1) Initially the hacker is a skilled writing and debugging of computer programming skills, and the use of these techniques to obtain illegal or unauthorized network or file access, invasion of Intranet for the people. With a variety of powerful hacking tools are widely spread, the computer technology to understand very few people can also implement of hacker attack behavior, so the network system hacking attacks significantly increased the likelihood of.2) Active attack can cause network system status and service change. Active attacks include attempting to stop or break protection mechanism, introduce malicious code, theft or tamper with the information. Active attack may cause data disclosure and dissemination, or cause a denial of service and data tampering, including most of the unauthorized user attempts to abnormal means and the normal means of access to the remote host.3) General complete attack process is to hide themselves, hiding yourself after the attack detection, detection of target machines with various properties, and have been attack condition; then take corresponding attack methods were destroyed, achieve his goal after the attacker will remove their behavior in the target system log.4) General complete attack process is to hide themselves, hiding yourself after the attack detection, detection of target machines with various properties, and have been attack condition; then take corresponding attack methods were destroyed, achieve his goal after the attacker will remove their behavior in the target system log.5) Denial of service attack, is through illegal monopoly target system services, ultimately trying to prevent legitimate users target to provide network services. Denial of service attack is the most common attack through the resulting in a large number of flows to the victim network packet, the network consume all available bandwidth.6) Modern cryptography is one of the basic principles are: all secrets are present and the key. The implication is that, in the design of encryption system, always assume the cipher algorithm is disclosed, really need to keep it secret. This is because the cipher algorithm is easier to reveal the relative key.7) Symmetric cipher password required to achieve through the security code channel by sender to receiver. The password system 's advantages are: high safety, fast encryption speed. The shortcoming is: with the expansion of network scale, key management becomes a difficulty;cannot solve the message confirmation problems; lack of automatic detection of key leakage ability.8) Cryptographic protocol has the following characteristics: agreement from first to last is a sequential process, every step must be performed, in the former step without prior to implementation, the following steps are not possible; protocol requires at least two participants; the protocol must be able to complete a certain task; protocol must meet certain security requirements.9) As a result of cryptography for communication to provide strong security, the attacker has turned to loopholes in the system. Loopholes in the system is a software system, network protocols such as in the preparation of safe flaw, the attacker can use these flaw carries on the attack to the system. For this type of attack, there are a variety of different coping techniques, and cryptography has to a certain extent, can play a role in.10) Public key cryptography is also known as asymmetric key cipher. Using public key cryptography each user separately has two key: encryption keys and decryption key, both of them are not the same, and the encryption key decryption keys on the computer is not feasible. Each user's encryption key are open (and hence, also known as the public key encryption key ).11) If the Internet and are accessed through the firewall, then the firewall, can record various visits, and provides information about network utilization value statistics. If a firewall in suspicious activity occurred when the alarm, it also provides the firewall and network are affected by the trial or attack details.12) The present firewall values are provided on external network user attack protection, from the internal network users to attack to rely on internal network host system by. The firewall can't forbid apostates or company spy sensitive data is copied to a floppy disk or PCMCIA card, and took them out of the company.13) The firewall can prevent data driven attack. If the user is graspinga program on the local operation, the program is likely to include a malicious code. With the Java, JavaScript and ActiveX controls a large number of use, this problem becomes more and more sharp.14) Packet filtering technology, as the name suggests is in proper position on the network data packets carried out selectively by, selectionbasis, namely system within a set of filter rules ( often referred to as the access control list -- Access Control List ), only to meet the data packet filtering rules to be forwarded to the corresponding network interface, the remaining data package is removed from the data stream.15) D ifferent types of firewalls are able to provide identification and authentication functions, the network user is usually considered credible, outside the network of users in access network resources are usually certified. Password authentication from the technical point of view, is not a very strong authentication, password based attack is a common attack, firewall, other filter access authentication method: one time password, the password based on time and challenge response scheme.16) I ntrusion detection is the rational supplement of the firewall, the help system against network attack, expanded the safe management of system administrator ( including safe audit, surveillance, attack recognition and response), improve the integrity of the information security foundation structure. It is thought to be behind a firewall second security gate, without affecting the performance of network condition on the network can be detected, thereby providing for internal attacks, external attack and wrong operation real time protection.17) I ntrusion detection, Intrusion Detection, is on the intrusion behavior found, through the computer network or computer systems in a number of key point of collecting and analyzing the information, found from the network or system of violating security policy behavior and signs of attack.18) The IDS system 's two major functions: real-time detection and safety audit. Real time detection of real-time monitoring, analysis of the network of all data packets, and real-time processing of the captured data packets; security audit based on IDS system records the network time for statistical analysis, found that the abnormal phenomenon, that the security state of the system, find out the evidence required.19) Most of the traditional intrusion detection system ( IDS ) take based on network or host based approach to identify and avoid attack. In either case, the product will be looking for" the attack flag", i.e. a malicious or questionable intent to attack mode. When the IDS in the network to find these patterns, it is based on the network. And when the IDS in a record file for the attack when the mark, which is based on host.20) Based on sentence due to IDS (HIDS) using data is the main source of audit log, system log, application logs and network connection data, these data have the success / failure event information, so it can becompared based on network IDS more accurately determine whether the attack was successful.21) IEFE based on IP draft definition VPN: using IP mechanism simulation of a private network, through private tunnel in public data network technology in simulation of a point-to-point line technology. Virtual private network is to rely on the ISP ( Internet service provider ) and other network service provider, in a public network for data communication network technology.22) VPN also made up of 3 components, different VPN connection using a tunnel as a transmission channel, the tunnel is built in a public network or a private network on the basis of, such as Internet or Intranet, users no longer need to have special long-distance data line.23) Security is one of the important features of the special network. Because VPN directly built on the public network, the realization of a simple, convenient and flexible, but at the same time, the security problem is more prominent. The enterprise must make sure that the VPN transmitted data are not the attacker snoops and tamper with, and to prevent the illegal user from cyber source or private information access. ExtranetVPN enterprise network expansion to partners and customers, for the safety of a higher demand.24) VPN requires the enterprise of its network management functions from the local area network seamlessly extends to the public network, or even customers and partners, although can be some minor network management task to the service provider to complete, enterprises still need to accomplish many tasks of network management, so, the VPN system should support the user management. The VPN management including safety management, equipment management, configuration management, access control list management, QoS management, to achieve reduced network risk, with high scalability, economy, high reliability target.25) VPN through the public network to establish links, so it is necessary to use encryption to prevent eavesdropping, protection of corporate data security. Common encryption algorithm including DES,3DES etc.. DES key length of 56 bits, easily deciphered, 3DES uses three encryption of increased safety.26) Computer virus epidemic began in November 2, 1988. The United States Cornell University 23 years of graduate Lott Maurice produced a worm, and putting it on the Internet to the United States, resulting in the computer network of more than 6000 computers were infected, manynetworked computers to shutdown, the direct economic losses of $96000000.27) A computer virus is a small program, able to replicate themselves, will own the virus code attached to other procedures, through the execution of other programs, for the propagation of the virus program, have a certain latency, when conditions are ripe, they are all sorts of sabotage, the effects of computer use.28) Now popular virus is composed of that deliberately prepared, most viruses can be found on the author information and the origin of information, through the analysis of large volumes of data statistics, virus author main condition and objective is: some talented programmer to show and prove their ability, due to the dissatisfaction of boss, for the curious, in retaliation, in order to congratulate and courtship, in order to get control of the password, to prevent software to get paid for the trap.29) Hybrid virus is not a simple file type virus and boot viruses simply added together, there is a conversion process, which is the most key. Generally take the gimmick: files for viruses when performing the virus writes the boot area, it is easy to understand.30) The computer virus is an objective existence, objective existence has its characteristics, computer virus is no exception. Essentially, a computer virus is a program code, although it may well hidden, but also left many traces. Through to these traces of discrimination, we can find the computer virus in the presence of.。
