应用层并行重组在NIDS中的设计与实现  

Design and Implementation of Application Layer Parallel Reassembling in NIDS

作　　者：杨宏宇[1] 赵晓玲[2] 

机构地区：[1]中国民航学院软件技术研究中心 [2]天津大学电信学院,天津300072

出　　处：《吉林大学学报（理学版）》2006年第4期575-582,共8页Journal of Jilin University:Science Edition

基　　金：国家自然科学基金(批准号:60472125);"863"计划项目基金(批准号:2002AA142010);中国民航总局科技项目基金(批准号:MR0421815);中国民航学院科技项目基金(批准号:05YK12M);天津市智能信号与图像处理重点实验室开放项目基金

摘　　要：针对目前网络入侵检测系统在IP分片重组和TCP流重组中的不足,提出应用层协议并行重组的新方法ALPPR及其原型系统.根据报文重组的特点,采用基于LogP模型的并行处理思想和主从模式实现并行任务的分配和处理.在并行重组过程中,采用二维链表保存(例如会话列表、相应状态和任务分配结果等)关键信息.同时,该方法采用动态分配策略实现并行重组中的负载平衡.实验结果证明了ALPPR方法的可行性和有效性.A new parallel reassembly approach ——ALPPR and its prototype are presented in the light of the weakness of present Network Intrusion Detection Systems （ NIDS）, especially the procedure of IP fragments and TCP flows reassembling. We adopted an idea based on LogP model and master-slave mode to complete parallel task allocation and implementation. Some key information such as sessions and their corresponding states, operation results were saved by using a two-dimensional linked list in parallel reassembly process. Meanwhile, a dynamic allocation strategy was used to keep load balancing. Experimental results show that ALPPR has good effectiveness and high performance.

关 键 词：入侵检测 并行重组 二维链表 负载平衡 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]