【作者】 高超；

【导师】 卢志茂； 胡秀兰；

【作者基本信息】 哈尔滨工程大学 ， 工程硕士（专业学位）， 2014， 硕士

【摘要】 随着互联网的飞速发展和它对生活的渗透,在其对生活带来极大便利的同时,安全隐患问题也如同双刃剑一般随之而来。在2013年的两份网络安全报告中指出,日均中毒电脑台数在200万至500万台之间,并且电脑病毒的感染量仍呈上升趋势。网络安全形势之严峻可见一斑。防火墙技术是网络安全设计中的核心元素,常用的防火墙技术包括:包过滤技术、状态过滤技术、内容过滤技术、应用层网关和网络地址转换技术等。本文结合状态过滤技术、内容过滤技术和应用层网关技术对应用层报文识别技术进行了详细的研究和实现,主要包括应用层报文状态过滤和报文内容过滤。在防火墙和路由器的特性开发的过程中,越来越多的业务需要关注应用层协议的特征和应用协议交互的内容本身。而报文内容过滤(ContentInspect,CI)是基于特征库对报文非法内容进行识别的技术,是目前为止较为有效的最新的防火墙技术。本文描述了 L4-7层深度检测框架(DPI系统)的系统设计方案,利用报文内容过滤技术达到应用识别(Application Recognize,APR)、攻击防护(Intrusion Prevention system,IPS)、用户上网行为控制(User Behavior Control, UBC)以及防病毒(AntiVirus)的功能。内容检测管理系统负责对报文应用层载荷做字符串规则匹配,并将生成的规则匹配结果交由内容识别部分使用。内容检测管理系统根据会话表上设置的处理标记,决定是否对报文做深度内容识别。若是需要做深度内容识别,则交由算法引擎进行字符串规则匹配和规则推导,然后将结果保存到结果集中由内容识别部分使用。系统通过设置网卡的混乱模式和Libpcap库从数据链路层中捕获数据,经包解码器将数据包解码成不同的协议;在报文到达检测引擎之前数据包还将经过预处理器的预处理操作:协议正规化、IP分片重组、TCP流重组等等;当数据包到达检测引擎时,检测引擎将根据规则库的规则对报文进行模式匹配,并根据规则头中配置的处理动作对报文进行处理。深度检测框架系统(DPI系统)的核心是搜索算法(Aho-Corasick算法[1])。该算法首先对用户配置的特征字符串进行处理,编译生成AC引擎,然后对解析后的报文做字符串的匹配,匹配高效,匹配效率与特征条目无关(只与待匹配字符串的长度有关);可以基于流(跨)报文,不需要缓存报文;但同时内存占用巨大。AC算法的实现非常消耗内存,每个状态的保存需要lk的内存,对于IPS来说特征的字符数1M左右,则占用内存1G。这种对内存的依赖并不是所有设备都能满足的。在论文中提出了一种稀疏矩阵和全矩阵结合的方式保存状态表的优化方法。在AC树中,模式的匹配过程是首先匹配上层的状态,只有在上层状态匹配成功的时候才会进行下层状态的匹配,在优化的算法中,用全矩阵的方式保存上层的状态表,以保证匹配的速度;用稀疏矩阵的方式保存下层的状态表,以降低内存的消耗;这种方式能大大降低内存的消耗,同时对匹配速度的影响又不是很大。对应用层报文识别技术的实现,通过测试能够有效阻止攻击报文的发送,尤其是对于已知攻击报文的阻止,对于未知攻击,仍然需要进一步的研究分析,以保护私有网络的安全性。更多还原

【Abstract】 With the rapid development of the Internet, it brings great convenience to life, but it brings Safety problems at the same time, just like a Double-edged sword. Two Network Security Report of 2013 put out, the number of computer poisoning is between 2 million to 5 million every day. We can see that Network security situation is grim.Firewall technology is a core element in a security network. Usually, firewall technologies include packet filtering technology, state filtering technology, content filtering technology, application layer gateway and network address translation. By analyzing the firewall technologies above, this paper gives a detailed implementation of the application layer packets identification technology, including implementation of the state filtering and content filtering of the application layer packet. During the development of firewall and router features, more and more businesses need to focus on the characteristics of the application layer protocol and application protocol interaction itself. Content Inspect is signatures illegal content identification technology which is based on the packet and it is the more effective firewall technology by far.This paper describes the design of L4-7 layer Deep Packet Inspection system (DPI System), using the Content Inspect technology to achieve Application Recognize, Intrusion Prevention, User Behavior Control identification and Anti Virus function.Content management is responsible for matching the rules of the application layer payload string, and the results is used to identify the contents. Content management decides whether to make the depth of the message content identification based on the mark set on the session table. If the content identify needs to be done, the algorithm matches string rules and inference rules, and then save the results to the result set is used by content identification section.The core of DPI System is a search algorithm. The most fundamental reason coming up with L4-17 layer DPI framework is search algorithm of fixed string. Firstly, the algorithm processes feature string profiled by user,compiled AC engine. Then matches the string of the parsed packets, the efficiency is unrelated to characteristical entries (only related to the length of the string). It is may be based on flow (cross) packets without buffering packets, but needs huge memory footprint.The implementation of the AC algorithm consuming memory very much. It will cost 1 K memory to save one StateTable. The IPS’ state will be more than 1M,so it will need 1G memory. But not all devices can meet this. In the paper we proposed a optimization program,use both Sparse Matrix and Full Matrix to save the StateTable. In the AC tree thr pattern’s matching process matches upper state first, onle when the upper state match successfully, it matches lower status. In the Optimization Algorithm, we use Full Matrix to save the upper states’ StateTable, to keep the matches speed. Use Sparse Matrix to save the lower status’StateTable, to save memory. In this way, we can reduce memory consumption, but does not affect the matches speed.The implementation of the technology can effectively prevent attack packets, especially to those known attack packets. To those unknown attack packets, the technology still need further research and analysis in order to protect the security of private networks.更多还原