FICoM:一种防火墙和入侵检测协同工作的模型

FICoM:a Firewall and Intrusion Detection Cooperative Model

防火墙和入侵检测是当前最为常用的安全技术。因为它们在功能上互为补充,所以在许多安全解决方案中结合使用防火墙和入侵检测技术。但是,这种结合却也引入了入侵检测系统检测不到已被防火墙过滤掉的来自外网的攻击等问题,这必须由这两个系统间的通信来解决;另外,防火墙和入侵检测有功能上相同的模块,若分别实现、独立使用这两个系统就忽略了信息的可复用性,造成资源的浪费。因此,该文提出了一种防火墙和入侵检测协同工作的安全构架模型FICoM及其设计。

Firewall and Intrusion detection are the most popular technology for security applications.Since they are functional complementary,you can combine them for constructing more secure systems.But combination will cause prob-lems such as necessary information unavailable for IDS.So this paper proposes a solution by communication between IDS and firewall.The paper also presents a model-- - Firewall&IDS Cooperative Model(FICoM)and its design to ex-tend their functions by reciprocity and to reuse the information by sharing data.