基于中间人的DB2数据的多客户端适应性解析  

Fuzzy Parsing Method for DB2 Data based on Man-in-the-middle

作　　者：黄河 陈君[1] 韩陆超 HUANG He;CHEN Jun;HAN Luchao(National Network New Media Engineering Research Center,Institute of Acoustics,Chinese Academy of Sciences,Beijing,100190,China;University of Chinese Academy of Science,Beijing,100049,China)

机构地区：[1]中国科学院声学研究所,国家网络新媒体工程技术研究中心,北京100190 [2]中国科学院大学,北京100049

出　　处：《网络新媒体技术》2021年第5期52-58,共7页Network New Media Technology

基　　金：中国科学院率先行动计划项目:端到端关键技术研究与系统研发(编号:SXJH201609)。

摘　　要：DB2是一种由IBM公司开发的关系型数据库管理系统,在大型商用系统中得到广泛应用,具有良好可伸缩性。各种应用场景中的开发者也基于其实际需求,在取得IBM授权的基础下,开发了多种多样的DB2客户端,造成了DB2响应网络包结构的细微不同。但第三方运维系统的设计者并不一定能获得IBM的授权。因此,对DB2协议进行合规合法的、高效率的审计与解析,对提高运维系统的可靠性、维持DB2使用者内部网络的通信安全有着极为重要的意义。DB2使用的是明文传输,为了对不同版本不同客户端中DB2响应数据包的细微差异进行正确解析,本文提出了一种基于中间人的DB2多客户端适应性解析法,这里称为模糊解析。该方法在每一个DB2操作会话中实施,收到客户端的请求之后,可根据固定格式进行解析,并且每解析一个消息即立刻转发到服务端,不需要等到整个网包拼凑完毕;收到服务端响应时,应立刻使用“跳跃特征”模糊算法对响应进行解析,每解析一个消息也即立刻转发到客户端。通过在实际的网络环境中的实验,该方法被证明可实现跨平台的DB2数据解析,并且相比已有串联方法,减少了31%的转发时间。DB2 is a Relational Database Management System developed by IBM Corporation.It is widely applied in a great number of large business systems since its outstanding scalability.Developers from various application scenarios,under the authorization of IBM,developed their customized DB2-clients based on their specific demands.It will lead to the minor differences between the packages which are generated by different clients.As a result,developers from third-party maintenance systems will face difficulties dealing with the packages without the authorization of IBM.Therefore,parsing DB2 in a legal and efficient way will greatly enhance the robustness of maintenance systems as well as improve the communication security for DB2.In order to correctly parse the minor differences in DB2 response packages,we proposed a fuzzy parsing method based on MITM.This method operates on each operation session of DB2.On one hand,it parses request packages with fixed patterns,on the other hand,it parses response packages with a fuzzy algorithm named“skipped feature”.Once it finishes parsing on a message,it will immediately transmit it without waiting for the complete parsing of the whole package.According to experimental results,this method is proved to be able to realize the cross-client parsing for DB2.Moreover,compared to the state-of-the-art methods,it achieves a significant reduction of 31%in transmitting time.

关 键 词：DB2 数据采集 网络审计 中间人 模糊解析 

分 类 号：TP311.13[自动化与计算机技术—计算机软件与理论]