基于ACE和SSL的Firewall与IDS联动系统研究  

Research of the linkage system of firewall and intrusion detection system based on ACE and SSL

作　　者：马占飞[1] 尹传卓[2] 

机构地区：[1]内蒙古科技大学包头师范学院,内蒙古包头014030 [2]内蒙古科技大学信息工程学院,内蒙古包头014010

出　　处：《计算机工程与科学》2014年第8期1486-1492,共7页Computer Engineering & Science

基　　金：国家自然科学基金资助项目(61163025);内蒙古自治区自然科学基金资助项目(2010BS0904);内蒙古自治区高等学校科学研究基金资助项目(重点项目)(NJ10162);内蒙古自治区高等学校科学研究基金资助项目(NJZY07116)

摘　　要：随着Internet的迅猛发展,网络攻击的方法和技术越来越智能化和多样化,网络安全需求与日俱增。传统的防火墙(Firewall)与入侵检测系统IDS已不能满足网络安全整体化需求。鉴于此,引入ACE网络通信中间件和SSL协议,采用开放接口方式,从网络安全整体性与动态性的需求考虑,设计了一种新型的基于ACE和SSL通信平台的Firewall和IDS协同联动系统模型。该系统模型融合了Firewall和IDS的优点,采用加密信息传输机制、策略管理机制和联动分析算法,确保了传输信息的可靠性、完整性和机密性。实验结果表明,该联动系统不但能够有效地检测和防御攻击,而且具有良好的协作性、通用性和可扩展性。With the rapid development of Internet,some intelligent attack methods and techniques are increasing.The network is easily attacked by hackers or malicious software.The safty problem is in creasingly outstanding in computer network.The traditional technologies of firewalls and Intrusion De tection Systems （IDSs） own poor security,high false alarm rate,and low level of intelligence.Consider ing the demands of obtaining integrity and dynamics in network security,a novel linkage system model of firewall and IDS based on open communication platform of ACE （Adaptive Communication Environ ment） and SSL （Secure Socket Layer） is proposed.This system model combines the advantages of fire wall and IDS,and uses the encrypted information transmission mechanism,and the policy management mechanism,and the associated linkage analysis algorithms to ensure the reliability,integrity and confidentiality of the transmitted information.Experimental results show that the linkage system can effectively prevent network from attacks,and possesses better cooperativeness,universalness and expansibility.

关 键 词：网络安全 入侵检测系统 防火墙 联动 中间件 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]