基于Hadoop的分布式入侵检测系统设计与实现  

Design and Implement of Distributed Intrusion Detection System Based on Hadoop

作　　者：洪波[1] 曹子建[1] HONG Bo;CAO Zijian(School of Computer Science and Engineering,Xi＇an Technological University,Xi＇ an 710021,China)

机构地区：[1]西安工业大学计算机科学与工程学院,西安710021

出　　处：《西安工业大学学报》2018年第4期390-395,407,共7页Journal of Xi’an Technological University

基　　金：陕西省教育厅专项科研计划项目(17JK0371;17JZ004);新型网络与检测控制国家地方联合工程实验室基金(GSYSJ2016007)

摘　　要：由于传统入侵检测系统存在单点无法容错和数据处理能力不足,已无法满足日益增长的信息安全问题.文中利用分布式技术,基于Hadoop的集群运算环境和其快速存储的优势,结合MongoDB数据库,采用Java体系设计了主数据检测器、RabbitMQ采集器、收发中间件和分析中心等部件,实现了一种开源的分布式入侵检测框架.通过对CPU、MEM、TCP和网络带宽等四个指标进行监控,能较好的发现外部DDOS的攻击和入侵并提供报警服务功能.Because of the lack of single point fault tolerance and inadequate data processing capability, the traditional intrusion detection system cannot meet the increasing demand for information security. By using the distributed technology and taking advantages of Hadoop ~s cluster operation environment and rapid storage, an open source intrusion detection framework is designed, with MongoDB adopted as database. Besides, the main data detector, the RabbitMQ collector, the transceiver middleware and the analysis center are designed, respectively. Through monitoring four indicators CPU, MEM, TCP and network bandwidth, the proposed IDS framework can detect external DDOS intrusion attack and intrusion effectively and provide alarm service.

关 键 词：分布式 入侵检测 数据处理 HADOOP 监控 

分 类 号：TN99[电子电信—信号与信息处理]