基于动态防火墙SecuRouter的网络安全框架  

Network Security Framework Based on the Dynamic Firewall of SecuRouter

作　　者：金舒[1] 刘凤玉[1] 

机构地区：[1]江苏省南京理工大学计算机科学与技术系,210014

出　　处：《微计算机信息》2006年第04X期66-69,共4页Control & Automation

基　　金：国家自然科学基金资助项目(60273035)-"软件抗衰和自愈"资助南京理工大学科研发展基金2005-"网络性能诊断与安全"资助

摘　　要：常见的网络防火墙系统因受其相对固定的规则集的限制而仅可以过滤掉已知类型的攻击数据包,因而只能为受保护局域网络提供静态的安全性。我们提出了一种网络安全框架,其核心是由一台联接外网与内部局域网的双穴主机所构成的动态防火墙SecuRouter。该动态防火墙在进行传统包过滤工作的同时可以依据局域网内的各入侵检测Agent所提供的信息动态地更新规则库,从而为整个局域网提供动态的保护。通过给出一个与入侵检测Agent通信的接口,该安全框架提供了对不依赖于具体算法的、可扩展的实时入侵检测能力的支持。同时,双穴主机上的网络数据包日志功能也为对网络数据流的进一步离线分析提供了可能。As the traditional fircwaUs can only filter the known types of attacks through blocking the packets sent from/to designated IP addresses or ports, they provide the LAN with only static and very limited protection. We present in this paper a security framework with a double-homed host （SecuRouter） at its core, which is a firewall that can dynamically modify its rule set from the notification messages sent by the legitimate intrusion detection agents running in the protected LAN. Through providing a uniform interface with these algorithm-independent intrusion detection modules, our approach shows a better adaptability and extensibility. Also provided in the framework is a packet logging mechanism and further off-line analysis of the network traffic will be easy with its help.

关 键 词：防火墙 动态防火墙 入侵检测 双穴主机 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]