高速网络环境下的网络入侵检测系统的研究  

Research on network intrusion detection of high-speed network

作　　者：刘学波[1] 孟丽荣[1] 

机构地区：[1]山东大学计算机科学与技术学院,山东济南250062

出　　处：《计算机工程与设计》2005年第5期1236-1238,共3页Computer Engineering and Design

摘　　要：高速网络环境下的入侵检测是一个新的研究方向。基于负载均衡技术和协议分析技术,提出了一个能够应用在高速环境下的网络入侵检测系统。负载均衡技术把在前端捕获的高速数据流进行分化,以利于后端处理;协议分析技术利用网络协议的层次性和相关协议的知识快速地判断攻击特征是否存在。基于代理的分布式体系结构,增强了系统的可扩展性,提高了系统的检测效率。Intrusion detection of high-speed network is a newly developed area. Based on load balance technology and protocol analysis technology, a network intrusion detection system is designed which can be applied in high-speed network. Load balance technology dispatches the high-speed data stream captured so the IDS can process it easily. By using knowledge of the network protocol, protocol analysis technology can quickly determine whether attack happens. The distributed architecture based on agents improves the scalable ability and detective efficiency of the system.

关 键 词：网络入侵检测 负载均衡 协议分析 代理 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]