基于通用多核平台的入侵检测系统研究

Research on Intrusion Detection System Based on Commodity Multi-core Platform

为应对网络流量快速增长问题,提出一种基于通用多核平台的入侵检测系统结构。在系统设计基础上,分析、验证了硬件平台、资源分配模式和流量特征等关键因素对系统处理性能的影响。实验表明,网络流量的流数、单位时间内报文包数等指标对系统性能的影响更大;在启用多核处理器超线程技术并将检测引擎与CPU绑定时,系统性能可以得到有效提高;系统易于实现,性价比高。

To deal with the rapid increment of network traffic, an Intrusion Detection System （IDS） based on commodity multi-core platform was proposed. This paper evaluated some critical factors for the system performance, such as hardware,resource-assigning and network traffic features. Extensive experiments demonstrate that number of traffic flow and pps index have larger impact on system performance. The ids performance can be improved obviously by activating the Hyper-Threading of multi-core processor and binding the detection engine with the CPU core. Our system is easy to be realized and has low price-performance ratio.