新一代深度报文检测设备对城市安全态势感知的影响  

Influence of new generation deep packet detection equipment on urban security situational awareness

作　　者：姚青[1] 谢永恒[1] 周汉川[1] 余勇[1] 万月亮[1] YAO Qing;XIE Yongheng;ZHOU Hanchuan;YU Yong;Wan Yueliang(Beijing Ruian Technology Co.,Ltd,Beijing 100083,China)

机构地区：[1]北京锐安科技有限公司,北京100192

出　　处：《长江信息通信》2022年第2期15-19,共5页Changjiang Information & Communications

摘　　要：随着网络规模的不断壮大,网络结构的日益复杂,网络病毒、Dos/DDos攻击等构成的威胁和损失越来越大,传统的网络安全管理模式仅仅依靠防火墙、防病毒、IDS等单一的网络安全防护技术来实现被动的网络安全管理,已满足不了目前网络安全的要求,城市安全态势感知研究便应运而生。态势感知中的新一代深度报文检测设备采用了新的深度报文检测技术,深度报文检测技术对比传统检测技术,加入了应用层分析,能够准确识别各种应用。采用了净荷特征匹配技术、交互式业务识别技术、行为模式识别技术、深度流检测技术。带来的好处包含:可视化全网、流量细粒度管理、及时发现和抑制异常流量、输出全量日志功能、减少或延迟带宽投入。With the continuous expansion of the network scale,the increasing complexity of the network structure,and the increasing threats and losses posed by network viruses and DOS/DDoS attacks,the traditional network security management mode can not meet the current requirements of network security by relying only on a single network security protection technology such as firewall,anti-virus and IDS to realize passive network security management,The research on urban security situational awareness came into being.The new generation of deep message detection equipment in situational awareness adopts new deep message detection technology.Compared with traditional detection technology,deep message detection technology adds application layer analysis,which can accurately identify various applications.Payload feature matching technology,interactive service recognition technology,behavior pattern recognition technology and deep flow detection technology are adopted.The benefits include:visualization of the whole network,fine-grained traffic management,timely detection and suppression of abnormal traffic,output of full log function,and reduction or delay of bandwidth investment.

关 键 词：态势感知 城市安全 深度报文检测 净荷特征匹配技术 可视化全网 全量日志 

分 类 号：TP391[自动化与计算机技术—计算机应用技术]