网络安全工程与实践课程大纲
中文版
一、课程基本信息
- 课程名称：网络安全工程与实践
- 英文名称：Network Security Engineering and Practice
- 开课院系：清华大学计算机系
- 课程性质：本科专业选修课
- 学时学分：32 学时，2 学分
- 教学形式：课堂讲授、案例分析、在线实验、课堂讨论与展示
- 实验形式：课外完成 6 个在线实验，实验环境基于 SecLab 实验平台
- 参考教材：段海新，《计算机网络安全实践教程》，清华大学出版社
二、课程简介
本课程面向具有计算机网络、操作系统和程序设计基础的本科生，围绕互联网基础设施、通信协议、密码机制、软件系统和 Web 应用中的典型安全问题，讲授网络安全工程中的基本概念、攻击原理、防护机制和实践方法。课程强调“理解系统、分析风险、构造攻击、设计防护”的工程化思维，通过真实安全事件、协议漏洞案例和在线实验，帮助学生建立从威胁建模到漏洞分析、从流量观察到安全加固的系统能力。
课程内容覆盖网络安全风险分析，局域网与 TCP/IP 协议安全，DNS 安全，常用密码算法、公钥基础设施与 TLS，虚拟专用网络，软件安全，栈溢出漏洞，以及 Web 安全策略和常见攻击防御。学生需在课外独立完成 6 个在线实验，并提交实验报告。
三、课程目标
完成本课程后，学生应能够：
- 理解网络安全的基本目标、攻防对抗特征、威胁建模方法和风险分析框架。
- 掌握常用网络分析与数据包构造工具，能够观察、解释和分析典型网络通信过程。
- 解释局域网、DNS、TCP/IP、TLS、PKI、VPN、Web 和软件系统中的主要安全问题。
- 分析典型漏洞和攻击的成因、攻击面、利用条件、影响范围和防护思路。
- 在受控实验环境中完成流量分析、局域网攻击、DNS 缓存污染、VPN、Web 安全、软件漏洞分析等实践任务。
- 形成网络安全实践中的法律、伦理和责任意识，遵守实验边界，不侵犯他人系统与隐私。
四、先修要求
学生应具备计算机网络、操作系统、Linux/Unix 基础、程序设计和基础密码学相关知识。
五、课程内容与学时安排
| 模块 | 主要内容 | 建议学时 |
|---|---|---|
| 课程导论与网络安全概览 | 课程定位；网络空间安全学科背景；网络安全的本质；攻防对抗与成本收益；CIA 安全目标；认证、访问控制、抗抵赖、可追查性与匿名性；法律伦理与实验规范 | 2 |
| 风险分析与威胁建模 | 资产、漏洞、威胁；个人、企业和基础设施场景中的安全资产；典型安全事件分析；威胁建模方法 | 2 |
| 网络概念、协议与常用工具 | TCP/IP 与 OSI 模型；网络拓扑、交换、路由、DNS、HTTP；tcpdump、Wireshark、dig、Scapy 等工具；流量捕获与协议分析 | 4 |
| 局域网安全与口令安全 | 交换机工作原理及问题；ARP 欺骗及防范；DHCP 攻击及防范；报文嗅探；口令猜解与摘要认证口令破解 | 2 |
| TCP/IP 协议安全 | IP 分片与地址伪造；IPv6 安全；TCP 状态管理；SYN Flood；序列号预测；TCP 劫持；TCP RST 攻击及防护 | 4 |
| DNS 安全 | DNS 系统功能、协议格式和解析过程；根域名系统及治理；DNS 攻击面；路径劫持与注入；缓存污染攻击；DNS 反射放大攻击；DNSSEC、DoT/DoH 等防护机制 | 4 |
| 密码技术基础 | 古典密码与现代密码思想；Hash、对称密钥算法、公开密钥算法；密钥协商；安全通信协议的认证、机密性、完整性和密钥管理需求 | 4 |
| PKI、TLS 与 VPN | 公钥基础设施、CA 与证书生命周期；Web PKI 信任模型及攻击；证书撤销、Certificate Transparency；TLS 工作原理与典型攻击；TLS VPN 与其他 VPN | 4 |
| 软件安全与漏洞利用 | 软件安全威胁分类；恶意软件、软件破解、软件漏洞；供应链安全；栈溢出漏洞原理、根因分析、利用可靠性与漏洞缓解机制 | 4 |
| Web 安全 | Web 与 HTTP 基础；前端、后端、数据库与 Web 架构；同源策略、Cookie、CSP 等安全策略；XSS、CSRF、SQL 注入、文件上传等攻击及防御；OWASP Top 10 | 2 |
| 合计 | 32 |
六、课外在线实验
课程包含 6 个课外在线实验，每名学生独立使用 SecLab 实验平台完成实验环境操作、结果验证和实验报告撰写。
| 实验 | 名称 | 主要目标 |
|---|---|---|
| 实验一 | 流量分析与数据包构造工具 | 熟悉实验平台、网络拓扑与基础协议；使用 tcpdump、Wireshark、dig、Scapy 等工具进行流量捕获、协议分析和数据包构造 |
| 实验二 | 局域网攻击及口令破解 | 理解局域网中的 ARP/DHCP 等安全问题，完成报文嗅探、中间人攻击场景观察、弱口令或摘要认证口令分析 |
| 实验三 | DNS 缓存污染攻击与防范 | 理解 DNS 解析流程、DNS 攻击面和缓存污染原理，在受控环境中完成攻击复现并分析防护机制 |
| 实验四 | 虚拟专用网络（VPN） | 理解 VPN 的基本原理、隧道通信和安全通信需求，完成 VPN 相关配置、连通性验证和安全分析 |
| 实验五 | Web 网站安全 | 分析 Web 应用中的认证、Cookie、同源策略和常见漏洞，实践 XSS、CSRF、SQL 注入或文件上传等典型问题的验证与防护 |
| 实验六 | 软件漏洞分析与利用 | 分析软件漏洞成因，理解栈溢出等典型漏洞的触发、利用和缓解机制，完成受控漏洞分析实验 |
参考实验节奏：课程开始后按约两周一个实验推进，实验一至实验六依次覆盖网络基础工具、局域网安全、DNS 安全、VPN、Web 安全和软件漏洞分析。遇到期中繁忙周可适当顺延，所有实验应在课程结束前完成。
实验报告要求包括主要操作步骤、关键步骤截图、配置或命令记录、代码或脚本、流量抓取分析、问题总结与探索。每个实验单独提交一份报告。
七、考核方式
- 平时实验/作业：主要依据实验报告、代码或脚本、实验完成质量、分析深度和按时提交情况评定。
- 课堂参与和表现：主要依据课堂讨论、问题回答、实验分享和课堂展示情况评定。
八、教学要求与学术规范
课程实验仅限在授权的 SecLab 在线实验环境中完成。学生应遵守网络安全法律法规、学校教学纪律和科研伦理，尊重他人系统、数据和隐私。未经授权不得对真实网络、第三方系统或他人账户进行扫描、攻击、测试或数据获取。
---
Course Syllabus: Network Security Engineering and Practice
English Version
1. Basic Information
- Course Title: Network Security Engineering and Practice
- Offering Department: Department of Computer Science and Technology, Tsinghua University
- Course Type: Undergraduate professional elective
- Contact Hours and Credits: 32 contact hours, 2 credits
- Teaching Format: Lectures, case studies, online labs, discussions, and student presentations
- Lab Format: Six online labs completed outside class, hosted on the SecLab platform
- Reference Textbook: Haixin Duan, Practical Tutorial on Computer Network Security, Tsinghua University Press
2. Course Description
This course introduces the engineering principles and practical methods of network security. It is designed for undergraduate students with background knowledge in computer networks, operating systems, and programming. The course examines representative security problems in Internet infrastructure, communication protocols, cryptographic mechanisms, software systems, and Web applications.
The course emphasizes an engineering mindset of understanding systems, analyzing risks, constructing attacks, and designing defenses. Through real-world incidents, protocol vulnerability cases, and online hands-on labs, students will develop systematic skills in threat modeling, vulnerability analysis, traffic inspection, attack reproduction in controlled environments, and defensive reasoning.
Major topics include security risk analysis, LAN and TCP/IP security, DNS security, cryptographic algorithms, PKI and TLS, VPNs, software security, stack-based buffer overflow vulnerabilities, and Web security policies and defenses. Students are required to complete six independent online labs outside class and submit lab reports.
3. Learning Objectives
Upon successful completion of this course, students will be able to:
- Explain fundamental security goals, adversarial thinking, threat modeling, and risk analysis.
- Use common network analysis and packet construction tools to observe and analyze network communication.
- Describe major security issues in LANs, DNS, TCP/IP, TLS, PKI, VPNs, Web applications, and software systems.
- Analyze the root causes, attack surfaces, exploitation conditions, impacts, and mitigation strategies of representative vulnerabilities.
- Complete hands-on tasks in traffic analysis, LAN attacks, DNS cache poisoning, VPN configuration, Web security, and software vulnerability analysis in a controlled environment.
- Understand the legal, ethical, and professional responsibilities of cybersecurity practice and respect the boundaries of authorized experiments.
4. Prerequisites
Students should have basic knowledge of computer networks, operating systems, Linux/Unix, programming, and introductory cryptography.
5. Topics and Contact Hours
| Module | Topics | Hours |
|---|---|---|
| Course Introduction and Security Overview | Course motivation; cybersecurity as a discipline; adversarial nature of security; cost-benefit tradeoffs in attack and defense; CIA goals; authentication, access control, non-repudiation, accountability, anonymity; ethics and lab rules | 2 |
| Risk Analysis and Threat Modeling | Assets, vulnerabilities, and threats; personal, enterprise, and infrastructure assets; case studies of security incidents; threat modeling methods | 2 |
| Network Concepts, Protocols, and Tools | TCP/IP and OSI models; topology, switching, routing, DNS, HTTP; tcpdump, Wireshark, dig, Scapy; traffic capture and protocol analysis | 4 |
| LAN Security and Password Security | Switching and LAN security issues; ARP spoofing and defenses; DHCP attacks and defenses; packet sniffing; password guessing and digest authentication password analysis | 2 |
| TCP/IP Security | IP fragmentation and spoofing; IPv6 security; TCP state management; SYN flooding; sequence number prediction; TCP hijacking; TCP RST attacks and mitigations | 4 |
| DNS Security | DNS functions, packet format, and resolution process; DNS root and governance; DNS attack surfaces; interception and injection; cache poisoning; DNS reflection amplification; DNSSEC, DoT, DoH, and related defenses | 4 |
| Cryptographic Foundations | Classical and modern cryptographic thinking; hash functions, symmetric-key algorithms, public-key algorithms; key exchange; authentication, confidentiality, integrity, and key management in secure communication protocols | 4 |
| PKI, TLS, and VPNs | Public key infrastructure, CAs, and certificate lifecycle; Web PKI trust model and attacks; certificate revocation and Certificate Transparency; TLS principles and attacks; TLS VPNs and other VPN technologies | 4 |
| Software Security and Exploitation | Software security threat categories; malware, software cracking, and software vulnerabilities; supply-chain security; stack-based buffer overflow, root-cause analysis, exploit robustness, and mitigation mechanisms | 4 |
| Web Security | Web and HTTP fundamentals; frontend, backend, databases, and Web architecture; same-origin policy, cookies, CSP; XSS, CSRF, SQL injection, file upload vulnerabilities, and defenses; OWASP Top 10 | 2 |
| Total | 32 |
6. Online Labs
The course includes six online labs to be completed independently on the SecLab platform. Each student is expected to operate the assigned virtual environment, validate key results, and submit an individual lab report.
| Lab | Title | Main Objectives |
|---|---|---|
| Lab 1 | Traffic Analysis and Packet Construction Tools | Become familiar with the lab platform, network topology, and basic protocols; use tcpdump, Wireshark, dig, Scapy, and related tools for traffic capture, protocol analysis, and packet construction |
| Lab 2 | LAN Attacks and Password Cracking | Understand ARP/DHCP-related LAN security issues; observe packet sniffing and man-in-the-middle scenarios; analyze weak passwords or digest authentication passwords |
| Lab 3 | DNS Cache Poisoning Attacks and Defenses | Understand DNS resolution, DNS attack surfaces, and cache poisoning; reproduce attacks in a controlled environment and analyze defenses |
| Lab 4 | Virtual Private Networks (VPNs) | Understand VPN principles, tunneling, and secure communication requirements; complete VPN configuration, connectivity validation, and security analysis |
| Lab 5 | Web Site Security | Analyze authentication, cookies, same-origin policy, and common Web vulnerabilities; practice validation and mitigation of issues such as XSS, CSRF, SQL injection, or file upload vulnerabilities |
| Lab 6 | Software Vulnerability Analysis and Exploitation | Analyze the root causes of software vulnerabilities; understand the triggering, exploitation, and mitigation of representative vulnerabilities such as stack-based buffer overflows |
Suggested lab pacing: the six labs are released sequentially throughout the semester, roughly one lab every two weeks. The labs cover network tools, LAN security, DNS security, VPNs, Web security, and software vulnerability analysis. Adjustments may be made around busy academic weeks, but all labs should be completed before the end of the course.
Lab reports should include major operation steps, screenshots for key checkpoints, configuration or command records, code or scripts, packet-capture analysis, and reflections on problems encountered or further exploration. Each lab should be submitted as a separate report.
7. Assessment
- Labs and assignments: Evaluation is based on lab reports, code or scripts, completion quality, analytical depth, and timely submission.
- Class participation and performance. Evaluation is based on discussion, responses to questions, lab sharing, and presentations.
8. Ethics and Academic Integrity
All hands-on experiments must be conducted only within the authorized SecLab online lab environment. Students must comply with cybersecurity laws, university rules, and professional ethics. Unauthorized scanning, attacking, testing, or data collection against real networks, third-party systems, or other users' accounts is strictly prohibited.