【作者】 周连兵；

【导师】 朱连章；

【作者基本信息】 中国石油大学 ， 计算机技术， 2007， 硕士

【摘要】 人们为了防范信息系统遭受入侵或攻击,常会使用各种网络安全系统如防火墙、入侵检测系统建构防御系统,然而以现今的技术及现实状况,防御系统仍需要管理者紧密的配合才能正确的阻断攻击,为了让网络安全系统能更为灵敏且自动化针对攻击进行正确的防御动作,本文将研究与设计一个效能及安全性兼顾的联动型网络安全系统。主要包括以下三部分工作:第一,设计开发防火墙分派器。当网络流量逐步增加到防火墙系统不能负担时,更换更高阶的防火墙不仅非常昂贵而且费时费力,所以如果能以类似集群的概念,以一群防火墙主机,平均分担一部主机所负责的工作,将会使效能的扩充非常具有弹性,而如何在负载平衡的概念下平均分给一群主机也是重点研究的课题。第二,研究开发规则调整系统。入侵检测系统虽能告知管理者相关的攻击信息,但管理者仍必须自行变动规则,这样就丧失了第一时间防御攻击的可能性,该研究能让入侵检测系统在发现攻击信息后,动态的变更防火墙主机的规则,阻断攻击者进一步的行动。第三,搭建网络安全实验平台。根据该研究方案的具体要求,设计搭建一个网络安全综合实验平台,利用该平台,比较应用联动型网络安全系统前后防火墙负担,拦截效率等的不同之处。更多还原

【Abstract】 For integrated security, we often integrate several network security systems such as firewall and intrusion detection system as a defensive system to prevent our information system being intruded. But according to current developed technology and practical situation, network administrator and the defensive system still have to work cooperatively to block intruders. In order to make the defensive system more sensitive and automatic and let it response to intrusions correctly, it will be the major objective for this project to research and design a secure, efficient and intelligent defensive system.The intelligent defensive system is composed of the following parts.The first,Firewall dispatcher.As the network activities grown up, firewall often become a bottleneck of network communication. Some attacking tricks, like DOS, will make the problem more serious. And when firewall system can not handle the increasing network communications, it will take much of time and cost a lot. If we can use the concept similar to cluster, we replace a single expensive firewall by a group of general firewalls and let them have the same function. The expansibility of firewall will be very elastic. So, our research objective will be how to dispatch the jobs into firewall group approaching the concept of load balance.The second,Self-adapting rule system.Although the intrusion detection system can provide the information about attacks for network administrator, but the administrator still have to change the firewall rules by himself to block the intruders. It will be minute and complicated and the chance to defend just in time will be lost. If the intrusion detection system can dynamically and automatically change the rules of firewall in order to block the attacker as quickly as possible when find alerts of attacks, it will make the defensive system more intelligent responding to attacks.The third, the platform of experiment. According to request of the project, the design will build the safe comprehensive experiment terrace of a network.更多还原