A resource scheduling and allocation method and system for matching computing

Abstract

The invention discloses a resource dispatching allocation method for matching calculation, which comprises the steps of monitoring the calculation load of each engine node in real time at an interval of delta t, and sorting the load of each engine node; and when a no-load or over-load node appears, dispatching a to-be-detected data packet of a node with the heaviest load at present to a node with the lightest load according to a certain proportion by taking the session as a unit, traversing the nodes and performing load balancing adjustment.

Description

technical field [0001] The invention relates to the field of network intrusion detection, in particular to a matching calculation resource scheduling method and system thereof. Background technique [0002] In a high-speed network environment, the detection engine of the Network Intrusion Detection System (NIDS) is facing a serious performance bottleneck problem, which is mainly reflected in the large increase in detection data samples caused by the high-speed network data flow, and the matching characteristics caused by the diversification of attacks. Patterns have grown considerably. Solving the performance bottleneck problem of NIDS under the high-speed network environment has become one of the hotspots in the current information security field. There are two main solutions to this problem in the existing technology: one is to optimize the detection algorithm efficiency of a single detection engine, However, limited by the processing speed of a single engine node, this m...

AI Technical Summary

Problems solved by technology

The static load balancing algorithm divides traffic according to a preset strategy. The advantage is that the algorithm is simple to implement and does not generate additional operating overhead. However, since this type of algorithm does not adjust the distribution in real time in combination with the actual network load situation, the effect of load balancing relatively poor

The dynamic load balancing algorithm will dynamically distribute the traffic to each engine node according to the load conditions of each node or link during operation, and maintain the rough balance of the traffic of each node in real time. Therefore, the load balancing effect will be lower than that of the static load balancing algorithm. Much better, but the algorithm will cause additional operating overhead of the system

[0004] Therefore, most of the existing technologies use dynamic load balancing algorithms to balance the load of the system. During the dynamic load distribution process, the original flow characteristics may be destroyed. If the packets belonging to the same session are distributed to different processing nodes, this will affect the routing The processing performance of the lookup table may not be affected, but in network security applications, this may be fatal: At present, many network attacks hide attack characteristics, and the attack behavior cannot be detected based on independent packet detection technology. The attack behavior of the message can only be detected after the message is spliced ​​and reassembled. If the load balancing system cannot allocate the entire session to a processor node, the intrusion detection system will not be able to detect the attack, resulting in false positives. .Facing this problem, some scholars have proposed a session-oriented adaptive load balancing algorithm, which classifies IP packets into multiple domains, dynamically adjusts TCP traffic, and can perform dynamic load balancing without affecting session integrity. , the simulation experiment shows that the algorithm has a certain load balancing effect, and the damage to the integrity of the session is small, and the implementation of the algorithm is relatively easy, but the algorithm still lacks the proof of stability

[0005] The real network tracer has a small number of large flows but a relatively large proportion of traffic. In order to deal with this situation, a security shunt algorithm based on the adjustment of large flows appears in the prior art. After simulation experiments, the bit-stream balancing effect of this algorithm is better than Well, the stream corruption rate is relatively low, but the complexity of the algorithm is relatively high

Images