Research Of The Content Processing In Gigabit Network Intrusion Prevention System

With the rapid development of the computer and network, the application of network technology is increasingly popularizing; and the network opening and the network sharing are continuingly expanding, so the network security is becoming more and more impending and challenging. As one of the network security technologies, the intrusion prevention technology is developed in recent years, but it is getting more and more attentions, and it is becoming the focus of the domestic and foreign computer experts and the network companies. The intrusion prevention system is an active security prevention technology. It is running in-line in the network, detecting the network packets, monitoring various suspicious attack behaviors, finding out the intrusions, and making real-time responses and actions.The content processing is one of core modules of the gigabit network intrusion prevention system. It is needed to process the gigabit network traffic at line rate, and it must guarantee the processing in real time and efficiently. In this thesis, the gigabit network intrusion prevention system is introduced and the content processing module is focused and described in detail. The main jobs and contributions of this thesis include:1) The features and key technologies of the content processing are analyzed thoroughly and the total solution is proposed. In the solution, the SW5000 network content processor of Seaway Corporation is used, which can fast and timely filter and classify the packets, provide the content check, make modification and duplication of the content at the hardware level, then can enhance the performance of the content processing efficiently.