PC的入侵檢測集群系統中負載均衡技術研究

論文編號:TX268  論文字數:16899,頁數:37

摘要

 近年來，網絡流量不斷增大，網絡結構日益復雜，攻擊方式層出不窮。傳統基于模式匹配的檢測手段與集中式管理構成的入侵檢測系統擴展性差、自適應能力不強，因此其不能適應當前網絡環境的需要。
 本文對一個基于負載均衡技術的集群式入侵檢測系統〔HMNIDS〕的各個模塊進行了優化設計。改進了入侵檢測系統的數據采集模塊、負載均衡算法及其入侵檢測模塊，解決入侵檢測系統適應性及其可擴展性差的問題。主要論文工作包括以下幾個方面：
 一、針對檢測模塊的特點，在數據流分發模塊設計了一種動態的負載均衡算法，根據入侵檢測機反饋來的信息動態的調整數據流的分發策略。
 二、在數據流分發模塊增加了宏觀預測可疑數據流的功能，提出了訪問密度這一概念和計算訪問密度的公式。此外，數據流分發模塊的負載均衡功能設計成由兩臺機器來完成，兩臺機器分流的數據種類不同，提高了數據分流的速度。
 三、數據截獲部分利用交換機的Trunk和PortMirror技術，設計出了多采集機共同來分流主干網流量的架構。
 最后，本文設計了模擬網絡環境，并對上述理論工作進行了檢測實驗。性能分析和實驗結果表明，改進的檢測系統具有擴展性，能合理的分發數據包，充分的利用入侵檢測模塊的資源。
 
關鍵詞：網絡入侵檢測系統 ；訪問密度 ；負載均衡

The Research on Load Balancing in Network Intrusion Detection System Base on PC
 Student:          Teacher: 
 
Abstrct: In recent years, the growing network traffic, increasingly complex network structure, the endless attacks, made the traditional IDS, which base on technology of load balancing and centralized management constitute and has poor expansibility and adaptability, also can not meet the requirement of the current network environment.
 This paper designed a kind of load balancing technology  in a intrusion detection system based on cluster (HMNIDS). By center data collection, layer-stepping data analysis and the collaborative detection of multi-detection engine, we solved the problems of traditional IDS on poor adaptability and expansibility in the high-speed, complex network environments. The wholes system is divided into three module ,every module has clear own function. The main researches and creative points are as follows:
 Firstly， in view of the features connection with detection module, we designed data stream distributed module which has a dynamic load-balancing algorithm that dynamic adjust distributed strategy by sending  information of detection machines.
 Secondly， In addition ,we added function to forecast doubtful data stream on the view of macroscopic in data stream distributed module , proposed  a concept of Access Pack Densities and formula of calculate Access Pack Densities. Furthermore, the function of load balancing is designed to complete by two computer which processing data is different and increase speed of data distributed.
 Thirdly，Data capture module is made use of Trunk and PortMirror technology of switch by a new sort of structure which many data capture machine gather data of backbone network.
 At last, we designed a simulated network environment which suite for the testing of this system and had done a test experiment to the HMNIDS in this environment. Performance analysis and experiments demonstrate that the model is scalable, and can dispatch packets reasonably and utilize intrusion detection system’ sources effectively.

Key words:  NIDS; Access Pack Densities; Load Balancing

目錄

摘要 Ⅰ
Abstrct Ⅱ
1  緒論 1
1.1 問題的提出及研究意義 1
1.1.1 問題的提出 1
1.1.2 論文的研究意義 2
1.2 國內外的研究現狀 2
1.3 本文研究的內容和目的 3
1.3.1 本文研究的主要內容 3
1.3.2 本文研究的主要目的 4
1.4 小結 4
2  數據捕獲模塊 5
2.1 網絡數據包流獲取的方法 5
2.2 鏈路聚合技術介紹 6
2.3 數據流捕獲結構圖 7
2.4 數據包捕獲原理 7
2.5 小結 9
3  數據包分流模塊的設計 11
3.1 設計思想 11
3.2 預處理機的算法 11
3.3 預處理機的流程 13
3.4 負載均衡機的表和算法設計 14
3.4.1 Hash函數介紹 14
3.4.2 散列法與其他查找方法的區別 16
3.4.3 負載均衡機中表的算法 17
3.4.4 檢測機狀態的門限值運算 19
3.5 負載均衡機的運行流程 20
3.5.1 對TCP包的處理方式 20
3.5.2 TCP負載均衡的原理 20
3.5.3 對其他包的處理方式 21
3.5.4 UDP負載均衡機的原理 22
3.5.5 數據包發送的設計與實現 22
3.6 小結 23
4  系統實現 23
4.1 測試系統配置 23
4.2 負載均衡實驗 24
4.3 系統性能實驗 27
4.4 實驗結果分析 30
5  結論 31
5.1 主要結論 31
5.2 后續研究工作的展望 31
致謝 33
參考文獻 34