【正文】 s knowledge status with regard to c. Depending on the value of CF(c), c is considered as pletely learned (CL), learned (L), or unlearned (UL) by this student. Furthermore, the level of the knowledge gained by the students through out the course topics is categorized as Excellent, Good, or Weak. TADV also considers the students’ participation in discussion forums (as given in the WCMS tracking data) to build a picture of the municative activities of each student. TADV uses SM to inform the teachers when a student is experiencing problems or is not municative, and to suggest appropriate activities to stimulate the student. In addition, the teacher can be advised to encourage students with excellent and good knowledge to help their struggling peers. Group and Class Models. TADV gives the teacher the choice to define groups ofstudents to be monitored. It is, therefore, possible to model groups of students andgenerate advice to highlight existing group problems. The main goal of GM is toenable TADV to infer about the mon problems that might happen to the majorityof students in the group and how these problems are related to the moncharacteristics of the students in the group. Similarly to existing group modelingapproaches (see [1]), GM is derived through the aggregation of the individual SM ofthe group members, . it depends on the interactions made by all students in aspecific group. A Group measure of belief GMB(c) and measure of disbelief GMD(c)in regard to a concept c are calculated using certainty factors theory using MB(c) andMD(c) of all group members, respectively. Then, a group Certainty Factor GCF(c) =GMB(c) GMD(c) is calculated to estimate the group understanding of c. GM alsoassesses the munication activities of the whole group. Similarly to GM, CMreflects the knowledge status and the municative aspects of the whole class,considered as one big group of students. GM and CM are used, for example, todetermine parts of the course that cause problems to many students, assessmentquizzes that are too challenging or too easy, types of learning objects preferred by thestudents, munication activities monly/rarely used, etc.Student Model Builder. (SMB) is the module that analyses WCMS tracking data and generates SM, GM, and CM. SMB may be executed periodically (. daily orweekly) or when required by the course facilitator. This depends mainly on therequired interval of time between advicegeneration sessions (. in the studydescribed in Section 6, SMB was executed daily). SMB contains three main modules:(a) Interaction Interpreter that process tracking data and stores information in thestudent behavior model。 see [6] and [7] for more details. The Advice Generator (AG), which is presented in Section 4, is a module that uses the SM, GM, and CM together with relevant information in DMK to produce appropriate advice to teachers.3 Modeling Students in TADVIndividual Student Models. The SM represents individual students and includes four parts: (1) Student Profile general information about the student, (2) Student Behavior student39?？傊?，這個(gè)系統(tǒng)仍然存在著很多不足，這恰恰也是我們不斷深入研究的動(dòng)力。 雖然這個(gè)系統(tǒng)取得了初步的進(jìn)展，但是限于時(shí)間的不足和知識(shí)的缺陷，仍然有很大的設(shè)計(jì)空間，希望可以在以后的學(xué)習(xí)工作中作進(jìn)一步的完善。（6）過(guò)濾掉冗余的數(shù)據(jù)包，加快系統(tǒng)的處理速度。（2）學(xué)習(xí)各種網(wǎng)絡(luò)協(xié)議，如TCP/IP和OSI，并分析它們的相似點(diǎn)與不同點(diǎn)。 通過(guò)這次畢業(yè)設(shè)計(jì)，我不僅重新學(xué)習(xí)了與網(wǎng)絡(luò)原理相關(guān)的的很多知識(shí)，而且極大的提高了我的自主學(xué)習(xí)能力，這為我在以后的學(xué)習(xí)和工作中打下了良好的基礎(chǔ)。因?yàn)榉阑饓θ菀自斐删W(wǎng)絡(luò)的延遲。依據(jù)用戶的身份和等級(jí)，如果用戶是有通行密碼的，它可以通過(guò)輸入密碼完成對(duì)網(wǎng)頁(yè)的訪問(wèn)。RETR:代表準(zhǔn)備下載的東西,RETR緊接著的的是目標(biāo)程序。數(shù)據(jù)庫(kù)服務(wù)器包含有一個(gè)FTP服務(wù)器,緊接著把含有非法網(wǎng)址的黑名單的副本通過(guò)TXT的形式存儲(chǔ)到FTP中,為數(shù)據(jù)更新模塊的隨時(shí)下載提供便利。web訪問(wèn)監(jiān)控系統(tǒng)配備了專門的黑名單數(shù)據(jù)庫(kù),并把它存儲(chǔ)在數(shù)據(jù)庫(kù)服務(wù)器里3。發(fā)送完畢后，這些就要準(zhǔn)備發(fā)送到用戶的瀏覽器中。3xx:代表重定向,例如301代表要求的把URL轉(zhuǎn)換到了新的位置。狀態(tài)行由三部分構(gòu)成,即HTTP的版本,狀態(tài)碼,以及CRLF。它會(huì)假裝是web服務(wù)器向?yàn)g覽器發(fā)送一個(gè)重定向的響應(yīng)報(bào)文，并且使瀏覽器切換到系統(tǒng)預(yù)先設(shè)計(jì)的網(wǎng)頁(yè)上去，對(duì)用戶起到警告的作用。當(dāng)發(fā)現(xiàn)瀏覽器訪問(wèn)的是非法網(wǎng)址時(shí)，服務(wù)器就重定向到它預(yù)先設(shè)計(jì)的網(wǎng)頁(yè)上，達(dá)到警告用戶的目的。(3)計(jì)算移位之后的URL地址,將相應(yīng)位置數(shù)組的值或上Ox02。在第一遍結(jié)束后,把數(shù)組對(duì)應(yīng)位置的值的第一個(gè)比特位置1,接著把字符串循環(huán)移位。i++)b[i%4]A=s[i]。ehar*b=(ehar*)amp。算法如下:(l)給定兩個(gè)32位int x和int y,令x=0,y=0。這個(gè)系統(tǒng)是在混雜模式下進(jìn)行的，所有的網(wǎng)址都經(jīng)過(guò)網(wǎng)卡，預(yù)先設(shè)置的頁(yè)面一定將重定向報(bào)文在員工或?qū)W生要求瀏覽的網(wǎng)頁(yè)的前面到達(dá)員工或?qū)W生的電腦。這個(gè)代理網(wǎng)站與瀏覽器要訪問(wèn)的目標(biāo)網(wǎng)站發(fā)生請(qǐng)求聯(lián)系，請(qǐng)求成功后，代理網(wǎng)站把目標(biāo)網(wǎng)站發(fā)送給瀏覽器。(2)處理POST報(bào)文由于網(wǎng)絡(luò)上混雜著一種可以進(jìn)行網(wǎng)頁(yè)代理的網(wǎng)站。有兩種情況不得不考慮進(jìn)去。 HTTP請(qǐng)求報(bào)文對(duì)于GET報(bào)文和POST報(bào)文,處理方法不同,要分別進(jìn)行處理。因此只分析關(guān)于GET和POST的報(bào)文，將這些報(bào)文交給下一個(gè)模塊（網(wǎng)址匹配模塊）。攔截方法模塊工作流程如圖 。在這里要介紹“白名單”。//混雜模式m_hCapThread = CreateThread(NULL, 0, CaptureThread, this, 0, NULL)。bopt, sizeof(bopt)) 。sa, sizeof(sa))。一個(gè)程序的運(yùn)行可以使用多個(gè)進(jìn)程并發(fā)執(zhí)行。如果一個(gè)程序只是有一個(gè)或少數(shù)幾個(gè)進(jìn)程完成，處理器一方面要求分析模塊要提取有效信息，進(jìn)行網(wǎng)址匹配。這個(gè)時(shí)候并不能獲取通過(guò)這個(gè)網(wǎng)卡的數(shù)據(jù)幀,對(duì)于不是發(fā)送到本機(jī)的數(shù)據(jù)幀，實(shí)行丟棄的方法，從而來(lái)減輕網(wǎng)卡的負(fù)擔(dān)。(2)將網(wǎng)卡設(shè)置為混雜模式。 （4）該系統(tǒng)的運(yùn)行前提是不影響我單位局域網(wǎng)的正常運(yùn)轉(zhuǎn)，更不能造成我單位局域網(wǎng)新的安全威脅。（4） 數(shù)據(jù)庫(kù)維護(hù)人員應(yīng)該實(shí)時(shí)關(guān)注黑名單的更新，做到不漏掉一個(gè)非法網(wǎng)址。 （6）系統(tǒng)支持即插即用方式，系統(tǒng)的實(shí)施不需要改變?cè)瓉?lái)現(xiàn)有網(wǎng)絡(luò)結(jié)構(gòu)，簡(jiǎn)言之就是安裝這個(gè)系統(tǒng)并不影響網(wǎng)絡(luò)的流暢性性。從而保證整個(gè)局域網(wǎng)的可用性、可生存性。 性能需求本文的 Web 監(jiān)測(cè)系統(tǒng)需要滿足的性能需求主要有以下若干方面。等下一次有人訪問(wèn)時(shí)，攔截服務(wù)器就可以直接組織其正常訪問(wèn)并彈出管理員預(yù)先設(shè)置好的界面。從用戶的角度看,就是所要訪問(wèn)的網(wǎng)頁(yè)被攔截了。其用例圖如圖 。IP包過(guò)濾部分的主要作用就是只保留HTTP協(xié)議中的GET報(bào)文和POST報(bào)文，而把除此之外的數(shù)據(jù)舍棄掉，這樣就可以極大的減少工作量，并且可以加快網(wǎng)址匹配的速度。從用戶的角度看,就是所要訪問(wèn)的網(wǎng)頁(yè)被攔截了。 網(wǎng)絡(luò)監(jiān)聽模塊用例圖（2）攔截策略控制模塊這個(gè)模塊具有很強(qiáng)的自主性，它可以隨時(shí)根據(jù)管理員的需要進(jìn)行開啟或者關(guān)閉。綜上所述，Web訪問(wèn)監(jiān)控系統(tǒng)有著很大的市場(chǎng)前景和社會(huì)效益。不難發(fā)現(xiàn)我國(guó)對(duì)于凈化網(wǎng)絡(luò)環(huán)境的重視程度，盡管這樣，仍有很多非法網(wǎng)站逍遙法外，嚴(yán)重危害著社會(huì)的和諧穩(wěn)定，這些非法網(wǎng)站的服務(wù)器大多都設(shè)在中國(guó)境外，這也給相關(guān)查處部門帶來(lái)了不小的難度。 這個(gè)工程的成本主要由兩部分構(gòu)成：硬件成本和軟件成本。 Web訪問(wèn)監(jiān)測(cè)系統(tǒng)地最主要的功能是判斷用戶訪問(wèn)的網(wǎng)站是否含有有害信息，對(duì)于有有害信息的網(wǎng)站要進(jìn)行攔截，并轉(zhuǎn)入一個(gè)健康的網(wǎng)站。還介紹了HTTP協(xié)議和IP協(xié)議的一些基本知識(shí)，最后簡(jiǎn)單說(shuō)了關(guān)于數(shù)據(jù)包捕獲的幾個(gè)函數(shù)。其中，s為一個(gè)套接口的句柄，dwIoControlCode為操作控制代碼，lpvInBuffer為輸入緩沖區(qū)的地址，cbInBuffer為輸入緩沖區(qū)的大小，lpvOutBuffer為輸出緩沖區(qū)的地址，cbOutBuffer為輸出緩沖區(qū)的大小，lpcbBytesReturned為輸出實(shí)際字節(jié)數(shù)的地址，lpOverlapped為WSAOVERLAPPED結(jié)構(gòu)的地址，lpCompletionRoutine為一個(gè)指向操作結(jié)束后調(diào)用的例程指針。 //指定的端口號(hào)struct in_addr sin_addr。（3）綁定函數(shù)bindint bind ( SOCKET s , struct sockaddr_in* name , int namelen)。（1）啟動(dòng)函數(shù)WSAStartupint PASCAL FAR WSAStartup (DWORD wVersionRequested , LPWSADATA lpWSAData)；所有的套接字應(yīng)用程序都首先運(yùn)行這個(gè)函數(shù)完成初始化工作，僅僅當(dāng)完成調(diào)用返回后，才可以使用套接字，括號(hào)中wVersionRequested是版本號(hào)，參數(shù)lpWSAData是指向WSADATA結(jié)構(gòu)的指針。（13）任選項(xiàng)域：長(zhǎng)度不是固定不變的，是可以變化的。（11）源地址域：長(zhǎng)度為32比特。例如：ICMP的值為1（十進(jìn)制），TCP的值為6，UDP的值為17。(8)生存時(shí)間域:長(zhǎng)度為8比特，用于指明IP分組可在網(wǎng)絡(luò)中傳輸?shù)淖铋L(zhǎng)時(shí)間，這個(gè)數(shù)值每通過(guò)一個(gè)路由時(shí)要減1，直至減到0時(shí)，這個(gè)分組就會(huì)被舍棄。(6)標(biāo)志域:長(zhǎng)度為3比特。(4)總長(zhǎng)度域:長(zhǎng)度為16比特，用于指明IP分組的總長(zhǎng)度，單位是字節(jié)，包括分組頭和數(shù)據(jù)區(qū)長(zhǎng)度。用于指明IP分組頭的長(zhǎng)度，其單位是4個(gè)字節(jié)。IP包首部固定部分各字段意義如下:(1)版本:長(zhǎng)度為4比特。IP協(xié)議的實(shí)現(xiàn)十分簡(jiǎn)