Design And Implementation Of The Million Protocol Analysis And Restoration System

With the development of Internet communication technology,the users of the Internet continue to expand.Internet brings convenience to people's life,but it also provides more convenience for criminals in the very degree.At present,relevant regulatory authorities have had the ability of constructing Internet monitoring system.Protocol analysis and restoration is the basis of the system.More efficiently and completely analyzing and restoring more protocol types is the necessary condition to meet the needs of relevant regulatory authorities discovering network crimes in time and collecting evidence.In this paper,the need of analyzing and restoring protocols is focused on,the structural frame for Million Protocol Analysis and Restoration System is designed,and the system is implemented and verified.The system improved the processing capacity of single protocol analysis device,reduced the cost of system construction for relevant regulatory authorities and had the ability to adapt constant changes of Internet protocols.The research of this thesis is as follows:1.In this thesis,the history and current situation of analyzing and restoring Internet protocols is analyzed,and the characteristics of the protocol analysis restoration system in relevant regulatory authorities is studied.The problem of the existing mainstream protocol analysis and restoration system is the not ideal processing capacity of single protocol analysis device,the high cost of the system construction and that it has no ability to adapt changes of Internet protocols.The solution which used the million smart network card and plug-ins in the structural frame design model improved the processing capacity of single protocol analysis device and had the ability to adapt changes of Internet protocols quickly.2.In this thesis,the demand of the system is analyzed,and the related technology about Internet protocol restoration is studied,including data capture,IP fragmentation reorganization,TCP flow reorganization,link management and so on.To be chosen to use million smart network card to capture packets,a high efficiency link management technique based on multi-dimensional Hash table is proposed,which improved the processing capacity of system.3.In this thesis,the overall structural frame for the system is designed according to the requirement analysis.The system using the plug-in structure design is implemented with C++ technology,which is composed of data capture module,data restoration module,data output module and protocol plug-in module.4.In this paper,the Million Protocol and Analysis Restoration System is implemented based on the design of overall structural frame,each module of the bottom frame is designed and implemented,and the dynamic loading of protocol pliug-in is realized.The SMTP,POP3,IMAP protocol plug-ins are also developed,which can be loaded by the bottom frame,and analyze and restore protocols to output to the local disks.5.Finally,in this paper the function,performance and availability of the Million Protocol and Analysis Restoration System are verified.And the processing capability of single protocol analysis device is also verified by using test instruments which can construct data flow and concurrent links.In this paper,by researching the Million Protocol and Analysis Restoration System,the feasibility of the system is verified,the processing capacity of single protocol analysis device is improved,the cost of system construction for relevant regulatory authorities is reduced and the system had the ability to adapt constant changes of Internet protocols.