网络安全威胁和网络监管的现状、问题及对策研究

上海交通大学硕士学位论文网络安全威胁和网络监管的现状、问题及对策研究姓名：李华清申请学位级别：硕士专业：公共管理指导教师：谢海光200706175455□1□“√”1“”2,,,,3THERESEARCHONNETWORKSECURITYMENACEANDSTATUS,PROBLEMS,COUNTERMEASURESOFNETWORKSUPERVISIONANDMANAGEMENTABSTRACTTheMinistryofthePublicSecurity,othergovernmentdepartmentsaswellastheInternetprofessionalassociationsandsoonallshouldimprovetheinvestmentofthemanpower,thephysicalresource,thetechnologytotakethemeasurestomanagetheInternet.TheestablishmentofComputerEmergencyResponseTeamCoordinationCenter,CNITSEC(ChinaInformationTechnologySecurityCertificationCenter)andotherdepartmentshasgreatlypromotedtheinternetmanagement.However,asourInternetstartedlate,thesupervisingandmanagingsystemisinsufficientlyperfectandcomprehensive.ThetechnologyisbehindthatoftheWesterncountrythedevelopment,soasthenetworksecuritymanagementandsupervision.Theexistinglegallawsandregulationsregardingthecurrentnetworksecuritydevelopmentsituation,appeargraduallydeficientandnottheintegrity,sotheywereunabletosatisfythevariousnetworksecuritythreats.Thepresentsupervisionandmanagementdepartmentsarenotresponsibleenoughto4supervisetheInternet,andwhat’smore,lotsofenterpriseshavecloserelationwithgovernmentdepartments,sothereistheregionalprotectionismphenomenonwhichpreventnetworksupervisingandmanagingsignificantbarriers.AstheInternetdevelopsrapidly,thelackofnetworksupervisionandmanagementwillbringtheunpredictableharmstothenetworkworld,theenhancementofnetworksupervisionandmanagementwillbethecurrentimpatientduty.Inordertoenhancethesecurity,thepublicsecuritysystemshouldstrengthengoldenshieldproject,classifiedinformationsecurityprotectionappraisal,publicinformationnetworksafesupervisionandaswellasthetrainingofprofessionals.Next,thedepartmentsrelatedshouldstrengthenthemanpowerandphysicalresourceassoonaspossible.Finally,thelegallawsandregulationsformulationdepartmentshouldconsummatetheexistinglegallawsandregulationsmakethenewlawstosuitsthenewsecuritymenace.ToimprovethesecurityoftheInternet,differentdepartments,accordingtotheirownrightsandobligation,shouldmakedifferentevaluationstandardstoanalyzetheevaluationresult,andalsoshoulddoinformationsecurityriskevaluationregularly.Theyshouldbuildmanagementsystemstodefinethefunction,obligationandrightsofeachdepartmentsoreveneachperson.What’smore,theyshoulddosomeeducationtocustomerstostrengthenthesenseofsecurity,aswellastobuildresponsesystemtoemergency.5KEYWORDS:informationsecurity,networksecurity,networksecuritymenace,networksupervision,classifiedsecurityprotection7B2BB2CC2C(Spyware)(Rascalware)(Botnet)821“”“”“”“”Internet“”“Network[1]”ComplexSystemoflinesthatcross“[2]”“ISO[1].[M],19881757.[2][EB/OL][3]“”[4]“CIH”“”“”“”200530073%“”“”[3]ISO7498-2:1989--2[S][4][M]19921190102006620062005520065200552006554%5%84%“”“”IBM20052006CIO“”[M]54811“”12,61%,22%,11%,6%2-1200683%11%80%44%68%67%56%[6]200674%52%9%200552006[6]2006[R]2006135200656“”QQ[7]73.00%83.98%85.57%87.93%80.00%74.06%50.00%55.00%60.00%65.00%70.00%75.00%80.00%85.00%90.00%2001200220032004200520062-2[8]62%4.21%17.98%13.12%6.11%16.07%15.15%20.93%6.43%0.00%5.00%10.00%15.00%20.00%25.00%2006-()2-32006-[9][7]2006&[R]2006[8]2006&[R]2006[9]2006&[R]20061443.00%64.05%63.57%49.38%61.25%62.21%0.00%10.00%20.00%30.00%40.00%50.00%60.00%70.00%2001200220032004200520062-4[10]Internet(ARPA)ARPAnet1977-1979ARPAnetTCP/IP1980ARPAnetTCP/IPInternet1983TCP/IP1988Internet1991InternetInternet[10]2006&[R]20061519788471301981“9-11”60010119961997200216CERT20024313621482-1CERT[11]2-1CERT(1988-2003)19881989199019911992199319941995199661322524067731,3342,3402,4122,57319971998199920002001200220032,1343,7349,85921,75652,65882,094137,529CERT(1988-2003)02000040000600008000010000012000014000019881989199019911992199319941995199619971998199920002001200220032-5CERT[11]CERT[EB/OL]“”----“”1996199620006“”18“”“”(NYSE:MFE)[12]2007McAfeeAvertLabsMcAfeeAvertLabsJeffGreenMcAfeeAvertLabs20071.McAfeeAvertLabs2007784%AvertLabs2.McAfeeAvertLabs200765%320061140%2005[12]McAfee2007[EB/OL]——WebAttrition.org13701807.8.PhilisFujacksAvertLabs150SibilGrumExpiro9.32rootkit20AvertLabs200720rootkit200610%McAfeerootkitMcAfeeVirusScanforEnterpriserootkit10.2007Microsoft35259Microsoft321910McAfeeAvertLabs(DAT)200420052006“YOU”[13]“”“”Web1.0“”Web2.0“”[14]Web2.0P2P……“”“”200312SysAdminAuditNetworkSecurityInstitute()(SANSInstitute)(ITAA)IntelMotorolaSUN[13]TIME[EB/OL][14]PaulGraham(November2005).Web2.0[M]2005169211997-20066212040016902650458059109400111001370002000400060008000100001200014000199711199871999720007200172002720037200412200512200612()2-61997-200619942007123CNNIC(CHINAINTERNETNETWORKINFORMATIONCENTER)2006123113700260023.4%2213700xDSLCableModem1040075.9%[15]19942000112001420046“”2005288……[15]CNNIC[R]200623“”“”“”“”24“”“”“”1290043%(VPN)22%47%42%39%2530%57%55%web2.0()(Spyware)200090%,100PC,2900,29Spyware“”