高速网络入侵检测系统负载均衡策略与算法分析

为了解决高速网络入侵检测系统(n IDS)的性能瓶颈问题,提出了可用于n IDS的负载均衡策略和算法。在阐述基于多引擎并行处理的n IDS框架的基础上,提出和分析了3种实用的n IDS负载均衡策略,重点论述了一种基于流的动态负载均衡算法——FDLB算法。该算法依据通过动态反馈和预测机制得到的当前引擎负载情况,以一个会话为分配单位,将新的网络数据包分发给当前负载最小的引擎。实验结果表明,在大流量多引擎情况下,FDLB算法的负载均衡效果要比轮转算法好得多。

Load balancing algorithm for high-speed network intrusion detection systems

The performance of high-speed network intrusion detection systems(nIDSs) is improved by load balancing algorithms developed for high-speed nIDSs.Three load balancing policies were analyzed to develop a flow-based dynamic load balancing algorithm based on nIDSs using multiple detection engines.The algorithm divides the data stream according to the current value of each detection engine's load using a dynamic feed and prediction mechanism.The incoming data packets for a new session are forwarded to the engine that currently has the lightest load.Test results show that the algorithm performs better than the Round Robin algorithm,especially when a large number of concurrent detection engines are used in heavy network traffic environments.