Network intrusion detection system and method

Abstract

The invention discloses a network intrusion detection system and method. The system comprises a packet header matching module, a packet load compiling module and a packet load matching module, whereinthe packet header matching module is used for extracting a packet header field to form an N-tuple, carrying out the packet header matching detection according to the N-tuple and a preset rule base, and triggering the packet load matching module if the matching succeeds; the packet load compiling module is used for compiling the packet load into a DFA matching library when the complexity of the data packet is lower than a threshold value, compiling the packet load into an NFA matching library when the complexity of the data packet is higher than or equal to the threshold value, and sending theDFA matching library and the NFA matching library to the packet load matching module; and the packet load matching module is used for performing DFA matching detection according to the DFA matching library during packet load detection of the data packet, directly skipping NFA matching detection if matching succeeds, or otherwise, performing NFA matching detection according to the NFA matching library. The technical problems that the existing SDN-based intrusion detection is relatively low in efficiency and low in throughput can be solved.

Description

technical field [0001] The present application relates to the technical field of network intrusion detection, in particular to a network intrusion detection system and method. Background technique [0002] Deep packet inspection and tuple matching are important technical means for intrusion detection, while software-defined networking (SDN) devices separate the control plane from the data plane to achieve flexible control and efficient forwarding. Therefore, implementing deep packet inspection and tuple matching on SDN devices can obtain high-performance network intrusion detection capabilities and flexible control over the network. [0003] The existing SDN-based intrusion detection has limitations in the performance of the SDN controller, and data packets that occupy a large memory are prone to space explosions during compilation. The efficiency of all-packet intrusion detection is low, and it is impossible to obtain high throughput. Contents of the invention [0004] ...

AI Technical Summary

Problems solved by technology

[0004] This application provides a network intrusion detection system and method, which are used to solve the problem that the existing SDN-based intrusion detection has limited device performance, and the intrusion data packets are not detected efficiently and in a targeted manner, which leads to the efficiency and throughput of intrusion detection. low technical issues

Images