一种异步日志记录的入侵防御系统的设计与实现  

Design and Implementation of an Asynchronous Logging Intrusion Prevention System

作　　者：艾磊[1] 陈文[1] 

机构地区：[1]四川大学计算机学院,四川成都610065

出　　处：《计算机安全》2014年第3期2-6,共5页Network & Computer Security

摘　　要：传统的入侵防御系统对于告警日志的记录采取同步的方式,即在整个数据包获取、数据包预处理、数据包检测、数据包处理以及日志记录的过程中,数据包获取会以同步阻塞的方式等待日志记录完成后才会再次循环进行,因此在整个系统运行过程中产生了大量的I/O操作,在高速复杂的网络环境下成为入侵防御系统的主要性能瓶颈。针对以上问题,设计并实现了一种异步记录告警日志的入侵防御系统(an Asynchronous Logging Intrusion Prevention System,ALIPS),并应用多核技术进行并行处理,通过测试,相比传统入侵防御系统,本系统在吞吐量上有着3倍多的提高。Traditional intrusion prevention system takes a synchronized method to log alarms, which is in the entire packet capturing, packet pre processing, packet parsing, packet inspecting, packet processing and alarm logging process, the packet capturing will not go on until alarm logging is over, resulting in a major performance bottleneck which is a large number of I/O operation happen in the intrusion prevention system which is running at high speed complex network environment. To solve this problem, this paper designs and implements an Asynchronous Logging Intrusion Prevention System （ALIPS）, and uses a multi--core parallel processing technology in it. Though the test, compared to the traditional intrusion prevention system, this system＇ s throughput has more than three times improved.

关 键 词：入侵防御系统 异步日志记录 多核并行处理 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]