论文部分内容阅读
随着网络技术及其应用的普及,网络安全问题日益凸现, 防火墙技术也日新月异。然而传统的防火墙设备如第一代的包过滤防火墙,第二代的应用代理防火墙到第三代的全状态检测防火墙只能检测 IP 层和 TCP/UDP 层的协议和端口,设置安全策略,并不检测数据包的净荷,即实际传输的数据内容。内网的服务器要对外提供服务,必然要开放相应的服务端口供用户访问,然而如今的网络安全威胁已经由针对 TCP/IP 协议本身漏洞的攻击转向针对操作系统和应用漏洞的攻击和入侵,安全威胁采用防火墙开放的合法端口进入内部网络,同时各种蠕虫病毒、木马等通过 Internet 广泛传播,造成网络瘫痪,间谍软件进入内网用户的电脑窃取私密信息。而这些复合型的网络安全威胁正是隐藏在 IP 数据包的净荷,即数据包的内容当中,前三代传统的防火墙对它们无能为力。
With the popularization of network technology and its application, the problems of network security are becoming more and more obvious, and the firewall technology is changing rapidly. However, the traditional firewall equipment such as the first generation of packet-filtering firewall, the second generation of application proxy firewall to the third generation of stateful inspection firewall can only detect the IP layer and TCP / UDP layer protocol and port, set the security policy, and Does not detect the payload of the packet, that is, the actual transmission of data content. However, today’s network security threats have turned from attacks targeting the TCP / IP protocol itself to attacks and intruders on operating system and application vulnerabilities, and in terms of security, they have to open their corresponding service ports for access. Threats using the legal port open firewall into the internal network, while a variety of worms, Trojans and other widely spread through the Internet, resulting in network failure, spyware into the user’s computer to steal private information. These complex network security threats are hidden in the payload of IP data packets, that is, the content of the data packets, the first three generations of traditional firewalls can not do anything about them.