Research And Implementation Of Application Protocol Identification

Application protocol identification is widely used to network traffic monitor system. With fast development of the Internet, the weakness of the present Application protocol identification has been exposed. On the one hand, Because of the limited capacity, the traditional method is not comfortable for the high speed network. On the other hand, it will be make mistake on protocol identification sometimes. So this thesis mainly focuses on the research of seeking for a new method.The present application protocol identification has two way, one is the based on transport layer port, the other one is matching the key word in packet data unit once. Firstly, the thesis analyses the identifying process of these two techniques, and then points out the limitation that can cause the mistake. According to the characteristic of application protocol communicating, the thesis advances a new identification technique which is based on matching the key word in packet data unit twice. The multi-pattern matching and rule management which are the crucial technology in the new identification method are research by the thesis. In order to achieve the requirement in the new identification way, the thesis advances that it integrates the content access memory and bloom filter for multi-pattern matching , while it uses dynamic cell link table and time out mechanism for rule management.Finally, the thesis presents reference design based on this new way and implicates it by FPGA. The thesis also introduces the simulation and testing schemes to the application protocol identification system.