Method and apparatus for filtrating network rubbish information supported by multiple protocols

Abstract

The invention discloses a network garbage information filtering method supported by multiprotocols and based on the transparent bridge, and a device, which belongs to the information security domain. The method and the device comprise a transparent bridge, data packet redirection, IP packet receiving and reinjecting, protocol analysis, a multi-thread scheduling analysis module and filtering modules (such as a mail filtering module and a short message filtering module, etc.) of various protocols. The method and the device adopt the technical proposal that the related information in the network is detained on the well-built linux transparent bridge by using iptables / netfilter, then ip lamination processing is completed, tcp data stream is restored, and complete network information is obtained and stored in a double-buffering queue; then the worker thread in a thread-scheduling awakened thread pool retrieves information form the double-buffering queue, and different filtering modules are invoked for filtering; the information is discarded when being judged as the garbage information, otherwise, the information is released. The device can be positioned at the front end of the gateway of a large and medium-sized enterprise or deployed at the front end of a border router for filtering the network information.

Description

technical field [0001] The present invention relates to a garbage information filtering method and device supported by multi-protocols. The netfilter and iptables modules in Linux are used to detain the packets of related protocols, and then simulate the protocol stack to analyze and restore the protocols of ip and tcp layers to obtain complete Network information (complete email information, SMS or web page information, etc.). Finally, use behavior filtering, bayes filtering, rule filtering and other methods to analyze the information and determine its nature. Background technique [0002] There are some spam filtering products at home and abroad, most of which are based on hardware and can block in real time, but the price is very expensive. Please refer to the figure below for details. Most products have a common problem, poor scalability. In addition, the execution efficiency of the program is too dependent on the hardware. [0003] There are also many spam filtering ...

AI Technical Summary

Problems solved by technology

[0004] 1. Spam information cannot be blocked in real time. It will be analyzed after the spam information arrives. In this way, the bandwidth occupation caused by spam information has already formed.

[0005] 2 Working on the client side, it can only handle small flow information, but cannot handle large flow information

There are two main reasons for this preference in academic research: one is that during the long-term "fighting" between anti-spam supporters and spammers, the traditional black-and-white list-based and rule-based filtering Due to its inherent defects (such as: poor flexibility, poor intelligence, high false negative rate and false positive rate), the method has been difficult to cope with the increasingly sophisticated spammers, and the statistical method with learning ability is in theoretical research and In practical applications, it shows extraordinary superiority. Well-trained statistical filters can often block some spam with insignificant characteristics with high accuracy, and even identify some unknown spam through self-learning ; Another reason is the famous assertion made by Paul Graham, the pioneer who introduced the Naive Bayes method into the field of anti-spam processing, in the article "A Plan For Spam": "The Achilles heel of the spammersis their message."

Images