Modularized network intrusion detection system

Abstract

The invention discloses a modularized network intrusion detection system, which comprises a data source module for packet acquisition and encoding analysis, a shunt module for dispatching network packets from an encoding resolution module and distributing the network packets to each detection submodule in a detection module, and the detection module for detecting whether the network packets contain an attack or not, wherein the detection module adopts multiple threads and comprises one or more detection submodules; and the data source module and the shunt module uses one thread. In the technical scheme of the modularized network intrusion detection system, an independently-designed data acquisition and distribution / detection modularized architecture facilitates the realization of the function of a specific module by using hardware; the processing capacity of a multi-core processor can be fully used, the performance can be increased linearly with the number of cores of the processor, and multiple detection modules can be loaded dynamically so that configuration can be performed according to different hardware conditions; and simultaneously, memory consumption is reduced greatly and the commonality of the system is reinforced.

Description

technical field [0001] The invention relates to the technical field of network filtering and monitoring, in particular to a modularized network intrusion detection system. Background technique [0002] Network Intrusion Detection System (NIDS) is a network security system that monitors malicious or harmful behaviors in network or system activities and issues alarms. It intercepts data packets in the network (hereinafter referred to as network packets) through bypass or online, and analyzes its content, and gives an alarm or intercepts the network packets containing attacks, so as to realize the function of intrusion detection / defense. Due to the complex functions of NIDS, it is generally realized by software and runs inside the firewall or security gateway system. [0003] In recent years, the industry has increasingly higher requirements on the throughput of network devices. As the performance bottleneck of the security gateway, NIDS requires a large amount of computing po...

AI Technical Summary

Problems solved by technology

However, the former does not implement memory sharing among multi-threads, which makes the memory consumption of multi-threading run too large, which limits the scope of application of the system; the latter does not implement a modular architecture, so it is difficult to add new applications to the system

Images