摘要
针对目前网络入侵检测系统在IP分片重组和TCP流重组中的不足,提出应用层协议并行重组的新方法ALPPR及其原型系统.根据报文重组的特点,采用基于LogP模型的并行处理思想和主从模式实现并行任务的分配和处理.在并行重组过程中,采用二维链表保存(例如会话列表、相应状态和任务分配结果等)关键信息.同时,该方法采用动态分配策略实现并行重组中的负载平衡.实验结果证明了ALPPR方法的可行性和有效性.
A new parallel reassembly approach ——ALPPR and its prototype are presented in the light of the weakness of present Network Intrusion Detection Systems （ NIDS）, especially the procedure of IP fragments and TCP flows reassembling. We adopted an idea based on LogP model and master-slave mode to complete parallel task allocation and implementation. Some key information such as sessions and their corresponding states, operation results were saved by using a two-dimensional linked list in parallel reassembly process. Meanwhile, a dynamic allocation strategy was used to keep load balancing. Experimental results show that ALPPR has good effectiveness and high performance.
出处
《吉林大学学报（理学版）》
CAS
CSCD
北大核心
2006年第4期575-582,共8页
Journal of Jilin University:Science Edition
基金
国家自然科学基金(批准号:60472125)
"863"计划项目基金(批准号:2002AA142010)
中国民航总局科技项目基金(批准号:MR0421815)
中国民航学院科技项目基金(批准号:05YK12M)
天津市智能信号与图像处理重点实验室开放项目基金
关键词
入侵检测
并行重组
二维链表
负载平衡
intrusion detection
parallel reassembling
two-dimensional linked list
load balance
