Research On Network Traffic Monitoring Technology Of Mobile Terminal

With the high-speed development of3G/4G technology, Mobile Internet has become the most rapid development one of the Internet business for the wide spread of intelligent mobile phone which as a representative of the mobile terminal. The high integration of mobile communication technology and Internet technology brings us a hitherto unknown operation experience. At the same time, new security problems have emerged one after another. Especially the malicious traffic cost on mobile terminal and illegal plug-ins Trojan virus, the mobile data traffic has soared and it bring a loss to the users. Therefore, the research on the technology of mobile terminal flow monitoring is very necessary.This paper will discuss the necessity and the lack of research on the flow monitoring technology of emerging Android, firstly. Then we focus on the Android system platform, and analyze the system framework of Android system in detail. Then we study traffic monitoring technology from the application layer and kernel layer. At the same time, considering the anomaly detection algorithm which is the most important part of traffic monitoring. We put forward a kind of anomaly detection algorithm based on Hurst index. Finally, combined with the characteristics of mobile devices, we put forward a design scheme of Android network traffic monitoring system, at the same time, tests the function of the system using the experiments.The main work is as follows:Firstly, we will analyze the Android system architecture and traffic monitoring system. Including the use of intercepted system calls to implement the monitoring of system level, using the netfilter/iptables firewall framework treatment on the hook function mechanism to filter the IP packets of terminal and processing the data flow using netfilter.Through the research on the technology of anomaly detection, combining the Android mobile terminal characteristic, we proposed an algorithm about abnormal traffic detection based on Hurst index. The algorithm determines whether there is abnormal flow in the system by the change degree of Hurst index. The key point of algorithm is the estimation of Hurst index and the setting of anomaly detection threshold. This paper presents a real time method of estimating Hurst index and adopts the method of setting the threshold which based on maximum likelihood estimation.After researching the technology of Android network traffic monitoring, this paper designs the overall framework of traffic monitoring system which based on Android platform. Combined with the working mechanism of iptables chain hook, we realize the traffic management module and anomaly detection module which are important functions of the system, including packet capture and feature extraction and the package pretreatment and abnormality judgment module. Finally, the tests verify the correctness and validity of the system.