Dynamic stream scheduling method, system and computer storage medium based on load capacity

Abstract

The invention relates to a dynamic flow scheduling method, system and computer storage medium based on load capacity. The method includes constructing a plurality of load flow node groups, generating a node processing capacity table of each load flow node group according to the load condition of each distributed computing node, and loading the intrusion signature database to each load flow node group All the rule files and distribute the whole rule files to each distributed computing node of each load flow node group; generate a dynamic scheduling flow that distributes the received data traffic to different load flow node groups based on the load balancing algorithm A rule; based on the dynamic scheduling flow rule, distribute data traffic to each of the load traffic node groups and copy the distributed data traffic to each distributed computing node in the load traffic node group. The invention can ensure real-time and accurate detection, prevent omission and time delay caused by performance, and realize the maximization of overall performance.

Description

technical field [0001] The present invention relates to the field of network security, and more specifically, relates to a dynamic flow scheduling method, system and computer storage medium based on load capacity. Background technique [0002] With the continuous accumulation of network attack characteristics and rules and the rapid growth of business traffic, the intrusion detection system is in the process of detecting viruses, Trojans, worms, botnets, buffer overflow attacks, distributed denial of service attacks (DDos), scanning detection, spoofing hijacking, etc. , Structured query language (SQL) injection, cross-site scripting (XSS), website hanging horse, abnormal traffic and other malicious attack behaviors are comprehensively detected, because comprehensive detection requires a large amount of calculation, although multi-core technology is used, it is still Unable to meet the rapid growth of traffic and the sharp increase of attack features, current products on the ...

AI Technical Summary

Problems solved by technology

[0002] With the continuous accumulation of network attack characteristics and rules and the rapid growth of business traffic, the intrusion detection system is in the process of detecting viruses, Trojans, worms, botnets, buffer overflow attacks, distributed denial of service attacks (DDos), scanning detection, spoofing hijacking, etc. , Structured query language (SQL) injection, cross-site scripting (XSS), website hanging horse, abnormal traffic and other malicious attack behaviors are comprehensively detected, because comprehensive detection requires a large amount of calculation, although multi-core technology is used, it is still Unable to meet the rapid growth of traffic and the sharp increase of attack features, the current market products often use the closed detection function to overcome performance bottlenecks when the traffic is very large, so there will be a large number of false positives

With the continuous accumulation of network intrusion features and the sharp increase of network bandwidth, in order to meet the problems of real-time detection and false negatives, parallel detection technology is used. The existing technology mainly adopts multi-core and multi-threading methods, but there are performance bottlenecks in hardware multi-core and multi-threading. And lack of elasticity, the overall performance is lower

Images