Test system and test method oriented to next-generation firewall

Abstract

The invention discloses a test system and a test method oriented to a next-generation firewall. The test system is composed of five modules, namely a management module, a strategy module, a session generation module, a result evaluation module and a report module. The test method comprises the steps: (a) test strategy configuration: according to preset parameters, filling in data structure linked lists of test rules to generate specific test cases; (b) network session generation: constructing an independent client program and an independent server program, respectively simulating an attack host and a host in the network protected by a firewall, then respectively calling plugins corresponding to the test cases, passing the parameters of the test cases generated in the step a to the plugins, generating data packets in real time through the plugins, and delivering the data packets to a client or a server to be sent to generate a network session or network attack session; (c) test result evaluation: evaluating test results according to the completion status of the session, as well as behavior parameters and alarm information of the firewall. By adopting the test system and the test method oriented to the next-generation firewall, automatic test and evaluation of the next-generation firewall can be realized.

Description

technical field [0001] The invention belongs to the technical field of information security, and relates to testing for next-generation firewalls, in particular to testing devices and testing methods for main security features of the next-generation firewalls, such as application identification, user control, content security, Web attack protection, and unknown Trojan horse attack defense. . Background technique [0002] Firewall is an important part of computer network security system, deployed between different networks (such as trusted internal network and untrusted public network) or between network security domains. As the only connection point between different networks, the firewall monitors the network data passing through according to the network security policy, and has strong anti-attack capability. [0003] With the significant increase in the level of network attacks and the intervention of network threats with group organizations or even national backgrounds, ...

AI Technical Summary

Problems solved by technology

[0010] 1. Poor pertinence

It is impossible to test the distinctive technical characteristics of NGFW. In response to the development of network attack technology, NGFW has greatly strengthened the fine-grained control capability of the application layer. Application identification, content security and intrusion prevention have become its core functions, but the focus of existing testing methods Still focused on the network and transport layers

[0011] 2. Unable to conduct fine-grained application layer and content layer testing

In the past testing methods, there were very few test contents at the application layer and content level, only basic application layer protocol identification and a small amount of URL, keyword filtering and other content, and a large number of network application and data level content could not be tested, so it was difficult to effectively test the following First-generation firewalls for accurate testing and evaluation

[0012] 3. Lack of network attack testing based on the application layer

Most of the existing attack testing methods are based on the network layer, and the application layer attack testing is lacking, such as Trojan horse attacks based on protocol masquerade, Web attacks, etc., so it is difficult to effectively evaluate the security technical characteristics of the next generation firewall

Images