并行入侵检测系统的预测负载均衡方法

Load balancing algorithm based on prediction for parallel intrusion detection system

数据流的高速化使得网络入侵检测系统(network intrusion detection system,NIDS)往往会出现严重的漏报率,并且面对某连接上突发流量的情况,基于连接的负载均衡很难做出较好的应对措施,针对该问题,提出了一种基于包预测的并行入侵检测的负载均衡方案。该方案通过观察每个探测器上数据包的进出情况,由包预测负载均衡算法预测下一个时刻各探测器上的负载情况,避免了将新连接加入到流量突发探测器的可能,提高了负载均衡的效率。仿真实验结果表明了该方案的可行性及有效性,它能有效的均衡负载,减少系统的丢包率。

NIDS （network intrusion detection system） often has high loss rate because of the high speed of data flow. Besides load balancing scheme that purely based on connection is hard to take good measures once data flow on one or several connections rise rapidly. This performance is proved by load balancing scheme developed for parallel NIDS based on packets prediction. This scheme observe packets in and out and predicts load by packets prediction load balancing algorithm on each sensor. On the basis of the algorithm, an ef- fective measure is taken to deal with the rapid rising flow on connections and avoid adding a new connection to a sensor that will have high load. Results of the simulation verified that the scheme proposed can balance load effectively and reduce the packet loss rate.