| Internet is an extremely important way of information spread in today’s society,which has a profound impact on the country’s political governance,economic,military,cultural and other fields.At the same time,the openness and security vulnerabilities of Internet has brought a negative effect which can not be ignored,the spread of illegal infor-mation including viruses,pornographic,reactive and fraud and the leakage of confidential information in the intranet have negative effects not only to the country and individuals caused huge economic losses,but also affect the stability of society and military security.At present,it is an urgent task how to discover and control the harmful information for the development of Internet.Network content analysis and identification is an important technology to detect,stop network security threat and filter out harmful information,is to achieve an basis for network information regulation,and have great significance to support the healthy and orderly development of the Internet.Due to the rapid development of Internet technology,the complexity of sensitive information and security threats is increasing.This paper focus on the problem of high space complexity,low processing rate and update of content analysis and identification system.The main contents are summarized as follows:1.On the basis of analyzing the demand of high-speed network content analysis and identification system,the architecture and relevant basic theory are clarified.Firstly,the functional model,structural model,strategy of deployment and evaluation technique indexes of network content analysis and identification system are given.Then,the regular expression and finite automata are explained,and the procedure of their applications is introduced.2.A multi-default transitions deterministic finite automaton named MD~2FA is pro-posed to solve the problem that network content analysis and identification system has too large space complexity.It is based on the observation that different states have many common transitions,and the space can be saved by increasing the number of default tran-sitions properly.At first,the basic structure of MD~2FA is illuminated,and its equivalence with finite automata is proved.Then,a heuristic construction algorithm of MD~2FA is pro-posed according to that the construction can be rephrased to a special set cover problem.At last,the performance of MD~2FA is confirmed by the experiments based on the analysis of parameters.MD~2FA has high compression efficiency and short construction time,so it is more suitable for high speed network content analysis and identification system who has more complex and large regular expression rule set.3.An acceleration model based on regular expression sampling is proposed to im-prove the processing speed of the network content analysis and identification system.Based on the idea of sampling in signal processing technology,the acceleration model builds a sampling automaton by sampling regular expression rules,and uses the sampling automaton to analyze the sampling traffic.Finally,the results can be obtained by com-prehensive judgments.In this paper,the acceleration model in a single processing unit and multi-processing unit are discussed,the difference of two kinds of architecture is the authentication mode.Only part of the network traffic is required in a single processing unit architecture,an efficient task decomposition is achieved in the multi-processing unit architecture,so the accelerating model can achieve outstanding acceleration effect and improve the processing speed of network content analysis and identification system.4.An algorithm of regular expression rule updating for network content analysis and identification system is proposed.The algorithm can be used to the update operation including addition,deletion or modification of the regular expression rules in the network content analysis and identification system,and solve the problem that it consumed too long time in rules updating.Minimization based on backward depth information,incre-mental construction algorithm and rule deletion algorithm are proposed to achieve low time complexity in the update of network content analysis and identification system from different perspectives.In summary,many practical solutions are putted forward for the construction of net-work content analysis and identification system according to the research on a number of key technical problems,and it provides theoretical and technical supporting to monitor internet information. |
