基于多核处理器的网络入侵检测系统的设计与实现

DESIGNING AND IMPLEMENTING MULTI-CORE PROCESSOR BASED NETWORK INTRUSION DETECT SYSTEM

在深入研究和分析OCTEON多核处理器技术和入侵检测系统的基础上,设计并实现了一种基于更强处理能力CPU的网络入侵检测系统(NIDS)。系统主要分为控制平台和检测系统两大模块。控制平台方便、强大,通过命令将检测引擎和指定的核绑定,即便检测系统在运行也能完成两者的交互,实现检测引擎在多个核上的运行。通过设定每个数据包流经所有的核,每个核上进行不同的规则匹配检测,实现网络入侵检测的并行处理,满足了NIDS高性能高效率的要求。

After making the in-depth research and analysis on OCTEON multi-core processor technology and the intrusion detection systems,in this paper we designed and implemented a network intrusion detection system（NIDS） based on the CPU with more powerful processing ability.This system includes two major modules：control platform and detection system.The platform is very convenient and powerful.It can bind the detection engine and the specified core by command,and can achieve the interaction between them even when the intrusion detection system is running,therefore the engines running on multi-core can be realised.Through such setting that every data packet passes all cores and every core is detected with different matching rules,the parallel processing of network intrusion detection is realised as well,and this meets NIDS＇ requirements of high performance and efficiency.