基于多模式匹配的应用协议识别研究

Study on Application Protocol Identification Based on Multi-pattern Matching

针对网络监听中应用层网络协议类型多、端口动态化、负载变化频繁、关键词匹配难度大等问题。本文提出了一种能够不降低被监听网络性能的多模式匹配的应用协议识别算法。首先根据模式串集合前后缀关系进行分类,然后采用正、反向匹配算法进行处理,最后采用活跃规则的方式对协议规则进行调度。实验结果表明,新算法在模式集较大的情况下,能明显提高应用协议识别的效率,并减少资源消耗,适用于实行大规模网络监听的生产环境。

Aiming at the problem of the multiple types of application layer network protocol, port dynamic variety, load changing frequently, keyword matching difficultly in network monitoring, in this paper, an application protocol identification algorithm based on multi-pattern matching was presented, but the network performance could not be re-duced. Firstly, the set of pattern strings is classified with relation of prefix and suffix, and then processed by forward algorithm and reverse algorithm. The active rules is used for scheduling protocol rule. The experimental results show that with the larger the pattern set the efficiency of application protocol identification can be significantly improved by new algorithm and resource consumption can be reduced,the new algorithm are suitable for large-scale network moni-toring of the production environment.