基于关联的多层次网络安全结构设计.pdfVIP

第 22 卷第 10 期 计算机应用与软件 Vol.22, No.10 2005 年 10 月 Computer Applications and Software Oct. 2005 基于关联的多层次网络安全结构设计 李 鹏 易军凯 (北京化工大学信息科学与技术学院 北京 100029) 摘 要 基于关联的网络安全综合监控是目前信息安全技术的一个重要发展方向。在关联基础上，提出了一种多层次网络安全 系统(MLNSS) 的架构及其实现方式。这种架构能够有效融合不同种类安全设备的信息，分析网络安全状态，对入侵做出正确判断 和决策。实践证明该技术能够处理不同种类安全设备间的协作关系，降低入侵检测系统的误警，从而更加有效地提高网络整体防 御性能。 关键词 多层次网络安全 关联 入侵检测 编码 DESIGN OF MULTI-LAYER NETWORK SECURITY ARCHITECTURE BASED ON CORRELATION TECHNOLOGY Li Peng Yi Junkai (School of Information Science and Technology, Beijing University of Chemical Technology, Beijing 100029, China) Abstract It is an important developing direction of information security technology at present that integrated network security monitoring based on correlation. The paper has put forward a framework of Multi-Layer Network Security System (MLNSS) and the implementation. This framework can merge the information of different kind security devices effectively, analyze the security state of network, judge and make policy correctly against intrusion. Practice has proved that the technology can deal with the cooperation relation among different kind security devices, reduce the mistake alert rate of IDS, thus improve the online security and defend performance wholly more effectively.. Keywords Multi-layer network security Correlation Intrusion detect Code 行分类是解决问题的关键所在。通过分析得到的这些关系，能 1 引 言 够获得有用的信息。可以从以下几个方面获取关联性：源 IP 关 联、目标 IP 关联、欺骗数据包特征关联、时间或者序