| As the development of network, the user's online behavior is becoming more and more diverse. In government department and enterprise the user's online behavior generate tremendous impact on the security and performance of network. In order to control the user's online behavior, more and more government department and enterprise opt for using the user's online behavior management system. This system can standardize the user's online behavior and improve worked efficiency. For example, it can forbid the employee to chat, play games and view stock market during the working hours. It also can control flow and assign band width, making the network resource used rationally. For instance, it can block those P2P applications which will occupy the band-width, such as Xunlei, BitTorrent, eMule. In a word, it's convenient to manage the user's online behavior using the user's online behavior management system.The functionality of the system is based on the precondition that the system can identify the application protocol precisely. The system identify the application protocol according to the protocol signature of the protocol signature library, so whether the system is a successful product depend on the accuracy of the protocol signature. My job is extracting the protocol signature of the application and add them to the protocol signature library. I have completed the mission that extracting signature from the application Xunlei, eMule, QQ, Zhongxin stock software, ku6 online-video website, etc. Experiment indicate that the system can identify the application accurately, and it will not mistake one application for another application. In comparison with the product of the other company, my protocol signature has a higher rate of identification. There are two means used for extracting protocol signature. One is to analyse the network data packet captured by the software and get the protocol signature using statistics.The other is reading the source code of the application, especially for the encrypted protocol. The paper mainly describes how I extract the protocol signature from the application. |
