网络流量分析系统的设计与实现  

Design and implementation of network traffic analysis system

作　　者：张潇晓[1] 唐勇[1] 苏金树[1] 陈曙晖[1] 

机构地区：[1]国防科学技术大学计算机学院,长沙410073

出　　处：《计算机应用》2011年第A02期25-28,共4页journal of Computer Applications

基　　金：国家自然科学基金资助项目(61003303);国家863计划项目(2009AA01A346)

摘　　要：随着网络速度的不断增长及网络应用的不断增多,网络监管的难度大大增加。实现了一种高速网络流量的实时监控系统NTAS——网络流量分析系统。通过PF_RING底层报文捕获模块,捕获网络流量,并对网络流量进行完整会话管理以及在此基础上基于有穷自动机(DFA)的协议识别,解决了同类系统性能不足和协议识别率不高的问题。最后给出了NTAS与同类系统的比较测试。测试结果表明,NTAS具备在高速网络环境下对网络流量的实时分析处理的能力。With the rapid increase of network traffic and the development of network applications,network traffic monitor and analysis becomes more and more difficult.This paper described the design and of implementation of a high-speed real-time Network Traffic Analysis System,named NTAS.It used PF_RING-based network traffic capture mechanism to capture network traffic,implementing intact network session management and protocols identification based on Deterministic Finite Automation（DFA）.NTAS outperformed current similar system in terms of performance and protocol-recognition accuracy.Experiment results show that NTAS can real-time monitor and analyze network traffic in high-speed network environment.

关 键 词：网络会话管理 网络会话哈希值 有穷自动机 网络流量分析系统 

分 类 号：TP311.134.3[自动化与计算机技术—计算机软件与理论]