【作者】 张林；

【导师】 高岭；

【作者基本信息】 西北大学 ， 计算机软件与理论， 2009， 硕士

【摘要】 计算技术的发展给人们生活带来了深远的影响,在生产系统中普遍引入了种类繁多的计算系统。一方面,计算技术的进步提高了社会生产力,另一方面,计算技术本身的脆弱性也让生产系统面临威胁。计算系统的漏洞常为攻击者所利用,从而对生产系统造成一定的影响,而在生产系统中引入漏洞评估系统,可一定程度地缓解这种不利影响,巩固生产系统的安全性。漏洞曝露的增长较之补丁发布要快的事实与安全工具生产商的技术力量配置不均衡的事实都使得安全工具生产商彼此之间需要更宽广范围的合作与理解。而安全工具生产商之间技术标准的不一致使得彼此之间不能相互理解和消费对方生产的安全数据,使得漏洞评估日趋复杂,不利于漏洞的快速排除。另外,计算网络在规模、配置、性能上的差异对漏洞评估也有着不同的需求,而单一结构型漏洞评估技术要么需要较高的计算成本,要么需要额外的网络资源,对计算网络造成一定影响,不能适应多种计算网络。基于上述事实的考虑,为了减少计算成本、节省网络开销、缩短漏洞发现到应用补丁之间的窗口期,经过对漏洞评估相关的理论与技术的研究后,本文设计并且初步实现了一个分层多服务器型,混合结构型分布式漏洞评估系统。该系统1)采用多服务器结构以实现客户业务的分流;2)采用分层结构对多服务器进行统一集中的管理;3)支持多种漏洞评估技术,可根据计算网络运行状况选择合适的漏洞评估方式;4)采用插件架构以提高系统的扩展性,可通过添加插件的方式对新漏洞进行评估;5)采用NASL脚本等成熟技术以实现基于网络的漏洞评估;6)引入CPE、CVE、OVAL等国际标准增强安全工具之间的互操作性;7)给出了基于web的友好的人机交互界面,可方便地浏览/发现主机,添加/删除评估任务等。该系统的实现证明该设计方案具备较强的伸缩性,较高的实用价值,有利于消除安全工具生产商的技术力量配置差异,有利于缩短漏洞发现到应用补丁之间的窗口期,有利于增强生产系统的安全性。更多还原

【Abstract】 The development of computing technologies brought people’s lives profound influences, various computing systems were introduced into production systems. On the one hand, advances in computing technologies improved the social productive forces; on the other hand, vulnerabilities of computing technologies themselves threatened production systems. Vulnerabilities in computing systems are often used by attackers and affect production systems certainly. The introduction of vulnerability assessment system into production systems can alleviate the adverse effects and consolidate the security of production systems.The fact that the growth speed of vulnerability exposure is faster than patching publishing, and the imbalance in technical force configuration between security tools manufacturers make them need a broader range of cooperation and understanding. Differences between standards in use make manufacturers can not understand and consume security data produced by them each other and vulnerability assessment more difficult and complex to cleanup. In addition, the differences in size, configuration, performance of computing networks make them have different requirements on vulnerability assessment, while a single structure-based vulnerability assessment technologies require either higher computing cost or additional network resources, place certain affection on computing networks, are not applicable to every computing network.Considering the above facts, to reduce computing cost, save network expense and shorten the window between vulnerability exposure and patching publishing, after research on vulnerability assessment relevant rationale and technologies, the paper designs and initially implements an multi-tiered servers-based, mixed-structural, distributed vulnerability assessment system.The system 1) arranges multiple servers to handle clients’ business; 2) centralizes the management of servers by demarcating servers into multiple layers; 3) supports multiple vulnerability assessment methods and can select appropriate method according to the performance of the computing network; 4) uses plug-in architecture to improve the scalablility of the system and can assessment new vulnerabilities through adding new plugins; 5) uses mature techonologies such as NASL to archive network-based vulnerability assessment; 6) introduces international standards such as CPE, CVE, OVAL to strengthen the interoperability between security tools; 7) has a friendly web-based human-machine interface, operators can browse/discovery hosts, add/remove assessment tasks through it.The implementation of the system proves that the design schema has strong flexiblility,highly utility value, is helpful to eliminate differences in technical force configuration between security tools manufacturers, shorten the window between vulnerability exposure and patching publishing and strenthen the security of production systems.更多还原