网络安全审计系统中FTP解析策略研究  

RESEARCH ON FTP PARSING STRATEGY IN NETWORK SECURITY AUDIT SYSTEM

作　　者：闫露[1,2] 邓浩江[1] 陈晓[1] 叶晓舟[1] 

机构地区：[1]中国科学院声学研究所国家网络新媒体工程技术研究中心,北京100190 [2]中国科学院大学,北京100039

出　　处：《计算机应用与软件》2017年第5期306-310,共5页Computer Applications and Software

基　　金：中国科学院战略性先导科技专项课题(XDA06010302)

摘　　要：常见的防火墙、防病毒、入侵检测等系统,对于防止外部非法入侵都有一定的作用,但对于防范内部人员对企业网等网络的破坏却效果甚微。网络安全审计系统针对内部网络进行监控,受到越来越广泛的重视。FTP由于其简单性与易用性,广泛运用于企业网中。针对FTP协议控制流和实时数据流分离的特点,提出了基于数据流信息封装传递的解析策略。该策略可实现FTP命令、响应的正确解析,获取实时建立的数据流端口,关联数据流信息,并实时产生审计日志。基于网络处理器平台实现了该策略,平稳阶段系统每秒事务处理量大于3万,吞吐率达到1 300 Mbps。Common firewall,anti-virus,intrusion detection and other systems,for the prevention of external illegal invasion have a certain role,but for the prevention of internal staff on the enterprise network and other network damage has little effect. Network security audit system for internal network monitoring,has been more and more attention.Because of its simplicity and ease of use,FTP is widely used in enterprise networks. Aiming at the characteristics of FTP protocol control flow and real-time data flow separation,a parsing strategy based on packaging and transmitting the data flow information is proposed,which can realize the correct parsing of FTP command and response,obtain real-time data flow port,associate data flow information,and generate audit log in real time. The strategy is implemented based on the network processor platform. In the steady phase,the system transaction per second is more than 30 000,and the throughput reaches 1 300 Mbps.

关 键 词：网络安全审计系统 FTP解析 控制流 数据流 

分 类 号：TP3[自动化与计算机技术—计算机科学与技术]