Research On Traffic Reassembly Technology Based On Big Data Platform

In the era of rapid development of the Internet,the problem of cyberspace security has intensified,and criminals have created various security threats to network applications.Traffic reassembly is a key part of network security audit.In the face of the ever-increasing speed of Internet bandwidth,traditional traffic reassembly technology gradually reveals the problem of insufficient performance and is difficult to handle massive network traffic.This topic takes high-speed Internet bandwidth as a scenario,and studies the traffic reassembly problem,and proposes a parallel TCP session bidirectional data stream recombination technology.The main work of this article is as follows:1.Traffic collection and storage is the basis of traffic reassembly.The current situation of flow acquisition technology and its shortcomings in high bandwidth background are studied.This paper designs a high-speed traffic acquisition and storage technology based on PF_RING and memory buffer.On the one hand,this technology makes up for the shortcomings of the current technology,and on the other hand,it has expanded new ideas for the development of this field.2.Traffic reassembly is the key content of this paper.The current status of traffic reassembly technology and its shortcomings in the context of high bandwidth are studied.This paper designs a bidirectional data stream recombination technique based on a mutated quaternion and an improved TCP state finite state machine.The recombination technology has good parallelism and high efficiency,and is suitable for TCP session reassembly under high-speed Internet bandwidth.3.Implement a traffic reassembly prototype system and test its performance.The system is based on the Spark platform and makes full use of the computing resources of the cluster.By comparing with other recombination technologies,the traffic reassembly technology proposed in this paper has higher execution efficiency and accuracy.At present,the system has been applied to the abnormal behavior detection of the BUPT campus'network.