摘要：

目前主流的网络预警系统普遍存在自适应性差和协同分析能力弱等问题。为此，提出一种基于云计算架构的大规模网络入侵协同预警技术，采用基于分布式哈希表的分布式报警消息存储和查询算法，利用树状对等覆盖网实现入侵关联分析的自适应任务调度。实验结果表明，使用该技术实现报警聚合和关联分析，不仅能使网络预警系统架构具备较好的扩展性，并且可以缩短大规模网络入侵的预警反应时间，同时保证报警关联分析的准确度。

关键词: 大规模入侵, 协同预警, 云计算, 分布式调度, 报警关联

Abstract:

Current prevalent network warning systems generally lack of ability of self-adaption and collaborarive analysis. A collaborative warning technology against massive network invasions is proposed, which is based on cloud computing architecture. This technology implements the global sharing of network intrusion alerts using distributed hash table, and adopts a tree-structured Peer-to-Peer(P2P) overlay, so that the task scheduling of intrusion correlation can be handled in a self-adaptive way. Experimental results based on a proof-of-concept prototype system demonstrate that, the alert aggregation and correlation through this technology, not only make the architechture of network warning system highly scalable, but also remarkably reduce the reaction time of warning against massive network intrusions without degradation in accuracy.

Key words: massive intrusion, collaborative warning, cloud computing, distributed scheduling, alerts correlation

中图分类号: 

• TP391