基于Linux的网络数据捕获和分析系统的设计与实现

发布时间：2018-05-21 01:12

本文选题：网络数据捕获 + 数据分析　；参考：《北京邮电大学》2017年硕士论文

【摘要】：伴随着信息化水平的不断提高,互联网正在以前所未有的速度渗入到人们的日常生活中,并且日趋复杂。复杂的网络必然充满了海量的网络数据,这些数据都是由无数的网络应用所产生的,由于网络应用千变万化,所以这些数据也随着变得非常复杂。网络数据中包含有大量的信息,既包括用户本人传递的信息,也包括各网络设备为协调自身的工作所传输的信息,这些数据中通常会包含有威胁网络安全的数据。对网络数据进行捕获和分析不仅有助于网络进行监管和优化,还能发现网络中潜在的安全问题,以对可能存在的网络安全问题做好预防工作。很多与网络安全有关的工具都是以网络数据包捕获和分析为基础的,如IDS和IPS等。由于如今所使用网络设备和数据站大多都是以Linux系统为基础的,因此以Linux系统为基础对网络数据进行捕获并进行分析具有更现实的意义,本课题所做的工作也都是基于Linux系统的。本文首先系统的阐述了网络数据包捕获和分析的原理以及本课题所用到的技术,涉及了 TCP/IP网络体系结构、协议分析技术以及数据包的封装格式等,Libpcap函数库以及数据包过滤技术是这其中的一个关键点。然后,以以上相关技术为基础,分析本系统的功能,对网络数据捕获和分析模块进行设计并实现,这其中比较重要的有统计分析、协议分析和分析结果实时展示。由于现有的技术不能及时的给出分析结果,本课题以此为突破点,在采集数据包的同时对其进行分析,实现了数据包的及时分析和实时展示。最后对本系统所提供的功能进行了测试,并对测试结果做简要说明。本课题的创新之处在于网络数据包的实时捕获以及分析结果的实时展示上,系统在捕获数据包时便立即对其进行分析,并将分析的数据以可视化的方式向用户展示,用户便可以非常及时的掌握网络的异常情况,以便能迅速做出应对措施。总结来说,本文主要进行了以下几个方面的工作:1. 阐述网络数据捕获和分析的一般方法和部分已有成果,并进行分析和加以对比,为后续工作提供参考依据。2. 深入挖掘Libpcap函数库提供的用于网络数据包捕获的功能,总结利用该函数库进行网络数据捕获的主要方法和流程。3. 在Linux系统下编写程序利用Libpcap函数库对网络数据进行捕获,然后进行信息提取,这其中包括数据包使用的网络协议,源端口号和目的端口号,HTTP数据包等。4. 将对网络数据包分析所得的数据以可视化的方式实时向用户展示。5. 对本系统实现的所有功能进行测试。
[Abstract]:With the continuous improvement of information technology, the Internet is infiltrating into people's daily life at an unprecedented speed, and is becoming more and more complex. Complex network must be full of massive network data, these data are produced by numerous network applications, because the network applications are changing, so these data also become very complex. There are a lot of information in network data, not only the information transmitted by users themselves, but also the information transmitted by various network devices to coordinate their own work. These data usually contain data that threaten the security of the network. The acquisition and analysis of network data can not only help to supervise and optimize the network, but also find the potential security problems in the network, so as to prevent the possible network security problems. Many tools related to network security are based on network packet capture and analysis, such as IDS and IPS. Because most of the network devices and data stations used today are based on Linux system, it is more realistic to capture and analyze the network data based on Linux system. The work of this subject is also based on Linux system. In this paper, the principle of network packet capture and analysis and the technology used in this subject are described systematically, and the TCP/IP network architecture is involved. Protocol analysis technology, packet encapsulation format and Libpcap library and packet filtering technology are one of the key points. Then, based on the above related technologies, the function of the system is analyzed, and the network data capture and analysis module is designed and implemented. Among these modules, the important ones are statistical analysis, protocol analysis and real-time display of analysis results. Because the existing technology can not give the analysis result in time, this subject takes this as the breakthrough point, collects the data packet simultaneously carries on the analysis, has realized the data packet timely analysis and the real-time display. Finally, the functions provided by the system are tested, and the test results are briefly explained. The innovation of this subject lies in the real-time capture of network data packets and the real-time display of the analysis results. The system analyzes the data packets immediately when they are captured, and displays the analyzed data to the users in a visual way. Users can very timely grasp the abnormal situation of the network in order to make quick response. To sum up, this paper mainly carried out the following aspects of work: 1. This paper expounds the general methods and some existing achievements of network data acquisition and analysis, analyzes and compares them, and provides a reference basis for the follow-up work. This paper deeply excavates the function provided by Libpcap function library for network data packet capture, and summarizes the main methods and flow chart of network data capture using this function library. In the Linux system, the program uses the Libpcap function library to capture the network data and extract the information, which includes the network protocol, the source port number and the destination port number, etc. The data obtained from the analysis of the network packets will be displayed to the user in a visual way in real time. All the functions of this system are tested.
【学位授予单位】：北京邮电大学
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TP393.08;TP316.81

【参考文献】