综合扫描系统的设计与实现

发布时间：2018-08-13 18:22

【摘要】：随着互联网技术的不断发展,网络给我们的日常生活带来了极大的便利。然而,随之而来的网络安全问题却变得日益严峻。恶意攻击者利用网络中存在的漏洞来入侵我们的系统,对我们的财产造成了极大的损失,这严重影响了互联网的健康发展。若想有效地阻止恶意攻击者对系统的攻击,用户就需要提前使用漏洞扫描器对系统中存在的安全隐患进行检测并及时地采取相应的解决措施。我们对目前已公开的网络扫描系统进行了详细的对比分析,发现不同的扫描系统或多或少存在着以下几个方面的不足:端口扫描常留下痕迹,容易被目标主机发现;扫描的速度比较慢,如采用ping扫描;漏洞扫描结果不够精确,存在误报或者漏报的情况;扫描功能单一,如Nmap只能够进行端口扫描以及操作系统识别;目前存在的扫描系统以web扫描为主,系统漏洞扫描很少。针对以上问题,我们提出了基于系统服务漏洞的综合扫描系统设计方案。在我们的方案中,综合扫描系统采用了按功能划分进行模块化设计的方式。模块化的方式能够降低系统设计的整体复杂度,这也是未来扫描系统发展以及许多其他类型软件的设计思路之一。系统共包括信息收集模块、漏洞扫描模块以及结果处理模块三个主模块。信息收集模块能够进行主机在线探测、端口扫描、端口服务确认以及操作系统识别;而漏洞扫描模块能够对目标系统进行漏洞的检测,实现扫描功能的多样化。我们采取漏洞预测与漏洞验证相结合的方式来检测每一个漏洞,即首先将信息收集模块收集到的目标系统的基本信息,主要为端口服务和操作系统类型信息,将这些信息与漏洞数据库中的漏洞特征即漏洞存在条件进行比较分析,预测出漏洞的大致范围,最后再调用漏洞插件去验证每一个预测的漏洞是否存在,这种相结合的扫描方式降低了漏洞的误报率,提高了系统扫描的准确性。在扫描系统的实现中,我们采用了多种技术来保证系统的整体性能。如采用多线程技术来提高扫描效率;采用插件技术实现扫描系统的可扩展性;并且采用端口内部乱序以及线程随机重启来躲避对方防火墙的过滤等等。最后在进行系统测试时,我们的扫描系统成功地对目标主机检测到了漏洞的存在。
[Abstract]:With the continuous development of Internet technology, the network brings great convenience to our daily life. However, the following network security problems have become increasingly serious. Malicious attackers take advantage of the vulnerabilities in the network to invade our systems, causing great losses to our property, which seriously affects the healthy development of the Internet. In order to effectively prevent the malicious attacker from attacking the system, the user needs to use the vulnerability scanner in advance to detect the hidden security problems in the system and take corresponding measures to solve them in time. We compare and analyze the network scanning system which has been published at present, and find that the different scanning system has the following shortcomings more or less: the port scan often leaves a trace, is easy to be found by the target host; The speed of scanning is slow, such as ping scan, the result of loophole scan is not accurate, there are false positives or false positives, the scanning function is single, such as Nmap can only scan ports and identify the operating system. At present, web scanning is the main scanning system, and the system vulnerability scanning is very few. In view of the above problems, we propose a comprehensive scanning system design scheme based on system service vulnerability. In our scheme, the integrated scanning system adopts the modular design method according to the function division. The modular approach can reduce the overall complexity of the system design, which is one of the future development of scanning systems and many other types of software design ideas. The system includes three main modules: information collection module, vulnerability scanning module and result processing module. The information collection module can detect the host on-line, scan the port, confirm the port service and identify the operating system, while the vulnerability scanning module can detect the vulnerability of the target system and realize the diversification of the scanning function. We use the combination of vulnerability prediction and vulnerability verification to detect each vulnerability, that is, the basic information of the target system collected by the information collection module is mainly port service and operating system type information. This information is compared with the vulnerability characteristics in the vulnerability database, that is, the condition of vulnerability existence, and the approximate scope of the vulnerability is predicted. Finally, the vulnerability plug-in is called to verify the existence of each predicted vulnerability. The combined scanning method reduces the false alarm rate of the vulnerability and improves the accuracy of the system scan. In the implementation of the scanning system, we adopt a variety of techniques to ensure the overall performance of the system. Such as multi-thread technology to improve the efficiency of scanning; plug-in technology to achieve the scalability of the scanning system; and the use of port internal disorder and thread random restart to avoid the filtering of the other firewall and so on. Finally, in the system test, our scanning system successfully detected the existence of vulnerabilities on the target host.
【学位授予单位】：电子科技大学
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TP393.08

【相似文献】