一种优化的实时电子邮件内容审计系统

Optimized Content-Based E-Mail Auditing System Implementation

提出并实现了一种新颖、高效的电子邮件内容审计系统.该系统由分组匹配和全文重组两部分分布实现,分组匹配部分不需要对到来的分组报文进行解码,而是在分组中利用多模式匹配技术搜索已编码的关键字集合,并分析了关键字的错位编码技术;全文重组不需要针对所有的电子邮件全文,而是充分利用数据包分组匹配结果,重组数据包分组中包含关键字的邮件全文,从而提高了整个系统的性能.该系统在功能、性能方面比已有系统都有很大的提高.

A high efficient content-based E-mail auditing system and its implement are described. The system consists of packet filter module and email reconstruct module. Keywords are encoded into Base64, UUcode and Quoted-Printable format, after they are bit-shifted. The packet filter module takes full advantage of the fast multi-pattern matching technology searching for encoded keywords in packets. Only when one of keywords is found in packet, all packets belong to the same TCP link will be sent to E-mail reconstruction module. The performance of E-mail auditing system is better than the systems with existing structure.