Adaptive Character Frequency-Based Exclusive Signature Matching Scheme in Distributed Intrusion Detection Environment
Adaptive Character Frequency-Based Exclusive Signature Matching Scheme in Distributed Intrusion Detection Environment
复制标题
分布式入侵检测环境中基于字符频率的自适应独占签名匹配方案
DOI：
--
复制
发表时间：
2012
期刊：
影响因子：
--
通讯作者：
Wenjuan Li
中科院分区：
文献类型：
--
作者：
Yuxin Meng;Wenjuan Li
目前，基于特征的网络入侵检测系统（NIDS）被广泛部署在分布式网络环境中，目的是保护网络通信免受各种攻击。然而，在大规模分布式网络环境下，签名匹配问题已成为制约基于签名的网络入侵检测系统性能的关键因素。网络数据包的开销会大大降低这种检测系统的有效性，并严重消耗计算机资源。为了缓解这个问题，需要一种更有效的签名匹配算法。因此，在本文中，我们开发了一种自适应的基于字符频率的排他性签名匹配方案，可以在基于签名的NIDS中实现，以帮助提高签名匹配的性能。在实验中，我们实现了我们的计划在分布式网络环境中，并评估我们的计划相比，Snort的性能。实验结果表明，在我们的分布式网络环境中，我们的计划可以积极减少时间消耗的范围从11.2%到37.6%。
Currently, signature-based network intrusion detection systems (NIDSs) are being widely deployed in distributed network environment with the purpose of protecting network communications from various attacks. However, signature matching has become a key limiting factor to restrict the performance of a signature-based NIDS in large-scale distributed network environment. The overhead network packets can greatly reduce the effectiveness of such detection systems and heavily consume computer resources. To mitigate this issue, a more efficient signature matching algorithm is desirable. In this paper, we therefore develop an adaptive character frequency-based exclusive signature matching scheme that can be implemented in a signature-based NIDS to help improve the performance of signature matching. In the experiment, we implemented our scheme in a distributed network environment and evaluated the performance of our scheme compared with Snort. The experimental results show that, in our distributed network environment, our scheme can positively reduce the time consumption in the range from 11.2% to 37.6%.