《基于MapReduce并行计算模型的报警聚合算法》.pdfVIP

: TP393. 08 : A : 1009 - 2552( 2011) 04 - 00 85 - 04 M apR educe 白浩泉, 姚立红, 陆松年 ( , 200240) : 随着网络攻击以及网络流量的飞速增长, 分析入侵检测系统产生的海量报警信息越 越困难M apR edu ce 是由 Google提出的一 个软件架构, 用于大规模数据集 ( 大于 1TB ) 的并行 运算, 提出了一种基于M apR educe并行计算模型的报警聚合算法, 用于执行高效的报警归并 最后使用 DARPA 2000 数据集, 验证了本算法可以高效地聚合报警信息, 大量减少冗余报警 数量 : M apR educe An alert aggregation algorithm based onM apReduce Parallel computing m odel BA I H ao-qu an, YAO L i-h ong, LU Song-n ian ( Shanghai K ey Laboratory of Integrate Adm in istration T echnologies for Information Secur ity, Shanghai 200240, Ch ina Ab stract: W ith the rap id grow th of v iruses, newt ork attack s and the network traffic, analyzing the huge log and alert inform ation generated by intru sion detect ion system wou ld face the increasing ch allenges. The M apR edu ce programm ing m odel is in sp ired by Goog le and targets data- intensive parallel computations. The pap er presents and mi plem ents a h igh-p erform ance alert agg regat ion a lgorithm b ased on M apR educe parallel com puting m odel. T he exp ermi ent results on the DARPA 2000 dataset show ed th at th is a lgorithm is effective and efficient. Key words: in trusion detection system a lert aggregation M apR edu ce paralle l computing 0 引言 1 报警聚合过程 ( Intrusion D etection System, IDS) ID S , , ID S : ID S : , , ( 1)( IP ) , ( 2) ,