Real-time Detection Technology For The Classified Information Network Vulnerabilities

In recent years, the rapid development of network technology and the popularity of the Internet have completely changed people's daily live, a variety of networking applications greatly enriched people's access to information and communicate with each other way. At the same time, these applications are also presented greater challenges to network security. Classified information networks, as it involves state secrets, and other important issues, the security of their networks become more pronounced. At present a lot of vulnerability scanning tools are expensive commercial products, ordinary free vulnerability scanning software features a lot of limitations, therefore, free, open source, powerful, update time, and has custom capabilities vulnerability scanning software has become an important work of tools. Security vulnerability scanning technology can detect potential network security vulnerabilities, so that network administrators know in advance where the vulnerability of the network is and thus ensure network system security.Addressed these problems, the network-based vulnerability scanning and host-based vulnerability scanning technologies are studied in this thesis. The Nessus plug-in technology as the main subject of study, the NASL scripting language is thoroughly studied, based on which, the technology of introducing the host-based vulnerability scanning into the network-based vulnerability scanning is investigated. The main contents are given as follows:1. It detaily studied the shortages of the network-based vulnerability scanning and the host-based vulnerability scanning. For the limitations of the network vulnerability scanning, I make use of plug-in functions to achieve some features of the host vulnerability scanner. Plug-ins as a scripting language written by the subroutine, the scanner can call it to perform vulnerability scanning system to detect the existence of one or more of the loophole. This also makes vulnerability scanning software upgrades maintenance is relatively simple, while the exclusive use of scripting languages simplifies the development of new plug-in programming, so that vulnerability scanning software has strong scalability. 2. A scanning system access to network, based on Nessus, is discussed deeply. The Plug-in technology is adopted in this scanning system. In order to extend the tools to a wider area and improve the network security, the Plug-in self-defined is used to attract a script by simulation. For the detection with weak passwords, the implement of the Web-based vulnerability scanning technology is very difficult due to the requirement of the privilege. For solve the problem, the ftp passwords are design to detect and attract the script in the system.3.The system uses C/S model structure, the server running on Linux systems, and placed in the classified network of different places to get different information, while the client uses the Windows version, for all servers control. The real test server and the client only provides configuration and reporting functionality.The Plug - in can detect the vulnerability of the weak passwords, which not only match with the host vulnerability scanning, but also, to a certain extent, make up the limit of the network vulnerability scanning technology. However, the drawback of this method is the requirement of the contrast between the characters of plug-ins and the weak passwords, which largely affected the success rate and running speed.