多任务多点映射分解技术的大规模入侵检测

Large-Scale Network Intrusion Detection Based on Multi-Point and Mulit-Task Decomposition Mapping Technology

针对传统单节点的大规模入侵检测效率低,难以满足入侵检测实时性要求的难题,提出了一种多任务多点映射分解技术的大规模网络入侵检测方法。采用Map数和Reduce函数将网络特征库上传到分布式文件系统,并将子任务分配到多个节点上并行执行和到各子任务的匹配结果,根据投票法确定网络入侵检测结果。仿真结果表明,相对传统单点检测方法,本文方法减少了特征上传和匹配的计算复杂度,网络入侵检测速度大幅提高,可以满足网络入侵检测的实时性要求。

The efficiency of traditional single node intrusion detection is low and difficult to meet the need for real time for network intrusion detection. This paper presented a large - scale network detection method based on multi - tasking and muhi - point mapping decomposition technique. Firstly, the network features in the database was upload- ed to the distributed file system using Map/Reduce function. Then sub -tasks were executed in parallel on multiple nodes to get the matching results for each sub - task. Finally, the network intrusion detection results based on voting method were determined. Simulation results show that compared with the traditional single - point detection methods, the proposed method reduces the computation complexity, increases the speed of network intrusion detection and sat- isfies the requirements of real - time detection.