基于多机的网络信息分析系统的研究与实现

发布时间：2018-07-13 14:32

【摘要】：随着互联网的广泛应用，互联网上出现了大量的垃圾信息以及各种网络攻击。要想营造一个健康和安全的网络环境，一个重要的手段就是对互联网信息进行分析过滤。过滤垃圾信息和入侵检测采用经典的多模匹配算法，但是多模式匹配问题又会给我们带来一个问题，就是算法要以牺牲空间来换取时间，普通的服务器可能无法给分析系统提供足够的内存。本文提出了利用多台机器来解决处理大规模模式时单台服务器无法工作的问题。首先，本论文介绍了AC算法和WM算法的原理。AC算法利用了模式串之间的相同前缀关系，每次失配时要近可能的跳转更远的距离。WM算法引入了坏字符跳转的思想，采用了HASH散列的技术来提高匹配的效率。另外，设计AC和WM算法的接口，如数据传输接口、查询接口等，把AC和WM算法运用到多机系统中去。其次，论文提出了基于多机系统下模式串集的分割算法。在基于多机的系统中，设计通信的协议和调用AC和WM算法的接口。设计基于多机的系统下模式串集的分割算法，模式集分割算法是过滤系统设计中的重要部分。分割算法影响整个系统内存的分配，，又会影响系统的响应时间。最后，论文给出了系统的功能和性能测试结果。对于功能测试，测试包括系统分割模式集功能、系统的查询功能，从而验证了系统功能的正确性；对于性能测试，测试本多机系统下和单台服务器下的查询时间。
[Abstract]:With the wide application of the Internet, a lot of spam and various network attacks appear on the Internet. To create a healthy and secure network environment, an important means is to analyze and filter the Internet information. The classic multi-mode matching algorithm is used to filter spam and intrusion detection, but the problem of multi-pattern matching will bring us a problem, that is, the algorithm should sacrifice space for time. A normal server may not be able to provide enough memory for the analysis system. In this paper, multiple machines are used to solve the problem that a single server can not work when dealing with large scale mode. Firstly, this paper introduces the principle of AC algorithm and WM algorithm. The AC algorithm uses the same prefix relationship between pattern strings. The hash hashing technique is used to improve the matching efficiency. In addition, the interface between AC and WM algorithm is designed, such as data transfer interface, query interface, etc. The AC and WM algorithms are applied to multi-computer system. Secondly, this paper proposes a segmentation algorithm based on multi-machine system. The communication protocol and the interface between AC and WM algorithm are designed in the system based on multiple computers. The segmentation algorithm of pattern string set based on multi-machine system is designed. Pattern set segmentation algorithm is an important part of filtering system design. The partition algorithm affects the memory allocation of the whole system and the response time of the system. Finally, the function and performance of the system are given. For the function test, the test includes the system partition mode set function, the system query function, thus validates the correctness of the system function; for the performance test, tests the query time under the local multi-machine system and the single server.
【学位授予单位】：哈尔滨工业大学
【学位级别】：硕士
【学位授予年份】：2014
【分类号】：TP393.06

【共引文献】