基于DPDK的入侵检测系统研究与应用  

Research and Application of Intrusion Detection System Based on DPDK

作　　者：阳亦斌 欧盛芬 杨将 Yang Yibin;Ou Shengfen;Yang Jiang(Hunan CRRC Times Communication Signal Co.,Ltd.,Changsha 410119,China)

机构地区：[1]湖南中车时代通信信号有限公司,长沙410119

出　　处：《铁路通信信号工程技术》2020年第11期1-7,12,共8页Railway Signalling & Communication Engineering

基　　金：中国铁路总公司科研项目重点课题(2017X012-I)。

摘　　要：LKJ系统作为干线铁路机车关键列控车载设备,因LKJ数据换装涉及到列控行车安全,基于公共移动通信网络的LKJ车载数据无线换装系统(简称换装系统)应从总体层面进行网络安全防护设计,利用传统的Snort入侵检测技术等诸多网络安全应用产品,其防御功能已经逐渐跟不上越来越高速的网络流量。考虑到LKJ数据换装业务机车数量庞大,同时并发性换装数据流量大,对基于DPDK的入侵检测系统进行研究,在传统的Snort入侵检测系统上,将Snort的D A Q模块进行扩展,以达到快速识别和分析数据包,并快速作出相应反馈的目的。最后比较传统Snort入侵检测与基于DPDK的Snort入侵检测数据处理性能,可以看到加入DPDK后性能有显著的提升,高效保障来自系统外部的危险攻击。LKJ system is the key train control on-board equipment of main railway locomotives.Because LKJ data replacement involves the safety of train control operation,LKJ on-board data wireless reloading system based on public mobile communication network(hereinafter shortened as reloading system)shall be designed for the network security protection from the overall level.Using the traditional Snort Intrusion Detection Technology and many other network security application products,its defense function has been unable to keep pace with the increasing speed of network traffic.Considering the large number of the locomotives with LKJ data reloading service and the large concurrent data traffi c,this paper studies the intrusion detection system based on DPDK.In the traditional Snort Intrusion detection system,the DAQ module of Snort is extended to quickly identify and analyze data packets,and quickly make corresponding feedback.Finally,by comparing the data processing performance of traditional Snort Intrusion Detection and Snort Intrusion Detection based on DPDK,we can see that the performance has been signifi cantly improved after adding DPDK,which can effectively protect against the dangerous attacks from outside the system.

关 键 词：入侵检测系统 DPDK SNORT LKJ 数据换装 

分 类 号：U28[交通运输工程—交通信息工程及控制]