利用流量特征的GIDS报文分类优化算法  

An Improved GIDS Packet Classification Algorithm Using the Characteristic of the Traffic

作　　者：宁卓[1] 孙知信[1,2] 龚俭[3] 张维维[3] 

机构地区：[1]南京邮电大学宽带无线通信与传感网技术教育部重点实验室,江苏南京210003 [2]南京大学计算机软件新技术国家重点实验室,江苏南京210093 [3]东南大学计算机科学与工程学院,江苏南京210096

出　　处：《电子学报》2012年第3期530-537,共8页Acta Electronica Sinica

基　　金：国家863高技术研究发展计划(No.60973140;No.61170276);江苏省自然科学资金(No.BK2009425);南京邮电大学引进人才科研启动基金(No.NY210081)

摘　　要：本文结合流量的动态特征和入侵检测系统规则库的静态特征生成高性能报文分类树,提出了一个新的面向骨干网高速入侵检测的报文分类算法FlowCopy Search(FCS).改进在于:①从流量的新角度提出了最优分类树定义并引入分类域熵衡量每个分类域对于流量的分类能力;②将传统分类算法中每个报文都必须频繁执行的内存拷贝操作简化为每个流只执行一次内存拷贝操作,克服了报文分类算法的瓶颈.实验结果表明FCS更适用于骨干网大流量trace的报文分类,较之两种经典分类算法,分类速度提高了10.1%～45.1%,同时存储消耗降低了11.1%～36.6%.A classification algorithm FlowCopySearch（FCS） is developed that systematically profiles static intrusion signatures and network traffic to generate a high performance and memory-efficient packet classification tree.The improvements are two folds.Firstly,the best classification tree is formally defined and packet feature entropy is proposed to measure how well a packet field can partition the traffic.Secondly,FCS copies a rule set for a flow instead of traditionally copying the rule set for every packet in the flow,so the classifying speed is increased considerably.The experiment results show that in backbone trace FCS is preferred.Compared to the other two classical algorithms,FCS can not only speed up classification by as much as 10.1%～45.1% in speed,but also save memory consumption of 11.1%～36.6% at the same time.

关 键 词：入侵检测系统 属性熵 重尾分布特性 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]