在網路發達的現今，為了防範資訊系統遭受入侵或攻擊，常會使用各種網路安全系統如防火牆以及入侵偵測系統建構防衛系統，然而以現今的技術及實際狀況，防衛系統仍需要管理者緊密的配合才能正確的阻斷攻擊，為了讓防衛系統能更為靈敏且自動化針對攻擊進行正確的防衛動作，本計畫將研究與設計一個效能及安全性兼顧的智慧型防衛系統。此智慧型防衛系統將分為下列兩部分：防火牆分派器：處於網路咽喉點的防火牆常會隨著網路活動的增加成為網路效能的瓶頸，一些攻擊手法如DoS更會突顯這個問題的嚴重性，而且當網路流量逐步成長到防火牆系統所不能負擔時，更換更高階的防火牆不僅所費不疵而且費時耗工，所以如果能以類似叢集的概念，以一群防火牆主機，平均分擔一部主機所負責的工作，將會使效能的擴充非常的具有彈性，而如何在負載平衡(load balance)的觀念下平均分給一群主機。自我規則調整系統：入侵偵測系統雖能告知管理者相關的攻擊警訊，但管理者仍必須自行變動規則，除了繁瑣也喪失了第一時間防禦攻擊的可能性，如能讓入侵偵測系統能在發現攻擊警訊外，更進一步地動態的變更防火牆主機的規則，以便快速地阻斷攻擊者進一步的行動，將是值得深入的研究與探討。 For integrated security, we often integrate several network security systems such as firewall and intrusion detection system as a defensive system to prevent our information system being intruded. But according to current developed technology and practical situation, network administrator and the defensive system still have to work cooperatively to block intruders. In order to make the defensive system more sensitive and automatic and let it response to intrusions correctly, it will be the major objective for this project to research and design a secure, efficient and intelligent defensive system.The intelligent defensive system is composed of the following parts.Firewall dispatcher： As the network activities grown up, firewall often become a bottleneck of network communication. Some attacking tricks, like DOS, will make the problem more serious. And when firewall system can not handle the increasing network communications, it will take much of time and cost a lot. If we can use the concept similar to cluster, we replace a single expensive firewall by a group of general firewalls and let them have the same function. The expansibility of firewall will be very elastic. So, our research objective will be how to dispatch the jobs into firewall group approaching the concept of load balance.Self-adapting rule system： Although the intrusion detection system can provide the information about attacks for network administrator, but the administrator still have to change the firewall rules by himself to block the intruders. It will be minute and complicated and the chance to defend just in time will be lost. If the intrusion detection system can dynamically and automatically change the rules of firewall in order to block the attacker as quickly as possible when find alerts of attacks, it will make the defensive system more intelligent responding to attacks.
