学会官网  |  加入学会  |  登录学会  |  English 

电子学报 ›› 2012, Vol. 40 ›› Issue (3): 530-537.DOI: 10.3969/j.issn.0372-2112.2012.03.020

• 学术论文 • 上一篇    下一篇

利用流量特征的GIDS报文分类优化算法

宁卓1, 孙知信1,2, 龚俭3, 张维维3   

  1. 1. 南京邮电大学宽带无线通信与传感网技术教育部重点实验室,江苏南京 210003;2. 南京大学计算机软件新技术国家重点实验室,江苏南京 210093;3. 东南大学 计算机科学与工程学院,江苏南京 210096
  • 收稿日期:2011-06-22 修回日期:2011-12-14 出版日期:2012-03-25
    • 基金资助:
    • 国家863高技术研究发展计划 (No.60973140,No.61170276); 江苏省自然科学资金 (No.BK2009425); 南京邮电大学引进人才科研启动基金 (No.NY210081)

An Improved GIDS Packet Classification Algorithm Using the Characteristic of the Traffic

NING Zhuo1, SUN Zhi-xin1,2, GONG Jian3, ZHANG Wei-wei3   

  1. 1. Key Laboratory of Broadband Wireless Communication and Sensor Network Technology of Ministry of Education, Nanjing University of Posts and Telecommunications,Nanjing,Jiangsu 210003,China;2. State Key Laboratory for Novel Software Technology,Nanjing University,Nanjing,Jiangsu 210093,China;3. School of Computer Science and Technology,Southeast University,Nanjing,Jiangsu 210096,China
  • Received:2011-06-22 Revised:2011-12-14 Online:2012-03-25 Published:2012-03-25

PDF

摘要： 本文结合流量的动态特征和入侵检测系统规则库的静态特征生成高性能报文分类树,提出了一个新的面向骨干网高速入侵检测的报文分类算法FlowCopySearch(FCS).改进在于:①从流量的新角度提出了最优分类树定义并引入分类域熵衡量每个分类域对于流量的分类能力;②将传统分类算法中每个报文都必须频繁执行的内存拷贝操作简化为每个流只执行一次内存拷贝操作,克服了报文分类算法的瓶颈.实验结果表明FCS更适用于骨干网大流量trace的报文分类,较之两种经典分类算法,分类速度提高了10.1%~45.1%,同时存储消耗降低了11.1%~36.6%.

关键词: 入侵检测系统, 属性熵, 重尾分布特性

Abstract: A classification algorithm FlowCopySearch (FCS) is developed that systematically profiles static intrusion signatures and network traffic to generate a high performance and memory-efficient packet classification tree.The improvements are two folds.Firstly,the best classification tree is formally defined and packet feature entropy is proposed to measure how well a packet field can partition the traffic.Secondly,FCS copies a rule set for a flow instead of traditionally copying the rule set for every packet in the flow,so the classifying speed is increased considerably.The experiment results show that in backbone trace FCS is preferred.Compared to the other two classical algorithms,FCS can not only speed up classification by as much as 10.1%~45.1% in speed,but also save memory consumption of 11.1%~36.6% at the same time.

Key words: intrusion detection system, packet feature entropy, heavy hitter

中图分类号: 

京ICP备12041980号-1　版权所有 ©《电子学报》编辑部