【作者】 张华；

【导师】 翟玉庆； 郑志彬；

【作者基本信息】 东南大学 ， 工程硕士（专业学位）， 2016， 硕士

【摘要】 随着互联网的快速发展,互联网安全监管已成为重要课题,根据统计,大部分网络流量为网页内容,从而网页内容监控成为互联网安全的主要内容。本文就是基于ETSI标准设计和实现一个网页内容监管系统。本文主要工作包括1)网页内容监管子系统的设计,主要包括系统架构设计,系统功能模块设计和系统工作流程设计,主要功能模块包括深度报文识别模块(在线流量中识别出网页内容数据)、协议解析模块(对深度报文识别模块发送过来的数据进行协议解析,在网页内容监管子系统中,协议解析模块中会加载HTTP协议解析线程,对网页内容交互情景再现,获取网页内容数据)数据处理模块(网页内容监管系统中结构化数据的实时转发入库和事后查询),文件处理模块(网页内容监管系统中还原处理的网页文件实时存储和事后查询)。其中HTTP协议解析模块是主要功能模块的基础和关键。2)对本系统核心模块HTTP协议解析模块进行了详细设计与实现,包括本模块与其他模块的关联关系,模块的功能及提高匹配查找效率的设计,并且描述了如何满足对应的功能点及性能指标的设计思路。对HTTP模块的内部结构,工作流程和主要程序流程进行了设计,在处理下行响应报文的流程中,提出了改进的ACBM算法,降低了系统内存的占用。开发环境为Windows 7 64位,开发工具为Visual Studio 2008,开发语言为C语言,编辑器为gcc。部署环境为Linux x86 64为通用服务器。3)对HTTP模块进行了单元测试,从被测单元的功能点、进行测试目标分解,考虑了边界值健壮性等,设计了单元测试的用例并执行。在集成测试中,对HTTP模块与其他模块的接口入手,描述了集成测试的环境和测试测试执行情况。本文主要成果是设计了 ACBM的改进算法--ACBM-HB算法,用于HTTP协议下行响应报文的解析的多模式匹配功能中,解决了 ACBM内存占用较大的问题。系统目前已经在实际线网中稳定运行了一年。运行效果表明,本文系统可有效支撑线网网页内容监管,可促进互联网内容监管工作的深入开展。更多还原

【Abstract】 With the rapid development of the internet,internet security monitoring has become an important task,according to statistics,most of the network traffic is web brower.thus web content monitoring becomes the main part of internet monitoring.This thesis is an implement of web content monitoring system based on ETSI standard. This thesis includes following parts1)The design of web content monitoring system,mainly include system architecture design,feature modular design and workflow design. The main function modules includes deep packet inspection module(identify web browse flow from online traffic)、protocol parse module(parse the data sent from deep packet inspection module,HTTP protocol parse thread will be loaded by protocol parse module in web content monitoring system,gain web content by reproducting the scene of web browse),data process center module(real-time forwarding the structured data to the database or query data from database in web content monitoring syatem),File process module(real-time storing the files to the file system or query files from file system in web content monitoring system),HTTP protocol parsing module is the foundation core part of the system.2)The detail design and implementation of HTTP protocol parse module in this system,include the relationship between HTTP protocol parse module and other modules,the feature and improve the search performance design(and the idea of the design) of this module . The design of internal structure,work process and main program flow of HTTP protocol parse module.Propose the improved ACBM algorithm used in the process of parsing downlink response packet inorde to reducing memory useage in system.The development environment is using C language in Visual Studio 2008 on Windows 7 64 bit machine,the compile tool is gcc,the deployment environment is Linux 64 on 64 bit system.3)Describe the implementation of the HTTP protocol parse module unit test,including analysising the function test point,disintegrating test target,considering the boundary and robustness test,designing and excuting the unit test.Describe the environment and process of the integration test by analysising the interface between HTTP protocol parse module and other modules.The main result of this thesis is designed an improved ACBM algorithm—ACBM-HB algorithm used in parsing downlink response packe in HTTP protocol parsing modulet,in order to reduce the memory use in system.The system has been deployed in actual network for more than a year,the operating result shows that the system can effectively achieve the goal of web content monitoring,can promote the internet content monitoring.更多还原