防火墙入侵阻止功能的设计与实现

针对防火墙内嵌入侵阻止功能模块的研究,提出了2种不同的设计方案,方案1利用基于libipq库的netfilter的排队(QUEUE)动作以及snort_inline技术实现对攻击数据包的丢弃,方案2则是综合利用syncookies技术、netfilter的新模糊包速率匹配、PSD检测、U32检测技术并结合对防火墙内核改造来实现对主流拒绝服务攻击(DOS)攻击包的阻止;在综合比较的基础上,依据方案2完成了实验模块的设计与实现;攻击测试结果表明,该模块具备了较好地防御主流DOS攻击的能力。

Design and Implementation of a Firewall IPS Module

Two different design schemes about firewall IPS module are brought up.In the first scheme snot-inline technique and the QUEUE action of netfilter are used to achieve dropping of attack data packet.In the second one,IPS about Denial of Service attack is achieved with the benefit of combination of synccokies,the new netfilter fuzzy match,PSD match,U32 match with an improvement on the firewall kernel.After comprehensive comparison,the module is developed according to the second scheme.The experiment shows that the designed module works well in defending main DOS attack.