|
|||||
|
|
| 利用流量特征的GIDS报文分类优化算法 | |
| 引用本文： | 宁卓,孙知信,龚俭,张维维.利用流量特征的GIDS报文分类优化算法[J].电子学报,2012,40(3):530-537. |
| 作者姓名： | 宁卓 孙知信 龚俭 张维维 |
| 作者单位： | 1. 南京邮电大学宽带无线通信与传感网技术教育部重点实验室,江苏南京,210003 2. 南京邮电大学宽带无线通信与传感网技术教育部重点实验室,江苏南京210003;南京大学计算机软件新技术国家重点实验室,江苏南京210093 3. 东南大学计算机科学与工程学院,江苏南京,210096 |
| 基金项目： | 国家863高技术研究发展计划(No.60973140,No.61170276);江苏省自然科学资金(No.BK2009425);南京邮电大学引进人才科研启动基金(No.NY210081) |
| 摘 要： | 本文结合流量的动态特征和入侵检测系统规则库的静态特征生成高性能报文分类树,提出了一个新的面向骨干网高速入侵检测的报文分类算法FlowCopySearch(FCS).改进在于:①从流量的新角度提出了最优分类树定义并引入分类域熵衡量每个分类域对于流量的分类能力;②将传统分类算法中每个报文都必须频繁执行的内存拷贝操作简化为每个流只执行一次内存拷贝操作,克服了报文分类算法的瓶颈.实验结果表明FCS更适用于骨干网大流量trace的报文分类,较之两种经典分类算法,分类速度提高了10.1%~45.1%,同时存储消耗降低了11.1%~36.6%. |
| 关 键 词： | 入侵检测系统 属性熵 重尾分布特性 |
| 收稿时间： | 2011-06-22 |
An Improved GIDS Packet Classification Algorithm Using the Characteristic of the Traffic |
|
| NING Zhuo , SUN Zhi-xin , GONG Jian , ZHANG Wei-wei.An Improved GIDS Packet Classification Algorithm Using the Characteristic of the Traffic[J].Acta Electronica Sinica,2012,40(3):530-537. | |
| Authors: | NING Zhuo SUN Zhi-xin GONG Jian ZHANG Wei-wei |
| Institution: | 1.Key Laboratory of Broadband Wireless Communication and Sensor Network Technology of Ministry of Education,Nanjing University of Posts and Telecommunications,Nanjing,Jiangsu 210003,China;2.State Key Laboratory for Novel Software Technology,Nanjing University,Nanjing,Jiangsu 210093,China;3.School of Computer Science and Technology,Southeast University,Nanjing,Jiangsu 210096,China) |
| Abstract: | A classification algorithm FlowCopySearch(FCS) is developed that systematically profiles static intrusion signatures and network traffic to generate a high performance and memory-efficient packet classification tree.The improvements are two folds.Firstly,the best classification tree is formally defined and packet feature entropy is proposed to measure how well a packet field can partition the traffic.Secondly,FCS copies a rule set for a flow instead of traditionally copying the rule set for every packet in the flow,so the classifying speed is increased considerably.The experiment results show that in backbone trace FCS is preferred.Compared to the other two classical algorithms,FCS can not only speed up classification by as much as 10.1%～45.1% in speed,but also save memory consumption of 11.1%～36.6% at the same time. |
| Keywords: | intrusion detection system packet feature entropy heavy hitter |
| 本文献已被 CNKI 万方数据 等数据库收录！ | |
| 点击此处可从《电子学报》浏览原始摘要信息 | |
| 点击此处可从《电子学报》下载免费的PDF全文 | |