Method and system for filtering messages based on audited object

Abstract

The invention discloses a method and a system for filtering messages based on an audited object. The method comprises the following steps: a control management end of an auditing system sends information containing an Ethernet MAC address, a service port, and the like of an audited server host computer to a detector; a network card driver of the detector analyzes a current network communication message captured by a network card to obtain a source MAC address, a destination address, a source port and a destination port of the current network communication message; and the source MAC address, the destination address, the source port and the destination port of the current network communication message are matched with the MAC address and the service port of the audited server host computer received by the control management end to obtain a successfully matched communication message by filtering. In the invention, messages with no need of attention are filtered and discarded in the early period of capturing the messages, thereby the processing expense in each stage of the later period can be saved, larger system resource margin can be brought, the processing ability of the system is improved, and the requirement of the network auditing system on the hardware of a messaging capturing detector is reduced.

Description

technical field [0001] The invention relates to the processing of network data of a network security audit system, in particular to a network card driver layer message filtering method based on the network audit system and a message filtering subsystem based on the network audit system. Background technique [0002] High-performance packet capture and processing is the key technology and basic problem of network security auditing system. The network audit system is through the steps of packet capture, packet analysis, fragment reassembly, session reassembly, and protocol analysis of the audited network communication, and matches the protocol parameters and content with the audit policy, so that the network communication that violates the security policy A system for alerting, logging and blocking. The system usually consists of a detector deployed at the mirror port of the switch for capturing and analyzing network communication packets, and a control management and data st...

AI Technical Summary

Problems solved by technology

[0005] 2) For the preprocessing stage of the message, all captured messages in the buffer need to be decoded step by step from the data link layer, network layer, transport layer, session layer, presentation layer to the application layer of the message, It also reassembles packet fragments, reassembles and buffers streams for stream-based protocols, and reassembles sessions for session-based protocols. During this process, all collected packets will be processed in these steps, which undoubtedly wastes Detects massive CPU resources and memory

At this stage, the matching and comparison of a large amount of irrelevant data wastes a lot of CPU computing resources of the detector

Images