【摘要】：隨著計(jì)算機(jī)網(wǎng)絡(luò)技術(shù)在政治，軍事，商業(yè)等領(lǐng)域的廣泛使用，網(wǎng)絡(luò)流量的高速增長(zhǎng)，使得網(wǎng)絡(luò)安全的問題日益突出，作為網(wǎng)絡(luò)安全的核心問題數(shù)據(jù)包分類技術(shù)顯得尤為重要。L7-Filter是Linux系統(tǒng)平臺(tái)下基于對(duì)數(shù)據(jù)包應(yīng)用層數(shù)據(jù)分析并最終確定分類的軟件平臺(tái)。然而，，隨著網(wǎng)絡(luò)中多核處理器的大規(guī)模部署，L7-Filter并沒有在多核環(huán)境下表現(xiàn)出明顯的性能提升。 針對(duì)以上問題，本文首先概要性的介紹了多核計(jì)算的體系結(jié)構(gòu)，分析了L7-Filter的架構(gòu)及其在多核處理器上性能瓶頸，針對(duì)性地提出了一種對(duì)目標(biāo)規(guī)則鏈進(jìn)行類型分類，并依據(jù)網(wǎng)絡(luò)數(shù)據(jù)流時(shí)間局部性的統(tǒng)計(jì)特性來動(dòng)態(tài)優(yōu)化規(guī)則鏈的方法來改進(jìn)數(shù)據(jù)包匹配分類算法;在本文最后通過設(shè)計(jì)仿真實(shí)驗(yàn)對(duì)算法的性能進(jìn)行了分析，改進(jìn)后的算法充分的利用了網(wǎng)絡(luò)數(shù)據(jù)包在時(shí)間和空間上的局部性，使多核環(huán)境下數(shù)據(jù)包分類性能有了約6%的提高；實(shí)驗(yàn)結(jié)果表明，在數(shù)據(jù)包個(gè)數(shù)相同的條件下，改進(jìn)后的算法明顯的提高了多核處理器的處理性能，隨著數(shù)據(jù)包個(gè)數(shù)的增加，性能優(yōu)越性越明顯。
[Abstract]:With the wide use of computer network technology in political, military, commercial and other fields, and the rapid growth of network traffic, the problem of network security has become increasingly prominent. As the core problem of network security, packet classification technology is very important. L7-Filter is a software platform based on the data analysis of the application layer of the data packet and finally determines the classification of the data packet under the Linux system platform. However, with the large-scale deployment of multi-core processors in the network, L7-Filter does not show a significant improvement in performance in multi-core environments. To solve the above problems, this paper firstly introduces the architecture of multi-core computing, analyzes the architecture of L7-Filter and its performance bottleneck on multi-core processors, and puts forward a kind of classification of target rule chain. According to the statistical characteristics of time locality of network data flow, the method of dynamic optimization of rule chain is used to improve the classification algorithm of packet matching. In the end of this paper, the performance of the algorithm is analyzed by designing simulation experiments. The improved algorithm makes full use of the localization of network packets in time and space, and improves packet classification performance by about 6% in multi-core environment. The experimental results show that under the condition of the same number of packets, the improved algorithm can obviously improve the processing performance of the multi-core processor. With the increase of the number of packets, the better the performance is, the more obvious the performance superiority is.
【學(xué)位授予單位】：武漢科技大學(xué)
【學(xué)位級(jí)別】：碩士
【學(xué)位授予年份】：2013
【分類號(hào)】：TP332;TP393.08

【參考文獻(xiàn)】

相關(guān)期刊論文 前10條

1 胡朝強(qiáng);黃利斌;;針對(duì)應(yīng)用層過濾的Iptables防火墻擴(kuò)展功能應(yīng)用研究[J];計(jì)算機(jī)安全;2010年05期

2 王杰;石成輝;;基于正則表達(dá)式的動(dòng)態(tài)應(yīng)用層協(xié)議識(shí)別方案[J];計(jì)算機(jī)工程與應(yīng)用;2010年18期

3 所光;楊學(xué)軍;;多核處理機(jī)系統(tǒng)Cache管理技術(shù)研究現(xiàn)狀[J];計(jì)算機(jī)工程與科學(xué);2010年07期

4 林闖;王元卓;任豐原;;新一代網(wǎng)絡(luò)QoS研究[J];計(jì)算機(jī)學(xué)報(bào);2008年09期

5 徐衛(wèi)志;宋風(fēng)龍;劉志勇;范東睿;余磊;張帥;;眾核處理器片上同步機(jī)制和評(píng)估方法研究[J];計(jì)算機(jī)學(xué)報(bào);2010年10期

6 丁晶;陳曉嵐;吳萍;;基于正則表達(dá)式的深度包檢測(cè)算法[J];計(jì)算機(jī)應(yīng)用;2007年09期

7 熊忠陽(yáng);張逢貴;張玉芳;;Linux下基于Netfilter個(gè)人內(nèi)核防火墻的設(shè)計(jì)與實(shí)現(xiàn)[J];計(jì)算機(jī)應(yīng)用;2009年S1期

8 楊贊;楊林;王保進(jìn);張琨;;依據(jù)流統(tǒng)計(jì)特性的報(bào)文分類規(guī)則集動(dòng)態(tài)優(yōu)化[J];計(jì)算機(jī)應(yīng)用研究;2011年05期

9 曹折波;李青;;多核處理器并行編程模型的研究與設(shè)計(jì)[J];計(jì)算機(jī)工程與設(shè)計(jì);2010年13期

10 王若梅;張綺雯;周凡;;一種新的多模式快速匹配算法[J];中山大學(xué)學(xué)報(bào)(自然科學(xué)版);2005年S2期

本文編號(hào)：2471511