高速环境下入侵检测系统设计  

Intrusion Detection System for High-speed Networks

作　　者：张玉军[1] 李忠诚[1] 田野[1] 于东[1] 

机构地区：[1]中国科学院计算技术研究所,北京100080

出　　处：《微电子学与计算机》2004年第3期25-28,80,共5页Microelectronics & Computer

摘　　要：高速网络的出现对网络入侵检测系统的处理能力带来了挑战。在分析了影响入侵检测系统性能因素的基础上,文章提出了高速环境下入侵检测系统的设计和应用架构。采用了中央控制下的并行和分布式共存的负载均衡设计、数据存储和分析系统独立运行、多层次阻断手段结合的技术来提升入侵检测系统性能。实现了原型系统,并且对原型系统的部分指标进行了测试,验证了本文提出的入侵检测系统设计架构的有效性。High-speed networks bring challenge for network intrusion detection system (abbreviated by IDS). Based on analyzing the factors that affect the performance of IDS, a new design and application framework of IDS for high-speed networks is proposed. Three new mechanisms are designed and used to upgrade IDS performance, which are load balancing of parallel and distributed combination with centralized-control, independent datum storing and analyzing from detection process, the combination of multiple interrupting methods. The prototype system is implemented and its processing ability is tested, which validates the validity of the new IDS framework.

关 键 词：入侵检测系统 网络安全 负载均衡 信息安全 防火墙 计算机网络 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]