Earticle

초록

영어

In order to protect Internet users from various attacks such as worms, viruses and other intrusions, signature-based intrusion detection system (IDS) should be deployed at the critical part of the network with rapid response for updating newly emerged attack signatures and containing the spread of worms or viruses at their early stage. The processing speed of one IDS cannot achieve the throughput requirement in the core networks because of the pattern matching, the key operation for signature-based IDS, is complex and time consuming. In this paper, it argues that if the signature set is shared by multiple IDSs, a packet needs to be checked once and once only by one of the IDSs, so traffic load can be redistributed among the IDSs to avoid local congestion. Packet marking is used to indicate the status of this packet utilized by collaborative IDSs, and a redistribution strategy named inner logical ring (ILR) is built among IDSs to redistribute the traffic load. Meanwhile, caching scheme is used to keep sequence for packets belonging to the same flow. This collaborative distributed IDS is robust with rapid response to various attacks, and the detection throughput is significantly increased from the throughput of the weakest IDS to the summation of all the collaborative IDSs.

목차

Abstract
 1. Introduction
 2. Related work
 3. Collaborative distributed scheme
 4. Performance evaluation
 5. Conclusion
 References

저자

• Wei Lin [ Department of Computer Science and Technology, Tsinghua University, China; Department of Electronic Engineering, City University of Hong Kong, Hong Kong ]
• Liu Xiang [ Department of Electronic Engineering, Tsinghua University, Beijing, China ]
• Derek Pao [ Department of Electronic Engineering, City University of Hong Kong, Hong Kong ]

참고문헌

발행기관

간행물

표지보기 관심저널 등록

• 간행물명

  International Journal of Multimedia and Ubiquitous Engineering

• 간기

  월간

• pISSN

  1975-0080

• 수록기간

  2008~2016

• 등재여부

  SCOPUS

• 십진분류

  KDC 505 DDC 605