基于半轮询驱动的网络入侵检测单元的设计与实现

Design and implementation of network intrusion detection unit based on semi-polling driven

在分析了网络入侵检测系统主要问题的基础上,设计并实现了一个面向网络的入侵检测单元NIDU。由于采用对等式架构,NIDU具有良好的可扩展性。提出了半轮询驱动的概念,利用半轮询驱动机制降低了系统中断频率,明显提高数据采集能力;同时采用基于相关度的异常检测技术,对DoS和DDoS攻击的检测效果较现有方法有明显改善。

A network intrusion detection unit based on semi-polling driven (NIDU) was designed and implemented on the basis of analysis over the performance bottleneck. With peer architecture, NIDU has characteristic of scalability. A concept of semi-polling driven is presented. With it, interrupts frequency is reduced and the performance of capturing packet is significantly improved. NIDU uses anomaly detection technology based on similarity, which improves the detection effect of the attack of DoS and DDoS dramatically.