Network Security Strategic Early Warning System Design And Key Technologies

For protecting the National Information Infrastructure (Nil) from attack, it is essential to establish and develop an efficient and reliable Network Security Strategic Indication&Warning (NSSI&W). NSSI&W must monitor the wide range of threat entities from hackers, terrorists to major states. It will incorporates data about political, economic, military, diplomatic information collected from the wide rage of network and attacked information from attack detection agents of all levels in the Nil, to evaluate the IW threat posed by a variety of actors; to provide Indicators and Warnings(I&W) of an IW attack; to predict enemy Courses of Action(COA). This will make information prevention timely, accurately and intentionally.In the paper, the following contents are discussed.1. The author describes the assume about the architecture and compose as well as the methods of which will be used in our NSSI&W.2. The thesis studies the key technologies on NSSI&W-attack detection technology. The author summarizes existing intrusion detection technology, sets up the modeling on information fusion and mining, puts forward some difficulties for farther research.3. After analyzing the OSPF routing protocol, the author describes a statistical mechanism against the attacks of OSPF routing protocol.4. The author sets up the modeling on threat database. Because the threat information are uncertain, incomplete, intangible, changeful, this thesis puts forward a method of characteristic information fusion-based on Mamdani fuzzy neural network method, applies on threat assessment on Network Security Strategic Indication/Warning system, and reasoning correlate rules, proves the method feasible and rational.5. In the prototype of NSSI&W-"Network information flow Monitoring and Warning", we implement to dynamic monitor about information transmitting and user operating through collecting data, analyzing data, watching user's behaviors and controlling user's behaviors. We give alarm in time for anomalous behaviors. The author implements the module of anomalous information flow detection.