Capacity Verification for High Speed Network Intrusion Detection Systems
Capacity Verification for High Speed Network Intrusion Detection Systems
复制标题
高速网络入侵检测系统的容量验证
DOI：
--
复制
发表时间：
2002
期刊：
影响因子：
--
通讯作者：
Kevin Wiley
中科院分区：
文献类型：
--
作者：
M. Hall;Kevin Wiley
商业上可用的网络入侵检测系统(NID)在六年多前进入市场。这些系统已被公认为一种可行的监控消费者网络安全的方法，但目前还没有商业标准来帮助消费者了解这些设备的容量特征。现有的网络入侵检测系统测试存在缺陷。这些测试类似于对交换机和路由器等其他网络设备使用的相同测试。但是，交换机和路由器不执行相同级别的深度数据包检测，也不需要NID所要求的更高级别的协议感知。因此，目前的测试不允许消费者推断其环境中的任何预期性能。设计一组针对NIDS薄弱领域或瓶颈的新测试是发现对消费者有意义的指标的关键。然后，NIDS技术的任何用户都可以检查测试中使用的指标，并将其网络流量配置为这些相同的指标。消费者可以使用标准测试结果准确预测其网络性能。本文提出了一种网络入侵检测系统的标准化容量基准测试方法。测试方法首先检查NID中的瓶颈，将这些瓶颈映射到可以测试的指标，然后探索执行的测试的一些结果。
Commercially available Network Intrusion Detection Systems (NIDS) came onto the market over six years ago. These systems have gained acceptance as a viable means of monitoring the security of consumer networks, yet no commercial standards exist to help consumers understand the capacity characteristics of these devices. Existing NIDS tests are flawed. These tests resemble the same tests used with other networking equipment, such as switches and routers. However, switches and routers do not conduct the same level of deep packet inspection, nor require the higher-level protocol awareness that a NIDS demands. Therefore, the current testing does not allow consumers to infer any expected performance in their environment. Designing a new set of tests that is specific to the weak areas, or bottlenecks, of a NIDS is the key to discovering metrics meaningful to the consumers. Any consumer of NIDS technology can then examine the metrics used in the tests and profile his network traffic to these same metrics. The consumer can use standard test results to accurately predict performance on his network. This paper proposes a test methodology for standardized capacity benchmarking of NIDS. The test methodology starts with examining the bottlenecks in a NIDS, mapping these bottlenecks to metrics that can be tested, and then exploring some results from tests conducted.