Design And Implementation Of Active Network Security Monitor System

As the Internet being highly used, more and more attention has been paid to network and information security. In network security most commonly used methods include installing firewall, or IDS on computer, but hackers still can get into the network by any means. So being able to identify what is happening on the network becomes an important aspect of network security.This paper firstly discusses about the disadvantage of networks, designs and implements Active Network Security Monitor System (ANSMS) for company network, including the Illegal Connection Monitor Subsystem (ICMS), Malicious Downloading Prevention Monitor Subsystem (MDPMS) and Mandatory Access Control Monitor Subsystem (MACMS). In Illegal Connection Monitor Subsystem (ICMS), researches the encryption technology, binding IP-MAC together and design the active strategy of illegal connection; design and implement authentication module, detection module and closed module based on ARP protocol; In Malicious Downloading Prevention Monitor Subsystem, mainly parsing the packets of HTTP and FTP protocol, detection netflow, design and implement TDI Filter Driver, intercepting the connecting users actively. In Mandatory Access Control Monitor Subsystem, take part in the implementation of a new access control model based on Bell-Lapadula model and Biba model which takes advantage both Bell-Lapadula model and Biba model; implement windows filter driver which intercept the operation for files by process.According to the characteristics of the special network, implement three modules of the Active Network Security Monitor System. The research results have been used in the network of a certain department as project background for several times, indicate that Illegal Connection Monitor Subsystem could detect the illegal computer and close the connection; Malicious Downloading Prevention Monitor Subsystem could close the users'downloading which download more than threshold and prevent the protection files being download; Mandatory Access Control Monitor Subsystem could intercept I/O request actively, implements Windows mandatory access control.