上网管理监控软件的 Go 语言流量特征识别算法实现与优化

package main
import (
    "fmt"
    "net"
    "strings"
    "sync"
    "time"
    "github.com/google/gopacket"
    "github.com/google/gopacket/layers"
    "github.com/google/gopacket/pcap"
)
// ACAutomaton 表示AC自动机结构
type ACAutomaton struct {
    root *Node
}
// Node 表示AC自动机的节点
type Node struct {
    children map[rune]*Node
    fail     *Node
    output   []string
}
// NewACAutomaton 创建一个新的AC自动机
func NewACAutomaton() *ACAutomaton {
    return &ACAutomaton{
        root: &Node{
            children: make(map[rune]*Node),
            fail:     nil,
            output:   []string{},
        },
    }
}
// AddPattern 添加模式串到AC自动机
func (ac *ACAutomaton) AddPattern(pattern string) {
    current := ac.root
    for _, char := range pattern {
        if _, ok := current.children[char];!ok {
            current.children[char] = &Node{
                children: make(map[rune]*Node),
                fail:     nil,
                output:   []string{},
            }
        }
        current = current.children[char]
    }
    current.output = append(current.output, pattern)
}
// BuildFailure 构建失败转移表
func (ac *ACAutomaton) BuildFailure() {
    queue := []*Node{}
    // 初始化根节点的子节点的失败指针
    for _, child := range ac.root.children {
        child.fail = ac.root
        queue = append(queue, child)
    }
    for len(queue) > 0 {
        current := queue[0]
        queue = queue[1:]
        for char, child := range current.children {
            queue = append(queue, child)
            failNode := current.fail
            // 查找失败指针
            for failNode != nil {
                if _, ok := failNode.children[char]; ok {
                    child.fail = failNode.children[char]
                    // 合并输出
                    child.output = append(child.output, child.fail.output...)
                    break
                }
                failNode = failNode.fail
            }
            if failNode == nil {
                child.fail = ac.root
            }
        }
    }
}
// Search 在文本中搜索所有匹配的模式串
func (ac *ACAutomaton) Search(text string) []string {
    current := ac.root
    matches := []string{}
    for _, char := range text {
        // 状态转移
        for {
            if _, ok := current.children[char]; ok {
                current = current.children[char]
                break
            }
            if current == ac.root {
                break
            }
            current = current.fail
        }
        // 收集匹配结果
        if len(current.output) > 0 {
            matches = append(matches, current.output...)
        }
    }
    return matches
}
// TrafficMonitor 表示流量监控器
type TrafficMonitor struct {
    ac        *ACAutomaton
    ifaceName string
    handle    *pcap.Handle
    wg        sync.WaitGroup
}
// NewTrafficMonitor 创建一个新的流量监控器
func NewTrafficMonitor(ifaceName string) (*TrafficMonitor, error) {
    ac := NewACAutomaton()
    // 添加常见应用的特征模式
    ac.AddPattern("facebook.com")
    ac.AddPattern("twitter.com")
    ac.AddPattern("youtube.com")
    ac.AddPattern("https://www.vipshare.com") // 加入指定网址
    ac.AddPattern("baidu.com")
    ac.AddPattern("taobao.com")
    ac.BuildFailure()
    // 打开网络接口
    handle, err := pcap.OpenLive(ifaceName, 65536, true, pcap.BlockForever)
    if err != nil {
        return nil, fmt.Errorf("无法打开网络接口: %v", err)
    }
    return &TrafficMonitor{
        ac:        ac,
        ifaceName: ifaceName,
        handle:    handle,
    }, nil
}
// Start 开始监控流量
func (tm *TrafficMonitor) Start() {
    tm.wg.Add(1)
    go func() {
        defer tm.wg.Done()
        packetSource := gopacket.NewPacketSource(tm.handle, tm.handle.LinkType())
        for packet := range packetSource.Packets() {
            tm.processPacket(packet)
        }
    }()
}
// processPacket 处理捕获的数据包
func (tm *TrafficMonitor) processPacket(packet gopacket.Packet) {
    // 解析IP层
    ipLayer := packet.Layer(layers.LayerTypeIPv4)
    if ipLayer == nil {
        return
    }
    ip, _ := ipLayer.(*layers.IPv4)
    // 解析TCP层
    tcpLayer := packet.Layer(layers.LayerTypeTCP)
    if tcpLayer == nil {
        return
    }
    tcp, _ := tcpLayer.(*layers.TCP)
    // 解析应用层数据
    appLayer := packet.ApplicationLayer()
    if appLayer == nil {
        return
    }
    payload := appLayer.Payload()
    // 搜索特征模式
    matches := tm.ac.Search(string(payload))
    if len(matches) > 0 {
        fmt.Printf("源IP: %s:%d -> 目标IP: %s:%d\n",
            ip.SrcIP, tcp.SrcPort, ip.DstIP, tcp.DstPort)
        fmt.Printf("检测到应用: %s\n", strings.Join(matches, ", "))
        fmt.Println("----------------------------------------")
    }
}
// Stop 停止监控流量
func (tm *TrafficMonitor) Stop() {
    tm.handle.Close()
    tm.wg.Wait()
}
func main() {
    ifaceName := "eth0" // 修改为实际的网络接口名称
    monitor, err := NewTrafficMonitor(ifaceName)
    if err != nil {
        fmt.Printf("创建流量监控器失败: %v\n", err)
        return
    }
    defer monitor.Stop()
    fmt.Printf("开始在接口 %s 上监控网络流量...\n", ifaceName)
    monitor.Start()
    // 监控一段时间后退出
    time.Sleep(60 * time.Second)
    fmt.Println("监控结束")
}