The Research And Design Of Application Layer Network Traffic Monitor On Cross-Platform

With the rapid development of Internet technologies, the architecture of the Internet becomes more and more complex; we must face the challenges of the network security, management and traditional network-based applications. The types and patterns of current network traffic are more complex than they were in the past. In the past network environment, most Internet traffic was occupied by HTTP, FTP, TELNET, SMTP, and NNTP which use little bandwidth. Today, the proportion of these well-know traffic types is decreasing. Instead, P2P, streaming media, and network game traffic are increasing and consuming an amount of bandwidth. In addition to the fundmental and traditional purposes of traffic monitor such as network planning, network problem detection and network usage reporting, the traffic monitoring and analysis are required in many areas to improve network service quality such as in abnormal traffic detection, network blocking, virus detection, and P2P applications massive traffic managent and usage-based accounting.In this study, aimed at traditional traffic monitors focus on OSI model layer 3 and 4 to detect only general network performance, can't get the details of the network traffic component, propose a new method to identify current sophisticated traffic data generated from various newly emerging network-based applications such as streaming media, peer-to-peer and other applications on cross-platform. The monitor which designed is based on application layer payload to inspect the application layer characteristics, especially aimed at the dynamically determining ports, pseudoing HTTP and data segmenting applications in order to escape scan and monitor. The process of design is separate into sereval layers and modules to adapt different protocol's characters. And at the same time aware of the execute efficiency.Toward the new emerged and unknown protocols, The design propose a new model using data mining and machine leaming technologies, extract characters and discover a new way of identify unknow protocols.Finally, with the data we get from the real network flow, and with the aid of some network flow simulation sol, ware, analyse the traditional protocol flow and P2P flow separately, the conclusion is although P2P flow have many different characters to traditional application layer protocol, it still have the Long-Range Dependence character.This conclusion will provide data foundation of next step design of forcasting network flow project.