With the continual growth of the variety and complexity of network crime means, the traditional packet feature matching cannot detect all kinds of intrusion behaviors completely. It is urgent to reassemble network str...With the continual growth of the variety and complexity of network crime means, the traditional packet feature matching cannot detect all kinds of intrusion behaviors completely. It is urgent to reassemble network stream to perform packet processing at a semantic level above the network layer. This paper presents an efficient TCP stream reassembly mechanism for real-time processing of high-speed network traffic. By analyzing the characteristics of network stream in high-speed network and TCP connection establishment process, several polices for designing the reassembly mechanism are built. Then, the reassembly implementation is elaborated in accordance with the policies. Finally, the reassembly mechanism is compared with the traditional reassembly mechanism by the network traffic captured in a typical gigabit gateway. Experiment results illustrate that the reassembly mechanism is efficient and can satisfy the real-time property requirement of traffic analysis system in high-speed network.展开更多
流量分片重组技术作为获取网络流量的基础技术之一,在网络空间的复杂情况下,一直都有各种各样的局限性。针对大流量高并发场景的传输控制协议(Transport Control Protocol,TCP)流量重组需求,详细调研了主流的分片重组技术的优缺点,拓展...流量分片重组技术作为获取网络流量的基础技术之一,在网络空间的复杂情况下,一直都有各种各样的局限性。针对大流量高并发场景的传输控制协议(Transport Control Protocol,TCP)流量重组需求,详细调研了主流的分片重组技术的优缺点,拓展了适用于数据报文的区间管理算法,对TCP流重组流程进行优化,解决了目前在大流量高并发场景下,TCP流重组效率低、重组完整度不足的问题。展开更多
为了提高网络管理人员对广播网络的监控能力,提出一个基于NDIS协议驱动程序的网络监控(Network Monitoring Based on NDIS Protocol Driver,简称为NMBPD)系统模型.通过实现一个基于NDIS协议驱动程序的数据包捕获驱动程序,能高效地捕获...为了提高网络管理人员对广播网络的监控能力,提出一个基于NDIS协议驱动程序的网络监控(Network Monitoring Based on NDIS Protocol Driver,简称为NMBPD)系统模型.通过实现一个基于NDIS协议驱动程序的数据包捕获驱动程序,能高效地捕获原始数据包,此外,设计并实现一个轻量级的协议栈以及能处理4种最流行的应用层协议的解析器,并通过实验对NMBPD系统进行了测试.NMBPD系统可以监控广播网络上的所有主机的活动,降低了网络管理难度.展开更多
基金National High-Tech Research and Development Program of China (863 Program) (No.2007AA01Z309)
文摘With the continual growth of the variety and complexity of network crime means, the traditional packet feature matching cannot detect all kinds of intrusion behaviors completely. It is urgent to reassemble network stream to perform packet processing at a semantic level above the network layer. This paper presents an efficient TCP stream reassembly mechanism for real-time processing of high-speed network traffic. By analyzing the characteristics of network stream in high-speed network and TCP connection establishment process, several polices for designing the reassembly mechanism are built. Then, the reassembly implementation is elaborated in accordance with the policies. Finally, the reassembly mechanism is compared with the traditional reassembly mechanism by the network traffic captured in a typical gigabit gateway. Experiment results illustrate that the reassembly mechanism is efficient and can satisfy the real-time property requirement of traffic analysis system in high-speed network.
文摘流量分片重组技术作为获取网络流量的基础技术之一,在网络空间的复杂情况下,一直都有各种各样的局限性。针对大流量高并发场景的传输控制协议(Transport Control Protocol,TCP)流量重组需求,详细调研了主流的分片重组技术的优缺点,拓展了适用于数据报文的区间管理算法,对TCP流重组流程进行优化,解决了目前在大流量高并发场景下,TCP流重组效率低、重组完整度不足的问题。
文摘为了提高网络管理人员对广播网络的监控能力,提出一个基于NDIS协议驱动程序的网络监控(Network Monitoring Based on NDIS Protocol Driver,简称为NMBPD)系统模型.通过实现一个基于NDIS协议驱动程序的数据包捕获驱动程序,能高效地捕获原始数据包,此外,设计并实现一个轻量级的协议栈以及能处理4种最流行的应用层协议的解析器,并通过实验对NMBPD系统进行了测试.NMBPD系统可以监控广播网络上的所有主机的活动,降低了网络管理难度.
