苟杰　李春强　丘国伟

摘 要：FBI和CSI曾对484家公司进行了网络安全专项调查，调查结果显示：超过85%的安全威胁来自公司内部。随着时间的增长互联网技术愈发成熟，企业内部网络系统更加复杂，这些系统更加频繁地被曝出漏洞。此外，黑客水平越来越高，漏洞利用门槛也越来越低，这些趋势使得企业内网安全防御变得十分紧要。此次研究开发企业内部联网设备安全风险检测与防御系统，目的在于探索一种集监测、主动发现、威胁解决为一体的闭环内网安全防御体系。此次研究中，完成了被动监测、主动发现、漏洞修复等模块的设计实施工作，这些工作使得防御体系，可以克服当下安全软件功能强大但解决问题单一、多个软件间的协作困難的问题。

关键词：网络安全 ；被动防御 ；主动防御 ；计算机网络

中图分类号：TP393.08 文献标识码：B

Abstract： The FBI and CSI conducted a special survey of network security for 484 companies. The survey results show that more than 85% of the security threats come from inside the company. With the growth of time， Internet technologies have become more mature， and the internal network systems of enterprises have become more complicated. These systems have been exposed to Vulnerability more frequently. In addition， the level of hackers is getting higher and higher， and the threshold for exploitability is getting lower and lower. These trends make intranets Security defense has become very important. Our research and development of enterprise internal networked device security risk detection and defense systems aims to explore a closed-loop internal network security defense system that integrates passive monitoring， active discovery， and active threat resolution. In this study， passive monitoring， active discovery， and bug fixes were implemented. These efforts made it possible for the defense system to overcome the problems of the current security software， which is powerful but just has a single function and the collaboration between multiple softwares is difficult.

Key words： network security； passive defense； active defense； compute network

1 引言

任何内网系统都面临威胁，企业内部网络系统则是更有价值的被攻击对象，这里可能有企业商业机密，有用户数据，有企业员工隐私，一旦被攻破必将损失巨大，而且更加令人不寒而栗的情况是黑客拿走了企业的机密数据企业却并不知情，这将使得企业和用户，员工都深陷危机而不自知。

黑客可以有多种手段攻击企业内网，比如利用恶意软件、系统漏洞、企业内部系统漏洞等等。为此多数企业采用了网段隔离、防火墙等基本手段来进行内网边界防护安全建设，这些方法都效果显著的阻止外部的网络入侵，但是一旦有黑客控制了内网中的某一台机器，边界防护便再也无法提供有效防护，很明显我们需要一套内网威胁监测处理的安全解决方案，这也是我们所做工作的目的。……