Method for improving IPS detection performance by adopting AMP architecture

Abstract

The invention provides a method for improving IPS detection performance by adopting AMP architecture, which comprises the following steps: step A, a hardware layer receives network data packets, and the data packets are transferred to a network processor (NP) through a hardware shunting mechanism; step B, after the NP receives the data packets, network flow processing (comprising recombination of IP fragments, decoding and exchanging of the data packets and establishment and maintenance of connection) is carried out on the data packets, and the processed data packets are packed into IPS queues, wherein each IPS detection process corresponds to an IPS queue; step C, each IPS process waits for data on the IPS queue thereof, when the data exists on the IPS queue, feature detection is carried out on the data packets, and the detected data packets are injected into a network processing layer; and step D, the NP acquires the data packets which are transferred from each IPS process and are processed by IPS detection, and the subsequent processing is carried out according to detection results. The invention can improve IPS performance on a multi-core processor platform by utilizing the parallel processing technique.

Description

technical field [0001] The invention relates to the technical field of network security and networking, in particular to a method for improving IPS detection performance by adopting an AMP framework. Background technique [0002] Intrusion Prevention System (IPS), as a security product that is connected in series in the network and provides deep attack defense for the protected network, has been more and more widely used. However, with the advancement of network technology and the in-depth development of network applications in various industries, the performance of intrusion prevention systems is becoming more and more important in the detection process. Only when the performance of intrusion prevention detection is guaranteed, efficient analysis algorithms , a complete rule set, etc. may be useful. [0003] In view of the complexity of IPS features and the characteristics of real-time updates, IPS detection and feature filtering are generally implemented by software, but ...

AI Technical Summary

Problems solved by technology

In recent years, the network processor (NP) has been widely used in the Gigabit environment, but the advantage of NP is mainly in the packet processing below the network layer, if the content processing will lead to performance degradation, the ASIC architecture IPS It uses specially designed ASIC chip logic for hardware acceleration processing, and obtains high processing capabilities by solidifying instructions or calculation logic into the chip, thereby significantly improving the performance of IPS products; but the ASIC-based IPS The disadvantages are also obvious: insufficient flexibility and scalability, high development costs, long development cycle, and cannot support too many functions

[0005] Although the above hardware acceleration implementation methods have improved the processing performance of network data packets below the network layer to a certain extent, they are powerless to improve the detection performance of IPS.

Images