信息审计系统中内容关联还原的设计与实现

Design and Implementation of Content Reconstruction in Network Information Audit Systems

互联网的飞速发展给信息审计系统中的内容还原提出了新的挑战。为了实现完整的内容还原,引入双向内容流表结构,实现了基于TCP序列号偏移的数据包存储,避免了数据包重传/乱序带来的问题。设计了基于IP对哈希索引的多连接关联还原,实现了多连接传输同一内容的准确还原。为了提高还原的性能,设计了基于多分配子的静态内存池,理论分析了优化的分配子大小设置问题。最后,以HTTP内容还原为例,验证了还原系统。

The rapid development of network brings new challenges to content reconstruction for information auditing system. In order to achieve accurate content reconstruction, we introduce a bi-directional content flow table to realize packet store based on the offset of TCP sequence number, and avoid the problems caused by packet retransmission and disorder. We design IP-pair hash indices to support multi-connection associated content reconstruction. To enhance performance, we propose to use multi-allocation unit based static-memory pool. We further study optimal setup of allocation unit size. At last, we verify our content reconstruction system with an example of HTTP content reconstruction.