本文選題：流量捕獲 + 異步并行存儲　； 參考：《中國科學(xué)院大學(xué)（工程管理與信息技術(shù)學(xué)院）》2014年碩士論文

【摘要】：隨著互聯(lián)網(wǎng)的爆發(fā)式發(fā)展,網(wǎng)絡(luò)與信息安全問題日益突出,全面系統(tǒng)的測試是保證網(wǎng)絡(luò)安全的重要手段。但相對于互聯(lián)網(wǎng),網(wǎng)絡(luò)測試技術(shù)的發(fā)展明顯滯后,傳統(tǒng)的測試方法手段單一、模式趨同、場景不夠真實,很難綜合評估系統(tǒng)的真實能力。 針對傳統(tǒng)測試方法的不足,本文提出了一種基于真實流量回放的測試方法,并設(shè)計了一套2.5G/10G網(wǎng)絡(luò)流量捕獲回放系統(tǒng),本文主要工作內(nèi)容如下： (1)分析了當(dāng)前主流的測試手段,提出了通過回放真實流量模擬實際網(wǎng)絡(luò)場景、對被測系統(tǒng)進行綜合評估的測試方法。 (2)對流量回放測試需求進行了詳細分析,并在此基礎(chǔ)上設(shè)計了一套2.5G/10G網(wǎng)絡(luò)流量捕獲回放系統(tǒng)。 (3)為了實現(xiàn)2.5G/10G網(wǎng)絡(luò)流量的線速捕獲和零丟包存儲,提出了一種基于循環(huán)隊列緩存的異步并行捕獲存儲方案,并設(shè)計了一種文件矩陣存儲架構(gòu),大大提高了捕獲存儲的性能。 (4)為了實現(xiàn)10TB級網(wǎng)絡(luò)數(shù)據(jù)的快速檢索,提出了一種基于哈希定位算法、Bloom Filter過濾和摘要信息索引技術(shù)的三級檢索方案,有力的提升了檢索效率。 (5)針對流量回放的測試需求,提出了線速、可控速率和真實速率三種流量回放方式,并設(shè)計了基于流量片段的多樣化回放手段。 網(wǎng)絡(luò)流量捕獲回放系統(tǒng)的研制將現(xiàn)網(wǎng)真實流量打造成了一種可控制、可標(biāo)注、可重放的測試流量,彌補了當(dāng)前測試手段不夠真實的缺陷,提升了測試結(jié)果的參考價值。另外,網(wǎng)絡(luò)流量捕獲回放系統(tǒng)也可用于網(wǎng)絡(luò)安全事件的分析與回溯。
[Abstract]:With the explosive development of Internet, the problem of network and information security is becoming more and more prominent. Comprehensive and systematic testing is an important means to ensure network security. However, compared with the Internet, the development of network testing technology is obviously lagging behind, the traditional testing methods are single, the patterns converge, the scene is not real enough, and it is difficult to comprehensively evaluate the real ability of the system. Aiming at the shortcomings of traditional testing methods, this paper proposes a testing method based on real traffic playback, and designs a set of 2.5G/10G network traffic capture and playback system. The main work of this paper is as follows: 1) this paper analyzes the current mainstream testing methods, and puts forward a test method of synthetically evaluating the system under test by simulating the real network scene by playing back the real traffic. 2) the requirement of flow playback test is analyzed in detail, and a set of 2.5G/10G network traffic capture and playback system is designed. In order to realize line speed capture and zero packet loss storage of 2.5G/10G network traffic, an asynchronous parallel capture storage scheme based on cyclic queue cache is proposed, and a file matrix storage architecture is designed, which greatly improves the performance of capture storage. In order to realize the fast retrieval of 10TB network data, a three-level retrieval scheme based on hashing location algorithm, bloom Filter filtering and summary information index, is proposed, which improves the retrieval efficiency. 5) according to the test requirements of flow playback, three flow playback methods, line speed, controllable rate and real rate, are proposed, and a variety of playback methods based on flow segments are designed. The development of network traffic capture and playback system makes the real traffic of the present network a kind of controllable, annotated and replayed test traffic, which makes up for the deficiency of the current testing methods and improves the reference value of the test results. In addition, the network traffic capture and playback system can also be used for network security events analysis and backtracking.
【學(xué)位授予單位】：中國科學(xué)院大學(xué)（工程管理與信息技術(shù)學(xué)院）
【學(xué)位級別】：碩士
【學(xué)位授予年份】：2014
【分類號】：TP393.08

【參考文獻】

相關(guān)期刊論文 前8條

1 楊武,方濱興,云曉春,張宏莉;基于Linux系統(tǒng)的報文捕獲技術(shù)研究[J];計算機工程與應(yīng)用;2003年26期

2 楊保華;亓亞p，

本文編號：1917941