高效率分散式入侵偵測系統之適應性法則分配演算法

本論文主要針對網路分散式入侵偵測系統(Network Distribution Intrusion Detection System - NDIDS) 中，如何使各個Snort Client端 (或 Snort sensor) 的中央處裡器使用率(CPU Loading)達到平衡 (Balance)；並提出數種適應性法則分配演算法(An adaptive rule assignment algorithm)，本論文中所提數種演算法主要分為兩大部分；一是Snort sensor 法則數的增刪原則；二是增刪法則的選取原則，之後綜合討論各演算法之間的差異性及適用時機。本文最後將針對分散式系統下各個Snort sensor 環境不同(如中央處理器 - CPU)的效能差異及實驗結果，以及Snort sensor數目在線性成長下的效能表現。

關鍵字

適應性法則分配；分散式入侵偵測系統；分散式系統

並列摘要

This thesis is mainly connected with Distribution Intrusion Detection System – NDIDS, and how to make each CPU Loading of Snort Clients or Snort sensors reach balance. Besides, this thesis is about two adaptive rule assignment algorithms. One is the increased and deleted principle of the Snort sensor rule. Another is the selected principle of the increased and deleted rule. Furthermore, there is synthetic discussing the differences and suitable time between each algorithm. Finally, this thesis aims at the effect differences and experiment results of the environment differences, as CPU, of each Snort sensor in the distribution system, and the effects of the number of Snort sensor in the linear growth. Key words: Distribution Intrusion Detection System – NDIDS, Adaptive rule assignment, Distribution System

並列關鍵字

Adaptive rule assignment ； Distribution Intrusion Detection System – NDIDS ； Distribution System

參考文獻

[1]曾仁志,,2005年,“高效率分散式入侵偵測系統之靜態法則分配演算法” ,中原大學資訊工程所碩士論文

[2]Jae-Myung Kim, Kyu-Ho Lee,Jong-Seob Kim, Kuinam J. Kim, ”Performance Improvement Scheme of NIDS through Optimizing Intrusion Pattern Database”, ISCIS 2003, LNCS 2869, pp. 1098-1105, 2003

[3]DU YE, WANG HUI-QIANG, PANG YONG-GANG, “Design of a distributed intrusion detection system based on independent agents”, IEEE Intelligent Sensing and Information Processing, 2004. Proceedings of International Conference on 2004 Page(s):254 - 257

Google Scholar

[4]M. Shoaib Alam, Qasim Javed, Dr M. Akbar, M.Raza Ur Rehman, M Bilal Anwer, “Adaptive Load Balancing Architecture for SNORT,” IEEE INCC 204. International Conference on Networking and Communication, 11-13 June 2004, pp.48-52.