节点文献
网络应用识别系统的研究与实现
Research and Implementation of Network Application Identification System
【作者】 孙博；
【导师】 何刚；
【作者基本信息】 北京邮电大学 ， 电子与通信工程（专业学位）， 2013， 硕士
【摘要】 随着互联网的高速发展,网络应用层出不穷,多种多样,但是由于互联网的交互与开放性使得网络应用良莠不齐,又由于政府、运营商、企业等组织的需要,并让网络管理人员能够及时了解并且控制网络的运行状态,保护网络正常运行,网络应用识别以及识别系统的研究迫在眉睫,成为一个十分重要的课题,这也对网络运营、管理以及控制具有重要意义。本论文致力于研究网络应用的识别以及系统的研究与实现,主要研究的内容包括三个部分,常见网络应用类型介绍和网络应用识别方法总结、Skype应用的分析以及识别,网络应用识别系统的研究与设计,基于递归哈希的多模式匹配算法的研究与实现。本文首先介绍了五种常见的网络应用,同时结合这五种网络应用的识别特征给出网络应用识别技术的几种方法,并以Skype应用为例对其加以分析与识别。其次本文着重介绍了网络应用识别系统,随着网络应用数量的不断增加,现有网络应用识别系统中的特征规则数量不断膨胀,进入系统的数据报文需要顺序匹配每一条特征规则,导致系统效率低下。在此基础上,我们研究并改进了现有网络应用识别系统,设计并提出一种规则初始化的树形分类结构的系统。最后针对系统中固定位置固定关键字的识别算法,在原有顺序匹配的基础上,本文创新提出一个基于递归哈希的多模式匹配算法,通过实验测试证明,随着规则数目的增加或者输入数据报文数目的增加,改进后的算法所需匹配时间大幅度缩短,且与原有算法相比,性能得到提高。
【Abstract】 With the rapid development of the Internet, a variety of network applications appeared in our daily life including good and bad applications, due to the needs of the government, carriers, enterprises and other organizations. In order to allow network managers to keep controlling the status of the network and protect network uptime, network application identification and recognition system become a very important issue, which also has an important significance for network management and control.This thesis aims to the research and implementation of network application identification system, the main contents of the study consists of three parts, network application identification methods based on DPI; research and implementation of network application identification system; I-HASH multiple various position pattern matching algorithm in Internet application identification.This paper first introduces five common network applications, then we introduced the identification method combined with those five network application, given the several methods of network applications identification technology. Furthermore, this article focuses on the network application identification system, with the increasing number of network applications, the number of the characteristics’ rules in the existing network application identification system is expanding, resulting in system efficiency is low. On this basis, we have studied and improved identification system of the existing network applications, design and proposed a rule tree classification structure of the system initialization. The efficiency of multiple pattern matching is important to our network application identification system, for the fixed pattern fixed keyword in the rules, on the basis of the original sequence matching, this paper proposed a recursive hash multi-pattern matching algorithm. Experiments showed that with increase of the number of rules and packets, the time of the improved algorithm increases slowly, and greatly improved performance compared to the original algorithm.