利用LINUX集群实现高速网入侵检测

Implement High-speed Network Intrusion Detection Via Linux Cluster

该文介绍了集群技术的应用背景和基于网络的入侵检测系统目前所面临的问题,提出了利用集群技术实现高速网络环境下的入侵检测的思想,描述了如何利用Linux内核的LVS进行集群实现基于千兆带宽的入侵检测,和如何改进LVS源程序以提高IDS应用的性能。

This paper introduces the application background of the cluster technology and the idea of implementing IDS over high speed network environment with a view of the current problems occurred in the web based IDS.In addition,the paper provides a description of how to employ LVS in the kernel of Linux for clustering technique,which will further facilitate the realization of Gigabit network intrusion detection,and how to improve the performance of IDS by modifying the source code of LVS.