【摘要】：隨著計算機網(wǎng)絡技術在政治，軍事，商業(yè)等領域的廣泛使用，網(wǎng)絡流量的高速增長，使得網(wǎng)絡安全的問題日益突出，作為網(wǎng)絡安全的核心問題數(shù)據(jù)包分類技術顯得尤為重要。L7-Filter是Linux系統(tǒng)平臺下基于對數(shù)據(jù)包應用層數(shù)據(jù)分析并最終確定分類的軟件平臺。然而，，隨著網(wǎng)絡中多核處理器的大規(guī)模部署，L7-Filter并沒有在多核環(huán)境下表現(xiàn)出明顯的性能提升。 針對以上問題，本文首先概要性的介紹了多核計算的體系結構，分析了L7-Filter的架構及其在多核處理器上性能瓶頸，針對性地提出了一種對目標規(guī)則鏈進行類型分類，并依據(jù)網(wǎng)絡數(shù)據(jù)流時間局部性的統(tǒng)計特性來動態(tài)優(yōu)化規(guī)則鏈的方法來改進數(shù)據(jù)包匹配分類算法;在本文最后通過設計仿真實驗對算法的性能進行了分析，改進后的算法充分的利用了網(wǎng)絡數(shù)據(jù)包在時間和空間上的局部性，使多核環(huán)境下數(shù)據(jù)包分類性能有了約6%的提高；實驗結果表明，在數(shù)據(jù)包個數(shù)相同的條件下，改進后的算法明顯的提高了多核處理器的處理性能，隨著數(shù)據(jù)包個數(shù)的增加，性能優(yōu)越性越明顯。
[Abstract]:With the wide use of computer network technology in political, military, commercial and other fields, and the rapid growth of network traffic, the problem of network security has become increasingly prominent. As the core problem of network security, packet classification technology is very important. L7-Filter is a software platform based on the data analysis of the application layer of the data packet and finally determines the classification of the data packet under the Linux system platform. However, with the large-scale deployment of multi-core processors in the network, L7-Filter does not show a significant improvement in performance in multi-core environments. To solve the above problems, this paper firstly introduces the architecture of multi-core computing, analyzes the architecture of L7-Filter and its performance bottleneck on multi-core processors, and puts forward a kind of classification of target rule chain. According to the statistical characteristics of time locality of network data flow, the method of dynamic optimization of rule chain is used to improve the classification algorithm of packet matching. In the end of this paper, the performance of the algorithm is analyzed by designing simulation experiments. The improved algorithm makes full use of the localization of network packets in time and space, and improves packet classification performance by about 6% in multi-core environment. The experimental results show that under the condition of the same number of packets, the improved algorithm can obviously improve the processing performance of the multi-core processor. With the increase of the number of packets, the better the performance is, the more obvious the performance superiority is.
【學位授予單位】：武漢科技大學
【學位級別】：碩士
【學位授予年份】：2013
【分類號】：TP332;TP393.08

【參考文獻】

相關期刊論文 前10條

1 胡朝強;黃利斌;;針對應用層過濾的Iptables防火墻擴展功能應用研究[J];計算機安全;2010年05期

2 王杰;石成輝;;基于正則表達式的動態(tài)應用層協(xié)議識別方案[J];計算機工程與應用;2010年18期

3 所光;楊學軍;;多核處理機系統(tǒng)Cache管理技術研究現(xiàn)狀[J];計算機工程與科學;2010年07期

4 林闖;王元卓;任豐原;;新一代網(wǎng)絡QoS研究[J];計算機學報;2008年09期

5 徐衛(wèi)志;宋風龍;劉志勇;范東睿;余磊;張帥;;眾核處理器片上同步機制和評估方法研究[J];計算機學報;2010年10期

6 丁晶;陳曉嵐;吳萍;;基于正則表達式的深度包檢測算法[J];計算機應用;2007年09期

7 熊忠陽;張逢貴;張玉芳;;Linux下基于Netfilter個人內核防火墻的設計與實現(xiàn)[J];計算機應用;2009年S1期

8 楊贊;楊林;王保進;張琨;;依據(jù)流統(tǒng)計特性的報文分類規(guī)則集動態(tài)優(yōu)化[J];計算機應用研究;2011年05期

9 曹折波;李青;;多核處理器并行編程模型的研究與設計[J];計算機工程與設計;2010年13期

10 王若梅;張綺雯;周凡;;一種新的多模式快速匹配算法[J];中山大學學報(自然科學版);2005年S2期

本文編號：2471511