信息网络安全 ›› 2014, Vol. 14 ›› Issue (10): 44-48.doi: 10.3969/j.issn.1671-1122.2014.10.008

• 技术研究 • 上一篇    下一篇

基于DPI的流量识别系统的研究

武光达, 蒋朝惠   

  1. 贵州大学大数据与信息工程学院,贵州贵阳 550000
  • 收稿日期:2014-07-23 出版日期:2014-10-01 发布日期:2015-08-17
  • 作者简介:

    武光达(1989-),男,山东,硕士研究生,主要研究方向:网络安全与通信技术;蒋朝惠(1965-),男,四川,教授,硕士,主要研究方向:通信网络与信息安全。

  • 基金资助:
    贵州省科学技术基金[黔科合J字[2012]2128号]

Research on Flow Identification System Based on DPI

WU Guang-da, JIANG Chao-hui   

  1. College of Big Data and Information Engineering Guizhou University , Guiyang Guizhou 550000, China
  • Received:2014-07-23 Online:2014-10-01 Published:2015-08-17

摘要:

随着网络应用的多样化,各种网络流量不断复杂化、多样化,各种网络安全事故频发。网络流量的分布不均匀以及网络安全状况的复杂使得互联网急需管理和维护,网络流量的监控问题变得尤为重要。流量识别作为一种能够自动、实时保障网络监控的技术,成为防火墙一类静态安全设备的必要补充,越来越受到人们的重视。深度包监测(DPI)技术以其识别的准确性成为应用越来越广泛的识别技术。然而单纯的软件实现系统监测速度较慢,不能满足网络高速数据包处理的吞吐量要求。单纯的硬件识别知识库会占用大量内存,一般的硬件内存达不到要求。单纯的软件识别效率又不能满足越来越大的网络吞吐量需求。这种情况下,文章研究了一种基于正则表达式的软硬件结合系统实现方法,该方法的主要思想是硬件识别网络常见协议,软件识别复杂的网络协议,且两者都支持正则表达式。这种方法兼具软件与硬件实现的优点,与传统的软件实现相比,在识别效率方面有明显提高。

关键词: 正则匹配, 深度包监测, AC算法

Abstract:

With the diversification of network applications, various kinds of network traffics are increasingly complex and diversified, and a number of serious accidents occur frequently. The non-uniform distribution of network traffics and the complexity of the internet security situation make the management and maintenance of the internet urgent, which make the monitoring of the network traffic to be an important issue. The traffic identification, a technology which can provide automatic and real-time protection for the network monitoring , becomes a necessary supplement to static security devices such as firewall and gains more and more attentions. As the main measure to traffic identification, DPI technology is more popular because of its accurateness. However, the method that only uses software to perform the system inspection is of low speed, which can not meet the requirement of throughput that the high-speed packet process needs. The method that only uses hardware identification knowledge base would occupy big memory, which the hardware memory can’t meet in general .In this paper , a method based on regular expression and the combination of hardware and software is proposed. The concept of this approach includes two aspects: one is that the hardware recognizes the common internet protocols , the other is that the software recognizes the complicated internet protocols. In addition, both of them can support the regular expression. This approach bears the advantages of the software and the hardware. Comparing with the traditional realization with software, it achieves remarkable improvement in the efficiency of recognition.

Key words: regular matching, DPI, AC algorithm

中图分类号: