论文部分内容阅读
为了在更高带宽的网络中进行有效的入侵检测分析,研究了入侵检测中的数据获取技术,提出了一种可扩展的高效入侵监测框架SEIMA(scalable efficient intrusion monitoring architecture).在SELMA结构模型中,通过将高效网络流量负载分割器与多个并行工作的入侵检测传感器相结合,从而可以将入侵检测扩展应用到更高的网络带宽中;通过使用高效地址翻译技术和缓冲区管理机制实现了旁路操作系统的高性能用户级网络报文传输模型,以便提高单传感器的报文处理性能;通过采用有限自动机的方法构建了基于用户层的多规则报文过滤器以消除多余数据包的处理开销.模拟环境和实际环境下的测试结果表明,SEIMA在提高网络入侵检测系统数据获取效率的同时,能够降低系统CPU的利用率,从而可以将更多的系统资源用于更复杂的数据分析过程.
In order to carry out effective intrusion detection and analysis in higher bandwidth networks, the data acquisition technology in intrusion detection is studied, and a scalable efficient intrusion monitoring architecture (SEIMA) is proposed. In the SELMA structural model By combining an efficient network traffic load splitter with multiple intrusion detection sensors that work in parallel, intrusion detection extensions can be applied to higher network bandwidths; by using efficient address translation and buffer management mechanisms, Road operating system high-performance user-level network packet transmission model in order to improve single sensor packet processing performance; through the use of finite automata method based on the user-level multi-rule packet filter to eliminate unnecessary packet processing Overhead Simulation results show that SEIMA can reduce system CPU utilization while improving data acquisition efficiency of network intrusion detection system so that more system resources can be used for more complicated data analysis process .