网络安全论文：网络安全审计系统中数据捕获和协议分析技术研究.docVIP

网络安全论文：网络安全审计系统中数据捕获和协议分析技术研究 【中文摘要】目前IT技术发展迅猛,各行各业对信息化的普及程度越来越高,对网络的依赖性也越来越重。同时信息安全问题也日益严峻,各种攻击手段层出不穷,每年由于网络攻击而造成的损失相当严重,这不仅影响了社会经济的发展,而且还对国防安全问题造成了严重威胁。据调查显示,有将近65%的攻击来自于网络内部,具有针对性强,攻击性高,造成损失大等特点。因为内部人员非常了解网络部署结构,而且还有一定的权限,攻击者可以避开相关的网络安全设备,传统的网络安全设备对内部人员的攻击防范甚微。因此,研发针对私有网络的安全,规范内部人员上网行为,实时监控网络上的内容信息,防止各种违法、泄密和攻击行为发生的审计工具,已经成为社会各界的重要任务。网络安全审计系统(Network Security Audit System)就是专门针对私有网络安全,并且对网络传输数据进行监听和行为审计分析的专用网络安全系统。要想有效的对网络进行监控,就必须将流经交换机的网络数据包全部捕获,然后对其进行分析和判断。然而现在以太网的带宽已经达到了1000Mbit/s,网络流量急剧增大,大流量环境下的数据捕获和协议分析是目前网络安全审计系统的主要技术瓶颈。本文就是基于此背景下,提出了一种动态负载均衡算法,来对网络数据进行动态分流给多个主机处理,从而达到网络安全审计的实时性、高效性,以此减轻对硬件性能的高要求,降低硬件成本,并且实现了会话重现和数据的协议分析。最后本文通过搭建的实验环境,对本文提出的动态负载均衡算法和协议分析进行了验证。测试结果表明,该动态负载均衡算法能有效的对数据包进行动态分流,并且处理时间短且不造成丢包等问题。 【英文摘要】With the rapid development of IT technology at present, the popularity of informatization in all walks of life is on the rise. People become more dependent on network. In the meantime, the information security problems are becoming more and more rigorous. All kinds of attack emerge in endlessly. Every year the loss resulting from cyber attack is rather serious, which not only impact the development of social economy, but also poses grave threat to the defense security.According to the survey, nearly 65% of the attack comes from the inside network. This kind of threat features high adaptability and great aggressiveness and easy to cause severe damage. Because the insiders are very familiar with the network deployment and have certain limits of authority. Attackers could avoid relevant network security equipments, therefore the traditional network security equipments prevent little from the attack from the insiders. Therefore, to develop the audit tools aiming at private network security, regulating the surf behavior of the insiders, monitoring the network information in real time, and preventing all kinds of illegal acts, secrect disclosure and attacks, has become an important mission in all walks of life. Network Security Audit System is a priva