的复合事件,运行算法需要检测的原子事件数目m (其中包含了与检测出的复合事件相关的成分事件数目为t i )与n i 的关系.因为TCHybrid 算法有剪枝策略,若m >n i ,最佳打分值B S 为∑t ij =1S j +∑m i -t ip =1H Sp,其中S j 为对相关的成分事件的概率,H S p 为从逆向索引列表中获取的可能最佳打分值,此时访问了t i 次数据库,对逆向索引列表的m i -t i 次访问的时间开销是可忽略的;若m <n i ,最佳打分值B S 为∑t ij =1S j +∑m i -t ip =1H Sp,同理,访问了t i 次数据库,对逆向索引列表的m i -t i 次访问的时间开销也是可忽略的.综合来说,算法检测时9774期刘家红等:ProSPer :一个支持proactive 特性的通用型事件监控系统对于一个有n i 个成分事件的复合事件,实际输入时出现t i 个事件,若t i <n i ,则以t i 次的数据库访问加索引访问的时间就能实现对其的检测,达到预警的目标.t i =n i 时只需要访问索引的延迟时间,则可近实时地将其检测,此时检测的proactive 特性体现在基于统计分析安全事件报警关联上,能实现对未知模式的检测.实际上,对于网络安全的主动防御来说,多源告警信息关联得到的复合事件通常都是多步骤、时间跨度比较大的.Pro SPer 设置的时间窗口大小(通常为1min 内)一般小于其时间跨度,实际运行时报告k 个最可能发生的复合事件时两个阶段(排序访问和随机访问)只涉及到时间窗口内发生的成分事件,因此实际检测时检测的原子事件数目通常是小于ni 的.这说明了TCHybrid 算法的预警能力.4.4.5 示 例下面给出一个示例,设时间窗口内待考察的3个原子事件P E 1、P E 2、P E 3,其内部数据结构如图5左侧所示.事件的重要性其内部数据结构和算法处理与此处的事件概率类似,为简单起见,此处不再涉及.为每个复合事件计算此时发生的概率.综合打分值为累加此扫描深度时所有的复合事件发生概率,k 为2时阈值为第k 个最大的概率,综合打分值和阈值都会随着扫描深度增加而递减,扫描直至综合打分值小于阈值结束.扫描深度1时综合打分值为018+019+017=214,阈值为018.到扫描深度3时,综合打分值112小于阈值114,扫描结束.图5 3个原子事件时的算法运行过程示例4.4.6 内存访问开销当一个原子事件进入系统时,若按如下方式处理:(1)检查复合事件表达式定义;(2)检查复合事件定义中出现在此原子事件之前的事件实例是否发生;(3)使用随机访问来获取之前事件的概率;(4)累积发生的事件的概率.假设有k 个复合事件包含原子事件E x ,上述处理方式处理一个原子事件实例的I/O 成本为∑k1C i(C i 为处理复合事件i 的成本).建立一个复合事件id 上的索引表,则C i =1+∑t11+C j(t 为已发生的原子事件实例数,C j 表示查找索引的成本).因此在出现t 个原子事件后处理一个原子事件实例E x 的总成本为C =k +kt +∑ki =1∑tj =1Ci j.但如果表中存储∑ti =1Si+I m p ,若原子事件到达,则系统只需把表中的值与阈值比较,然后只处理那些比阈值大的值.此时的I/O 成本大大减小.假设有p 个条目的值大于阈值,则处理原子事件实例E x 的成本为1+p ,p νk.5 实 验我们对Pro SPer 的性能进行了模拟实验(环境配置如表1).实验使用不同规模的数据集,规模1～4分别包含了40,60,80,100个原子安全事件以及相应的1200,3000,5000,10000个复合事件.复合事件和原子事件的表示都沿用了前文的实验所用的安全事件格式,但复合事件中未使用表达式D ,因为其中的否定在Pro SPer 中无法检测[7].Pro SPer 解析这些表达式,获知其含有的成分事件数目.另外,ip 地址作为识别所有事件的owner 2id.所有的实验均测试10次,取其平均值.表1 实验环境配置项配置情况 操作系统Windows XP SP2硬件配置Pentium 4312GHz ,1G B RAM J VM 版本J RE 11510Update6数据库MySQL Server 510087计 算 机 学 报2009年。
高效能人士的7个习惯英文关键词
Keywords from《the 7 habits of highly effective people》《高效能人士的七个习惯》关键词第一部分：自我探索 self-exploration品德与技巧Character & personality思考thinking—行为behavior—习惯habit—命运destiny思维定式 paradigm 思维转换 paradigm shift习惯 habit ：知识 knowledge + 技巧 skill + 意愿 desire滤镜 map原则 principle 自然法则 laws of nature由内而外 from inside to outside成熟模式 mature continuum依赖 Dependent 独立 independent 互赖 interdependent产能/产出平衡 P/PC Balance效能 efficiency第二部分：个人领域的成功，从依赖到独立Self-mastery，from dependence to independence习惯一Habit 1：积极主动 be Proactive四大天赋 four talents：自我意识 self-awareness 独立意志 independent will 良知 conscience 想象力imagination自由选择 freedom of choice刺激 stimulate 反应 react积极主动 proactive 和消极被动 reactive责任 Responsibility 与职责 duty关注圈 circle of concern 和影响圈 circle of influence承诺 commitment各个级别的承诺 level of commitment愿望Wish 希望hope 想 like 尝试 try 要 want 承诺习惯二 Habit 2：以终为始 begin with end in mind两次创造 create twice：智力创造 mental create 和体力创造 physical create意愿 desire * 行动 action = 成功 successSMART 原则： SMART principle1 确定的s pecific2 可衡量的 m easurable3 可实现的a chievable4 现实的r ealistic5 有时间限制的t ime生命的核心 center of life配偶husband/wife-家庭family-金钱money-工作job-名利-享乐happy-敌人enemy&朋友friend-宗教religion-自我 self使命宣言 Mission Statement心灵演练 visualization习惯三Habit 3：要事第一 put first thing first管理 management 和领导 leadership勇于说“不” say NO重要 importance 和紧急 urgent时间管理 time management -- 4D原则 4D principle规划做d o it later 立刻做d o it now放弃做d on’t do it 授权做d elete第四代时间管方法六标准 six standards of time management和谐一致Coherence、平衡功能balance、围绕中心focus、以人为本people、灵活变通flexibility、便于携带Portability自我管理四步骤 four steps确认角色set role-选择目标choose targets-安排进度plan-每日调整adjust everyday帕累托法则 80/20 rule第三部分：公众领域的成功，从独立到互赖Public Victory，from independence to interdependence习惯四Habit 4：双赢思维think win-win情感账户 emotional bank account人际关系六种模式 six relations1.双赢win/win2.损人利己win/lose3.独善其身win4.损己利人lose/win5.两败俱伤lose/lose6.无交易 no win or lose勇气 courage 和体谅 consideration双赢五要素 five elements in win/win relationship1双赢品德2双赢关系3双赢协议Win/win character connection contract4双赢体系 system和 5双赢过程process习惯五Habit 5：知己解彼Seek first to understand, then to be understood 沟通是生活中最重要的技能 Communication is the most important skill in life 绝大多数人都是带着答复的目的去倾听 Most people listen with the intent to reply沟通的元素：10%语言+30%声音+60%肢体语言Communication involves：10% language + 30%sounds+ 60%body language先诊断后开方 Diagnose before you prescribe.倾听的层次listening at one of four levels：1、听而不闻 Ignoring2、敷衍了事Pretend Listening3、选择地听Selective Listening4、专注地听Attentive Listening5、同理心地听/移情聆听 Empathic Listening四种自传式回应Four Autobiographical Response1、价值判断evaluating2、追根究底 probing3、好为人师 advising4、自以为是 interpreting适时扮演知音：理解和感知 understanding and perception同理心三字诀Three points of Empathic：等、问、换 wait a moment & shift同理心包含四个发展阶段Empathic listening involves four development ：重复内容 mimic content重整内容 rephrase the content表达感情 reflect feeling重整内容并表达感受 rephrase the content and reflect the feeling同理心雷达（Empathic RADAR）：了解realize、评估assess、决定decide、行动act、检讨review有效表达的基本方面The essence of making effective presentations：品格ethos、情感pathos、理性logos。
Focus on Form
Focus on forms (forms-focused instruction) Pre-selected in the syllabus
Forms are taught in isolation Synthetic approach
Summary:
… a focus on form entails a focus on formal elements of language, whereas focus on forms is limited to such a focus, and focus on meaning excludes it. … the fundamental assumption … is that meaning and use must already be evident to the learner at the time that attention is drawn to the linguistic apparatus needed to get the meaning across (Doughty and Williams, 1998).
(2) Aspects of the L2 input learners need to notice, but do not (for whatever reason), will require some kind of pedagogical intervention (Doughty, 2002).
II. Difference between focus on form and focus on formS
Focus on form (FonF instruction) The word form refers to language form in general; Learners first engage in meaning; then explore some linguistic features. Occasional shift of attention to form Focus on forms (forms-focused instruction) Forms refers to discrete, isolated, specific language forms Primary attention to form
处事态度英语作文模板
处事态度英语作文模板英文回答：Approaches to Handling Situations。
Approaching situations with a positive attitude can significantly impact outcomes and personal well-being. Individuals should consider adopting constructive approaches to ensure effective and satisfying results.Proactive Approach。
A proactive approach involves anticipating challenges and taking initiative to address them before they arise. By being proactive, individuals can:Identify potential obstacles and develop strategies to overcome them.Plan and execute actions that align with long-termgoals.Reduce stress and uncertainty by proactively addressing potential issues.Reactive Approach。
Conversely, a reactive approach involves responding to situations as they occur. While this may be necessary sometimes, it's generally less effective than a proactive approach. Individuals who adopt a reactive approach may face:Limited time and resources to address problems effectively.Increased stress and anxiety due to unpredictable situations.Missed opportunities for growth and improvement.Balanced Approach。
- 1、下载文档前请自行甄别文档内容的完整性，平台不提供额外的编辑、内容补充、找答案等附加服务。
- 2、"仅部分预览"的文档,不可在线预览部分如存在完整性等问题,可反馈申请退款(可完整预览的文档不适用该条件!)。
- 3、如文档侵犯您的权益，请联系客服反馈,我们会尽快为您处理(人工客服工作时间：9:00-18:30)。
前不久一个研究SDN的博士生和博主抱怨说：现在开源的SDN控制器性能都好差啊，每秒钟2K个新流就会提示packet-in太多，停止工作。
博主问他是如何定义一个流的，他说用TCP 5 tuple。
博主又问他是怎么产生那么密集的packet-in 的，他说是用一台服务器直接向SDN控制器发packet-in。
博主接着问那台服务器和SDN控制器的配置，他说服务器是8核，SDN控制器是4核。
博主没有继续问更多的问题，而是在想：是什么原因让人们设计出这样的实验？如果这个实验的数据正确，那么又意味着什么呢？
直到今天，不少人对SDN和OpenFlow都抱有两个误解。
第一，采用OpenFlow
的SDN控制器是在per flow的更新流表。
第二，每个flow有自己的生命周期，控制器只为active flow更新流表，其余的表项则会被删除。
之所以是误解，是因为任何一个版本的OpenFlow标准都没有说per flow的更新，更没有说只为active flow更新流表。
事实上，OpenFlow仅仅定义了控制器和交换机之间的一种接口，根本没提要如何使用这些接口。
一个非常有趣的问题是：人们为什么会对SDN和OpenFlow有以上的误解？首先，OpenFlow这个名字非常糟糕，它本身似乎在暗示人们这个协议是per flow的，但事实根本不是这样。
如果有机会为这个协议重新起名，OpenTable会更合适，因为它本质上是开放了交换机里的各种流表，SDN控制器可以编辑这些流表。
另外OpenFlow协议本身需要交换机采取match+action的方式进行转发，而不是传统的2层+3层+TCAM的转发方式。
这个转发方式的转变是造成人们产生以上误解的一个重要原因。
在早期的OpenFlow实践中，人们发现在现有的硬件ASIC
上很难采取wildcard match+action的转发方式。
最立竿见影的在硬件上部署SDN的方案是仅仅利用ASIC上的TCAM表，因为这张表支持wildcard match，支持drop，forward，broadcast，copy to CPU等多种action。
TCAM表与OpenFlow 协议的转发方式有着最直接的对应的关系。
于是市场上就出现了早期的支持OpenFlow的交换机：它们支持OpenFlow协议，将OpenFlow的每一个Flow Modification Message转变为相应的TCAM表项。
这对SDN和OpenFlow的普及有非常积极的影响。
但它有一个问题：TCAM实在是有些贵，导致即便到了今天，最成熟的ASIC也只支持3K-4K的TCAM表项，这么小的表最多只能做做demo，
规模部署根本是天方夜谭。
天才的SDN先驱们想到一个办法来克服TCAM表过小的问题，那就是采用reactive的方式来编写TCAM。
通俗来说就是：只保存那些active流的表项，那些不再active的表项都会因为超时而被删除。
具体的做法是：对于每个新流的第一个包，交换机不知道该如何处理，于是交换机会向控制器发送一个packet-in，控制器收到这个packet-in之后，计算路径并通过Flow_Mod告诉各个交换机如何转发这个新流。
如果与这个流相关的各个表项在一段时间内没有见到新包，这个流被认为已经结束，相关的表项被从TCAM表中清除。
这个reactive的办法确实从一定程度上解决了TCAM表过小的问题。
不过SDN的后继者们却忘记了TCAM过小是因，reactive是果。
如果一个初学者刚刚读完OpenFlow spec，他可能会想当然的以为SDN by design就是reactive的，而忽视了去探寻reactive的原因。
事实上OpenFlow spec和是不是reactive 没有任何关系。
历史讲到这里，我们再返回头看看文章开始的那个实验。
不难发现，实验设计者在潜意识中就想当然的认为OpenFlow是per flow的并且是reactive的！带着这样的假设设计实验本身就不科学。
很遗憾，这两个不正确的假设仍然在不少SDN研究者的脑子里根深蒂固，于是在实验中，他们会依靠产生不同的TCP 5 tuple来模拟大量新流。
在工业界中，这样的误解会少很多，因为在设计任何一个SDN产品之前，人们会评估设计的瓶颈：如果每一个新的TCP 5 tuple都会引起packet-in的话，SDN控制器肯定会成为系统瓶颈，这种系统设计会被毫无疑问的在第一时间抛弃。
我们从来没有听说过哪个厂商公布他们的控制器处理packet-in的能力，不是因为这是他们的机密，而是因为系统的稳定程度在设计上就与新流产生的速度无关，根本就没有人关心这个测试结果。
分析到这里，我们已经知道reactive的模式虽然在一定程度上解决了由于TCAM 过小带来的问题，但也让SDN控制器成为了系统的瓶颈。
如果文章最初的那个实验数据是正确的，那么reactive的SDN控制器根本无法控制大规模的网络和流量。
在这种情况下，也许会有人建议去研究如何提高SDN控制器的性能，使其不再成为瓶颈。
但这样便是典型的舍本逐末，解决一个本来可以不存在的问题。
试想，如果TCAM足够大，人们还会采用reactive的方式来设计SDN系统吗？显然
不会。
与之相对应，proactive会成为一个更合理的方式，即：在新流还没有来到之前，就把相应的表项编辑好，这样，新流出现就不会引起packet-in了。
看到这里，也许有朋友会问：1) SDN控制器怎么知道会有什么流产生？2)TCAM 只有那么大，如果在新流产生之前就主动的编辑好流表，怎么装得下？
其实这两个问题都是伪问题，之所以把它们列在这里是为了让文章的逻辑保持连贯。
提出问题1的人仍然在局限在SDN是per flow的误解里面。
除非人为的调度，SDN控制器永远不会聪明到能够猜出会有什么新流产生。
但是没关系，问题的关键不在于知道会有什么新流产生，而在于知道各个设备在哪里。
互联网发展到今天，从来都不是per flow转发，而是per device转发！传统的二层交换机需要学习(vlan, mac)到port的映射，其实就是在学习各个device在哪里。
只要知道mac1在port1，不管什么flow，只要是去mac1的就转发到port1。
同样的逻辑可以非常自然的推广到SDN里面，控制器可以学习各个device在哪里，并且告知网络中的交换机们如何达到各个设备。
学习的渠道可以很多，比如ARP，LLDP，LACP等等。
学习mac不过瘾，还可以学IP。
总之，如果把per flow的mental model转变为per device的mental model，SDN系统设计的一切都会变得自然很多。
问题2是一个更大的伪问题。
正如在之前的段落中介绍的那样，SDN的先驱们非常理想化的设计了OpenFlow协议，后来发现只有昂贵TCAM才能够和OpenFlow 协议产生比较直接的对应，于是OpenFlow和TCAM才成为难兄难弟，总是成双成对的出现。
问题是：我们的目的是用集中控制的方式简化网络管理，为什么一定要用TCAM？又为什么一定要用OpenFlow？这才触及到问题的本质。
博主的答案是：我们不一定要用TCAM，我们也不一定要用OpenFlow。
一切都是design choice，只有不同的选择，没有最好的选择。
比较有代表性的是学院派和工业界的选择。
学院派以Nick McKeown教授为代表，主张彻底重新设计硬件交换芯片[link]，使其完全适应OpenFlow协议。
工业界的做法没有那么激进：cisco设计了ACI和OpFlex，让协议适应硬件ASIC；BigSwitch沿用了OpenFlow，但是只使用TCAM存放复杂的规则，而用L2和L3的表来存放一般的转发规则，
在最大程度上规避了TCAM大小的局限。
在多方的共同努力之下，SDN和OpenFlow 设计之初的种种限制正在成为历史，reactive的系统设计也完成了它的历史使命。
现在实用的proactive的SDN系统大概长这个样子：1) SDN控制器不断学习网络中的各种设备，包括交换机，链路，服务器，虚拟机等等，2) 管理员通过某种语言配置业务关系，比如multi-tier application和service chaining。
3) SDN控制器翻译用户配置并且通过南向接口编辑交换机中的L2，L3表，这里的表项不是per flow的，而是per device的。
SDN控制器同样通过南向接口将租户的业务逻辑转变为TCAM表项，这里的表项更复杂，可能需要匹配
source+destination以及L4的某些字段。
采用proactive的方式设计SDN系统还有一个更大的好处是它极大的简化了High Availability(HA)的设计，让SDN控制器不再成为整个系统的单点故障(single point of failure)。
以后的文章会对这一点进行深入讨论。
讲了这么多，博主只是在传达一个信息：采用reactive的方式设计SDN系统是有历史原因的。
现在这些原因都已经不再存在，proactive的SDN系统设计已经成为主流。