一个分布式深度报文过滤系统的设计与实现

发布时间：2018-05-29 13:52

本文选题：网络安全 + 分布式　；参考：《华中科技大学》2014年硕士论文

【摘要】：近年来，随着网络垃圾泛滥以及网络攻击不断增加，网络安全性问题日益突出，它已严重的危害到了现代人们的生活，因此如何实施有效的技术手段去过滤网络报文，达到净化网络环境的目的是十分有必要的。在传统的包过滤技术中，仅仅只能对IP包头中的“五元组”信息进行切割分析。但是随着网上应用的不断丰富和网络内容的不断复杂，只通过分析IP包四层以下内容，，包括源地址、目的地址、源端口、目的端口和协议类型是远远不够的，其并不能真正识别出应用类型，同时也增加了网络恶意攻击的可能性。因此，基于DP（IDeepPacket Inspection）技术，构建能够深入到各个应用层具体报文内容的过滤系统和使用能够提高系统性能的分布式架构，是有很好的实际意义和学术价值的。主要针对基于DPI深度报文过滤开展研究工作。首先，介绍了深度报文过滤系统所依赖的理论知识，对DPI技术、AC多模匹配算法及常见应用层协议进行深入的研究。然后，针对具体的实际需求提出合理的系统分布式架构，并对主要的策略配置服务器和深度报文过滤服务器进行详细设计。策略配置服务器以多级引用的数据组织形式对过滤条目进行存储以及向深度报文过滤服务器下发配置数据，深度报文过滤服务器则进行主要的过滤处理工作。最后，基于常见的HTTP、SMTP、TELNET三种应用层协议，具体实现深度报文过滤功能。从而可以达到加强网络安全和净化网络环境的目的。
[Abstract]:In recent years, with the proliferation of network garbage and the increasing number of network attacks, the network security problem has become increasingly prominent, which has seriously endangered the lives of modern people. Therefore, how to implement effective technical means to filter network messages, It is necessary to purify the network environment. In the traditional packet filtering technology, only the "five-tuple" information in the IP packet header can be cut and analyzed. However, with the continuous enrichment of network applications and the continuous complexity of network content, it is far from enough to analyze the contents of IP packets below four layers, including source address, destination address, source port, destination port and protocol type. It can not really identify the type of application, but also increases the possibility of malicious network attacks. Therefore, based on DP(IDeepPacket inspection technology, it is of great practical significance and academic value to construct a filtering system that can penetrate into the specific packet content of each application layer and to use a distributed architecture that can improve the performance of the system. This paper mainly focuses on the research of DPI-based deep packet filtering. Firstly, the theoretical knowledge of deep packet filtering system is introduced, and the DPI technology and AC multi-mode matching algorithm and common application layer protocols are deeply studied. Then, a reasonable system distributed architecture is proposed to meet the actual needs, and the main policy configuration server and the deep packet filtering server are designed in detail. The policy configuration server stores the filtered items in the form of multilevel reference data and distributes the configuration data to the deep packet filtering server, while the deep packet filtering server performs the main filtering work. Finally, based on three kinds of application layer protocols, the function of deep packet filtering is realized. Thus, the purpose of strengthening network security and purifying network environment can be achieved.
【学位授予单位】：华中科技大学
【学位级别】：硕士
【学位授予年份】：2014
【分类号】：TP393.08

【相似文献】