混网网络结构下最优入侵目标检测软件设计与实现.docVIP

混网网络结构下最优入侵目标检测软件设计与实现 　　摘 要： 传统网络入侵目标检测方法存在漏报率高和对不确定入侵数据检测性能弱的缺陷，无法胜任混网网络安全检测的需要。针对混网网络结构特征，设计并实现了最优入侵目标检测软件，该软件包括负载均衡模块、误用检测模块、匹配算法自适应模块，并采用多核网络处理器的多个同构核当成混网入侵检测引擎。通过自适应多模式匹配模型，基于混网网络的状态、特征动态对模式匹配算法进行动态调控，确保入侵目标检测引擎的利用率最大化。该匹配模型包括规范预操作过程、流量检测过程以及动态调控过程。给出了混网网络结构下的数据包多核处理过程以及匹配算法的优化代码。实验结果说明，所设计入侵检测软件可实现混网下入侵目标的有效检测，具有较高的检测性能。 　　关键词： 混网网络； 最优入侵目标； 检测； 软件 　　中图分类号： TN911?34 文献标识码： A 文章编号： 1004?373X（2015）24?0079?04 　　Design and implementation of optimal detection software for intrusion objects in 　　hybrid network structure 　　GAO Xiaohu 　　（Jiangsu Vocational College of Business， Nantong 226011， China） 　　Abstract： The traditional network invasion detection method can not satisfy the demands of the mixed network safety detection due to its high non?response rate and weak detectability for uncertainty intrusion data. In view of the hybrid network structure characteristics， the optimal detection software for intrusion objects was designed. Thr software consists of load balancing module， misuse detection module and matching algorithm self?adaptive module. The multiple isomorphic cores of multi?core network processor is used in it as the engine of the hybrid network intrusion detection. By adaptive multiple pattern matching model， the dynamic caontrol of pattern matching algorithm is performed based on the state and characteristic dynamic state of the mixed network， and the maximum utilization of intrusion detection engine is guaranteed. The matching model includes the pre?operation process of the specification， the flow detection process and the dynamic regulation process. The multi?core treating process of data packet and the optimized code of matching algorithm are presented. The experiment result shows that the designed intrusion detection software can realize the effective detection of intruder in hybrid network and has high detection performance. 　　Keywords： mixed network； optimal invasion goal； detection； software 　　0 引 言 　　随着网络技术的快速发展，网络安全问题逐渐受到关注。当前的网络环境