基于混合模式匹配算法的网络入侵检测

Network Intrusion Detection based on Hybrid Pattern Matching Algorithm

摘要:

为了提升中央处理单元(CPU)和图形处理单元(GPU)协同检测网络入侵的性能,本文提出了一种具有数据包有效载荷长度约束的CPU/GPU混合模式匹配算法(LHPMA)。在分析CPU/GPU混合模式匹配算法(HPMA)的基础上,设计了长度约束分离算法(LBSA)对传入数据包进行提前分类。利用CPU中的预过滤缓冲区对较长数据包进行快速预过滤,结合全匹配缓冲区将较短数据包直接分配给GPU进行全模式匹配,通过减少有效载荷长度的多样性,提升了CPU/GPU协同检测网络入侵的性能。实验结果表明,LHPMA增强了HPMA的处理性能,充分发挥了GPU并行处理较短数据包的优势,并且LHPMA提高了网络入侵检测的吞吐量。

Abstract:

In order to improve the performance of central processing unit (CPU) and graphics processing unit (GPU) in detecting network intrusion, this paper proposes a cpu/gpu hybrid pattern matching algorithm (LHPMA) with packet payload length constraints. Based on the analysis of cpu/gpu hybrid pattern matching algorithm (HPMA), a length constrained separation algorithm (LBSA) is designed to classify incoming packets in advance. The pre filter buffer in the CPU is used to quickly pre filter long packets, and the short packets are directly allocated to the GPU for full pattern matching in combination with the full match buffer. By reducing the diversity of payload length, the performance of cpu/gpu cooperative detection of network intrusion is improved. The experimental results show that lhpma enhances the processing performance of HPMA, gives full play to the advantage of GPU parallel processing shorter packets, and lhpma improves the throughput of network intrusion detection.