浅析计算机网络安全技术

计算机技术和网络技术的高速发展，对整个社会的发展起到了巨大的推动作用，尤其近年来，计算机网络在社会生活各方面的应用更加广泛，已经成为人们生活中的重要组成部分，但同时也给我们带来许多挑战。

随着我们对网络信息资源的需求日益增强，随之而来的信息安全问题也越加突出，病毒、黑客、网络犯罪等给网络的信息安全带来很大挑战。

因此计算机网络安全是一个十分重要且紧迫的任务。

一.计算1.网络安全的基本概念计算机网络安全是指。

为数据处理系统建立和采取的技术和管理的安全保护，保护计算机硬件、软件数据不因偶然和恶意的原因而遭到破坏、更改和泄漏。

计算机安全的定义包含物理安全和逻辑安全两方面的内容，其逻辑安全的内容可理解为我们常说的信息安全，是指对信息的保密、完整和可用的保护，而网络安全的含义是信息安全的引申，即网络安全是对网络信息保密、完整和可用的保护。

2.网络安全的基本组成(1)网络实体安全：如计算机的物理条件、物理环境及设施的安全标准，计算机硬件、附属设备及网络传输线路的安装及配置等;(2)软件安全：如保护网络系统不被非法侵入，系统软件与应用软件不被非法复制、篡改、不受病毒的侵害等;(3)数据安全：如保护网络信息的数据安全，不被非法存取，保护其完整、一致等(4)网络安全管理：如运行时突发事件的安全处理等，包括采取计算机安全技术，建立安全管理制度，开展安全审计，进行风险分析等内容。

3.网络安全现状计算机和网络技术具有的复杂和多样，使得计算机和网络安全成为一个需要持续更新和提高的领域。

目前黑客的攻击方法已超过了计算机病毒的种类，而且许多攻击都是致命的。

在Internet网络上，因互联网本身没有时空和地域的限制，每当有一种新的攻击手段产生，就能在一周内传遍全世界。

这些攻击手段利用网络和系统漏洞进行攻击从而造成计算机系统及网络瘫痪。

蠕虫、后门(Back-doors)、DoS(Denia1 of Services)和Snifer(网路监听)是大家熟悉的几种黑客攻击手段。

但这些攻击手段却都体现了它们惊人的威力，且有愈演愈烈之势。

这几类攻击手段的新变种，与以前出现的攻击方法相比，更加智能化，攻击目标直指互联网基础协议和操作系统层次，从web程序的控制程序到内核级Rootlets。

黑客的攻击手法不断升级翻新，向用户的信息安全防范能力不断发起挑战。

二.提膏计算机爵络安全的措麓1.采用防火墙防火墙是目前最为流行、使用最广泛的一种网络安全技术，它的核心思想是在不安全的网络环境中构造一个相对安全的子网环境。

防火墙的最大优势就在于可以对两个网络之间的访问策略进行控制，限制被保护的网络与互联网络之间，或者与其他网络之间进行的信息存取、传递操作。

它具有以下特：所有的从内部到外部或从外部到内部的通信都必须经过它;只有内部访问策略授权的通信才允许通过;使系统本身具有更高的可靠。

常见防火墙的体系结构有三种：(1)双重宿主主机体系结构。

它是丽绕具有双重宿主功能的主机而构筑的，是最基本的防火墙结构。

主机充当路由器，是内外网络的接口，能够从一个网络向另一个网络发送数据包。

这种类型的防火墙完全依赖于主机，因此该主机的负载般较大，容易成为网络瓶颈。

对于只进行酬昙过滤的安全要求来说，只需在两块网卡之间转发的模块上插入对包的ACL 控制即可。

但是如果要对应用层进行代理控制，其代理就要设置到这台双宿主主机上，所有的应用要先于这个主机进行连接。

这样每个人都需要有个登录账号，增加了联网的复杂。

(2)屏蔽主机体系结构，又称主机过滤结构，它使用个单独的路由器来提供内部网络主机之间的服务，在这种体系结构中，主要的安全机制由数据包过滤系统来提供。

相对于双重宿主主机体系结构，这种结构允许数据包,Internet上进人内部网络，因此对路由器的配置要求较高。

(3)屏蔽子网体系结构。

它是在屏蔽主机体系结构基础上添加额外的安全层，并通过添加周边网络更进一步把内部网络和Intemet隔离开。

为此这种结构需要两个路由器，一个位于周边网络和内部网络之间，另一个在周边网络和外部网络之间，这样黑客即使攻破了堡垒主机，也不能直接入侵内部网络，因为他还需要攻破另外一个路由器。

2.数据加密技术数据加密技术是为提高信息系统及数据的安全l生和保密，防止秘密数据被外部破析所采用的主要手段之一。

数据加密技术按作用不同可分为数据存储，数据传输、数据完整的鉴别，以及密钥的管理技术。

数据存储加密技术是防止在存储环节上的数据丢失为目的，可分为密文存储和存取两种，数据传输加密技术的目的是对传输中的数据流加密。

数据完整鉴别是对介入信息的传送、存取，处理人的身份和相关数据内容进行验证，达到保密的要求，系统通过对比验证对输入的特征值是否符合预先设定的参数，实现对数据的安全保护。

3.网络安全的审计和跟踪技术审计和跟踪机制一般情况下并不干涉和直接影响主业务流程，而是通过对主业务进行记录、检查、监控等来完成以审计、完整等要求为主的安全功能。

审计和跟踪所包括的典型技术有：漏洞扫描系统、入侵检测系统(IDS)、安全审计系统等。

我们以IDs为例，IDs是作为防火墙的合理补充，能够帮助系统对付网络攻击，扩展了系统管理员的安全管理能力(包括安全审计、监视、进攻识别和响应)，提高了信息安全基础结构的完整。

入侵检测是一种主动保护网络和系统安全的技术，它从计算机系统或网络中采集、分析数据，查看网络或主机系统中是否有违反安全策略的行为和遭到攻击的迹象，并采取适当的响应措施来阻挡攻击，降低可能的损失。

它能提供对内部攻击、外部攻击和误操作的保护。

入侵检测系统可分为基于主机的入侵检测系统和基于网络的入侵检测系统两类。

4.网络病毒的防范与互联网相连的网络，般需要网关的防病毒软件，加强上网计算机的安全。

如果在网络内部使用电子邮件进行信息交换，还需要一套基于邮件服务器平台的邮件防病毒软件，识别出隐藏在电子邮件和附件中的病毒。

在网络环境下，病毒传播扩散快，仅用单机防病毒产品已经很难彻底清除网络病毒，必须有适合于局域网的全方位防病毒产品。

学校、政府机关、企事业单位等网络一般是内部局域网，就需要一个基于服务器操作系统平台的防病毒软件和针对各种桌面操作系统的防病毒软件。

所以最好使用全方位的防病毒产品，针对网络中所有可能的病毒攻击点设置对应的防病毒软件，通过全方位、多层次的防病毒系统的配置，通过定期或不定期的自动升级，及时为每台客户端计算机打好补丁，加强日常监测，使网络免受病毒的侵袭。

由于计算机网络系统应用范围的不断扩大，人们对网络系统依赖的程度增大，因而对计算机网络系统信息的安全保护提出了更高的要求。

现在，计算机网络系统的安全已经成为关系到国家安全和主权、社会的稳定、民族文化的继承和发扬的重要问题。

因此，充分认识到网络的脆弱和潜在威胁并采取强有力的安全防范措施，对于提高网络的安全能将显得十分重要。

With the rapid development of computer technology and network technology, the development of the society as a whole played a huge role, especially in recent years, the application of computer network in all aspects of social life more widely, has become an important part in people's lives, but it also brings us many challenges. As our growing demand for network information resources, the subsequent information security issues become more prominent, virus, hacker, network crime, such as a great challenge to network information security. So the computer network security is a very important and urgent task.A calculation.1. The basic concept of network security refers to the computer network security. Established for data processing system and adopting the technology and the management of security protection, protection of computer hardware, software, data is not due to accidental and malicious destruction, change, and the source of the leak. The definition of computer security includes the content of the two aspects of physical security and logical security, its logical security can be understood as we often say that the content of the information security, refers to information confidentiality, integrity and availability of protection, and the meaning of the network security is the extension of information security, namely the network security of network information confidentiality, integrity and protection available.2. The basic component of network securityPhysical security: (1) network such as the computer's physical condition, physical environment and facilities safety standards, computer hardware, accessories and installation and configuration of network transmission lines;(2) the software security: if illegal intrusion is to protect the network system, the system software and application software are not illegal copying, tampered with, from viruses, etc.;(3) data security: such as protecting the security of network information data, from illegal access, protect its complete, consistent, and so on(4) network security management: such as runtime emergency security processing, such as computer security technology, set up a safety management system, to carry out the security audit, risk analysis, etc.3. The network security status of computer and network technology is complicated and varied, makes the computer and network security become a need to continue to update and improveareas. At present the hacker's attack method has been more than the kinds of computer virus and many attacks is fatal. On the Internet, without the restrictions of time and space and region, because of the Internet itself whenever there is a new means of attack, can spread throughout the world in a week. These attacks means using network and system vulnerabilities to attack resulting in computer system and network paralysis. Worms, the Back door (Back - doors), DoS (Denia1 of Services) and Snifer (network monitor) is one of the familiar ways hacker attacks. But these are means of attack are amazing power, and has intensified. The attack on a class of new varieties, compared with the attack appeared before method, more intelligent, attacks targeting Internet based protocols and operating system level, from the web program control to the kernel level Rootlets. The hacker's attack technique continuously upgrade renovation, to the user's information security challenge ability continuously.2. Lift cream computer jue foot of network security measures1. Use a firewall, a firewall is currently the most popular, the most widely used a network security technology, its core idea is in an insecure network environment to construct a relatively safe subnet environment. Biggest advantage of firewall is the access policy between two networks can be control, limit between the protected network and Internet network, or with other network information access, transfer operation. It has the following characteristic: all from internal to external, or from external to internal communication must go through it; Is only allowed through internal access strategy authorized communication; Make the system itself has a higher reliability. There are three kinds of common firewall architecture:(1) double host host architecture. It is beautiful around with dual functions of host host and constructing, is the most basic structure of the firewall. Host ACTS as a router, is the internal and external network interface, can be sent from one network to another network packets. This type of firewall is completely dependent on the host, so as the host load is bigger, is easy to become network Pay for only haze filtering security requirements, just between the two pieces of card forwarded on the module of insert the ACL control of the package. But if you want to control the agent application layer, the agent will be set to the double host host, all application should come before the hosts to connect. So that everyone needs to have a login account, increased the complex network.(2) shielding host system structure, also known as the host to filter structure, it USES a separate router to provide service between internal network host, in this kind of system structure, the main security mechanisms provided by the packet filtering system to. Relative to the dual host host system structure, this structure allows packets, Internet aspirant person internal network, so that higher requirements for router configuration.(3) shielded subnet architecture. It is on the basis of shielding the host architecture add additional security layer, and by adding the perimeter network further isolated from the internal network and the Intemet. For this structure need two routers, a lies between peripheral and internal network, another between peripheral network and external network, so that hackers even breached the bastion host, have no direct invasion of the internal network, because he also need to break another router.2. The data encryption technology data encryption technology is to improve the information system and data security and confidentiality, l prevent secret data by external broken analysis using one of the main means. Data encryption technology according to the effect of different can be divided into the data storage, data transmission, data complete identification, and the keymanagement techniques. Data encryption is to prevent data loss in storage link for the purpose, can be divided into ciphertext storage and access to two, data encryption technology is the purpose of the transfer of data stream encryption. Complete data identification is involved in information transmission, access, processing of identity authentication and related data content, reached the requirements of confidentiality, the eigenvalues of the system by comparing the validation of input meets the preset parameters, realization of the data security.3. Audit and tracking technology of network security audit and tracking mechanism in general is not interference and direct impact on the main business processes, but rather through to the main business to record, inspection, monitoring, etc to complete is given priority to with the audit and complete safety features.Typical included in audit and tracking technology are: vulnerability scanning system, intrusion detection system (IDS), security audit system, etc. Our IDs, for example, as rational supplement of the firewall, IDs is able to help to deal with network attacks, extend the safety management capacity of the system administrator (include security audit, surveillance, attack recognition and response), improve the integrity of the information security infrastructure. Intrusion detection is a kind of active protection network and system security technology, its collection, analysis of data from a computer system or network, to check the network or host system whether there is a violation of security policy and the signs of attack, and to take appropriate response measures to stop the attack, reduce the possible losses. It can provide to the internal attack, exterior attack and misoperation protection.Intrusion detection system can be divided into host-based intrusion detection systems and intrusion detection system based on network.4. Network virus prevention network connected to the Internet, need gateway antivirus software, to strengthen the security of the computer on the Internet. If use E-mail on internal network information exchange, also need a email anti-virus software, based on the mail server platform to identify the virus hidden in the E-mail and attachments. Under the network environment, the spread of the virus spread rapidly, with only stand-alone anti-virus products have been difficult to completely remove the network viruses, there must be suitable for local area network (LAN) comprehensive antivirus products. Schools, government agencies, enterprises and institutions, and other general network is an internal LAN, you need an antivirus software and based on server operating system platform for a wide variety of desktop operating system of antivirus software. So it is best to use a comprehensive range of antivirus products, for all the possible virus attacking the network set up corresponding anti-virus software, through the omni-directional and multi-level virus protection system configuration, through regular or not regular automatic update, in time for each client computer good patch, strengthen daily monitoring, network from viruses.Due to expanding the scope of application of computer network system, the network system depends on the extent of the increase, so for the computer network system of information security protection put forward higher requirements. Now, the computer network security has become a relates to national security and sovereignty, social stability, national culture, inherit and carry forward the important issues. Therefore, fully realize the network vulnerability and potential threats and to take strong security precautions, to enhance the security of the network can appear very important.。