基于Linux防火墙的内部邮件监控系统

Inner email monitoring system based on Linux firewall

给出了一种分布式邮件监控系统的设计和实现方案。该方案的实现建立在Linux防火墙的基础上。采用了Netfilter构架中的ip_queue机制获取流经网关的邮件,根据SMTP和POP3的协议特点提取邮件内容,利用文本分类技术对邮件内容进行监控。系统中广泛地使用了插件机制,明确地划分了实时处理和离线分析两大类操作的界限。针对文本分类器的特点,系统定义了简明的接口,使不同算法的分类器可以方便地整合到系统当中来。该方案的实施可以有效地监控流经网关的邮件。

The design and implementation scheme of a distributed email monitoring system are presented, which is based on Linux firewall. The ip_queue module in Netfilter structure is adopted to obtain emails from gateway, and email content is extracted according to SMTP and POP3 protocols. Text categorization technique is utilized to monitor email content. Plug-ins is widely used in the system, and real-time processing and off-line analysis are compartmentalized definitely. According to the characters of text categorizer, compendious interfaces are defined, which could integrate categorizers via various algorithms into the system conveniently. Application shows that the system could monitor emails effectively.