高速网络中入侵检测的抽样方法.PDFVIP

高速网络中入侵检测的抽样方法 1，2+ 1，2 1，2 卓 , 龚 俭 ，顾文杰 1(东南大学 计算机科学与工程学院,江苏 南京 210096) 2(江苏省计算机网络技术重点实验室,江苏 南京 210096) * A Sampling Method for IDS in High Bandwidth Network Zhuo Ning1,2+, Jian Gong1,2 , Wenj ie Gu1,2 1(School of Computer Science and Technology, Southeast University, Nanjing 2 10096, China) 2(Jiangsu Provincial Key Laboratory of Computer Network Technology, Nanjing 2 10096, China) + Corresponding author : Phn : +86-25304, E-mail: zhning@, http ://nj Received 2009-02- 18; Accepted 2009-00-00 Abstract: It is well known that Intrusion Detection System (IDS) does not scale well with Gigabit links. Unlike the other solutions that try to increase the performance of IDS by the distributed architecture, we develop a novel sampling method IDSampling for backbone intrusion detection which is adaptive with the consumption of the memory bottleneck. With the help of the heuristic messages, such as the entropy of the single-packet flow and the flow length, IDSampling applies the simple sampling strategy based on the entropy of the single-packet flow when large-scale anomaly occurs, or another complicated one instructed by the feedback of the rear detection results by default. The results of experiment show that comparing with the other two overwhelming sampling methods, the Random Packet Sampling and the Random Flow Sampling, the number of attack packets sampled by IDSampling is higher one order of magnitude than that of the former two in large-scale anomaly case, so IDSampling makes IDS remain effective when it is overloaded for IDSampling can guarantee the detection accuracy of the trend information of the large-scale anomaly. Key words: intrusion detection System; Sampling; Bloom Filter; sample entropy 要: 目前入侵检测系统（IDS ）在万兆网络上的应用存在着性能和精度不平衡问题。与传统采用