本文選題：正則表達(dá)式　切入點(diǎn)：訪(fǎng)問(wèn)概率　出處：《國(guó)防科學(xué)技術(shù)大學(xué)》2013年碩士論文

【摘要】：在網(wǎng)絡(luò)高速發(fā)展的同時(shí),網(wǎng)絡(luò)的開(kāi)放性導(dǎo)致的安全問(wèn)題也日益嚴(yán)峻。深度報(bào)文檢測(cè)是網(wǎng)絡(luò)安全的核心技術(shù),深度報(bào)文檢測(cè)利用預(yù)定義的規(guī)則集對(duì)報(bào)文內(nèi)容進(jìn)行匹配,從而識(shí)別出隱藏于報(bào)文內(nèi)容中的惡意信息或協(xié)議特征。正則表達(dá)式匹配是深度報(bào)文檢測(cè)的主要手段,在正則表達(dá)式匹配技術(shù)中,匹配性能和存儲(chǔ)需求是一對(duì)相互制約的因素。吉比特網(wǎng)絡(luò)的快速發(fā)展要求骨干網(wǎng)必須具備線(xiàn)速匹配能力,而越來(lái)越復(fù)雜的規(guī)則要求存儲(chǔ)器必須具備足夠大的容量,但存儲(chǔ)器件一般都不同時(shí)具備大容量和高吞吐量的特點(diǎn)。這給正則表達(dá)式的匹配帶來(lái)了巨大的挑戰(zhàn),必須探索新的技術(shù)以從根本上解決性能與存儲(chǔ)的矛盾問(wèn)題。本文首次提出基于兩級(jí)存儲(chǔ)的匹配技術(shù),一級(jí)存儲(chǔ)器采用高速的小容量存儲(chǔ)器解決性能問(wèn)題,二級(jí)存儲(chǔ)器采用大容量的低速存儲(chǔ)器解決存儲(chǔ)空間需求。通過(guò)結(jié)合使用兩種存儲(chǔ)器件,可以用較低的存儲(chǔ)代價(jià)獲得較高的吞吐量。論文主要完成的工作有:1)闡明吞吐量和存儲(chǔ)是正則表達(dá)式匹配技術(shù)的主要矛盾,進(jìn)而提出基于兩級(jí)存儲(chǔ)的匹配引擎思想。通過(guò)仿真匹配實(shí)驗(yàn)對(duì)狀態(tài)訪(fǎng)問(wèn)概率進(jìn)行統(tǒng)計(jì)分析,實(shí)驗(yàn)表明狀態(tài)訪(fǎng)問(wèn)概率呈Zipf分布,非常有利于兩級(jí)存儲(chǔ)的架構(gòu)。2)利用馬爾可夫鏈理論對(duì)報(bào)文匹配中狀態(tài)遷移過(guò)程進(jìn)行建模,把穩(wěn)態(tài)向量作為狀態(tài)理論訪(fǎng)問(wèn)概率。討論了穩(wěn)態(tài)向量的計(jì)算方法,并進(jìn)行編碼實(shí)現(xiàn)。實(shí)驗(yàn)數(shù)據(jù)表明該模型與狀態(tài)訪(fǎng)問(wèn)概率分布特性基本吻和。3)基于開(kāi)放式網(wǎng)絡(luò)實(shí)驗(yàn)平臺(tái)Net Magic,實(shí)現(xiàn)了本文提出的兩級(jí)存儲(chǔ)匹配引擎,并充分利用FPGA內(nèi)部多RAM塊的特性,實(shí)例化多個(gè)匹配線(xiàn)程,使系統(tǒng)性能線(xiàn)速提升。實(shí)驗(yàn)結(jié)果表明,該方法能在保證一定吞吐量的情況下,使存儲(chǔ)代價(jià)大幅降低。
[Abstract]:With the rapid development of the network, the security problems caused by the openness of the network are becoming more and more serious. Deep message detection is the core technology of network security. The depth message detection uses the predefined rule set to match the message content. In order to identify malicious information or protocol features hidden in message content, regular expression matching is the main means of detecting deep message, in regular expression matching technology, The fast development of gigabit network requires the backbone network to have the ability of line speed matching, and the increasingly complex rules require that the memory must have enough capacity. However, memory devices generally do not have the characteristics of large capacity and high throughput at the same time. This poses a great challenge to the matching of regular expressions. It is necessary to explore new techniques to solve the problem of conflict between performance and storage fundamentally. In this paper, a matching technique based on two-stage storage is proposed for the first time, and a high speed low-capacity memory is used to solve the performance problem. Secondary memory uses a large capacity of low-speed memory to address storage space requirements. By using a combination of two storage devices, The main work done in this paper is to clarify that throughput and storage are the main contradiction of regular expression matching technology. Furthermore, the idea of matching engine based on two-level storage is put forward, and the state access probability is statistically analyzed by simulation matching experiment, which shows that the state access probability is distributed in Zipf. In this paper, the Markov chain theory is used to model the state transition process in message matching, and the steady-state vector is regarded as the access probability of state theory, and the calculation method of steady-state vector is discussed. The experimental data show that this model is based on the open network experiment platform Net Magic. the proposed two-level storage matching engine is realized. Taking full advantage of the characteristics of multiple RAM blocks in FPGA, several matching threads are instantiated to improve the system performance line speed. The experimental results show that the proposed method can reduce the storage cost significantly under certain throughput.
【學(xué)位授予單位】：國(guó)防科學(xué)技術(shù)大學(xué)
【學(xué)位級(jí)別】：碩士
【學(xué)位授予年份】：2013
【分類(lèi)號(hào)】：TP393.08;TP333
，

本文編號(hào)：1673066