The system analyzes the acquired traffic protocol, restores the session, obtains samples, compares file characteristics and behavior characteristics through analysis module, and completes blocking or redirecting malicious traffic according to the flow monitoring
