Research On High Performance Matching Technology For Email Security Gateway

E-mail security gateway products have played an important role in filtering spam and preventing leakage of important papers.But with the explosive increment of E-mail users' number,the processing performance of the mail security gateway is getting higher and higher.When break down the message security gateway,and we find that with the zero-copy and DPDK and other high-performance transceiver packet technology,the network card has been very efficient in packet processing,but the protocol analysis can not adapt to the development of keyword matching,especially in which matching technology is most important.This paper aims to improve the matching performance of E-mail security gateway,and we have detail study on the mail address matching and e-mail text matching two aspects.In the mail address matching,in the area of mail address matching,The length of e-mail address is basically fixed in a range,and mail address filtering is more like a collection of e-mail address to determine whether an e-mail address in the collection.Counting Bloom filters are widely used in such situations.But the space complexity of the Counting Bloom filter is high and the false positive rate can be decreased.So as to decrease the false positive rate of the Counting Bloom Filter and decrease the space consumption,a variable length Bloom filter(FPVLCBF)based on fingerprint is proposed,which combines the idea of fingerprint and variable length Bloom filter.Compared with the existing Counting Bloom filter,it is proved that FPVLCBF is a small false positive rate,with small spatial complexity and time complexity.It is very suitable for mail address matching in the high-traffic environment.In mail content matching,if the content contains non-ascii characters,the content of the E-mail usually contains Base64 encrypted content.Earlier Base64 encrypted content matching is to decode it first,and then filter the content of the filter.In this paper,a base64 encoded text direct matching algorithm is studied in detail,and in the Small-scale character set,it has been improved,the use of hash table storage first and last byte group Base64 encoding block method eliminates the need for fuzzy matching after the decoding operation.The experiment proves that the Optimization of the algorithm has higher filtering performance than the EmailMatch algorithm.Finally,we achieve a high-performance mail security gateway system by using FPVLCBF and improved EmailMatch algorithm.And the function goal,network topology and module composition of E-mail security gateway are introduced.We conducted functional tests and stress tests on the mail security gateway.The results prove that the high-performance mail security gateway is very suitable to work in high traffic network environment.