入侵检测与防火墙的联动平台研究

通过分析入侵检测系统和防火墙技术的各自优势,认为实现防火墙的数据过滤与入侵检测的实时监控间的有效互补是非常重要的。提出了网络安全事件的基本分类方法,定义出入侵检测系统提供给防火墙的信息格式,采用向入侵检测系统和防火墙中嵌入相关模块的方法,实现了入侵检测系统对攻击行为的自动响应,从而实现了防火墙与入侵检测系统间的协同工作。这样无论是来自内网还是外网的攻击,都可以被联动平台识别并自动响应。

Research on the Platform of Linkage between Intrusion Detection System and Firewall

The advantages of intrusion detection system and firewall technology are analyzed.It is very important of implementing complementary between data filtering of firewall and real-time monitoring of intrusion detection system.The basic classification method of the network security event is proposed,and the information format which intrusion detection system provides to the firewall is defined.By embedding the relevant modules in the intrusion detection system and firewall,the intrusion detection system could automatically respond to aggressive behavior,and firewall and intrusion detection systems could work together.So whether attacks are from the internal network or external network,they could be recognized and be responded automatically.