Multi Layer Monitoring Function on Unauthorized Network Access Analysis Method

摘要

This paper is concerned with network security, and proposes a new network-unauthorized access analysis method. This method allows Multi Layer Monitoring (MLMon) covering OSI-7-layer model. MLMon function consists of various newly-developed modules such as: Cracking Analysis Protocol Stack (CAPS), optimized for analyzing unauthorized access on the network; Application Layer Level session Re-assemble function (ALLR); and CAPS-Application Program Interface (CAPS-API). The innovative feature of ML-Mon are 1) existing network protocols and hardware remain unchanged, and 2) enables unauthorized access analysis up to the application level. This paper describes in detail CAPS and software package called "Cracking Analyzer" that implements CAPS. CAPS is the key technology of MLMon. CAPS is a generalized protocol stack. CAPS can handle third party communications, pick out any protocol stack layer's data. Cracking Analyzer is a software that implements CAPS. Cracking Analyzer's Application Program Interface (API) is very similar to standard protocol stack's one. Using the API, many cracking analysis program is written with very a few program steps, and the program can analyze up to application layer level cracking.