HTTP (hyper text transport protocol)-based network packet reduction method

Abstract

The invention relates to a network application protocol analytical method. Based on a TCP (transmission control protocol) session data stream recombination algorithm, the invention provides an HTTP (hyper text transport protocol)-based network data packet reduction method according to the analysis and design of the network application protocol and related content characteristics thereof and the individualization. On the basis of the basic network data packet reduction algorithm, data submitted by a post method in the HTTP protocol is judged whether to be sent completely by adding a Content-Length value, thus the preparation works before the complication of the HTTP-based network data packet are simplified, the bottleneck of the content analysis in a high flow environment can be effectively solved, and the analytical efficiency and accuracy of parts of the submitted data in the application of the world wide web can be improved. By using the algorithm, the reduction of the HTTP data can be completed without considering tcp (transmission control protocol) response messages, thus the reconstruction and reduction procedures of the network data streams can be greatly simplified, thereby reducing the system loads effectively and accelerating the data processing speed.

Description

technical field

[0001] The invention relates to a method for analyzing network application protocols, in particular to a method for restoring network data packets based on http. Background technique

[0002] With the development of computer networks, network applications are also increasing, especially the application of the World Wide Web, which has accounted for 90% of Internet traffic. People have paid more and more attention to the security of World Wide Web information. The http protocol of the protocol is the basis. When bad information such as pornography, violence and superstition are transmitted on the Internet, it will affect people's physical and mental health and social unity. The restoration of these harmful information and bad information at the application layer can clearly know the information transmitted by the information. Blocking and monitoring have very intuitive effects, which can help network administrators better monitor the network. The existing ht...

Examples

Embodiment

[0054] Embodiment: Restoration of a complete piece of information transmitted through the post method of the http protocol. By analyzing the post method of the http protocol, the effective total length of the transmitted information is content-length=1400byte. Let the total length of the obtained message be length.

[0055] 1. Obtain packet1 with seq1=1, len1=100. Put packet1 into the normal packet queue. length=length+len1=100. length<content-length, the data is not yet transmitted.

[0056] 2. Obtain packet2 with seq2=101, len2=150. Judging that seq2==seq1+len1, packet2 is exactly the expected follow-up packet of packet1. Put packet2 into the normal packet queue. length=length+len2=250. length<content-length, the data is not yet transmitted.

[0057] 3. Obtain packet3 with seq3=200 and len3=40. Judging that seq2<seq3<seq2+len2-1, the data segment of packet3 is repeated with the data segment 200-239 of the normal message queue. Do not process this message.

[0058]...

technical field

[0001] The invention relates to a method for analyzing network application protocols, in particular to a method for restoring network data packets based on http. Background technique

[0002] With the development of computer networks, network applications are also increasing, especially the application of the World Wide Web, which has accounted for 90% of Internet traffic. People have paid more and more attention to the security of World Wide Web information. The http protocol of the protocol is the basis. When bad information such as pornography, violence and superstition are transmitted on the Internet, it will affect people's physical and mental health and social unity. The restoration of these harmful information and bad information at the application layer can clearly know the information transmitted by the information. Blocking and monitoring have very intuitive effects, which can help network administrators better monitor the network. The existing ht...

Examples

Embodiment

[0054] Embodiment: Restoration of a complete piece of information transmitted through the post method of the http protocol. By analyzing the post method of the http protocol, the effective total length of the transmitted information is content-length=1400byte. Let the total length of the obtained message be length.

[0055] 1. Obtain packet1 with seq1=1, len1=100. Put packet1 into the normal packet queue. length=length+len1=100. length<content-length, the data is not yet transmitted.

[0056] 2. Obtain packet2 with seq2=101, len2=150. Judging that seq2==seq1+len1, packet2 is exactly the expected follow-up packet of packet1. Put packet2 into the normal packet queue. length=length+len2=250. length<content-length, the data is not yet transmitted.

[0057] 3. Obtain packet3 with seq3=200 and len3=40. Judging that seq2<seq3<seq2+len2-1, the data segment of packet3 is repeated with the data segment 200-239 of the normal message queue. Do not process this message.

[0058]...