基于网络处理器的入侵检测方法  

Intrusion Detection Methods Based on Network Processor

作　　者：魏利华[1] 张晓明[2] 唐玉华[2] 孙志刚[2] 

机构地区：[1]浙江嘉兴学院信息工程学院,嘉兴314001 [2]国防科技大学计算机学院,长沙410073

出　　处：《计算机工程》2006年第7期160-162,共3页Computer Engineering

基　　金：国家"863"高技术基金资助项目(2003AA115130)

摘　　要：入侵检测是网络安全的核心技术。随着网络速度的不断提升,现有NIDS的检测速度已不适应千兆位以上网络,漏检率和误检率越来越高。网络处理器以高度并行、硬件多线程、多级存储和灵活可编程等先进技术提供高速的数据包处理性能。该文对利用网络处理器解决入侵检测的速度瓶颈提出了观点、方法和策略,设计和实现了一个面向入侵检测的高速网络处理器原型。Intrusion detection is a dynamic core technology in network security. With the ever-increasing wire-speed and packets dropping and false positive the existed NIDS doesn＇t fit for high-speed network any longer. Network processor can analyze packets in parallel mode and shorter inner latency by using hardware threads, multi-level memories, and obtain flexibility by using programmable components. This paper builds a validate high-speed platform for intrusion detection and achieves much good approaches, methods and ideas to overcome the speed bottleneck in current IDS.

关 键 词：网络处理器 入侵检测 多级并行 硬件线程 调度策略 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]