CN1282333C - Multiline program loading equialization method of invading detection - Google Patents

Abstract

The invention relates to a multi-thread load balancing method for intrusion detection in the technical field of network security. By adopting pipelined multi-thread concurrent processing, the main steps of network intrusion detection: S1, the packet capture thread cyclically captures data packets from the network; S2, each detection thread cyclically reads the data packets in the corresponding queue, performs rule matching, and Put the matching data packets into the alarm queue; S3, the alarm thread reads the data packets in the alarm queue cyclically, and outputs an alarm. Replacing multiple detectors with multiple threads greatly improves the utilization rate of system resources, so that the detection performance of the system adopting this method is greatly improved. At the same time, if this mode is combined with the traditional two load balancing methods, it can more effectively share the load of the entire system, reduce possible system bottlenecks, improve the overall efficiency of the system, and make it more adaptable to high-speed network environments. Intrusion detection required.

Description

A Multithreaded Load Balancing Method for Intrusion Detection

technical field

The invention relates to the technical field of network security, in particular to a multi-thread load balancing method for intrusion detection. In particular, a multithreaded load balancing method for network intrusion detection based on signature analysis.

Background technique

Since Denning proposed the first intrusion detection system model in 1987, intrusion detection technology has developed rapidly. With the popularization of network in recent years, network intrusion detection has gradually replaced host-based detection and has become the mainstream of intrusion detection research. A network intrusion detection system (NIDS) detects attacks by analyzing network traffic. Due to the rapid development of network technology and network applications, the data traffic on the network is continuously increasing, and the network bandwidth is rapidly increasing. The traditional 10Mbps network has been quickly replaced by 100Mbps and 1000Mbps networks. The data packets are all intercepted, and complex intrusion detection and analysis are performed. The traditional intrusion detection technology has become more and more powerless.

In order to realize real-time intrusion detection on high-speed network, especially in 1000Mbps network environment, a large amount of network data analysis is inevitable. When the generation speed of the data to be analyzed exceeds the processing capacity, the data will inevitably be discarded before it can be analyzed in time. This leads to the load problem in NIDS, which becomes one of the bottlenecks restricting the performance of NIDS. Therefore, to achieve load balance for network intrusion detection system has become a main research direction for network intrusion detection system to adapt to high-speed network.

The number of data packets to be processed per unit time and the size of the rule base are two main factors affecting the performance of an intrusion detection system. The existing load balancing methods for intrusion detection mainly focus on these two factors. Its main idea is shown in Figure 1: the control center (center) distributes the load to be completed to each sensor (sensor) according to a certain plan according to factors such as network data flow and the actual processing capacity of each sensor. Implement intrusion detection on network data. The payload here may be a rule in the detection rule base or a data packet in the network. According to the different types of load sharing, the current load balancing methods are divided into the following two types:

· Rule-based multi-probe load balancing method. In this method, the load shared by the control center to each detector is the intrusion detection rule, and each detector is responsible for a part of the detection rule. When some detectors are too late to process data, load balancing can be achieved by increasing the number of detectors or dynamically adjusting the number of detection rules of each detector by the control center.

· Application-based multi-probe load balancing method. In this method, the control center distributes data packets of different types (http packets, telnet packets, ftp packets, udp packets, etc.) as loads to each detector. Each detector is only responsible for the detection of a certain type (or several types) of specific application network traffic, and the detection rules they maintain are only for certain specific applications. When some probes are too late to process data, you can increase the number of probes to achieve load balancing.

The above two methods share the load by adding detectors, and achieve load balancing to a certain extent to adapt to high-speed networks. However, they basically complete all the detection work by simply increasing hardware resources, without starting from the optimization of the intrusion detection system itself. The detection principle on each detector is basically the same, so the original bottleneck of the detection system still exists here. The flow of intrusion detection on each detector is shown in Figure 2: As can be seen from the figure, the system will go through the process of parsing → rule matching → alarm output for each intercepted data packet, and then the system will intercept next packet. However, all three steps may become the bottleneck of the system. When the system has a bottleneck in any step of processing, the system will not be able to intercept the subsequent data packets, and serious packet loss will occur, resulting in a very high false negative rate in the system.

Contents of the invention

The purpose of the present invention is to provide a multi-thread load balancing method for intrusion detection.

The main purpose of the present invention is to break the traditional serial detection mode, adopt pipelined multi-thread concurrent processing, and combine the load balancing method of intrusion detection to realize the multi-thread load balance of intrusion detection.

The traditional intrusion detection mode is a serial detection mode, and the present invention changes the serial behavior to be concurrent. The three steps in the basic intrusion detection process: packet capture, detection, and alarm are executed concurrently by three types of threads. Each thread only completes its own function, and the threads communicate through corresponding queues. Thus, the speed of packet capture, detection, and alarm is greatly improved, and the bottleneck caused by these three processes to the system is eliminated.

The invention combines the traditional load balancing method to classify the detection threads according to the types of data packets, and each thread is only responsible for maintaining one type of detection rules and detecting one type of data packets. Therefore, multiple threads can process different types of data packets at the same time, effectively sharing the load of the entire system, and improving the overall efficiency of the system.

invention technical solution

The invention realizes network intrusion detection by means of pipelined multi-thread concurrent processing combined with load balancing.

The three steps in the basic intrusion detection process, that is, packet capture S1, rule matching S2, and alarm output S3, are executed concurrently by three types of threads. Each thread only completes its own function, and the threads communicate through corresponding queues.

Combining the traditional load balancing method with multi-threading, the detectors in the traditional load balancing method are replaced by threads, each thread maintains its own rules, and performs independent intrusion detection in parallel.

Description of drawings

Fig. 1 is a schematic diagram of a load balancing method of a network intrusion detection system.

Figure 2 is a flow chart of the intrusion detection system.

Fig. 3 is a block diagram of the implementation of the load balancing method based on multithreading in the present invention.

Fig. 4 is a flow chart of the intrusion detection based on the multi-thread load balancing method of the present invention.

Detailed ways

The invention realizes the load balance of the network intrusion detection system through multi-thread concurrent execution. The specific implementation block diagram is shown in Figure 3.

The main steps that the present invention realizes are as follows:

首先，进行初始化工作，打开网络接口，准备截获网络数据包。

First, perform initialization work, open the network interface, and prepare to intercept network data packets.

然后，创建相应线程。其中每个线程具体完成的功能如下：

Then, create the corresponding thread. The specific functions of each thread are as follows:

Thread 1: Packet capture thread, which is equivalent to the control center. Intercept data packets from the network and put them into corresponding queues 1, 2...n-2 according to the type of data packets (HTTP, TELNET, ICMP, etc.);

Threads 2, 3...n-1: detection threads, equivalent to each detector. Read the rule files maintained by each, establish the corresponding rule list, then read the data packets from the respective queues for parsing and rule matching, and finally put the data packets that need to be alarmed into the queue n-1;

Thread n: Alarm thread. Read the data packets in the queue n-1, and output the alarm.

The overall implementation flow chart of the three types of threads is shown in Figure 4. Among them, step S1, packet capture thread: the packet capture thread loops to capture data packets from the network. Packets are classified into corresponding detection queues. This thread will loop to realize the two operations of packet capture and classification; step S2, detection thread: the data packets in the respective detection queues are cyclically read by each detection thread, and the commonly used pattern matching algorithm is used to match with the preset rules, and Put the successfully matched data packets into the alarm queue. This thread will loop to realize the three operations of reading data packets, matching, and storing data packets; step S3, alarm thread: read the data packets in the alarm queue by the alarm thread loop alarm thread, and store the main information of the data packets through the Alarm output in database mode. This thread will loop to realize two operations of reading data packets and alarm output. In this way, the serial three steps of packet capture, detection, and alarm are turned into concurrent execution, thereby greatly improving the speed of packet capture, detection, and alarm, and eliminating the bottleneck caused by these three steps to the system.

The multi-thread-based load balancing technology we proposed breaks the traditional serial processing method of capturing packets→unpacking→rule matching→alarm output→grabbing the next packet→…, adopts pipelined concurrent processing, and each thread only completes Each function, combined with the existing load balancing method, multi-thread corresponds to multi-detector, greatly improves the utilization rate of system resources, so that the detection performance of the system adopting this method has been greatly improved. At the same time, if this mode is combined with the first two load balancing methods, it can more effectively share the load of the entire system, eliminate possible system bottlenecks, improve the overall efficiency of the system, and make it more adaptable to the needs of high-speed network development. .

The method of the present invention is implemented in a multi-thread concurrent manner, combined with the load balancing method of traditional network intrusion detection, and replaces multiple detectors with multiple threads, which greatly improves the utilization rate of system resources, so that the system using this method The detection performance has been greatly improved. At the same time, if this mode is combined with the traditional two load balancing methods, it can more effectively share the load of the entire system, reduce possible system bottlenecks, improve the overall efficiency of the system, and make it more adaptable to high-speed network environments. Intrusion detection required.

Claims (3)

1. A multi-threaded load balancing method for intrusion detection, characterized in that, adopting pipelined multi-threaded concurrent processing and combining the steps of load balancing to realize network intrusion detection is as follows: three steps in the basic intrusion detection process The steps of packet capture S1, rule matching S2, and alarm output S3 are respectively executed concurrently by three types of threads. Each thread only completes its own function, and the threads communicate through corresponding queues. 2. The multithreaded load balancing method for intrusion detection according to claim 1, characterized in that the traditional load balancing method is combined with multithreading, the detectors in the traditional load balancing method are replaced by threads, and each thread maintains its own The rules, in parallel with each other independently of the intrusion detection. 3. The multi-thread load balancing method for intrusion detection according to claim 1, characterized in that, comprising the following specific steps: Step S1: cyclically capture data packets from the network by the packet capture thread, and classify the captured data packets into corresponding detection queues according to the type of data packets; Step S2: Each detection thread cyclically reads the data packets in the corresponding queue, matches with the preset rules, and puts the successfully matched data packets into the alarm queue; Step S3: The alarm thread cyclically reads the data packets in the alarm queue, and stores the main information of the data packets into the database for alarm output.

Images