The Development Of Legal Interception Based On Decision Trees Algorithm

With Rapid growth of network traffic in recent years, the Internet has become one of the main tools that people use to communicate. Many crimes have been done through IP networks, the traditional voice interception on fixed network and wireless network cannot meet the needs of the demand for security, while using lawful interception on data communication network can be an effective measure to combat modern crime.Based on the demand of operator and the framework of H3C routing equipment, this paper constructs the module of lawful interception, and does a thoroughly analysis of the process. Control plane receives the configuration information of law enforcement agencies, records the monitoring situation and calls the driver by enabling the streams to transfer the LI Stream rules to Data plane; The Data plane complete the procedure of the packet parsing, rules monitoring and forwarding. The search method is achieved by the structure of double-linked list, More than 3000 lines codes to implement the lawful interception function, which is already been merged into the H3C b73 baseline version.In real network environment, the performance of lawful interception decreases significantly as the traffic's increasing. To solve this problem, the paper continues to analyze the problem of operating characteristics of the lawful interception, and find that it has a close relationship with the packet classification model. Based on this finding, the paper improves the data plane structure of lawful interception. This proposal uses the first packet classification algorithm to do rapid processing, and then propose separable decision trees to solve the problem that the space of one rule differs extremely from others. Finally, the same rules share the same mediation information, which lead to the algorithm of merging spaces. All above ways contributes to "One Time" fast matching procedure. Through the analyses of the test results based on H3C network routing map, new designed algorithm increased the efficiency by 25% and 45%, which has some theoretical significance.