高速网络入侵检测系统中基于Hash函数的分流算法  

Diffluent algorithm based on hash function of high-speed network intrusion detection system

作　　者：杨锋[1] 钟诚[1] 尹梦晓[1] 

机构地区：[1]广西大学计算机与电子信息学院,广西南宁530004

出　　处：《计算机工程与设计》2009年第2期321-323,共3页Computer Engineering and Design

基　　金：广西科学基金项目(桂科自0339008);广西大学科研基金项目(X071105)

摘　　要：如何使入侵检测系统能适用于高速网络环境,成为当今入侵检测领域急需解决的技术难题。结合机群系统,提出一种基于散列函数的分流算法,将高流量数据流通过该分流算法分为多个数据流,交由机群系统中各节点上的IDS分析引擎处理。实验结果表明,该算法保证同一连接的所有数据报文由同一IDS分析引擎处理,在高速网络环境下保持高检测率,并有效地解决负载平衡问题。It is difficult that intrusion detection system run on high-speed network. The diffiuent algorithm based on hash function is presented by applying the cluster system. It divides high traffic into several data stream, and sends them to IDS analysis engines of the cluster system. The test results show that the algorithm can ensure that all data messages from the same connection are sent to the same IDS analysis engines and keep high detection rate on high-speed network and keep load balancing effectively.

关 键 词：入侵检测 机群系统 散列函数 负载平衡 分流算法 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]