Restoration and audit of Internet e-mail based on TCP stream reassembling

Abstract

With the ceaseless development of Internet/intranet application, Internet e-mail has become one of the most important ways for people and enterprises to communicate with each other. However, in enterprises, a great deal of sensitive data, such as product reports, statistic data, may be divulged through the mail system by the provocateur. So, checking the outgoing e-mail is an effective means to protect sensitive data in the enterprises. As a network application service, the e-mail is based on simple mail transfer protocol (SMTP). According to some defects exists in mail checking system nowadays, the technology of TCP stream reassembling is proposed to restore the whole e-mail text and attachment in this paper, and audit the completed e-mail file using MIME standard and improved pattern match algorithm. Finally, the framework of implementation is illustrated using Win Pcap library.