网络流量识别技术的研究与实现

发布时间：2018-05-14 07:13

本文选题：流量识别 + DPI　；参考：《电子科技大学》2017年硕士论文

【摘要】：随着网络技术的不断发展,各种网络应用的日益丰富,使得人们的生活与互联网的关系变得越来越紧密。新的网络技术在给人们的生活带来便利的同时,也给网络管理造成了新的问题。例如,当前主流网站逐渐开始采用HTTPS协议替代原来的HTTP协议,以加密方式传输网络数据,然而不法分子试图利用HTTPS逃避监管,传播不良信息,甚至通过伪造证书的方式侵犯用户的权益。另外,新型BitTorrent应用传输层采用UDP协议,而当前对于此类BitTorrent流量缺乏有效的识别手段。网络环境的净化、服务质量的提升都建立在对网络流量进行有效监管的基础之上,流量识别作为网络管理的重要一环,也因此受到国内外学者的广泛关注。本文针对以上问题,深入研究了现有的流量识别技术,设计并实现了网络流量识别原型系统,主要的研究内容如下:第一,研究流量识别技术,总结了各种技术的优势和劣势,并采用端口识别技术与DPI技术相结合的流量识别方案,对网络流量进行识别。第二,研究模式匹配算法,并总结了各种算法的性能和适用场景。在识别具体协议时,针对不同协议的实际特点,分别选取高性能的模式匹配算法。第三,分析了各种协议的特征,特别是SSH、HTTPS等加密协议以及传输层采用UDP的BitTorrent协议。在对协议特征进行提取的过程中,主要采用逆向工程的方法。第四,设计并实现了实时网络流量识别原型系统,包括流量采集、通用处理层、流量识别、流量统计和数据存储以及用户界面5个部分。其中,通用处理层的设计对外屏蔽了拆包、分流等具体过程,完成数据包的预处理;流量识别模块采用模块化的思想,并针对各种协议自身特征复杂的问题,专门设计了协议分析器。本文最后对原型系统测试了功能和性能,通过对实验结果进行分析,验证系统能够成功识别多种协议,整个系统具备良好的稳定性和可扩展性。
[Abstract]:With the continuous development of network technology, various network applications become increasingly rich, making people's lives and the relationship between the Internet more and more close. The new network technology not only brings convenience to people's life, but also brings new problems to network management. For example, the current mainstream websites have gradually begun to use HTTPS instead of the original HTTP protocol to transmit network data in an encrypted manner. However, the criminals are trying to use HTTPS to evade supervision and spread bad information. It even infringes the rights and interests of users by forgery of certificates. In addition, the new BitTorrent application transport layer adopts UDP protocol, but there is no effective identification method for this kind of BitTorrent traffic at present. The purification of network environment and the improvement of service quality are based on the effective supervision of network traffic. As an important part of network management, traffic identification has been widely concerned by scholars at home and abroad. In view of the above problems, this paper deeply studies the existing traffic identification technology, designs and implements the network traffic identification prototype system. The main research contents are as follows: first, research traffic identification technology, summarize the advantages and disadvantages of various technologies. The network traffic identification scheme based on port identification technology and DPI technology is used to identify the network traffic. Secondly, the pattern matching algorithm is studied, and the performance and applicable scenarios of each algorithm are summarized. In recognition of specific protocols, high performance pattern matching algorithms are selected according to the actual characteristics of different protocols. Thirdly, the characteristics of various protocols are analyzed, especially the encryption protocols such as UDP HTTPS and the BitTorrent protocol used in the transport layer. In the process of protocol feature extraction, reverse engineering is mainly used. Fourthly, the prototype system of real-time network traffic identification is designed and implemented, which includes five parts: traffic collection, general processing layer, traffic identification, traffic statistics and data storage, and user interface. Among them, the general processing layer is designed to shield the specific processes such as unpacking and shunting, so as to complete the preprocessing of the data packet, and the flow identification module adopts the idea of modularization, and aims at the complex characteristics of various protocols. Protocol analyzer is specially designed. Finally, the function and performance of the prototype system are tested. By analyzing the experimental results, it is proved that the system can successfully identify various protocols, and the whole system has good stability and scalability.
【学位授予单位】：电子科技大学
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TP393.06

【相似文献】