Design And Implementation Of E-Mail Monitoring And Audit System

With the rapid development of the computer network technology and information technology, E-Mail has become an indispensable communications tool during study and working. However, its convenience to people will also cause a lot of potential safety problems. On the basis of the analysis of the data transmission theory of TCP/IP protocol, the disassembly and reassembly algorithm of packets and the SMTP protocol, a distributed real-time e-mail monitoring and audit method based on TCP session reassemble technology is proposed in this thesis. The leaking of illegal or confidential information via e-mail can effectively been detected and reported. Here are the research contents of this thesis:1. Use Libpcap to capture the packet in the network.2. Reassemble the captured IP packets based on the fragment information. Then filter results by protocol to pick out TCP packets of SMTP protocol for TCP reassembly.3. Get mail information such as sender and subject from gained data based on protocol and rules like RFC821 protocol. At the same time, decode the coded parts to get plain text of the mails.4. Choose high-effective and precise multi-pattern match algorithm to extract features from mails.5. Choose appropriate algorithm of text classification, and evaluate the mail content by feature values gained from the pre-step.