One-way flow detection method and network equipment

Abstract

The invention discloses a one-way flow detection method and network equipment. A message is analyzed according to protocol stack information in synchronizing information which is sent by other network equipment in receiving detection system. And the application-layer data in the synchronizing information of the message is combined with application-layer data in the synchronizing information which is sent by the other network equipment, so that a file is obtained. If the message is the last message in the file, security detection can be carried out on the file. If the message is not the last message in the file, the synchronizing information of the message can be sent to the other network equipment so that the other network equipment can detect the file according to the synchronizing information of the message, and therefore the security detection based on agent technology to one-way flow is achieved.

Description

Technical field [0001] The invention belongs to the field of safety detection, and particularly relates to a detection method and network equipment for unidirectional flow. Background technique [0002] Currently, in the hardware security market, anti-virus (Anti-Virus, AV) or data leakage prevention (DataLoss, DLP) functions that implement content security detection have become essential security functions for UTM or other network security devices. Since AV or DLP and other features themselves mainly operate on files, if they operate on part of the file instead of the entire file each time, the detection rate of the feature will be greatly affected. On this basis, proxy technology emerged. [0003] The proxy can make the network device act as an intermediary, cache all the file content in the message, and perform security inspection after the entire file is restored, which can significantly improve the detection rate. [0004] The existing proxy technology relies on the kernel mod...

AI Technical Summary

Problems solved by technology

[0004] The existing proxy technology relies on the kernel mode protocol stack function provided by the host operating system. To reach the application program, the message needs to be copied many times, which is a huge overhead in terms of performance.

At the same time, all the information required by the link is fully maintained by the operating system kernel, and the application cannot do any intervention

[0005] The disadvantage brought by the maintenance of link information by the operating system kernel is that all messages must pass through the operating system kernel in order to realize the normal maintenance of link information to form a complete file content

If a message in the file is forwarded from other paths without being processed by the kernel, the file will lose packets due to inconsistency in the link information, and eventually the link of the file will be interrupted, and the complete file content cannot be formed.

Therefore, none of the existing proxy technologies support one-way traffic inspection

Images