基于内容分析的高速网络协议识别技术研究
|
摘要
协议识别,也称为应用层流量分析,是防火墙、IDS、内容审计系统、网络管理的基础。当前,面向ISP主干链路的协议识别主要面临带宽过高、新型协议不断出现、传统的端口识别方法无法满足应用要求等挑战。近年来,虽然研究人员从统计与模型、报文深度处理等途径研究协议识别问题,但从整体上,协议识别系统在性能、准确性、可扩展性和鲁棒性上仍然无法满足要求。
论文以高速主干网络协议识别为目标,在研究了当前各种协议识别方法的基础上,充分考虑主干链路流量类型复杂、带宽高、并发流众多等特点,以软硬件结合的方式,采用基于报文深度处理的技术思想,开展协议识别的深入研究。主要完成了以下工作:
(1)提出了一种面向高速网络的协议识别框架,该框架由协议识别系统结构、通信机制、协议识别方法以及协议识别描述语言(Protocol Identification DescriptionLanguage,PIDL)组成。协议识别系统结构包括主控单元、交换单元和处理单元。高速交换单元连接多个处理单元,用于解决非对称路由、路由均衡等问题;主控单元对处理单元执行管理,负责规则的编译与加载;处理单元采用硬件匹配引擎,线速处理报文,从而解决性能问题。通信机制包括各单元之间的通信以及协议识别系统与分析系统之间的通信。主控单元以PIDL语言定义协议特征,解决可扩展性问题。采用端口匹配、精确串匹配,以及正则表达式等多种识别方法处理报文流,解决准确性问题。
(2)针对在协议识别端口匹配时出现离散端口与范围端口的问题,为确保线速执行范围匹配,提出了一种降低存储资源的范围匹配算法LRC-RM,将规则中的端口范围映射成压缩位向量,并将位向量组织成扩展平衡二叉树。报文匹配时获取位向量,然后将位向量与其它字段组合查找TCAM得到匹配结果。满足了规则含端口范围以及离散多端口条件下的报文线速匹配问题。
(3)为解决基于精确串的协议识别问题,采用一种基于TCAM的链式共享多匹配(Linking Shared Multi-Match,LSMM)检测方法,有效解决了大规模、长度差异大的协议特征串匹配问题。
(4)在基于正则表达式的协议识别中,研究了合成状态机与分离状态机的关系。合成状态机具有匹配引擎简单、但存储空间大的特点;分离状态机采用多个并行引擎,具有存储空间小,但每个协议需要一个匹配引擎的特点。在合成状态机匹配引擎研究中,以Thompson算法为基础,提出了一种压缩ε的NFA构造算法,该算法通过减少ε边及其对应状态,有效提高在协议模式编译时,NFA转换成DFA及DFA最小化过程的性能;基于上述理论与算法实现了一种无回溯线性扫描的组合多模式协议识别系统。在针对分离状态机的研究中,为进一步降低存储空间,研究了一种SI-Precode的预编码机制,以集合预编码的方式降低状态转移表所占用的存储空间,从而使状态转移表可采用FPGA片内存储器,不再需要外挂存储器,实现高效廉价的匹配引擎。
论文还在863高技术研究发展计划信息安全主题、国家242信息安全计划的资助下,以上述研究为基础,设计并实现了一个2.5G POS双向链路的应用分类分流采集系统(ACSGather),并对ACSGather协议识别的准确性与性能进行了评估。ACSGather系统于2006年开始部署应用,取得了良好的社会效益与经济效益。
Protocol Identification (also called Application-Layer Traffic Analysis) is the basis of Firewall, Intrusion Detection System, Content Auditing System and Network Management System. Nowadays, Protocol Identification for ISP Backbone faces many challenges, such as high traffic, new protocols, and unfeasible transport layer port matching method. Lately, some novel approaches have been proposed, such as method based on statistics and model, mathod based on packet deeply procession. But these methods fall short of performance, accuracy, expandability, and robustness.
This thesis focuses on the Protocol Identification of the ISP Backbone. Based on the research of many Protocol Identification methods, a new method combining the software and hardware has been proposed, which is capable of processing complicated, high speed traffic with many concurrent streams. The main contributions of the thesis are as follows:
(1) A High Speed Network Protocol Identification Framework has been proposed. The framework is composed of Protocol Identification Architecture (PIA), Communication Mechanism, Protocol Identification Method and Protocol Identification Description Language (PIDL). A high speed switch is used in PIS to connect several linecard, which solve unsymmetrical routing and routing balance problem. Master card controls the linecard, which take charge of compilation and loading of rules. We use PIDL to describe the protocol features, which solves the expansibility problem. Matching Engine has been implemented using customized hardware to enhance performance. Port matching, string matching and regular expression matching have been used to process the packet stream, which can improve the accuracy.
(2) Port matching in Protocol Identification often includes discrete ports and port range. To realize the wire-speed port range matching, a range matching algorithm called LRC-RM is proposed. LRC-RM maps the port range into a compressed bit vector and organizes the bit vectors as an extended balanced binary tree. The corresponding bit vector is retrieved when matching packets, then the bit vector and other fields are sent to TCAM to obtain matching result. Experiments based on actual network are employed to show that NIDS using LRC-RM can perform wire-speed range matching for OC-192 links, while saving much memory resource comparing to the existing methods. LRC-RM can be easily implemented within a chip without additional RAM.
(3) To solve the accurate string matching problem in protocol identification, we introduce a hardware detection method based on TCAM called Linking Shared Multi-Match (LSMM), which can effectively realize the Multi-Pattern Multi-Match of large capability of string rules.
(4) The relationship between the single pattern FSM and the Multi-Pattern FSM (MPFSM) has been studied. MPFSM matching engine is simple in structure but need more storage memeory, and single pattern FSM need little memory but the structure is complex. In MPFSM, based on Thompson algorithm, an Epsilon Compressed NFA (ECNFA) Construction Algorithm has been put forward and implemented. This algorithm enhances the performance of conversion from NFA to DFA by decreasing the epsilon edges and the corresponding states. A One-Pass multiple-pattern protocol identification system has been implemented using the MPFSM and corresponding algorithms. In single pattern FSM matching engine, we introduces a Set Intersected Precode (SI-Precode) method, SI-Precode codes all input symbols before the conversion from Regular Expressions to NFA, and the space of FSM state transition table is then reduced by compressing the input symbols. Using the SI-Precode, we could put the state transition table into the FPGA without additional memory.
Based on the above researches and with the aid of the National Grand Fundamental Research 863 Program of China and National Information Security Research 242 Program, an Application Classifying & Splitting Gather (ACSGather) for 2.5G POS bidirectional link is designed and implemented. The Accuracy and Performance of ACSGather are also been evaluated. ACSGather has been deployed since 2006, and has gotten positive effect.
论文以高速主干网络协议识别为目标,在研究了当前各种协议识别方法的基础上,充分考虑主干链路流量类型复杂、带宽高、并发流众多等特点,以软硬件结合的方式,采用基于报文深度处理的技术思想,开展协议识别的深入研究。主要完成了以下工作:
(1)提出了一种面向高速网络的协议识别框架,该框架由协议识别系统结构、通信机制、协议识别方法以及协议识别描述语言(Protocol Identification DescriptionLanguage,PIDL)组成。协议识别系统结构包括主控单元、交换单元和处理单元。高速交换单元连接多个处理单元,用于解决非对称路由、路由均衡等问题;主控单元对处理单元执行管理,负责规则的编译与加载;处理单元采用硬件匹配引擎,线速处理报文,从而解决性能问题。通信机制包括各单元之间的通信以及协议识别系统与分析系统之间的通信。主控单元以PIDL语言定义协议特征,解决可扩展性问题。采用端口匹配、精确串匹配,以及正则表达式等多种识别方法处理报文流,解决准确性问题。
(2)针对在协议识别端口匹配时出现离散端口与范围端口的问题,为确保线速执行范围匹配,提出了一种降低存储资源的范围匹配算法LRC-RM,将规则中的端口范围映射成压缩位向量,并将位向量组织成扩展平衡二叉树。报文匹配时获取位向量,然后将位向量与其它字段组合查找TCAM得到匹配结果。满足了规则含端口范围以及离散多端口条件下的报文线速匹配问题。
(3)为解决基于精确串的协议识别问题,采用一种基于TCAM的链式共享多匹配(Linking Shared Multi-Match,LSMM)检测方法,有效解决了大规模、长度差异大的协议特征串匹配问题。
(4)在基于正则表达式的协议识别中,研究了合成状态机与分离状态机的关系。合成状态机具有匹配引擎简单、但存储空间大的特点;分离状态机采用多个并行引擎,具有存储空间小,但每个协议需要一个匹配引擎的特点。在合成状态机匹配引擎研究中,以Thompson算法为基础,提出了一种压缩ε的NFA构造算法,该算法通过减少ε边及其对应状态,有效提高在协议模式编译时,NFA转换成DFA及DFA最小化过程的性能;基于上述理论与算法实现了一种无回溯线性扫描的组合多模式协议识别系统。在针对分离状态机的研究中,为进一步降低存储空间,研究了一种SI-Precode的预编码机制,以集合预编码的方式降低状态转移表所占用的存储空间,从而使状态转移表可采用FPGA片内存储器,不再需要外挂存储器,实现高效廉价的匹配引擎。
论文还在863高技术研究发展计划信息安全主题、国家242信息安全计划的资助下,以上述研究为基础,设计并实现了一个2.5G POS双向链路的应用分类分流采集系统(ACSGather),并对ACSGather协议识别的准确性与性能进行了评估。ACSGather系统于2006年开始部署应用,取得了良好的社会效益与经济效益。
Protocol Identification (also called Application-Layer Traffic Analysis) is the basis of Firewall, Intrusion Detection System, Content Auditing System and Network Management System. Nowadays, Protocol Identification for ISP Backbone faces many challenges, such as high traffic, new protocols, and unfeasible transport layer port matching method. Lately, some novel approaches have been proposed, such as method based on statistics and model, mathod based on packet deeply procession. But these methods fall short of performance, accuracy, expandability, and robustness.
This thesis focuses on the Protocol Identification of the ISP Backbone. Based on the research of many Protocol Identification methods, a new method combining the software and hardware has been proposed, which is capable of processing complicated, high speed traffic with many concurrent streams. The main contributions of the thesis are as follows:
(1) A High Speed Network Protocol Identification Framework has been proposed. The framework is composed of Protocol Identification Architecture (PIA), Communication Mechanism, Protocol Identification Method and Protocol Identification Description Language (PIDL). A high speed switch is used in PIS to connect several linecard, which solve unsymmetrical routing and routing balance problem. Master card controls the linecard, which take charge of compilation and loading of rules. We use PIDL to describe the protocol features, which solves the expansibility problem. Matching Engine has been implemented using customized hardware to enhance performance. Port matching, string matching and regular expression matching have been used to process the packet stream, which can improve the accuracy.
(2) Port matching in Protocol Identification often includes discrete ports and port range. To realize the wire-speed port range matching, a range matching algorithm called LRC-RM is proposed. LRC-RM maps the port range into a compressed bit vector and organizes the bit vectors as an extended balanced binary tree. The corresponding bit vector is retrieved when matching packets, then the bit vector and other fields are sent to TCAM to obtain matching result. Experiments based on actual network are employed to show that NIDS using LRC-RM can perform wire-speed range matching for OC-192 links, while saving much memory resource comparing to the existing methods. LRC-RM can be easily implemented within a chip without additional RAM.
(3) To solve the accurate string matching problem in protocol identification, we introduce a hardware detection method based on TCAM called Linking Shared Multi-Match (LSMM), which can effectively realize the Multi-Pattern Multi-Match of large capability of string rules.
(4) The relationship between the single pattern FSM and the Multi-Pattern FSM (MPFSM) has been studied. MPFSM matching engine is simple in structure but need more storage memeory, and single pattern FSM need little memory but the structure is complex. In MPFSM, based on Thompson algorithm, an Epsilon Compressed NFA (ECNFA) Construction Algorithm has been put forward and implemented. This algorithm enhances the performance of conversion from NFA to DFA by decreasing the epsilon edges and the corresponding states. A One-Pass multiple-pattern protocol identification system has been implemented using the MPFSM and corresponding algorithms. In single pattern FSM matching engine, we introduces a Set Intersected Precode (SI-Precode) method, SI-Precode codes all input symbols before the conversion from Regular Expressions to NFA, and the space of FSM state transition table is then reduced by compressing the input symbols. Using the SI-Precode, we could put the state transition table into the FPGA without additional memory.
Based on the above researches and with the aid of the National Grand Fundamental Research 863 Program of China and National Information Security Research 242 Program, an Application Classifying & Splitting Gather (ACSGather) for 2.5G POS bidirectional link is designed and implemented. The Accuracy and Performance of ACSGather are also been evaluated. ACSGather has been deployed since 2006, and has gotten positive effect.
引文
[1]2006 Annual Report by CNCERT/CC.http://www.cert.org.cn/UserFiles/File/2006%20Annual%20Report%20by%20CNCERT.pdf.
[2]凌捷,谢赞福.信息安全概论.华南理工大学出版社,2005.08.
[3]CNNIC.中国互联网络发展状况统计报告.Beijillg,2007.01.http://www.cnnic.net.cn/uploadfiles/pdf/2007/1/23/113114.pdf.
[4]Shaomeng Li,Jim Torresen and Oddvar Soraasen.Exploiting Stateful Inspection of Network Security in Reconfigurable Hardware.Proceedings of 13th International Conference on Field Programmable Logic and Applications.Sep.2003,Lisbon-Portugal.
[5]V.Srinivasan.Fast and Scalable Layer fore switching,Proceddings of ACM Sigcomm.1998:203-14.
[6]P.Gupta and N.McKeown.Packet classification on multiple fields.Proceedings ofACM Sigcomm.1999.
[7]Cao Z,Wang Z,Zegura E.Performance of hashing-based schemes for Internet load balancing.In:Nokia FB,ed.Proc.of the IEEE INFOCOM 2000.Piscataway:IEEE Computer and Communications Societies,2000.332-341.
[8]CLAFFY K C.Internet Traffic Characterization.Dissertation for the degree Doctor of Philosophy[D].University of California,Sam Diego.1994.
[9]Gero Dittmann,Andreas Herkrtsdorf,Network Processor Load Balancing for High-Speed Links.
[10]迅雷在线.http://www.xunlei.com.
[11]Subhabrata Sen,Jia Wang.Analyzing Peer-to-Peer Traffic across Large Networks[C].IEEE/ACM Transactions on Networking,NJ:IEEE Press,2004:P219-232.
[12]IANA.http://www.iana.org.
[13]M.S.Kim,H.J.Kang,J.W Hong.Towards Peer-to-Peer Traffic Analysis Using Flows.Lecture Notes in Computer Science,Springer,Heidelberg,Germany,2003,PP.55-67.
[14]Kim M.S.,Won YJ,Hong J.W.K.Application2Level Traffic Monitoring and an Analysis on IP Networks[J].ETRI journal,2005,27(11):22-42.
[15]T.Karagiannis,A.Broido.M.Faloutsos.Transport Layer Identification of P2P Traffic.Proceedings of the 4th ACM SIGCOMM conference on Internet Measurement,ACM Press,New York,USA,2004,P 121-134.
[16]T.Karagiannis,K.Papagiannaki,M.Faloutsos.BLINC:Multilevel Traffic Classification in the Dark.In Proc.ACM SIGCOMM,2005.
[17] Charles Wright, Fabian Monrose, Gerald M. Masson. HMM profiles for network traffic classification. Proceedings of the 2004 ACM Workshop on Visualization and Data Mining for Computer Security, pages 9-15, October 2004.
[18] Charles V. Wright, Fabian Monrose, Gerald M. Masson, Towards better protocol identification using profile HMMs. JHU Technical Report JHU-SPAR051201.
[19] L. Bernaille, RTeixeira, I. Akodkenou, Traffic Classification On The Fly, ACM SIGCOMM Computer Communication Review. Volume 36, Number 2, April 2006.
[20] YueXiang Yang, Rui Wang, Yang Liu, A New Method for P2P Traffic Identification Based on Support Vector Machine, ISDA06,2006.10.
[21] Rui Wang, Yang Liu, YueXiang Yang, Xiaoyong Zhou, Solving the App-Level Classification Problem of P2P Traffic Via Optimized Support Vector Machine. ICSP06 2006.11.
[22] Nigel Williams. A Preliminary Performance Comparison of Five Machine Learning Algorithms for Practical IP Traffic Flow Classification. SIGCOMM Computer Communication Review, October 2006.
[23] A. Moore and D. Zuev. Internet Traffic Classification Using Bayesian Analysis Techniques. In Proc. ACM SIGMETRICS, 2005.
[24] M. Roughan, S. Sen, O. Spatscheck, N. Duffield. Class of Service Mapping for QoS: A Statistical Signature Based Approach To IP Traffic Classification. In Proc.ACM Internet Measurement Conference, 2004.
[25] K. Xu, Z.-L. Zhang, and S. Bhattacharyya. Profiling Internet Backbone Traffic: Behavior Models and Applications. In Proc. ACM SIGCOMM, 2005.
[26] Y. Zhang and V. Paxson. Detecting Backdoors. In Proc. USENIX Security Symposium, 2000.
[27] K. Tan and B. Collie. Detection and classification of TCP/IP network services.Annual Computer Security Applications Conference, 1997.
[28] J. Early, C. Brodley, and C. Rosenberg. Behavioral Authentication of Server Flows. In Proc. Annual Computer Security Applications Conference, 2003.
[29] van der Merwe J , Caceres R , Chu Y2H , Sreenan C. mmdump-A Tool for Monitoring Internet Multimedia Traffic[C]. ACM Computer Communication Review,Oct. 2000, 30: 48-59.
[30] Kang H. J., M. S. Kim, J. W-K. Hong. A Method on Multimedia Service Traffic Monitoring and Analysis[J]. DSOM 2003. Lecture Notes in Computer Science 2867.Heidelberg, Germany, Oct. 2003.93-105.
[31] Holger Greger, Anja FeldMann, Michael Mai, Vern Paxson, Robin Sommer,Dynamic Application-Layer Protocol Analysis for Network Intrusion Detection.Proceedings of USENIX Security Symposium. August 2006.
[32] Subhabrata Sen, Oliver Spatscheck, Dongmei Wang, Accurate, Scalable In-Network Identification of P2P Traffic Using Application Signature. WWW04, ACM Press,New York,USA,2004,P512-521.
[33]刘元勋,徐秋亮,云晓春,面向入侵检测系统的通用应用层协议识别技术研究,山东大学学报,2007,37(02)P1-5.
[34]T.Choi,C.Kim,S.Yoon,J.Park,H.Kim,H.Chung,and T.Jesong.Content-Aware Internet Application Traffic Measurement and Analysis.In IEEE/IFIP NOMS'04,Seoul,Korea,April 2004.
[35]Andrew W.Moore.And Konstantina Papagiannaki,Toward the Accurate Identification of Network Application.PAM 2005.Boston,MA,2005.
[36]Y.J.Won,B-C.Park,H-T.Ju,M-s.Kim,J.W.Hong,A Hybrid Approach for Accurate Application Traffic Identification.IEEE/IFIP E2EMON,Vancouver,Canada,April 3,P1-8.
[37]Application Layer Packet Classifier for Linux,http://17-filter.sourceforge.net
[38]IPP2P:http://www.ipp2p.org.
[39]http://www.wildpackets.com.
[40]SecPath 1 800F防火墙P2P流量监管技术白皮书.http://www.3com.com.on/3com/pro/switch/paper/paper_p2p.htm.
[41]Huawei Technologies Co.,Ltd.Eudemon Series Firewalls Technology White Paper.2005.
[42]Cisco System Inc.Blocking Peer-to-Peer File Sharing Programs with the PIX Firewall.2006.
[43]CacheLogic.Advanced Solutions for P2P Networks.2006.
[44]天阗 IDS.http://www.venustech.com.cn.
[45]Thompson K.Regular Expression search algorithm.Communications of the ACM,1968,11(6):410-422.
[46]R.McNaughton and H.Yamada.Regular expressions and state graphs for automata.Trans.IRS,EC(9):39-47,1960.
[47]C.Chang.Ph.D Thesis.Department of Computer Science,Courant Institute,New York,1992.
[48]G.Berry and R.Sethi.From regular expressions to deterministic automata.Theoretical Computer Science,48:117-126,1986.
[49]V.Antimirov.Partial derivatives of regular expressions and finite automata construction.Theoretical Computer Science,155:291-319,1996.
[50]G.Xing.A Simple Way to Construct NFA with Fewer States and Transitions.ACMSE'04 Huntsville,USA:April 2004.
[51]Sidhu,R.and Prasanna,V.K.,"Fast Regular Expression Matching using FPGAs," in Proceedings of 9th Annual IEEE Symposium on Field-Programmable Custom Computing Machines(FCCM'01),April 2001.
[52]Peter Sutton,Partial Character Decoding for Improved Regular Expression Matching in FPGAs,2004.
[53]Benjamin C.Brodie,David E.Taylor,Ron K.Cytron,A Scalable Architecture For HighThroughput Regular-Expression Pattern Matching.ACM SIGARCH Computer Architecture News,2006,34(2):191-202.
[54]Hopcroft JE.Ullman JD.Introduction to Automata Theory,Languages,and Computation Second Edition,Boston.Addison-Wesley,2002.
[55]Fang Yu,Randy H.Katz,and T.V.Lakshman.Gigabit Rate Packet Pattern-Matching Using TCAM,In Proceedings of the 12th IEEE Intemational Conference on Network Protocols(ICNP'04).
[56]Sailesh Kumar,Sarang Dharmapurikar,Fang Yu,Algorithms to Accelerate Multiple Regular Expressions Matching for Deep Packet Inspection.In:.SIGCOMM' 06.Pisa,Italy:September 2006,11-15.http://www.arl.wustl.edu/～sarang/fp289-kumar.pdf.
[57]Sailesh Kumar,Jonathan Turner,John Williams,Advanced Algorithms for Fast and Scalable Deep Packet Inspection.In ANCS' 06,California,USA:December 2006.
[58]J.van Junteren,High-Performance Pattern-Matching for Intrusion Detection.Proceedings IEEE infocom,2006.
[59]J.van Junteren,Searching very large routing tables in wide embedded memory,proc.1EEE Globecom,vol.3,PP.1615-1619,November 2001.
[60]张泽鑫,陈曙晖,苏金树.一种报文过滤设备配置管理系统的实现.计算机工程与科学,2005.1.
[61]陈曙晖,苏金树.基于两级审计的分布式内容审计系统.计算机工程与科学,2006.6.
[62]Stefaan Pouseele.How the FTP protocol Challenges Forewall Security.2003.http://www.isaserver.org.
[63]P.Gupta and N.McKeown.Packet classification on multiple fields.Proc.Sigcomm,Comp.Commun.Rev,29(4):147-60,Sept.1999.
[64]S.Nilsson and G.Karlsson.Ip-address lookup using lctries.IEEE Journal on Selected Areas in Communications,17(6):1083-92,1999.
[65]M.Waldvogel,G.Varghese,J.Turner,and B.Plattner.Scalable high-speed ip routing lookups.In Proc.ACM SIGCOMM,pages 25-36,Cannes,France,1997.
[66]A.Brodnik,S.Carlsson,M.Degermark,and S.Pink.Small forwarding tables for fast routing lookups.In Proc.ACM SIGCOMM,pages 3-14,Cannes,France,1997.
[67]V.Srinivasan and G.Varghese.Fast address lookups using controlled prefix expansion.ACM Transactions on Computer Systems,17(1):1-40,Oct.1999.
[68]T.Lakshman and D.Stiliadis.High-speed policy-based packet forwarding using efficient multi-dimensional range matching.In Proc.ACM Sigcomm,pages 191-202,Sept.1998.
[69]V.Srinivasan,S.Suri,and G.Varghese.Packet classification using tuple space search.In Proc.ACM Sigcomm,pages 135-146,Sept.1999.
[70]Song H Y,Lockwood J W.Efficient Packet Classification for Network Intrusion Detection using FPGA[A].International Symposium on Field-Programmable Gate Arrays(FPGA'05)[C],Monterey,CA,USA.2005.20-22.
[71]Lakshminarayanan K,Rangarajan A,Venkatachary S.Algorithms for Advanced Packet Classification with Ternary CAMs[A].SIGCOMM'05[C],Philadelphia,PA,USA.2005.21-26.
[72]Liu H.Effcient Mapping of Range Classifier into Ternary-CAM[A].IEEE Symposium on High Performance Interconnects(HotI)[C],Stanford,CA,USA.2002.21-23.
[73]Lunteren J V,Engbersen T.Fast and Scalable Packet Classification[J].IEEE Journal on Selected Areas in Communications,VOL.21,NO.4,MAY 2003.560-570.
[74]Brassard G,Bratley P.Heuristic and Approximate Algorithms[M],Fundamentals of Algorithmics.New Jersey,USA.Prentice Hall.1995.474-500.
[75]Roesch M.Snort-Lightweight Intrusion Detection for Networks[A],USENIX Technical Program-13th Systems Administration Conference-LISA '99[C].Seattle,Washington,USA.1999.229-238.
[76]陈曙晖,苏金树.线速硬件NIDS的范围匹配研究.通信学报2006.10.
[77]R.Sommer.Viable Network Intrusion Detection in High-Performance Environments.PhD thesis,TU M"unchen,2005.
[78]Aho,M Corasick.Efficient string matching:An aid to bibliographic search.Comunications of ACM,1975,18(6):P333-334.
[79]D.E.Knuth,J.H.M.Jr.,and V.R.Pratt.Fast pattern matching in strings.SIAM J.Comput.,vol.6,no.2,pp.323-350,June 1977.
[80]WU Sun,Manber U.A Fast Algorithm for Multi-Pattern Searching[R].Technical Report TR 94-17,University of Arizona at Tuscon,May 1994.
[81]R.S.Boyer and J.S.Moore.A fast string matching algorithm.Commun.ACM,vol.20,no.10,pp.762-772,October 1977.
[82]王永成,沈州,许一震.改进的多模式匹配算法.计算机研究与发展,2002,39(1):55.60.
[83]Y.Sugawara,M.Inaba,and K.Hiraki,"Over 10gbps string matching mechanism for multi-stream packet scanning systems",in FPL,2004.
[84]G.Tripp.A finite-state machine based string matching system for intrusion detection on high-speed networks.EICAR,2005.
[85]M.Aldwairi,T.Conte,and P.Franzon.Con gurable string matching hardware for speeding up intrusion detection.SIGARCH.Comput.Archit.News,vol.33,no.1,pp.99-107,2005.
[86]F.Yu,R.Katz,and T.V.Lakshman.Gigabit rate packet pattern matching using tcam.ICNP,2004.
[87]L.Tan and T.Sherwood.A high throughput string matching architecture for intrusion detection and prevention.ISCA,2005.
[88]S.Dharmapurikar,P.Krishnamurthy,T.Sproull,and J.W.Lockwood.Deep packet inspection using parallel bloom filters.Micro,2004.
[89]叶明江,崔勇,徐恪,吴建平,基于有状态Bloom filter引擎的高速分组检测,软件学报,2007,18(1),117-129.
[90]R.Sidhu and V.K.Prasanna.Fast regular expression matching using fpgas.FCCM,2001.
[91]Z.K.Barker and V.K.Prasanna,Time and area efficient pattern matching on fpgas.FPGA,2004.
[92]E.Spitznagel,D.Taylor,and J.Turner.Packet Classification Using Extended TCAMs.ICNP,2003.
[93]P.Gupta,and N.McKeown.Algorithms for Packet Classification.IEEE Network,2001.
[94]Karthik Lakshminarayanan,Anand Rangarajan,and Srinivasan Venkatachary,Algorithms for Advanced Packet Classification with Ternary CAMs.In SIGCOMM'05,August 21-26,2005.
[95]Bro Intrusion Detection System.http://bro-ids.org/Overview.
[96]PCRE-Ped Compatible Regular Expression,www.pcre.org.
[97]Wiki protocol info.http://www.protocolinfo.org/wiki/Main_page.
[98]Aho AV,Corasick MJ.Efficient string matching:An aid to bibliographic search.Communications of the ACM,1975,18(6):333-340.
[99]Tuck N,Sherwood T,Calder B,Varghese G.Deterministic memory efficient string matching algorithms for intrusion detection.Li VOK,ed.Proc.of the IEEE Infocom 2004.Piscataway:IEEE,2004.333-340.
[100]LI WN,E Yue-Peng,GE JG,QIAN HL,Multi-Pattern Matching Algorithms and Hardware Based Implementation,Journal of Software,2006 17(12),2403-2415.
[101]FangYu,Zhifeng Chen,Yanlei Diao,Fast and Memory-Efficient Regular Expression Matching for Deep Packet Inspection.Technical Report,Berkeley:University of California,2006.http://www.eecs.berkeley.edu/Pubs/TechRpts/2006/EECS-2006-76.html.
[102]T.J.Green,A.Gupta,G.Miklau,M.Onizuka,and D.suciu,"Processing XML Streams with Deterministic Automata and Stream INdexs",ACM TODS,voi.29,2004.
[103]Y.Diao,M.Altinel,M.J.Franklin,H.Zhang,and P.Fischer.Path Sharing and Predicate Evaluation for High-Preformance XML Filtering.ACM TODS,2003.
[104]Karel Hrbacek,Thomas Jech,Introduction to set Theory,Third Edition,Marcel Dekker Inc.NewYork,1999.
[105]烽火通信,http://www.fiberhome.com.cn.
[106]Cypress Semiconductor Corp.Content addressable memory.http://www.cypress,com/.
[107]Sumsang.http://www.sumsang.com.
[108]Altera.http://www.altera.com.
[109]程光,龚俭,丁伟,徐加羚,面向IP流测量的哈希算法研究,软件学报2005,16(05)P652-658.
[110]L.Tan and T.Sherwood.A high throughput string matching architecture for intrusion detection and prevention.In ISCA'05:32nd Annual International Symposium on Computer Architecture,pages 112-122,2005.
[111]W.E.Leland,M.S.Taqqu,W.Willinger,and D.V.Wilson.On the Self-Similar Nature of Ethemet Traffic.Proceedings ACM SIGCOMM 93,13-17September 1993.
[112]W.E.Leland,M.S.Taqqu,W.Willinger,and D.V.Wilson.On the Self-Similar Nature of Ethemet Traffic(Extended Version).IEEE/ACM Transactions on Networking,2(1994) 1-1.
[113]M.W.Garrett,W.Willinger.Analysis,modeling and generation of self-similar VBR video traffic.Proceedings of ACM Sig-comm'94,London,UK,1994,269-280.
[2]凌捷,谢赞福.信息安全概论.华南理工大学出版社,2005.08.
[3]CNNIC.中国互联网络发展状况统计报告.Beijillg,2007.01.http://www.cnnic.net.cn/uploadfiles/pdf/2007/1/23/113114.pdf.
[4]Shaomeng Li,Jim Torresen and Oddvar Soraasen.Exploiting Stateful Inspection of Network Security in Reconfigurable Hardware.Proceedings of 13th International Conference on Field Programmable Logic and Applications.Sep.2003,Lisbon-Portugal.
[5]V.Srinivasan.Fast and Scalable Layer fore switching,Proceddings of ACM Sigcomm.1998:203-14.
[6]P.Gupta and N.McKeown.Packet classification on multiple fields.Proceedings ofACM Sigcomm.1999.
[7]Cao Z,Wang Z,Zegura E.Performance of hashing-based schemes for Internet load balancing.In:Nokia FB,ed.Proc.of the IEEE INFOCOM 2000.Piscataway:IEEE Computer and Communications Societies,2000.332-341.
[8]CLAFFY K C.Internet Traffic Characterization.Dissertation for the degree Doctor of Philosophy[D].University of California,Sam Diego.1994.
[9]Gero Dittmann,Andreas Herkrtsdorf,Network Processor Load Balancing for High-Speed Links.
[10]迅雷在线.http://www.xunlei.com.
[11]Subhabrata Sen,Jia Wang.Analyzing Peer-to-Peer Traffic across Large Networks[C].IEEE/ACM Transactions on Networking,NJ:IEEE Press,2004:P219-232.
[12]IANA.http://www.iana.org.
[13]M.S.Kim,H.J.Kang,J.W Hong.Towards Peer-to-Peer Traffic Analysis Using Flows.Lecture Notes in Computer Science,Springer,Heidelberg,Germany,2003,PP.55-67.
[14]Kim M.S.,Won YJ,Hong J.W.K.Application2Level Traffic Monitoring and an Analysis on IP Networks[J].ETRI journal,2005,27(11):22-42.
[15]T.Karagiannis,A.Broido.M.Faloutsos.Transport Layer Identification of P2P Traffic.Proceedings of the 4th ACM SIGCOMM conference on Internet Measurement,ACM Press,New York,USA,2004,P 121-134.
[16]T.Karagiannis,K.Papagiannaki,M.Faloutsos.BLINC:Multilevel Traffic Classification in the Dark.In Proc.ACM SIGCOMM,2005.
[17] Charles Wright, Fabian Monrose, Gerald M. Masson. HMM profiles for network traffic classification. Proceedings of the 2004 ACM Workshop on Visualization and Data Mining for Computer Security, pages 9-15, October 2004.
[18] Charles V. Wright, Fabian Monrose, Gerald M. Masson, Towards better protocol identification using profile HMMs. JHU Technical Report JHU-SPAR051201.
[19] L. Bernaille, RTeixeira, I. Akodkenou, Traffic Classification On The Fly, ACM SIGCOMM Computer Communication Review. Volume 36, Number 2, April 2006.
[20] YueXiang Yang, Rui Wang, Yang Liu, A New Method for P2P Traffic Identification Based on Support Vector Machine, ISDA06,2006.10.
[21] Rui Wang, Yang Liu, YueXiang Yang, Xiaoyong Zhou, Solving the App-Level Classification Problem of P2P Traffic Via Optimized Support Vector Machine. ICSP06 2006.11.
[22] Nigel Williams. A Preliminary Performance Comparison of Five Machine Learning Algorithms for Practical IP Traffic Flow Classification. SIGCOMM Computer Communication Review, October 2006.
[23] A. Moore and D. Zuev. Internet Traffic Classification Using Bayesian Analysis Techniques. In Proc. ACM SIGMETRICS, 2005.
[24] M. Roughan, S. Sen, O. Spatscheck, N. Duffield. Class of Service Mapping for QoS: A Statistical Signature Based Approach To IP Traffic Classification. In Proc.ACM Internet Measurement Conference, 2004.
[25] K. Xu, Z.-L. Zhang, and S. Bhattacharyya. Profiling Internet Backbone Traffic: Behavior Models and Applications. In Proc. ACM SIGCOMM, 2005.
[26] Y. Zhang and V. Paxson. Detecting Backdoors. In Proc. USENIX Security Symposium, 2000.
[27] K. Tan and B. Collie. Detection and classification of TCP/IP network services.Annual Computer Security Applications Conference, 1997.
[28] J. Early, C. Brodley, and C. Rosenberg. Behavioral Authentication of Server Flows. In Proc. Annual Computer Security Applications Conference, 2003.
[29] van der Merwe J , Caceres R , Chu Y2H , Sreenan C. mmdump-A Tool for Monitoring Internet Multimedia Traffic[C]. ACM Computer Communication Review,Oct. 2000, 30: 48-59.
[30] Kang H. J., M. S. Kim, J. W-K. Hong. A Method on Multimedia Service Traffic Monitoring and Analysis[J]. DSOM 2003. Lecture Notes in Computer Science 2867.Heidelberg, Germany, Oct. 2003.93-105.
[31] Holger Greger, Anja FeldMann, Michael Mai, Vern Paxson, Robin Sommer,Dynamic Application-Layer Protocol Analysis for Network Intrusion Detection.Proceedings of USENIX Security Symposium. August 2006.
[32] Subhabrata Sen, Oliver Spatscheck, Dongmei Wang, Accurate, Scalable In-Network Identification of P2P Traffic Using Application Signature. WWW04, ACM Press,New York,USA,2004,P512-521.
[33]刘元勋,徐秋亮,云晓春,面向入侵检测系统的通用应用层协议识别技术研究,山东大学学报,2007,37(02)P1-5.
[34]T.Choi,C.Kim,S.Yoon,J.Park,H.Kim,H.Chung,and T.Jesong.Content-Aware Internet Application Traffic Measurement and Analysis.In IEEE/IFIP NOMS'04,Seoul,Korea,April 2004.
[35]Andrew W.Moore.And Konstantina Papagiannaki,Toward the Accurate Identification of Network Application.PAM 2005.Boston,MA,2005.
[36]Y.J.Won,B-C.Park,H-T.Ju,M-s.Kim,J.W.Hong,A Hybrid Approach for Accurate Application Traffic Identification.IEEE/IFIP E2EMON,Vancouver,Canada,April 3,P1-8.
[37]Application Layer Packet Classifier for Linux,http://17-filter.sourceforge.net
[38]IPP2P:http://www.ipp2p.org.
[39]http://www.wildpackets.com.
[40]SecPath 1 800F防火墙P2P流量监管技术白皮书.http://www.3com.com.on/3com/pro/switch/paper/paper_p2p.htm.
[41]Huawei Technologies Co.,Ltd.Eudemon Series Firewalls Technology White Paper.2005.
[42]Cisco System Inc.Blocking Peer-to-Peer File Sharing Programs with the PIX Firewall.2006.
[43]CacheLogic.Advanced Solutions for P2P Networks.2006.
[44]天阗 IDS.http://www.venustech.com.cn.
[45]Thompson K.Regular Expression search algorithm.Communications of the ACM,1968,11(6):410-422.
[46]R.McNaughton and H.Yamada.Regular expressions and state graphs for automata.Trans.IRS,EC(9):39-47,1960.
[47]C.Chang.Ph.D Thesis.Department of Computer Science,Courant Institute,New York,1992.
[48]G.Berry and R.Sethi.From regular expressions to deterministic automata.Theoretical Computer Science,48:117-126,1986.
[49]V.Antimirov.Partial derivatives of regular expressions and finite automata construction.Theoretical Computer Science,155:291-319,1996.
[50]G.Xing.A Simple Way to Construct NFA with Fewer States and Transitions.ACMSE'04 Huntsville,USA:April 2004.
[51]Sidhu,R.and Prasanna,V.K.,"Fast Regular Expression Matching using FPGAs," in Proceedings of 9th Annual IEEE Symposium on Field-Programmable Custom Computing Machines(FCCM'01),April 2001.
[52]Peter Sutton,Partial Character Decoding for Improved Regular Expression Matching in FPGAs,2004.
[53]Benjamin C.Brodie,David E.Taylor,Ron K.Cytron,A Scalable Architecture For HighThroughput Regular-Expression Pattern Matching.ACM SIGARCH Computer Architecture News,2006,34(2):191-202.
[54]Hopcroft JE.Ullman JD.Introduction to Automata Theory,Languages,and Computation Second Edition,Boston.Addison-Wesley,2002.
[55]Fang Yu,Randy H.Katz,and T.V.Lakshman.Gigabit Rate Packet Pattern-Matching Using TCAM,In Proceedings of the 12th IEEE Intemational Conference on Network Protocols(ICNP'04).
[56]Sailesh Kumar,Sarang Dharmapurikar,Fang Yu,Algorithms to Accelerate Multiple Regular Expressions Matching for Deep Packet Inspection.In:.SIGCOMM' 06.Pisa,Italy:September 2006,11-15.http://www.arl.wustl.edu/～sarang/fp289-kumar.pdf.
[57]Sailesh Kumar,Jonathan Turner,John Williams,Advanced Algorithms for Fast and Scalable Deep Packet Inspection.In ANCS' 06,California,USA:December 2006.
[58]J.van Junteren,High-Performance Pattern-Matching for Intrusion Detection.Proceedings IEEE infocom,2006.
[59]J.van Junteren,Searching very large routing tables in wide embedded memory,proc.1EEE Globecom,vol.3,PP.1615-1619,November 2001.
[60]张泽鑫,陈曙晖,苏金树.一种报文过滤设备配置管理系统的实现.计算机工程与科学,2005.1.
[61]陈曙晖,苏金树.基于两级审计的分布式内容审计系统.计算机工程与科学,2006.6.
[62]Stefaan Pouseele.How the FTP protocol Challenges Forewall Security.2003.http://www.isaserver.org.
[63]P.Gupta and N.McKeown.Packet classification on multiple fields.Proc.Sigcomm,Comp.Commun.Rev,29(4):147-60,Sept.1999.
[64]S.Nilsson and G.Karlsson.Ip-address lookup using lctries.IEEE Journal on Selected Areas in Communications,17(6):1083-92,1999.
[65]M.Waldvogel,G.Varghese,J.Turner,and B.Plattner.Scalable high-speed ip routing lookups.In Proc.ACM SIGCOMM,pages 25-36,Cannes,France,1997.
[66]A.Brodnik,S.Carlsson,M.Degermark,and S.Pink.Small forwarding tables for fast routing lookups.In Proc.ACM SIGCOMM,pages 3-14,Cannes,France,1997.
[67]V.Srinivasan and G.Varghese.Fast address lookups using controlled prefix expansion.ACM Transactions on Computer Systems,17(1):1-40,Oct.1999.
[68]T.Lakshman and D.Stiliadis.High-speed policy-based packet forwarding using efficient multi-dimensional range matching.In Proc.ACM Sigcomm,pages 191-202,Sept.1998.
[69]V.Srinivasan,S.Suri,and G.Varghese.Packet classification using tuple space search.In Proc.ACM Sigcomm,pages 135-146,Sept.1999.
[70]Song H Y,Lockwood J W.Efficient Packet Classification for Network Intrusion Detection using FPGA[A].International Symposium on Field-Programmable Gate Arrays(FPGA'05)[C],Monterey,CA,USA.2005.20-22.
[71]Lakshminarayanan K,Rangarajan A,Venkatachary S.Algorithms for Advanced Packet Classification with Ternary CAMs[A].SIGCOMM'05[C],Philadelphia,PA,USA.2005.21-26.
[72]Liu H.Effcient Mapping of Range Classifier into Ternary-CAM[A].IEEE Symposium on High Performance Interconnects(HotI)[C],Stanford,CA,USA.2002.21-23.
[73]Lunteren J V,Engbersen T.Fast and Scalable Packet Classification[J].IEEE Journal on Selected Areas in Communications,VOL.21,NO.4,MAY 2003.560-570.
[74]Brassard G,Bratley P.Heuristic and Approximate Algorithms[M],Fundamentals of Algorithmics.New Jersey,USA.Prentice Hall.1995.474-500.
[75]Roesch M.Snort-Lightweight Intrusion Detection for Networks[A],USENIX Technical Program-13th Systems Administration Conference-LISA '99[C].Seattle,Washington,USA.1999.229-238.
[76]陈曙晖,苏金树.线速硬件NIDS的范围匹配研究.通信学报2006.10.
[77]R.Sommer.Viable Network Intrusion Detection in High-Performance Environments.PhD thesis,TU M"unchen,2005.
[78]Aho,M Corasick.Efficient string matching:An aid to bibliographic search.Comunications of ACM,1975,18(6):P333-334.
[79]D.E.Knuth,J.H.M.Jr.,and V.R.Pratt.Fast pattern matching in strings.SIAM J.Comput.,vol.6,no.2,pp.323-350,June 1977.
[80]WU Sun,Manber U.A Fast Algorithm for Multi-Pattern Searching[R].Technical Report TR 94-17,University of Arizona at Tuscon,May 1994.
[81]R.S.Boyer and J.S.Moore.A fast string matching algorithm.Commun.ACM,vol.20,no.10,pp.762-772,October 1977.
[82]王永成,沈州,许一震.改进的多模式匹配算法.计算机研究与发展,2002,39(1):55.60.
[83]Y.Sugawara,M.Inaba,and K.Hiraki,"Over 10gbps string matching mechanism for multi-stream packet scanning systems",in FPL,2004.
[84]G.Tripp.A finite-state machine based string matching system for intrusion detection on high-speed networks.EICAR,2005.
[85]M.Aldwairi,T.Conte,and P.Franzon.Con gurable string matching hardware for speeding up intrusion detection.SIGARCH.Comput.Archit.News,vol.33,no.1,pp.99-107,2005.
[86]F.Yu,R.Katz,and T.V.Lakshman.Gigabit rate packet pattern matching using tcam.ICNP,2004.
[87]L.Tan and T.Sherwood.A high throughput string matching architecture for intrusion detection and prevention.ISCA,2005.
[88]S.Dharmapurikar,P.Krishnamurthy,T.Sproull,and J.W.Lockwood.Deep packet inspection using parallel bloom filters.Micro,2004.
[89]叶明江,崔勇,徐恪,吴建平,基于有状态Bloom filter引擎的高速分组检测,软件学报,2007,18(1),117-129.
[90]R.Sidhu and V.K.Prasanna.Fast regular expression matching using fpgas.FCCM,2001.
[91]Z.K.Barker and V.K.Prasanna,Time and area efficient pattern matching on fpgas.FPGA,2004.
[92]E.Spitznagel,D.Taylor,and J.Turner.Packet Classification Using Extended TCAMs.ICNP,2003.
[93]P.Gupta,and N.McKeown.Algorithms for Packet Classification.IEEE Network,2001.
[94]Karthik Lakshminarayanan,Anand Rangarajan,and Srinivasan Venkatachary,Algorithms for Advanced Packet Classification with Ternary CAMs.In SIGCOMM'05,August 21-26,2005.
[95]Bro Intrusion Detection System.http://bro-ids.org/Overview.
[96]PCRE-Ped Compatible Regular Expression,www.pcre.org.
[97]Wiki protocol info.http://www.protocolinfo.org/wiki/Main_page.
[98]Aho AV,Corasick MJ.Efficient string matching:An aid to bibliographic search.Communications of the ACM,1975,18(6):333-340.
[99]Tuck N,Sherwood T,Calder B,Varghese G.Deterministic memory efficient string matching algorithms for intrusion detection.Li VOK,ed.Proc.of the IEEE Infocom 2004.Piscataway:IEEE,2004.333-340.
[100]LI WN,E Yue-Peng,GE JG,QIAN HL,Multi-Pattern Matching Algorithms and Hardware Based Implementation,Journal of Software,2006 17(12),2403-2415.
[101]FangYu,Zhifeng Chen,Yanlei Diao,Fast and Memory-Efficient Regular Expression Matching for Deep Packet Inspection.Technical Report,Berkeley:University of California,2006.http://www.eecs.berkeley.edu/Pubs/TechRpts/2006/EECS-2006-76.html.
[102]T.J.Green,A.Gupta,G.Miklau,M.Onizuka,and D.suciu,"Processing XML Streams with Deterministic Automata and Stream INdexs",ACM TODS,voi.29,2004.
[103]Y.Diao,M.Altinel,M.J.Franklin,H.Zhang,and P.Fischer.Path Sharing and Predicate Evaluation for High-Preformance XML Filtering.ACM TODS,2003.
[104]Karel Hrbacek,Thomas Jech,Introduction to set Theory,Third Edition,Marcel Dekker Inc.NewYork,1999.
[105]烽火通信,http://www.fiberhome.com.cn.
[106]Cypress Semiconductor Corp.Content addressable memory.http://www.cypress,com/.
[107]Sumsang.http://www.sumsang.com.
[108]Altera.http://www.altera.com.
[109]程光,龚俭,丁伟,徐加羚,面向IP流测量的哈希算法研究,软件学报2005,16(05)P652-658.
[110]L.Tan and T.Sherwood.A high throughput string matching architecture for intrusion detection and prevention.In ISCA'05:32nd Annual International Symposium on Computer Architecture,pages 112-122,2005.
[111]W.E.Leland,M.S.Taqqu,W.Willinger,and D.V.Wilson.On the Self-Similar Nature of Ethemet Traffic.Proceedings ACM SIGCOMM 93,13-17September 1993.
[112]W.E.Leland,M.S.Taqqu,W.Willinger,and D.V.Wilson.On the Self-Similar Nature of Ethemet Traffic(Extended Version).IEEE/ACM Transactions on Networking,2(1994) 1-1.
[113]M.W.Garrett,W.Willinger.Analysis,modeling and generation of self-similar VBR video traffic.Proceedings of ACM Sig-comm'94,London,UK,1994,269-280.