A Real-time Lossless Network Stream Reassembly Mechanism

With network intrusion and crime means becoming complex and diverse, the traditional packet feature matching cannot detect intrusion behavior completely. So it is urgent to reassemble network stream for analyzing network traffic more deeply. In this paper, we present a real-time and lossless network stream reassembly mechanism. First we detailedly explain the design policies of reassembly mechanism, and describe the reassembly implementation procedure. Several applicable search methods are discussed, and their performances are contrasted by experiment results. Finally we evaluate the real-time and lossless properties of the reassembly mechanism with network stream in typical network environment. Experiment results illustrate that the reassembly mechanism can satisfy application requirements.