【作者】 李欣；

【导师】 谷利泽；

【作者基本信息】 北京邮电大学 ， 信息安全， 2016， 硕士

【摘要】 随着计算机技术迅猛发展,互联网应用成为生产生活的关键部分,网络安全问题在高速网络时代下愈发突出和严重。基于目前的软硬件技术,传统的入侵检测系统已经无法适应高速网络下超负荷的高速流量压力。入侵检测技术的研究对于网络攻击的动态防御有着重要意义,将入侵检测技术应用到高速网络环境下也势在必行。本文对高速网络下入侵检测的研究现状进行了调研和分析,引出了应用负载均衡机制的重要意义,并对负载均衡机制的研究现状做了分析和研究。本文分析了高速网络环境下入侵检测系统面临的主要技术难题并研究了国内外的解决方案,着重介绍了现有的入侵检测模型及负载均衡相关技术。在此基础上,本文提出了一种基于正常流量过滤的负载均衡机制,设计了包含正常流量过滤和动态层次负载调度功能的负载均衡模型。该模型采用一种改进的k-means聚类算法实现正常流量过滤模块,算法动态地确定聚类数目;同时提出了“基于最小正常流量类”的在线过滤方法,通过应用基于密度权值的距离计算公式,严格地控制了正常流量的划分,更加适用于入侵检测系统的正常过滤模块。该模型同时应用动态层次负载均衡算法完成负载调度,详细地阐述了算法所应用的静态分流方式,设计了动态调度的信息策略、触发策略、对象选择策略以及负载调度策略。主要提出基于引擎配对的对象选择策略、基于性能指标和流束重hash的负载调度策略,该算法很大程度上减少了对数据流的破坏,减少系统开销的同时提高了负载均衡度。在提出改进的负载均衡机制的基础上,本文设计实现了入侵检测系统,并详细阐述了系统框架、业务流程以及流量采集、协议解析、正常流量过滤、负载均衡以及规则匹配五个核心模块的设计。根据以上提出的设计方案,本文最终实现了高速网络环境下的入侵检测系统。同时本文搭建了测试环境,并对系统的核心模块以及整个系统的性能进行了测试。通过测试实验,验证了系统设计的有效性和实用性,满足高速网络环境下的性能需求。更多还原

【Abstract】 With the rapid development of network technology and bandwidth,the network security problems in high-speed network have been more and more serious.Based on current technology of hardware and software,traditional intrusion detection systems in high-speed network environment has difficulties to adapt to the overload pressure.It is imperative to apply Intrusion detection technology to high-speed network environment.This article discusses the research in the field of intrusion detection in status of high-speed network,it leads to the importance of the application of load balancing mechanism.Based on the research of load balancing mechanism.This paper analyzes the intrusion detection system’s main technical challenges facing high-speed networks and study abroad solutions.It fully describes the existing intrusion detection model and load balancing technologies.We propose a load-balancing mechanism based on normal traffic filtering,and design a load balancing model including traffic filtering model and dynamic load balance model.This model uses a modified k-means clustering algorithm to realize a normal flow filtration module.The algorithm dynamically determines the number of clusters k to reduce the impact of the initial parameters to the clustering results.And it proposes a "minimum normal traffic" in filtration method.It applies weights based on the density to calculate the distance between clusters,strictly controls the division of normal traffic,and make it more practical to apply in intrusion detection system.The model completes load dispatch based on a dynamic hierarchical algorithm.It mainly proposes a load balance algorithm bases on performance indicators and second hash.This strategy has considerably reduced the destruction of the data stream,consuming minimal system while increasing load balancing.Based on the study of the improved intrusion detection model,the design has realized the intrusion detection system in high-speed network.It illustrates the system framework,business process and the design of the core modules in details.According to the design scheme above,this paper finally realizes intrusion detection system in high-speed network,and build a test environment,as well as the core module of the system and the function of the whole system are tested.Through the testing experiment,the system completes the function of the design,verifies the validity and practicability of the design.更多还原