【摘要】：當(dāng)今,互聯(lián)網(wǎng)飛速發(fā)展,網(wǎng)絡(luò)新業(yè)務(wù)層見疊出,網(wǎng)絡(luò)流量也呈現(xiàn)指數(shù)級的增長。網(wǎng)絡(luò)業(yè)務(wù)流量的精細(xì)識別被廣泛應(yīng)用于規(guī)劃和管理網(wǎng)絡(luò),解決網(wǎng)絡(luò)用塞,預(yù)防網(wǎng)絡(luò)攻擊等方面,成為對防火墻等安全技術(shù)的有力補充。高速網(wǎng)絡(luò)的出現(xiàn)對流量識別技術(shù)提出了更高的要求,而分布式計算框架對大規(guī)模數(shù)據(jù)的處理能力使其能夠更好的應(yīng)對高速網(wǎng)絡(luò)流量,從而確保網(wǎng)絡(luò)環(huán)境的通暢。因此,將分布式計算框架應(yīng)用于網(wǎng)絡(luò)業(yè)務(wù)流量識別中已成為新的研究熱點。本文全面詳細(xì)的闡述了網(wǎng)絡(luò)流量識別技術(shù)的理論,對當(dāng)下最為常見的網(wǎng)絡(luò)流量識別技術(shù)中包含的端口識別技術(shù)、DFI技術(shù)和DPI技術(shù)進(jìn)行了深入分析。通過分析網(wǎng)絡(luò)流量識別的需求,重點研究了DPI技術(shù)中的KMP算法、BM算法、WM算法和AC算法,對各種算法的原理以及算法的運算流程進(jìn)行了對比性研究,提出了一種改進(jìn)的模式匹配算法--BMF算法,它能夠更加快速的進(jìn)行文本串的模式匹配。伴隨著互聯(lián)網(wǎng)的高速發(fā)展,傳統(tǒng)的網(wǎng)絡(luò)結(jié)構(gòu)已經(jīng)難以適應(yīng)如今網(wǎng)絡(luò)新業(yè)務(wù)的需求,傳統(tǒng)的關(guān)系型數(shù)據(jù)的存儲和計算也已經(jīng)難以適應(yīng)未來海量流量增長的需求,因此應(yīng)用分布式計算框架對大規(guī)模數(shù)據(jù)流量進(jìn)行識別是必然的發(fā)展趨勢,本文根據(jù)Hadoop云計算平臺的特點設(shè)計了基于DPI技術(shù)和MapReduce模塊的MapReduceBoyer-MooreFast算法的運算流程,將DPI技術(shù)應(yīng)用到Hadoop云計算平臺中,最后搭建Hadoop實驗集群,抓取數(shù)據(jù)進(jìn)行對比實驗,實驗結(jié)果表明,該方法能夠有效的識別網(wǎng)絡(luò)業(yè)務(wù)流量。本文的主要工作如下:(1)提出了一種改進(jìn)的模式匹配算法—BMF算法。BM算法利用好后綴規(guī)則和壞字符規(guī)則構(gòu)造兩張?zhí)D(zhuǎn)表,指示字符向右移動的距離,在此基礎(chǔ)上,本文對算法的匹配思想進(jìn)行了優(yōu)化和改進(jìn),舍棄了好后綴規(guī)則以及好后綴規(guī)則中數(shù)據(jù)鏈表的構(gòu)造,從而簡化了算法的運算流程,降低了空間復(fù)雜度,重點利用壞字符規(guī)則,改進(jìn)字符匹配方式,增加文本串向右移動的最大距離,降低了文本串向右移動的次數(shù)。實驗結(jié)果表明,BMF算法在不降低匹配準(zhǔn)確率的前提下一定程度上提高了模式匹配算法的運行效率。(2)設(shè)計了基于Hadoop平臺的DPI技術(shù)流量識別方案。首先使用抓包軟件Wireshark對網(wǎng)絡(luò)流量進(jìn)行抓取,提取流量的數(shù)據(jù)包特征,然后利用Hadoop平臺處理大規(guī)模數(shù)據(jù)流量的優(yōu)勢,將DPI技術(shù)與MapReduce編程框架進(jìn)行結(jié)合,根據(jù)其框架特點設(shè)計了MapReduceBoyer-MooreFast算法的運算流程,最后搭建相關(guān)的實驗環(huán)境,在Hadoop云計算平臺下實現(xiàn)了基于DPI技術(shù)的流量識別。實驗結(jié)果表明,DPI技術(shù)在Hadoop平臺下不僅提高了流量識別的效率,而且也保證了識別的準(zhǔn)確率。
[Abstract]:Nowadays, with the rapid development of the Internet, the new network services are stacked, and the network traffic increases exponentially. The fine identification of network traffic is widely used in planning and managing network, solving network plug, preventing network attack and so on. It becomes a powerful supplement to firewall and other security technologies. The emergence of high-speed network has put forward higher requirements for traffic identification technology, while the distributed computing framework has the ability to deal with large-scale data better to cope with high-speed network traffic, so as to ensure the smooth flow of network environment. Therefore, the application of distributed computing framework in network traffic identification has become a new research hotspot. In this paper, the theory of network traffic identification technology is expounded in detail, and the port identification technology, DFI technology and DPI technology, which are the most common network traffic identification technology, are deeply analyzed. By analyzing the demand of network traffic identification, the KMP algorithm, BM algorithm, WM algorithm and AC algorithm in DPI technology are studied. In this paper, an improved pattern matching algorithm, BMF algorithm, is proposed, which can match the pattern of text string more quickly. With the rapid development of the Internet, the traditional network structure has been difficult to adapt to the needs of new network services, the traditional relational data storage and computing has been difficult to adapt to the future demand of massive traffic growth. Therefore, it is an inevitable trend to use distributed computing framework to identify large-scale data traffic. According to the characteristics of Hadoop cloud computing platform, this paper designs the MapReduceBoyer-MooreFast algorithm based on DPI technology and MapReduce module. The DPI technology is applied to the Hadoop cloud computing platform. Finally, the Hadoop experimental cluster is built, and the data is grabbed to carry on the contrast experiment. The experimental results show that the method can effectively identify the network traffic. The main work of this paper is as follows: (1) an improved pattern matching algorithm, BMF algorithm, is proposed. The BM algorithm constructs two jump tables using good suffix rules and bad character rules to indicate the distance of characters moving to the right. This paper optimizes and improves the algorithm's matching idea, forgets the construction of good suffix rule and data linked list in good suffix rule, thus simplifies the operation flow of the algorithm, reduces the space complexity, and makes use of the bad character rule. The method of character matching is improved to increase the maximum distance of text string moving to the right and to reduce the frequency of text string moving to the right. The experimental results show that the BMF algorithm improves the efficiency of the pattern matching algorithm to some extent without reducing the matching accuracy. (2) the scheme of DPI traffic recognition based on Hadoop platform is designed. Firstly, the packet grabbing software Wireshark is used to capture the network traffic and extract the packet characteristics of the traffic. Then, the advantage of the Hadoop platform to deal with the large-scale data traffic is used to combine the DPI technology with the MapReduce programming framework. According to the characteristics of the framework, the operation flow of MapReduceBoyer-MooreFast algorithm is designed. Finally, the related experimental environment is built, and the traffic identification based on DPI technology is realized on the platform of Hadoop cloud computing. The experimental results show that DPI technology not only improves the efficiency of traffic identification, but also ensures the accuracy of recognition on Hadoop platform.
【學(xué)位授予單位】：曲阜師范大學(xué)
【學(xué)位級別】：碩士
【學(xué)位授予年份】：2017
【分類號】：TP393.06

【參考文獻(xiàn)】

相關(guān)期刊論文 前10條

1 彭立志;;互聯(lián)網(wǎng)流量識別研究綜述[J];濟南大學(xué)學(xué)報(自然科學(xué)版);2016年02期

2 杜江;張錚;張杰鑫;邰銘;;MapReduce并行編程模型研究綜述[J];計算機科學(xué);2015年S1期

3 李莉;江育娥;林R，

本文編號：2365302