Research On Protocol Analysis Based On Content Audit

Just as one coin has its two sides, the computer network brings more convenient life and lots of questions at the same time. With the high popularity and wide application of the network in life, the pornographic and violent contents are also increasing drastically. As a result, more and more illegal and immoral information spread widely, which puts the society at high risk. Consequently, it is becoming more and more necessary to audit the network information so as to reduce the risk brought by the detrimental information. Against this major background, the content audit is proposed.Content audit refers to detecting what is happening online, recording and analyzing the data packets concerned to find the contents and behaviors against the rules, recording, alarming and preventing them. Network information audit aims to purify the network by combining such technologies as the computer network, data mining, natural language processing, complex network and artificial intelligence to achieve the strict audit and detection to the network information and preventing the illegal and detrimental information from spreading widely.This paper consists of:1. Brief introduction of the concept and status of the content audit; comparison between the content audit and other network security technologies; analysis on typical content audit methods and introduction of present well-known content audit modes.2. An intensive study on the role that every layer in the TCP/IP mode plays in data transmission, which causes the basic understanding of the protocol form and protocol structure and the rapid conformation of the key areas to be analyzed during the protocol analysis process.3. The presentation of a new two-way multi-pattern matching algorithm by studying various typical pattern matching algorithms. (Pattern identification is an indispensable part of protocol analysis whose efficiency will directly affect that of protocol analysis.)The main contributions and innovations of this paper are as follows:1. This paper creates a simple signature library by capturing and analyzing a large number of unpublished date packets, getting the signatures which can uniquely identify the protocol and combining them.2. This paper proposes a new two-way multi-pattern matching algorithm on the basis of analysis on characteristics of the pattern set. The paper divides the pattern set into the prefix pattern set and the suffix pattern set according to the relation between the prefix and suffix in pattern set, creates different finite automatons according to different pattern sets, and then matches the target texts according to the pattern matching algorithms created by different automatons.Due to the limitation of ability and time, the paper has the following deficiencies:1. In the process of protocol analysis, this paper analyzed data packets off-line, and didn't research its on-line function, so which need to be researched in the future.2. The two-way multi-pattern matching algorithm proposed leads to low efficiency when the pattern set is small and long pre-processing time, which need to be improved in the future.The test proved that the algorithm performs better with a bigger set pattern, and has a high recognition rate but a low false rate while being applied to self-made protocol analysis software.