Policy Based Network Security System

Wei Yang

2003-01-01

Abstract:With the widening of network,more serious problems have appeared,such as virus,IDS.All of these impact the network security.According to P2DR model,this paper shows a plan of security system,binding the functions of firewall and IDS.All the distributed applications are built on COPS.

What problem does this paper attempt to address?

Network Safeguard System Based on IDXP

WANG Xiaodong,ZHU Miaoliang

DOI: https://doi.org/10.3969/j.issn.1000-3428.2005.07.055

2005-01-01

Abstract:This paper puts forward an intellective network safe guard system based on a multi-agent system structure. The purpose of the system is to defend the intrusion of campus-wide network. It is based on IDXP and the focus is blackboard. This system can deal with multi-levels and many ways of anti-intrusions, which has self-determination. It is proved to have a good performance by spot tests.
Research on Information Security Model and Security System Design

黄益民,平玲娣,潘雪增

DOI: https://doi.org/10.3785/j.issn.1008-973x.2001.06.005

2001-01-01

Abstract:After study of existing security models; analysis of information flow model, Bell-LaPadula(BLP) access control model and Biba access control model; and collation and comparison of their advantages and disadvantages, an improved model is put forward that satisfies the actual demands of information security. An implementation strategy is put forward that ensures information security, reliability, practicality and compatibility in the designed security system. An implementation scheme of this security system and its components and functions is provided. This system combines the following functions: mandatory access contro1, privilege separation, security audit, identity authentication and self-protection. It achieves the level 3 of national information security standard and level B1 of TCSEC standard. It was implemented in the Windows NT and Linux operating system and has yielded good resultsin application.
Proactive Security Defense of Dynamic Network

WUChunming

DOI: https://doi.org/10.3969/j.issn.1009-6868.2016.01.009

2016-01-01

Abstract:Dynamic network proactive security defence is an effective method for solving the unknown vulnerabilities and back door attacks in the information system. In this paper, the evolution defense mechanism (EDM) is proposed. According to the security status, network system security needs, EDM can select the best network configuration change elements to deal with potential attacks and ensure the safety requirements of a specific level. Dynamic reconfiguration and changes of the network need to be considered in accordance with the security situation of the system and the possible network attacks. The key is how to detect and the security situation and network attacks. It proposes that study on dynamic network proactive security defense in China is in the initial stage, and there is stil much work to do.
Evolving Defense Mechanism for Future Network Security

Haifeng Zhou,Chunming Wu,Ming Jiang,Boyang Zhou,Wen Gao,Tingting Pan,Min Huang

DOI: https://doi.org/10.1109/mcom.2015.7081074

IF: 9.03

2015-01-01

IEEE Communications Magazine

Abstract:The past few years have witnessed revolutionary advances in network technology. Along with new techniques such as SDN come lots of new network security challenges. Conventional network security mechanisms are incompetent to overcome these challenges, since they are built on a static network configuration that facilitates attackers in finding the weaknesses of a network. In this article, we conceive a novel conceptual network security mechanism, the evolving defense mechanism (EDM), to resolve current and future security problems. EDM is based on a bio-inspired idea of network configuration variations. According to the security requirements of the system, the user, and the network security state, EDM selects an efficient network configuration variation strategy to prevent corresponding security threats. Combined with SDN implementation, EDM resolves security problems from a new angle and is capable of evolving with new network security technology. We sketch a way to implement EDM and present its reference framework, which serves as an ecosystem and coexisting environment for various kinds of network configuration variations. The proposed mechanism avoids the deficiency of conventional mechanisms and has potential to cope with emerging security threats.
Insights on Cooperative Defense for Multiple Industrial Security Technologies

Ming Wan,Minglei Hao,Yang Li,Jianming Zhao,Ying Li

DOI: https://doi.org/10.1145/3586102.3586127

2022-01-01

Abstract:Due to the rapid development of industrial automation, ICSs (Industrial Control Systems) gradually expose their potential security vulnerabilities, and are facing more and more serious security risks. Although different industrial security technologies have been developed to strengthen industrial security protection, they always struggle for their own because of their standalone and non-related functions, and their actual defense effects are not encouraging. This paper first summarizes some intrinsic security vulnerabilities in ICSs, and analyzes the main causes to generate each class of vulnerabilities. Furthermore, five popular security technologies which have been successfully applied in today's ICSs are introduced, and their advantages and shortages are also compared by explaining each working mechanism. In order to take full advantage of various industrial security technologies, this paper proposes one novel cooperative defense model based P2DR (Policy, Protection, Detection and Response), which establishes the dynamical defense process to integrate five different industrial security technologies. Under the guidance of security policies, this model can comprehensively utilize the resources of various industrial security technologies to learn and judge current security status of the whole system, and effectively adjust the optimum deployment to provide the strongest protection with the lowest risk. Finally, one applicable case based on the proposed model is designed to verify the feasibility of cooperative defense in ICSs.
Design and implementation of computer network security detection and control system

Xi Chen

DOI: https://doi.org/10.54254/2755-2721/38/20230530

2024-02-07

Abstract:With the widespread application of computer network technology, computer network security defense capability has become a focus of attention in various industries. The extensive use of computer information systems in various sectors has significantly improved work efficiency but has also introduced security risks and management issues. The deployment of network security detection and control systems allows for effective security monitoring and management of computer operations and real-time network information. This paper presents a computer network security detection and control system based on human-computer interaction, which enables users to handle daily key business processes. The work principles and overall architecture of the network security detection and control system are analyzed and demonstrated. It offers functions such as filtering options, address rules, network security detection, network unreachability, overall traffic analysis, subnet definition, fault diagnosis, and security analysis. Testing and analysis indicate that the systems design achieves the intended goals. In the application of network security features, it can effectively combine various forces to enhance the quality and efficiency of network security, making it widely applicable in various industry units.
Network Security Emergency Response System Based on Metropolitan Area Network

Yan LIU

DOI: https://doi.org/10.3969/j.issn.1671-1122.2015.09.037

2015-01-01

Abstract:With the rapid popularization of the Internet, the security threat facing the network information security is also becoming more and more serious. This paper presents a based on metropolitan area network coverage throughout the city of the Internet and the key network infrastructure of network security emergency response system, and introduces the hierarchical architecture. The core functions of the system are described in detail. At key network nodes of MAN, the system can timely warn large-scale network attacks and virus spread, which can protect the Internet and key sites of network security. This paper also presents the measures of system validation.
A Collaborative Network Security Management System in Metropolitan Area Network

Beipeng Mu,Xinming Chen,Zhen Chen

DOI: https://doi.org/10.1109/cmc.2011.130

2011-01-01

Abstract:Network Security Appliances are deployed at the vantage point of the Internet to detect security events and prevent attacks. However, these appliances are not so effective when it comes to distributed attacks such as DDoS. This paper presents a design and implementation of collaborative network security management system (CNSMS), which organize the NetSecu nodes into a hybrid P2P and hierarchy architecture to share the security knowledge. NetSecu nodes are organized into a hierarchy architecture so they could realize different management or security functions. In each level, nodes formed a P2P networks for higher efficiency. To guarantee identity trustworthy and information exchange secure, PKI infrastructure is deployed in CNSMS. Finally experiments are conducted to test the computing and communication cost.
Application of Wireless Sensor Network in Perimeter Protection System

吴选忠,宋执环

DOI: https://doi.org/10.3969/j.issn.1001-5531.2008.06.008

2008-01-01

Abstract:The functional and technical requests of perimeter protection system were analyzed.A wireless sensor network strategy was proposed to improve the accuracy of the invaded alarm rate and reduce false alarms.The level demand,information transmission and data fuse of system were mainly discussed.A network topology structure and intelligent position method were proposed to meet the real-time and self-organization demand of system,which provided a new idea for intelligent perimeter protection system.
Informational Network Security Policy Configuration for Chemical Enterprise

Li Li,He Daxing

DOI: https://doi.org/10.3969/j.issn.1007-1865.2011.11.032

2011-01-01

Abstract:A computer network faces two kinds of threat: threat to the information and threat to the equipment of the network.The network security strategy is to prevent the information and the equipment of the network from being destroyed.And the method presented in the paper can ensure the security of the network from the point of the server,PC,router,switch,etc.
Design and Implementation of A Network Security Management System

Zhiyong Shan,Vinod Namboodiri

DOI: https://doi.org/10.24297/ijct.v20i.8841

2020-09-10

Abstract:In recent years, the emerged network worms and attacks have distributive characteristics, which can spread globally in a short time. Security management crossing network to co-defense network-wide attacks and improve the efficiency of security administration is urgently needed. This paper proposes a hierarchical distributed network security management system (HD-NSMS), which can centrally manage security across networks. First describes the system in macrostructure and microstructure; then discusses three key problems when building HD-NSMS: device model, alert mechanism, and emergency response mechanism; at last, it describes the implementation of HD-NSMS. The paper is valuable for implementing NSMS in that it derives from a practical network security management system (NSMS).

English Else
Design and Implementation of Enterprise Network Security System Based on Firewall

Hui Yuan,Lei Zheng,Shuang Qiu,Xiangli Peng,Yuan Liang,Yaodong Hu,Guoru Deng

DOI: https://doi.org/10.1007/978-3-030-15235-2_142

2019-04-25

Abstract:With the rapid development of the network, in recent years, the Internet has greatly improved people’s lives, and the real-time, sharing and distance-removing characteristics of network information transmission have made the operation and management of enterprises more efficient and coordinated. The basis of refinement. At the same time, various network security incidents have followed, such as hacker attacks on computer network systems, and various types of viruses, Trojans and other active attacks emerge one after another. In this regard, this paper analyzes the enterprise network security system of firewall from the perspective of enterprise network security, briefly summarizes the background, advantages and disadvantages of firewall technology, and designs and implements a client software according to the actual needs of users. The network performs real-time intelligent security monitoring. After the system design is completed, the security is tested by building a simulation platform, including qualitative testing and quantitative testing, which are divided into security and performance to verify whether the system can achieve and guarantee performance.
NetSecu: A Collaborative Network Security Platform for In-network Security

Xinming Chen,Beipeng Mu,Zhen Chen

DOI: https://doi.org/10.1109/cmc.2011.94

2011-01-01

Abstract:Malicious attacks are frequently launched to make specified network service unavailable, compromising end hosts for political or business purpose. Though network security appliances are widely deployed to resist these attacks, there is a lack of dynamic and collaborative platform to flexibly configure and manage all the security elements. In this paper, we present NetSecu, a platform based on Java and Click Router, which can dynamically enable, disable and configure security elements such as firewall, IPS and AV. Furthermore, a collaborate module is implemented to integrate individual NetSecu platform into a Secure Overlay Network, providing collaborative traffic control against DDoS attack. Equipped with collaborate module, NetSecu platforms are organized in a tree hierarchy where each level node is registered to its father node. A Central Management Site acts as the root node for large scale deployment. The policy is distributed from higher level to lower level NetSecu nodes, while security events are aggregated from lower level to higher level. Performance evaluation shows that our NetSecu system can achieve line rate with and without security function. Finally we deploy the NetSecu platform in multiple sites, where our design is fully demonstrated and tested.
Computer Network Security Technology Research

Shen Wei

DOI: https://doi.org/10.1007/978-3-319-98776-7_98

2018-11-05

Abstract:With the development of the information technology, computer information system has played an important role in modern society. As long as any break appears in computer information system, it takes a huge effect in whole society. Based on the analysis of network information safety factors, and then put forward common computer network information safety protection strategy, and the development of the network information safety was prospected and formed the network information safety protection system. There is an important, direct and realistic significance in research about computer system security. With the development of computer and communication technology, the computer net will penetrate every field of our social life as an important method of exchanging information. So, recognizing the frangibility and potential threatens of the net and some existent security problems objectively, taking effectively security strategy and ensuring the security of the net information are the things that every country, and group and every person must envisage. From the basic concept and existent problem of the net information security, some digital security technologies, such as information cryptography technology, digital abstract, digital signature, digital envelope and digital credentials have been analyzed in the paper.
An Overlay Network Based Collaborative Network Security System

HAN Fu-ye,CHEN Zhen,LIANG Yong,LI Jun

DOI: https://doi.org/10.3969/j.issn.1671-1122.2012.04.003

2012-01-01

Abstract:Internet security problem is still not well addressed as there are many network security event occurs,such as sending huge volumes of spam or launching Distributed Denial-of-Service(DDoS) attacks to victim targets.These attacks are launched by attackers who controlled a well-organized distributed network consists of a larger volume of hosts called bots.It is difficult to suppress such a distributed,widely,and automotive organized botnet without collaborative effort among the well deployed network security appliances(e.g.Unified Threat Management,i.e.UTM) in Internet.In this paper,we propose a practical Collaborative Internet Security System based on Overlay Network.We design a Peer-to-Peer communication protocol,a collaborative module,and retrofit security functions for UTM to virtually interconnect these UTMs to build a Security Overlay Network.In this Security Overlay Network,each UTM can communicate with each other to exchange security rules,events and signatures,and the huge size of signatures and security rules file can be disseminated easily,also ensure the security rules version in UTM will be consistency.Our design leverages existing technology to fully construct a comprehensive Collaborative Internet Security System for practical use.In the real deployment of our Security Overlay Network,several concrete applications,experiments and demos are also conducted and the results are also presented.
Effective allied network security system based on designed scheme with conditional legitimate probability against distributed network attacks and intrusions

Ruey-Maw Chen,Kuo-Ta Hsieh

DOI: https://doi.org/10.1002/dac.1289

2011-06-01

International Journal of Communication Systems

Abstract:Dependence on the Internet is increasing dramatically. Therefore, many researchers have given great attention to the issue of how to tighten Internet security. This study proposes a new scheme for the distributed intrusion prevention system (DIPS), in which the concept of ‘union’ is presented for satisfying the increasing requirements of Internet security issues. In this proposed design, the network intrusion detection system (NIDS) applies a misuse detection technique to detect well‐known intrusion behavior on the Internet. Meanwhile, for anomaly detection technique, a tool named ‘Scent’ (a network traffic sniffer) is combined with conditional legitimate probability to reveal previously undiscovered intrusion packets that do not match the intrusion signatures in NIDS. Moreover, blocking distributed denial‐of‐service (DDoS) attacks inside the protected allied network is also covered. To increase the detection accuracy, reduction of false positives and false negatives is also accomplished. Experimental results reveal that the suggested network security system scheme is effective and efficient in resolving the intrusion activity problem of real network environments. Copyright © 2011 John Wiley & Sons, Ltd. In this work, a new system scheme of the allied distributed intrusion prevention system was implemented to meet the increasing Internet security issues. A network intrusion detection system (NIDS) applies misuse detection technique to detect well‐known intrusion behaviors on the Internet. Meanwhile, for anomaly detection technique, a designed tool named ‘Scent’ (a network traffic sniffer) is combined with conditional legitimate probability to find out new intrusion packets that do not match the intrusion signatures in NIDS. Moreover, blocking distributed denial‐of‐service attacks inside the protected allied network is also designed. To increase the detection accuracy, reducing false positive and false negative are also accomplished.

telecommunications,engineering, electrical & electronic
Intelligent Network Layer for Cyber-Physical Systems Security

Rajasekhar Chaganti,Deepti Gupta,Naga Vemprala

DOI: https://doi.org/10.4018/ijsst.2021070103

2021-07-01

International Journal of Smart Security Technologies

Abstract:The cyber-physical system (CPS) has made tremendous progress in recent years and also disrupting technical fields ranging from health, transportation, industries, and more. However, CPS security is still one of the concerns for wide adoption owing to the high number of devices connecting to the internet and the traditional security solutions may not be suitable to protect the advanced, application-specific attacks. This paper presents a programmable device network layer architecture to combat attacks and efficient network monitoring in heterogeneous environment CPS applications. The authors leverage industrial control systems (ICS) to discuss the existing issues, highlighting the importance of advanced network layers for CPS. The programmable data plane language (P4) is introduced to detect well known HELLO flood attacks with minimal effort in the network level and show that programmable switches are suitable to implement security solutions in CPS applications.

English Else
The problems in campus network information security and its solutions

Cuihong Wu

DOI: https://doi.org/10.1109/indusis.2010.5565862

2010-07-01

Abstract:In the Age of Information, network education pays more attention to the application of IT technology and the training of talents, which makes learning more of customization and of opening up. In order to better enable learners to go beyond the limitations of space and time to acquire knowledge; in order to provide excellent learning environment for greater freedom and greater choice of learning activities space, the project to building campus network has become the basis of all university building work. It is directly related to the quality and level of their teaching and scientific research work. The campus network has a number of tasks such as teaching, research, management and communication with the outside. Therefore, the issue of network security has become a priority to campus network management. Obviously, the current Internet is convenient but at the same time it is unsafe. As part of the Internet and the unique attributes of campus network, it is more easily attacked when enjoying the service provided by the Internet. This paper starts from the current security status of the campus network, analyzing threatens to campus network security and strategies to maintenance of network security, so as to establish a suitable campus network security system, and introduce some current popular campus network information security solutions.
Analysis of Influencing Factors and Countermeasures of Computer Network Security

Yanli Liu,Meng Cui

DOI: https://doi.org/10.1007/978-3-030-51431-0_39

2020-07-24

Abstract:Since the new century, with the gradual popularization of computer networks around the world, network security defense methods have become more sophisticated and comprehensive, but they are still unable to defend against increasingly sophisticated and increasingly globalized virus attacks. In the process of network use and promotion, the influence of viruses on the network and hackers’ attacks have become an important factor threatening network security. Especially when people use the Internet to pay funds, remittances and other online financial activities, network security has become a constant topic. Establishing an efficient network security incident response system is of great significance for the network to better play its role. Based on the research of network security monitoring, network attack defense, network data backup and recovery theory and technology, this paper studies the strategy model of network security incident response, and uses relevant theories and methods of software engineering, combined with programming languages, to achieve Related application modules of this model. This article implements a low-cost, high-performance multi-data backup and recovery system that works in conjunction with other security devices and systems in the network. The overall structure and workflow are analyzed and designed to achieve multi-point backup and Fast recovery, efficient synchronization strategy for remote data, etc. The experimental research found that the network security incident response system can effectively reduce the security risk of the internal network, with a security proportion of more than 92%.
The Establishment and Implementation of Information Network Security Plan

Wang Yuanyuan

DOI: https://doi.org/10.2991/icsnce-18.2018.43

2018-01-01

Abstract:This paper explains the idea of information security and discusses the establishment of the security system of information network. By using the information system security engineering method, we will establish and improve the network security plan and disaster recovery plan through strict organization and management, adequate financial support, strong...

Policy Based Network Security System

Network Safeguard System Based on IDXP

Research on Information Security Model and Security System Design

Proactive Security Defense of Dynamic Network

Evolving Defense Mechanism for Future Network Security

Insights on Cooperative Defense for Multiple Industrial Security Technologies

Design and implementation of computer network security detection and control system

Network Security Emergency Response System Based on Metropolitan Area Network

A Collaborative Network Security Management System in Metropolitan Area Network

Application of Wireless Sensor Network in Perimeter Protection System

Informational Network Security Policy Configuration for Chemical Enterprise

Design and Implementation of A Network Security Management System

Design and Implementation of Enterprise Network Security System Based on Firewall

NetSecu: A Collaborative Network Security Platform for In-network Security

Computer Network Security Technology Research

An Overlay Network Based Collaborative Network Security System

Effective allied network security system based on designed scheme with conditional legitimate probability against distributed network attacks and intrusions

Intelligent Network Layer for Cyber-Physical Systems Security

The problems in campus network information security and its solutions

Analysis of Influencing Factors and Countermeasures of Computer Network Security

The Establishment and Implementation of Information Network Security Plan