【摘要】 入侵检测技术是维护网络安全的一种重要手段。为了克服现有入侵检测系统在处理速度上的不足,该文提出了一种基于网络处理器和处理机群的高速入侵检测系统结构。重点讨论如何采用网络处理器实现系统中的流量分配器。对网络处理器的多线程数据采集、流量分配两个算法作了详细的分析。研究结果表明,经过算法优化,采用网络处理器IXP 1200实现的流量分配器可以完成1 G b.-s 1以上数据的实时采集,基于目的媒体接入控制(M AC)地址的转发策略在维护信息完整性和降低处理复杂度两方面体现了很好的折中,达到了合理的流量分配。更多还原

【Abstract】 Intrusion detection technology is an indispensable way to protect the network security.This paper presents a high-speed intrusion detection system(IDS framework based on network processor and detection cluster.Two hardware algorithms were developed for the traffic distributor.One is the high-speed data-receiving program with the IXP1200 network processor,while the other is the load balance policy based on the destination media access control(MAC address.Tests show that the first algorithm achieves more than(1 Gb/s data-capturing ability,while the second algorithm is a satisfactery trade-off between protecting information integrity and reducing computational complexity.更多还原