Distribuované zpracování síťového provozu pro forenzní analýzu

C#, SQL, MS SQL, WCF, TCP, Cluster, Microsoft HPC Pack, HPC, Distributed Computing

Processing captured network communication creates information that is used for analysing traffic. Network traffic can result into a large capture files. Magnitude of processed data grows with the size of file. But user's memory does not have to have enough memory to process it. And when the client's application closes, all data is lost so the file has to be parsed again. Here comes the database, because it stores already parsed data. Database does not strain the RAM Memory when data are pulled by pages. Records are loaded by blocks. Application loads records by dynamically created stored procedures. Every stored procedure declares a parameter that defines type of table. When application tries to load the data, it calls the stored procedure with specified parameter. Distributed solution enables to parse the capture file on distributed system. User forwards raw frames on a cluster. Application consist of WCF services. There are two kind of services. First type of service sends frames onto a second type of services. The other kind of service is parsing the frames and loads processed data into a database.

• md README.md 6 KB