| As network technology develops,more and more applications appear,which make the relationship between people’s life and Internet increasingly close.New network technology brings convenience,but also problems as for network management.For example,websites gradually begin to use HTTPS instead of the original HTTP,which transfers data by encryption.But criminals try to use HTTPS to avoid supervision,disseminate illeagal information and even forge certificates,which infringe users’ rights.In addition,new BitTorrent uses UDP as transport protocol,which can’t be detected currently.Network environment and quality of service are both based on the effective supervision of network traffic.Network traffic identification is an important part of network management,and therefore valued by domestic and foreign scholars.To solve the problems above,this thesis deeply studies the existing traffic identification technology.This thesis designs and implements network traffic identification system.The main research contents are asfollows:First,the study of traffic indentifation technology,summed up the advantages and disadvantages of various technology,and combine port identification technology and DPI technology.Second,we study the pattern matching algorithms,and summarize the performance.In the indentification of specific protocols,we select the high-performance pattern matching algorithm.Third,analyse the characteristics of various protocols,especially SSH,HTTPS and BitTorrent protocol which uses UDP in the transport layer.In the process of extracting the characteristics of protocols,the reverse engineering method is mainly used.Finally,a real-time network traffic identification system is designed and implemented,including traffic collection,general processing layer,traffic identification,traffic statistics and data storage,and user interface.Among them,the design of the general processing layer shields the process of unpacking and flow processing.The traffic identification module adopts the modularization idea.Design of dissectors solve complex characteristics of various protocols.At the end of this thesis,the function and performance of the system are tested.Through the analysis of the experimental results,it proves that the system can successfully classify a variety of protocols,Test results shows that the system can detect many kinds of protocols,with good stability and scalabilty. |
