基于主机信息内容审计系统的设计与实现_韦猛.pdfVIP

20 6 () Vol. 20 No. 6 2008 12 Journal of Chongqing University of Posts and elecommunications(Natural Science Edition) Dec. 2008 韦 猛, 程克非 ( 1. , 400065; 2. 400065) : 为了检测受控网络的信息, 介绍了 种基于主机内容信息审计系统, 通过对包过滤系统和协议分析系统以 及 Libpcap库函数进行优化改进, 来实现大数据量情况下对数据的审计同时通过对部署该系统的主机性能进行 测试, 得到了对受测主机的详细内容, 结果表明新系统大大提高了审计效率 : 信息内容审计; 规则匹配; 前端服务器 : TP393. 08 : A : 1673-825X ( 2008) 06-0725-04 Design and implementation of audit system based on host information content WE I M ng, CHENG K -f i ( 1. C oll g of Comm un ication and Inform ation Engin ring, Chongqing Un iv rsity of Posts and T l comm un ication s, Chongqing 400065, P. R. Ch ina; 2. C oll g of C omput r Sci nc and T chnology, Chongqing Un iv rsity of Posts and T l comm un ication s, Ch ongqing 400065, P. R. Ch ina) Abstract: In ord r to d t ct con troll d n twork inform ation, th is pap r pr s nts a syst m fram work bas d on th host con- t nt of th information audit sy st m. By optmi izing th pack t filt ring syst m, protocol analys is syst m and Libpcap tr as- ury function, th data aud it is ach i v d und r th circumstanc of larg am ount of data. In addition, through th p rform- anc t st on th host d p loy ing th sy st m, th d tails of th host w r gain d. Th t sting r sult show s that th n w syst m has gr atly nhanc d th ffici ncy of th audit. K ey words: in form ation cont nt aud its; ru l s m atch ing; front- nd s rv r 0 1 , , , ,