| 摘要 |
In a Transmission Control Protocol (TCP) internet session, a stream of data packets is searched for particular strings (eg. swear words in emails) by encoding the strings using the same compression or encryption algorithm applied to the data before the search, rather than decoding the data first and then searching for the unencoded string. This allows sessions of interest to be identified efficiently, with unmatched session packets being discarded. Packets associated with eg. a particular username can be searched for without decoding and decrypting the entire data stream, allowing only those sections of interest to be selected for decoding. The data is losslessly compressed via a dynamic Huffman coding table which is transmitted as part of the data and used to match sequences in the data stream. Data may also be encrypted using a secret key. Algorithms such as Lempel Ziv LZ77 or Deflate may also be employed. The method is useful for packets having partly fixed and partly variable form, eg. webmails, which can be searched via the creation of an exemplar document. |
