| Along with the appearing of Everything over IP, various heterogeneous networks aremerged into the Internet, various separate business platforms are also gradually merged tocomprehensive business platform based on IP load bearing, in the Internet there constantlyappears new business types and led to many new business forms, network loading services aremore and more and present new characteristic: the non-key business is consuming more andmore bandwidth resources, such as P2P (Peer to Peer) business flow occupies nearly2/3of thebackbone network bandwidth, which affects the network ’s normal use of other users; at the sametime, the network game, high-clear IPTV and other new businesses are ceaseless emerge in largenumbers, making the network business increasingly become complex and diverse, due to the lackof precise control, be unable to grasp the users’ behavior and determine the network traffic type.More serious is for some bad information, such as illegal propaganda, network viruses, networkattacks, spasm and so on, because the Internet is lack of effective identification and controlmeans, so it causes malicious information spreading through the network widely, massiveflooding, causes serious threats to the network security and the network credibility. Therefore,identifying varies of business component in the network traffic, mastering the components andchanges of flow business, intercepting bad information spread via the backbone network,blocking malicious attack via the backbone network are the key works in current networkmanagement and control works.The traditional network management and control means such as TE (Traffic Engineering),QoS (Quality of Services) are the technologies to manage the network bandwidth and thenetwork traffic. With the development of Internet, the traditional network management methodsbased on flow and bandwidth have been unable to meet the actual needs of the application innetwork management. Currently the trend of Internet control is mainly developing based on thedirection of business control, so the network business management research has become the hotissue in Internet research. In the current network traffic control, the technical means used to thebusiness identification have been developed to the current popular technologies: DPI (DeepPacket Inspection) and DFI (Deep Flow Inspection). However, as the network rate increased andthe requirements of accurate identification and fine control increased, the current deep inspectiontechnology couldn’t satisfy the accurate and precision multi-business identification requirementsin high speed network, mainly contains following aspects: software based way is inefficient;hardware based processing has larger power and high cost of business system; business controlmeans is single, can only support business identification based on fixed position information in TCP/IP message head; business recognition accuracy using packet sampling is low, cannotsatisfy the precision demand of current business management; traffic identification algorithmprecision is not high.In order to solve the above problems, this thesis studies on deep inspection technologies inthe network business management and control system, through the improvement of depthinspection technologies and inspection schemes, it could greatly improve the inspectionperformance, such as matching rate, false positives rate of inspection and other aspects, reducethe inspection complexity, satisfy the actual application needs of deep packet inspection and deepflow inspection in high-speed link for the network business management and control system.This thesis firstly designs a new kind of business management and control structure whichcould support real-time, depth, multi-dimension identification and control, puts forwardreduction type physical structure with three stages based on the high-speed front and the deepbackend, proposes logic structure with three layers include the control operation layer, theintelligent recognition layer and network, the network joint management and control layer. Basedon the design of the network business management and control structure, it researches relateddeep inspection technologies in the network management and control system.During the research on the key technologies in deep packet inspection, it designs theline-speed deep packet inspection mechanism and related algorithms applied in the high-speednetwork. This thesis presents a content level with multi-mode, multi-dimension identificationscheme called CLM2IS, according to the domain value and the location, the keywords could beclassified, and high efficient keyword matching algorithms are designed for different types ofkeywords. For the fixed keyword matching, this thesis proposes fixed keywords exact matchingalgorithm based on hardware accelerated called HAFMA, through introducing the pipelineprocessing mechanism, it could shorten the look-up table time, improve processing efficiency;for the range keyword matching, it puts forward a kind of multi-dimension range keywordsmatching algorithm called MDFMA, through the convert of the serial multi-object characteristiccomparison process to a parallel search operation, the processing efficiency is improved; for thefloating keyword matching, it proposed floating keywords matching algorithm based on twolevel TCAM called T2FMA, through the pretreatment and two TCAM structure design, it couldreduce the TCAM comparison times and TCAM hardware power, improve the pattern matchingrate. Experiment and analysis show that the proposed keywords matching algorithms areeffective, which could significantly improve the matching rate, suitable for line-speed deeppacket identification in high speed network.During the research on the key technologies in deep flow inspection, this thesis designsdeep flow inspection mechanism and related algorithms applied in the high-speed link. This thesis proposes deep flow recognition mechanism based on host behavior characteristics intransport layer and flow statistical characteristics, for the massive information storage inhigh-speed network, it proposes flow information storage scheme based on the hierarchicalstructure called TSFIS, which store the information of long flow and short flow accordingdivided level, it could solve the contradiction between storage capacity and processing speed; inorder to choose out flow characteristic to distinguish flow type, it proposes flow feature selectionalgorithm based on the information measure, called IMFCS, through coarse-grained data flowfeature selection and fine-grained data flow feature selection, it could reduce the redundant andthe feature dimension of optional feature set; in the traffic sampling measurement, this thesisproposes a dynamic adaptive flow balanced sampling algorithm called DAFBS, which improvesthe flow sampling ratio and reduces sampling error, it could reflect the actual flow in the networkmore accurately; for the identification of unknown flow and encrypted traffic, it puts forward akind of traffic identification algorithm based on semi supervised learning called S2MLFI, whichimproves the flow classification and clustering ability, also improves the accuracy andrecognition rate of the flow identification. Experiment and performance analysis show that theproposed deep flow inspection mechanism and related algorithms are effective, which couldsatisfy deep flow inspection requirements in the high-speed link.Finally, on the basis of research on the key technologies of deep packet inspection and dataflow inspection, this thesis designs high-speed network business management and control deepinspection system. |
