网络安全新锐 新一代智能防火墙

防火墙已经被用户普遍接受,而且正在成为一种主要的网络安全设备。防火墙圈定一个保护的范围,并假定防火墙是唯一的出口,然后防火墙来决定是放行还是封锁进出的包。传统的防火墙有一个重大的理论假设——如果防火墙拒绝某些数据包的通过,则一定是安全的,因为这些包已经被丢弃。但实际上防火墙并不保证准许通过的数据包是安全的,防火墙无法判断一个正常的数据包和一个恶意的数据包有什么不同,而是要求管理员来保证该包是安全的。管理员必须告诉防火墙准许通过什么,防火墙则依据设置的规则来准许该包通过,这样管理员就必须承担策略错误的安全责任。然而,传统防火墙的这种假设对网络安全是不恰当的,安全效果也不好。把安全责任交给安全管理员,实际上就没有解决安全问题。新一代的防火墙应该加强放行数据的安全性,因为网络安全的真实需求是既要保证安全,也必须保证应用的正常进行。     

基于哈夫曼树的防火墙规则动态优化的研究

随着网络功能的不断增加,防火墙过滤规则集合日益庞大,已严重影响了网络整体性能。本文基于网络流量的特征,提出一种根据网络流量变化动态调整防火墙规则的防火墙规则优化方法,使得匹配网络数据包越多的规则越先与数据包相匹配,从而尽量减少数据包过滤时间。     

基于防火墙策略路由的网络安全应用研究

随着互联网的飞速发展,网络安全逐渐成为一个潜在的巨大问题。防火墙是网络安全的关键技术,策略路由可以使数据包按照用户指定的策略进行转发。针对日益复杂的网络多出口问题,本文介绍了基于源地址的策略路由,提出了一种结合策略路由、网络地址转换等多技术的多出口配置方案,并比较了策略路由和路由策略的区别。基于防火墙设计策略路由,并结合网络地址转换,可以提高网络出口资源利用率,实现网络负载均衡,保护校园网安全。     

基于防火墙策略路由的网络安全应用研究

随着互联网的飞速发展,网络安全逐渐成为一个潜在的巨大问题。防火墙是网络安全的关键技术,策略路由可以使数据包按照用户指定的策略进行转发。针对日益复杂的网络多出口问题,文中介绍了基于源地址的策略路由,提出了一种结合策略路由、网络地址转换等多技术的多出口配置方案,并比较了策略路由和路由策略的区别。基于防火墙设计策略路由,并结合网络地址转换,可以提高网络出口资源利用率,实现网络负载均衡,保护校园网安全。     

针对规则更新操作的测试数据包选取算法*

防火墙规则集中存在的配置错误主要来源于规则的添加、删除等更新操作。因此进行规则更新时,需要使用测试算法判断更新操作的正确性。现有的测试算法仅从被添加或被删除规则的顶点选取测试数据包,不能检测出所有因规则冲突而导致的配置错误。基于此,提出了一种针对规则更新操作的测试数据包选取算法PCRU。该算法从两处选取测试数据包,即被添加或者被删除的规则的顶点和规则冲突区域。理论分析和仿真实验表明,与现有测试算法相比,在进行规则更新时,PCRU算法只需使用少量的测试数据包,即可检测出所有因规则冲突而导致的配置错误。     

网络防火墙技术

１防火墙技术 防火墙技术也是目前网上使用较多的一项静态安全防范技术,它是一种被动式防御的访问控制技术,当前实现“防火墙”功能的主要技术有：数据包过滤,代理服务器（应用网关）、电路层网关等。 １）包过滤技术（Ｐａｃｋｅｔ ｆｉｌｔｅｒｉｎｇ） 它一般被用在路由器上,使得路由器能够根据特定的服务允许或拒绝进出网络的数据包或分组。包过滤路由器接收来自网络的数据包,再由路由器审查每个数据包并进行包过滤规则的匹配,从而控制进入内部网的数据包。包过滤规则是基于提供给ＩＰ转发过程的包头信息。包头信息中包括ＩＰ源地…     

支持防火墙规则扩展的匹配算法HERAM

防火墙是一种重要的网络安全技术,但随着网络规模的发展,遇到了许多急需解决的问题,其中就有防火墙网络瓶颈的问题。提出一种新的规则匹配算法来解决这个问题,把多维的问题进行降维处理,根据规则之间有无关联性把规则进行分类处理,另外把新添加的规则运用散列表进行组织,从而做到在增加扩展性的同时,使时间效率不受大的影响。     

基于区域分割的防火墙部署与配置

防火墙技术作为内部网络与外部网络之间的第一道安全屏障,是受到人们重视的网络安全技术之一。本文为提高网络安全的健壮性,从实施网络安全策略的角度,提出了一种以区域分割的三角方式部署防火墙系统的方案,说明了基于Cisco FIX525防火墙配置方法,以及访问控制列表与防火墙包过滤规则的联合应用方法。实用检验说明,这种方案能够较好地实现网络安全访问控制,有效地提高网络安全性。     

基于防火墙规则匹配优化算法的研究

随着网络功能和应用程序的增加,过滤规则集日益庞大,这严重影响了网络的性能。该文提出了一种基于规则匹配的防火墙优化方法。该方法对通过防火墙匹配的数据包进行权重计算相关规则排序,从而减少规则匹配时间。仿真结果显示,该方法有效地改善了防火墙的性能。     

Linux与Windows平台下的网络数据包拦截技术及应用

本文讨论了Linux与Windows平台下的网络数据包拦截技术,比较了两种技术的特点;深入分析了数据包拦截技术在防火墙中的实现;讨论了基于数据包拦截的防火墙程序设计技术;根据过滤规则对相关数据包进行拦截,实现具有个性特色的个人的防火墙系统。     

Application of evolutionary algorithm in performance optimization of embedded network firewall

With the development of the network, the problem of network security is becoming increasingly serious. The importance of a firewall as the "first portal" to network security is obvious. In order to cope with a complex network environment, the firewall must formulate a large number of targeted rules to help it implement network security policies. Based on the characteristics of the cloud environment, this paper makes in-depth research on network security protection technology, and studies the network firewall system. The system implements unified configuration of firewall policy rules on the cloud management end and delivers them to the physical server where the virtual machine is located. Aiming at the characteristics of virtual machines sharing network resources through kernel bridges, a network threat model for virtual machines in a cloud environment is proposed. Through analysis of network security threats, a packet filtering firewall scheme based on kernel bridges is determined. Various conflict relationships between rules are defined, and a conflict detection algorithm is designed. Based on this, a rule order adjustment algorithm that does not destroy the original semantics of the rule table is proposed. Starting from the matching probability of the rules, simple rules are separated from the default rules according to the firewall logs, the relationships between these rules and the original rules are analyzed, and the rules are merged into new rules to evaluate the impact of these rules on the performance of the firewall. New rules are added to the firewall rule base to achieve linear firewall optimization. It can be seen from the experimental results that the optimization strategy proposed in this paper can effectively reduce the average number of matching rules and improve the performance of the firewall.     

一种防火墙规则冲突检测算法

在入侵检测系统和状态检测防火墙等系统的应用中,规则冲突检测及冲突检测算法在计算机网络安全及服务质量方面起着至关重要的作用。文章首先对防火墙过滤规则进行了描述,然后对规则冲突进行了分类,在此基础上提出了一种规则冲突检测算法。     

一种防火墙规则冲突检测算法

在入侵检测系统和状态检测防火墙等应用中,规则冲突检测及冲突解析算法是影响安全性及服务质量的关键。首先对防火墙过滤规则之间的关系进行了建模和分类。然后在过滤规则关系分类的基础上提出了一种冲突检测算法。该算法能够自动检测、发现规则冲突和潜在的问题,并且能够对防火墙过滤规则进行无冲突的插入、删除和修改。实现该算法的工具软件能够显著简化防火墙策略的管理和消除防火墙的规则冲突。     

刍议计算机网络安全之防火墙

网络安全已成为人日益关心的问题,而网络防火墙是一种隔离控制技术,通过预定义的安全策略,对内外网通信强制实施访问控制,防火墙较常用的技术有应用网关、状态检测、包过滤等技术。在保护内部网络安全的前提下:其主要作用是在网络入口外检查网络通信,设定用户的安全规则,提供内部网络的安全,保障内外网络通信。     

一种分布式防火墙过滤策略的异常检测模型

分布式防火墙的安全性很大程度上取决于过滤策略正确配置。过滤策略的异常可能导致分布式防火墙系统所保护的网络出现严重的访问漏洞。为了能够自动化地检测分布式防火墙过滤策略存在的异常,对分布式防火墙系统中各过滤节点上的过滤规则之间可能出现的异常进行分类,并建立了一个过滤策略异常检测的模型。该模型能够检测出分布式防火墙过滤规则之间的冗余、冲突、不完整等各种异常,从而保证了分布式防火墙过滤策略的完整性和一致性。     

浅析基于嵌入式网络防火墙安全策略

为了将嵌入式网络系统与既有普通网络系统进行区分,对既有网络安全系统存在的主要构成与缺陷进行了分析,探讨了嵌入式网络系统承受的主要网络攻击类型和网络防火墙安全防范的主要特点。并针对嵌入式网络防火墙的特点、防火墙的数据包过滤机理与算法进行了分析,提出采用递归流分类算法形成网络防火墙的安全策略,以达到提高防火墙数据包的处理能力。     

防火墙技术的研究

防火墙是集包过滤技术、代理服务技术、入侵检测技术等多种技术的安全平台,是现代网络安全防范的重要设备。该文针对各种主流防火墙体系结构、应用现状及优缺点比较,探讨防火墙技术今后的发展方向。     

Improving cloud network security using the Tree-Rule firewall

This study proposes a new model of firewall called the ‘Tree-Rule Firewall’, which offers various benefits and is applicable for large networks such as ‘cloud’ networks. The recently available firewalls (i.e., Listed-Rule firewalls) have their limitations in performing the tasks and are inapplicable for working on some networks with huge firewall rule sizes. The Listed-Rule firewall is mathematically tested in this paper to prove that the firewall potentially causes conflict rules and redundant rules and hence leads to problematic network security systems and slow functional speed. To overcome these problems, we show the design and development of Tree-Rule firewall that does not create conflict rules and redundant rules. In a Tree-Rule firewall, the rule positioning is based on a tree structure instead of traditional rule listing. To manage firewall rules, we implement a Tree-Rule firewall on the Linux platform and test it on a regular network and under a cloud environment respectively to show its performance. It is demonstrated that the Tree-Rule firewall offers better network security and functional speed than the Listed-Rule firewall. Compared to the Listed-Rule firewall, rules of the Tree-Rule firewall are easier to be created, especially on a large network such as a cloud network.     

Structured firewall design

A firewall is a security guard placed at the point of entry between a private network and the outside Internet such that all incoming and outgoing packets have to pass through it. The function of a firewall is to examine every incoming or outgoing packet and decide whether to accept or discard it. This function is conventionally specified by a sequence of rules, where rules often conflict. To resolve conflicts, the decision for each packet is the decision of the first rule that the packet matches. The current practice of designing a firewall directly as a sequence of rules suffers from three types of major problems: (1) the consistency problem, which means that it is difficult to order the rules correctly; (2) the completeness problem, which means that it is difficult to ensure thorough consideration for all types of traffic; (3) the compactness problem, which means that it is difficult to keep the number of rules small (because some rules may be redundant and some rules may be combined into one rule).To achieve consistency, completeness, and compactness, we propose a new method called structured firewall design, which consists of two steps. First, one designs a firewall using a firewall decision diagram instead of a sequence of often conflicting rules. Second, a program converts the firewall decision diagram into a compact, yet functionally equivalent, sequence of rules. This method addresses the consistency problem because a firewall decision diagram is conflict-free. It addresses the completeness problem because the syntactic requirements of a firewall decision diagram force the designer to consider all types of traffic. It also addresses the compactness problem because in the second step we use two algorithms (namely FDD reduction and FDD marking) to combine rules together, and one algorithm (namely firewall compaction) to remove redundant rules. Moreover, the techniques and algorithms presented in this paper are extensible to other rule-based systems such as IPsec rules.