基于网络负载容量的高速网络取证数据采集器的设计与实现

为了解决高速网络取证的证据完整性问题,提出了经济的可扩展模型,提出一种新的基于网络负载容量的负载均衡策略.该算法通过动态反馈和预测机制得到证据捕获端的处理能力,以一个会话为分配单位,将网络数据包分发给负载容量最大的捕获端.实验结果表明,该系统的扩展性,可以满足当前大流量网络的需求.

The design and implement of high-speed network forensics evidence collector based on network load capacity

To solve the problem on how to get the complete evidence in high-speed network forensics,this paper puts forward an economical and band widlth model and a new strategy of load balance based on network load capacity.This algorithm gets the capture ability of evidence capture by dynamic feedbace and forecast mechanism.Taking one session as a distribution unit,it distributes the network packets to the host with the maximal-load capacity.The result shows the stretchability of this system can satisfy the current...