基于云计算架构的网络入侵协同预警技术  

Collaborative Warning Technology Against Network Intrusions Based on Cloud Computing Architecture

作　　者：许佳[1] 苏璞睿[2] 符易阳[1,3] 

机构地区：[1]江南计算技术研究所,江苏无锡214083 [2]中国科学院软件研究所信息安全国家重点实验室,北京100049 [3]北京大学信息科学技术学院,北京100871

出　　处：《计算机工程》2013年第6期21-27,33,共8页Computer Engineering

基　　金：国家"863"计划基金资助项目(2009AA01Z435)

摘　　要：目前主流的网络预警系统普遍存在自适应性差和协同分析能力弱等问题。为此,提出一种基于云计算架构的大规模网络入侵协同预警技术,采用基于分布式哈希表的分布式报警消息存储和查询算法,利用树状对等覆盖网实现入侵关联分析的自适应任务调度。实验结果表明,使用该技术实现报警聚合和关联分析,不仅能使网络预警系统架构具备较好的扩展性,并且可以缩短大规模网络入侵的预警反应时间,同时保证报警关联分析的准确度。Current prevalent network warning systems generally lack of ability of self-adaption and collaborarive analysis. A collaborative warning technology against massive network invasions is proposed, which is based on cloud computing architecture. This technology implements the global sharing of network intrusion alerts using distributed hash table, and adopts a tree-structured Peer-to-Peer（P2P） overlay, so that the task scheduling of intrusion correlation can be handled in a self-adaptive way. Experimental results based on a proof-of-concept prototype system demonstrate that, the alert aggregation and correlation through this technology, not only make the architechture of network warning system highly scalable, but also remarkably reduce the reaction time of warning against massive network intrusions without degradation in accuracy.

关 键 词：大规模入侵 协同预警 云计算 分布式调度 报警关联 

分 类 号：TP391[自动化与计算机技术—计算机应用技术]