嵌入内核式状态检测防火墙的研究与实现  

Research and Implementation of the Embedded Kernel State Inspection Firewall

作　　者：袁暋[1,2] 侯整风[1] 钟伯成[2] 檀明[2] 

机构地区：[1]合肥工业大学计算机与信息学院,合肥230009 [2]合肥学院计算机科学与技术系,合肥230601

出　　处：《合肥学院学报（自然科学版）》2009年第2期33-37,共5页Journal of Hefei University :Natural Sciences

摘　　要：利用过滤器挂钩驱动程序(Ipfltdrv)机制,在Windows 2000/XP内核嵌入用户自定义状态检测模块来过滤数据包.使用TCP包SYN/ACK标志位和UDP包虚连接建立方式维护状态监测表,实现了状态检测.根据状态表存量实时对时间溢出值进行动态调控,控制状态表内表项的存量,避免遭受拒绝服务(DoS)攻击,提高了防火墙抗攻击性能.By using the mechanism of Ipfltdrv, a state inspection module was embedded in the kernel of Windows 2000/XP to filter data packet. State monitor table can be maintained by using TCP SYN/ ACK flag and UDP virtual connection. Thus, state detection can be realized. The overflow value of time can be dynamically adjusted according to the state remainder value. In this way, the remainder value can be controlled and Dos attack can also be avoided, which enhance the performance of the anti-attack of firewall.

关 键 词：防火墙 状态检测 过滤钩子驱动 

分 类 号：TP309.5[自动化与计算机技术—计算机系统结构]