Network flow analysis and file extraction system and method

Abstract

The invention discloses a network flow analysis and file extraction system. The system comprises a flow capture module, a flow preprocessing module, a protocol statistics module, a protocol analysis module and a file extraction module. Under the condition that normal communication flow of an enterprise is not influenced, communication flow between the enterprise and a public network can be captured, flow of different IPs and different protocols is counted, transmitted files are extracted in real time, and file content is written into a disk.

Description

technical field

[0001] The invention relates to a method for realizing network traffic analysis and file extraction, in particular to a method for extracting files transmitted in network traffic in a high-bandwidth network environment, and belongs to the technical field of computer network security. Background technique

[0002] With the continuous development of computer communication technology, network security is receiving more and more attention. For enterprises, if malicious software invades the intranet and leaks sensitive data of the enterprise, it will cause huge losses. In a complex traffic environment, how to effectively identify malicious traffic has gradually become an increasing concern of many enterprises. Traditional network protection often only analyzes network traffic data packets to detect whether they contain some malicious features, thereby preventing malicious traffic from connecting to the corporate intranet. However, this method cannot perform fine...

Images