隨著網路應用的普及與多元化，網路的安全問題逐漸被人們所重視。目前防火牆已經成為大多數企業的第一道網路安全防線，同時也是最重要的攻擊回應機制，且未來幾年內，防火牆仍然會是相當重要的網路安全防禦機制。但現有的防火牆因為部署位置及運作架構的限制，遭遇愈來愈多的問題，也漸漸無法防禦日新月異的攻擊手法。
本研究首先整理及分析防火牆的演進及目前的問題，進而以分散式防火牆為基礎，加上縱深防禦及合作防禦的概念，提出一套合作式防火牆系統，各合作式防火牆主機與其它防禦機制可進行合作防禦來達到入侵預防的目的。本研究將探討合作式防火牆的數種合作防禦方式及其中的困難點，並提出對應的解決方案，包括提出一種以 XML 為基礎的通用規則來解決合作防禦時的溝通及分散式防火牆的管理問題，及一種網蟲防禦方法以解決網蟲擴散時的內部網路癱瘓問題。
論文中也將說明合作式防火牆的系統架構、運作流程及模組設計，並以系統雛型展示解決網蟲的內部網路癱瘓問題及與入侵偵測系統進行合作防禦來抵禦攻擊，藉此說明合作式防火牆系統的效用及應用方式。

Because of the popularity and variety of network applications, network security is getting respected by people. Today, firewalls are the first line of defense of network security in most enterprises, and are also the most important mechanism of attack response. However, firewalls that are restricted by deployed positions and their architectures now suffer more and more challenges, and they also can’t defend more and more new attacks.
In this thesis, we analyze the evolutions and problems of firewalls, and then develop a cooperative firewall system which is based on the distributed firewall and the concepts of defense in depth and cooperative defense. All firewalls in the cooperative firewall system can cooperate with other defense mechanisms to achieve intrusion prevention. We first present some possible schemes of cooperative defense with cooperative firewall system and discuss their difficulties. Then we propose solutions to solve these difficulties. The solutions include a new generic rule based on XML to solve the communication problems in cooperative defense and the management problem of distributed firewalls, and a detection and defense method of internet worm to solve the problem of network jam when worms spreading.
We also propose the system architecture, operating procedures, and module design of our cooperative firewall system and build a prototype system that is able to solve the network jam of internet worm and make cooperative defense with intrusion detection system to explain the efficiency and applications of the cooperative firewall system.

[1] 王凱，「我國資訊安全市場發展現況與趨勢」，財團法人資訊工業策進會市場情報中心研究報告，民國 91 年 12 月。
[2] 李勁頤，「利用程序追蹤方法關聯分散式入侵偵測系統之入侵警示研究」，國立中央大學資訊管理學系碩士論文，民國 91 年 6 月。
[3] Simson Garfinkel 及 Gene Spafford 原著，林逸文、蔣大偉翻譯，「UNIX 與 Internet 安全防護 – 網路篇」，第264 至 265 頁，美商歐萊禮台灣分公司，2001 年 12 月。
[4] 曾宇瑞，「網路安全縱深防禦機制之研究」，國立中央大學資訊管理學系碩士論文，民國 89 年 6 月。
[5] Carlton R. Davis 原著，劉良棟翻譯，「IPSec – VPN 安全架構與實作」，9-3 至 9-8 頁，麥格羅‧希爾國際出版公司，民國 91 年 6 月。
[6] 林宸堂，「IPsec VPN 的難題：Firewall 與 NAT 的配置」，http://www.iii.org.tw/ncl/document/IPSecVPN.htm，民國 90 年 9 月。
[7] Power, Richard, “1999 CSI/FBI Computer Crime and Security Survey”, Computer Security Journal, Volume XV, Number 2. San Francisco, CA: Computer Security Institute, 1999.
[8] CERT/CC, “Overview of Attack Trends”, Software Engineering Institute, Carnegie Mellon University, 2002.
(Available at http://www.cert.org/archive/pdf/attack_trends.pdf)
[9] Ed Skoudis, “Infosec’s Worst Nightmares”, Information Security Magazine, November 2002.
(Available at http://www.infosecuritymag.com/2002/nov/nightmares.shtml)
[10] W. R. Cheswick and S. M. Bellovin, “Firewalls and Internet Security, Repelling the Wily Hacker ”, Addision-Wesley Publishing Company, 1994.
[11] DistributedFirewalls.com, http://www.distributedfirewalls.com.
[12] Steven M. Bellovin, “Distributed Firewalls”, ;login:, November 1999, pp. 39-47.
[13] Sotiris Ioannidis, Angelos D. Keromytis, Steven M. Bellovin, and Jonathan M. Smith, “Implementing a Distributed Firewall”, ACM Conference on Computer and Communications Security, Athens, Greece, November 2000.
[14] Wei Li, “Distributed Firewall”, December 2000.
(Available at http://www.cs.helsinki.fi/u/asokan/distsec/documents/li.ps.gz)
[15] Utz Roedig, Ralf Ackermann, and Christoph Rensing et al., “A Distributed Firewall for Multimedia Applications”, Proceedings of the Workshop "Sicherheit in Mediendaten", September 2000.
[16] Steve Bridge, “Achieving Defense-in-Depth with Internal Firewalls”, August 2001. (Available at http://www.sans.org/rr/paper.php?id=797)
[17] Edward Hurley, " Intrusion prevention: IDS'' 800-pound gorilla”, http://searchsecurity.techtarget.com/originalContent/0,289142,sid14_gci892744,00.html, April 2003.
[18] Kathleen A. Jackson, “Intrusion Detection System Product Survey”, June 1999.
[19] Martin Roesch and Chris Green, “Snort Users Manual”, http://www.snort.org/docs/writing_rules/chap2.html#tth_sEc2.3.22, 2003.
[20] Snort inline Projects, http://www.honeynet.org/papers/honeynet/tools/.
[21] FireHOL Project, http://firehol.sourceforge.net/, September 2002.
[22] Nessus Project: A free, powerful, up-to-date and easy to use remote security scanner, http://www.nessus.org/.
[23] SARA Project: Security Auditor''s Research Assistant, http://www-arc.com/sara/.
[24] ISS Internet Scanner, http://www.iss.net/products_services/enterprise_protection/ vulnerability_assessment/scanner_internet.php.
[25] Stuart Staniford, Vern Paxson, and Nicholas Weaver, “How to 0wn the Internet in Your Spare Time”, Proceedings of the 11th USENIX Security Symposium, May 2002. (Available at http://www.icir.org/vern/papers/cdc-usenix-sec02/)
[26] Gregory R. Ganger, Greg g Economou and Stanley M. Bielski, “Self-Secure Network Interfaces: What, Why and How”, CMU-CS-02-144, School of Computer Science Carnegie Mellon University Pittsburgh, PA 15213, May 2002.
[27] Matthew M. Williasmson, “Throttling Viruses: Restricting propagation to defeat malicious mobile code”, 18th Annual Computer Security Applications Conference, December 2002.
[28] Anil Somayaji and Stephanie Forrest, ”Automated Response Using System-Call Delays”, Proceedings of the 9th USENIX Security Symposium, August 2000.
[29] Guardian Project, http://www.chaotic.org/guardian/.
[30] CERT/CC, “CERT Advisory CA-2003-04 MS-SQL Server Worm”, January 2003.
[31] Microsoft Corporation, “PSS Security Response Team Alert – New Worm: W32.Slammer”, January 2003. (Available at http://www.microsoft.com/technet/ security/virus/alerts/slammer.asp )
[32] Cisco System Inc., “Using Network-Based Application Recognition and ACLs for Blocking the "Code Red" Worm”, September 2002.
[33] Cisco System Inc., “SAFE SQL Slammer Worm Attack Mitigation”, January 2002.
[34] Kerio Personal Firewall, http://www.kerio.com/us/kpf_home.html.
[35] Nmap, http://www.insecure.org/nmap/index.html, 2003.
[36] Snort: The Open Source Network Intrusion Detection System, http://www.snort.org/.
[37] S. Cheung, R.Crawford, and M. Dilger et al., “The Design of GrIDS: A Graph-Based Intrusion Detection System”, Technical Report CSE-99-2, U.C. Davis Computer Science Department, January 1999. (Available at http://seclab.cs.ucdavis.edu/arpa/grids/grids.ps)
[38] S. Staniford-Chen, S. Cheung, R. Crawford et al., “GrIDS: A graph based intrusion detection system for large networks”, In Proceedings of the 19th National Information Systems Security Conference, pages 361 ~ 370, 1996.
[39] Robert Gwaltney, “Protecting the Next Generation Network – Distributed Firewalls”, http://www.sans.org/rr/firewall/next_gen.php.
[40] Thomas Toth and Christopher Kruegel, “Connection-history based anomaly detection”, Proceedings of the 2002 IEEE Workshop on Information Assurance and Security, June 2002.
[41] CNET Networks, Inc., “Counting the cost of Slammer”, January 2003.
(Available at http://news.com.com/2100-1001-982955.html)
[42] High Level Firewall Language Projects, http://www.hlfl.org and http://freshmeat.net/projects/hlfl/.
[43] VulXML Project: A Web Application Security Vulnerability Description Language, http://www.owasp.org/vulnxml/, October 2002.
[44] OVAL, Open Vulnerability Assessment Language, http://oval.mitre.org/, October 2002.
[45] AVDL, Application Vulnerability Description Language, http://www.avdl.org/, April 2003.