一种计算机网络防御策略描述语言  

Computer network defense policy specification language

作　　者：魏玉娣[1] 夏春和[1] 李肖坚[1] 王海泉[1] 何巍[1] 

机构地区：[1]北京航空航天大学网络技术北京市重点实验室,北京100083

出　　处：《计算机应用研究》2008年第8期2420-2424,共5页Application Research of Computers

基　　金：北京教育委员会共建项目建设计划基金资助项目(SYS100060412);国防基础科研基金资助项目;国家“863”计划资助项目(2007AA01Z407)

摘　　要：定义了一种计算机网络防御策略描述语言(computer network defense policy specification language,CNDPSL)。该语言面向CNDPM模型,能够统一描述保护、检测和响应策略,并通过策略引擎映射为相应的防御规则。CNDPSL是一种声明式语言,抽象了网络防御控制的行为,对网络防御需求具有较好的灵活性、可扩展性和适应性。在GTNetS仿真平台中的实验表明,该语言能够描述防御策略并有效地转换为防火墙的ACL、检测和响应规则等,从而为计算机网络攻防演练提供防御策略支持。This paper defined a new computer network defense policy specification language （CNDPSL）. This language pro- vided a common method of specifying protection, detection and response policies based on CNDPM model, which could be mapped to corresponding defense rules by policy engine. CNDPSL was declarative abstracting defense control behavior of net- work which made this language flexible, extensible and adaptable to network defense requirements. Experiments in GTNetS platform indicated that it can describe defense policies and transforms to ACL （access control list） in firewall, IDS detection rules, response rules and so on. The above information shows that CNDSPL can provide defense policy support for computer network attack ＆ defend simulation.

关 键 词：计算机网络防御 策略 计算机网络防御策略模型 描述语言 策略引擎 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]