IMAP (Internet Message Access Protocol) multi-link association analysis method and system

Abstract

The invention discloses an IMAP (Internet Message Access Protocol) multi-link association analysis method and system. The method comprises: 1) obtaining each data structure BODYSTRUCTURE of header information of all MIME (Multipurpose Internet Mail Extensions) blocks, which describe an entire mail, from a TCP link; 2) extracting MIME block headers from the data structure BODYSTRUCTURE, and according to locations where the MIME block headers are located, numbering the same; and 3) constructing a unique key KEYx for each MIME block header, adding the header information of the MIME blocks to a hash table, and after a TCP link transmitting MIME entities captures traffic of an MIME block entity, extracting key information from the traffic, generating a key which is consistent with KEYx, and obtaining corresponding MIME header information from the hash table according to the key KEYx. The method has more comprehensive monitoring capability, and greatly enhances efficiency in hash association.

Description

technical field [0001] The invention belongs to the technical field of computer networks, and relates to an IMAP protocol multi-link correlation analysis method and system. Background technique [0002] Some enterprises or organizations with high security requirements have strong monitoring requirements for the content transmitted on the Internet. By monitoring and auditing the traffic going in and out of the Internet, attacks or leaks can be discovered. E-mail is one of the main means for internal and external document exchange in enterprises and organizations. With the deterioration of the Internet security situation and the improvement of confidentiality awareness, more and more network monitoring systems include emails as monitoring objects and deploy them at the Internet entrances and exits of operators, governments, military, and enterprises. Usually, the network monitoring system obtains the network traffic of the internal network and the Internet through optical sp...

AI Technical Summary

Problems solved by technology

The patent application with the patent publication number CN106385358A mentions a method for checking and collecting evidence from email data packets, but the analysis of the BODYSTRUCTURE is only a passing paragraph, without explaining the analysis method, and does not support the method of data acquisition when downloading in blocks. There is no mention of the case of multi-link transfers

Images