Abstract: The traditional algorithms for packets-based pattern matching are unable to meet the needs of the network behavior management system if data packets flow through the network in TCP streams. After presenting an efficient algorithm for restructuring TCP session streams, this paper discusses detailedly solution to the problems appeared in multiple connection management, repeatable message processing, out-of order message processing and etc. Finally, we implement the interception and analysis of data packets complying to the FTP protocol by means of the algorithm. Comparing with the Libnids library, the experimental results demonstrates that our algorithm is more efficient and stable.