04-DPI深度安全配置指导-DPI深度安全概述.pdfVIP

目 录 1 DPI深度安全概述 ··········································································································· 1-1  1.1 DPI深度安全简介 ········································································································ 1-1  1.1.1 DPI深度安全的应用背景 ······················································································ 1-1  1.1.2 DPI深度安全的功能 ···························································································· 1-1  1.1.3 DPI特征库 ········································································································ 1-2  1.1.4 DPI业务 ··········································································································· 1-2  1.1.5 DPI深度安全的处理流程 ······················································································ 1-2  1.2 DPI深度安全配置指导 ·································································································· 1-3  i 1 DPI深度安全概述 1.1 DPI深度安全简介 DPI （Deep Packet Inspection，深度报文检测）深度安全是一种基于应用层信息对经过设备的网络 流量进行检测和控制的安全机制。 1.1.1 DPI深度安全的应用背景 随着信息技术的日新月异和网络信息系统应用的快速发展，网络技术应用正在从传统、小型业务系 统逐渐向大型、关键业务系统扩展，网络所承载的数据应用日益增加，呈现复杂化、多元化趋势。 网络在使得我们的工作和生活快捷、方便的同时也带来了许多安全问题，比如，信息泄露和计算机 感染病毒等。 虽然防火墙技术在网络中的应用极大提高了网络的安全性。但是日益复杂的网络安全威胁中，很多 恶意行为（比如，蠕虫病毒、垃圾邮件、漏洞等）都是隐藏在数据报文的应用层载荷中。因此，在 网络应用和网络威胁都不断高速增长的今天，仅仅依靠网络层和传输层的安全检测技术，已经无法 满足日益增长的网络安全要求。 因此，设备必须具备 DPI 深度安全功能，实现对网络应用层信息的检测和控制，以保证数据内容的 安全。 1.1.2 DPI深度安全的功能 DPI 深度安全提供了一种对数据报文进行一体化检测和多 DPI 业务（如 IPS、防病毒等）处理相结 合的安全机制，提高了设备的安全检测以及 DPI 业务处理性能，简化了多 DPI 业务策略配置的复杂 度。 具体来说，DPI 深度安全功能可以实现业务识别、业务控制和业务统计。 • 业务识别 业务识别是指对报文传输层以上的内容进行分析，并与设备中的特征字符串进行匹配来识别业务流 的类型。业务识别功能由应用层检测引擎