Network data processing method and system based on protocol analysis

Abstract

The invention discloses a network data processing method and system based on protocol analysis. The method comprises the following steps: 1) capturing a data packet in a network; 2) comparing the fingerprint of the captured data packet with a target fingerprint; 3) judging whether the data packet which is subjected to the fingerprint comparison is a complete data packet; 4) carrying out data mining on the complete data packet and generating new association rules; 5) carrying out protocol analysis on the data packet by utilizing the features of a protocol according to the protocol parsed from a rule base; and 6) carrying out real-time response on warning signals through a management server based on information logs and meanwhile, judging whether to keep the newly-generated association rules to the rule base. The system comprises a sensing unit, a fingerprint comparison unit, an analysis unit, a data reduction unit, a mining unit, a protocol analysis unit, a management server and a parsing unit. According to the network data processing method and system based on protocol analysis, not only the accuracy and reliability of data processing are improved, but also mass data can be processed, and real-time response is achieved.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a network data processing method and system based on protocol analysis. Background technique [0002] As one of the most important active network security measures at present, network intrusion detection effectively supplements and perfects the security measures such as access control, data encryption, firewall, virus prevention, etc. by identifying and responding to malicious network connections on computers and network resources. Security measures, which improve the integrity of the information security infrastructure, have become an integral part of information system security solutions. Network intrusion detection technology can be divided into misuse detection technology and anomaly detection technology according to its working principle. Among them, the misuse detection technology is based on the feature matching of data packets. This detection technology has a hi...

AI Technical Summary

Problems solved by technology

In recent years, with the emergence of high-speed network technologies such as ATM, Gigabit Ethernet, and G-bit fiber optic networks, the amount of data and information in the network has increased exponentially, causing more and more problems with the above-mentioned simple protocol analysis technology. , including: all data packets must be restored and interpreted, and the massive data generated in the network cannot be processed in a timely manner,

Images