大型分布式入侵检测系统  

Broad-scale distributed intrusion detection system

作　　者：杨瑞增 陈天鹰 李玉盼[3] Yang Ruizeng;Chen Tianying;Li Yupan(National Computer System Engineering Research Institute of China,Beijing 100083,China;Graduate School,China Academy of Railway Sciences,Beijing 100081,China;Beijing Jiaotong University,Beijing 100044,China)

机构地区：[1]华北计算机系统工程研究所,北京100083 [2]中国铁道科学研究院研究生院,北京100081 [3]北京交通大学,北京100044

出　　处：《信息技术与网络安全》2020年第7期31-35,共5页Information Technology and Network Security

摘　　要：提出一种大型分布式入侵检测系统(Broad-scale Distributed Intrusion Detection System,BDIDS)的体系结构,以发现多手段多层次的攻击。这些攻击是分布式网络中多个子网之间存在的异常现象。BDIDS由两个关键组件组成:大数据处理引擎和分析引擎。大数据处理是通过HAMR完成的,HAMR是下一代内存MapReduce引擎。据报告,HAMR通过多种分析算法,使得现有大数据解决方案的速度大大提高。分析引擎包括一种新颖的集成算法,该算法从多个IDS警报的集群中提取训练数据。基于聚类与已知潜在攻击的高度相似性,将聚类用作预处理步骤以重新标记数据集。总体目标是预测分布在多个子网中的多手段多层次的攻击,这些攻击手段如果不以综合方式进行评估,极有可能会被忽略。In this paper,a large-scale distributed intrusion detection system(broad-scale distributed intrusion detection system,BDIDS)architecture is proposed to discover multi-level and multi-means attacks.These attacks are anomalies that exist between multiple subnets in a distributed network.BDIDS consists of two key components:big data processing engine and analysis engine.Big data processing is done through HAMR,which is the next-generation in-memory MapReduce engine.According to reports,HAMR has greatly improved the speed of existing big data solutions through various analysis algorithms.The analysis engine includes a novel integrated algorithm that extracts training data from a cluster of multiple IDS alerts.Based on the high similarity between clustering and known potential attacks,clustering is used as a preprocessing step to relabel the data set.The overall goal is to predict multi-method,multi-level attacks distributed in multiple subnets.If these attacks are not evaluated in a comprehensive manner,they will most likely be ignored.

关 键 词：大数据 分布式入侵检测系统 集成学习 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]