信息网络安全

信息网络安全 ›› 2018, Vol. 18 ›› Issue (5): 41-51.doi: 10.3969/j.issn.1671-1122.2018.05.005

• • 上一篇    下一篇

基于DPDK的虚拟化网络入侵防御系统设计与实现

刘超玲1,2(), 张棪1,2, 杨慧然1,2, 吴宏晶1,2   

  1. 1.中国科学院信息工程研究所,北京 100195
    2.中国科学院大学网络空间安全学院,北京 100195
  • 收稿日期:2018-01-15 出版日期:2018-05-15 发布日期:2020-05-11
  • 作者简介:

    作者简介：刘超玲（1992—）,女,广东,硕士研究生,主要研究方向为虚拟化与安全防护;张棪（1980—）,男,四川,副研究员,博士,主要研究方向为内容网络与安全、网络虚拟化与安全、大数据技术;杨慧然（1991—）,女,山西,硕士,主要研究方向为网络虚拟化;吴宏晶（1993—）,男,福建,硕士研究生,主要研究方向为网络虚拟化与安全。

  • 基金资助:
    国家自然科学基金[61701494]

Design and Implementation of a DPDK-based Virtual NIPS

Chaoling LIU1,2(), Yan ZHANG1,2, Huiran YANG1,2, Hongjing WU1,2   

  1. 1. Institute of Information Engineering, Chinese Academy of Sciences, Beijing 100195, China
    2. School of Cyber Security, University of Chinese Academy of Sciences, Beijing 100195, China
  • Received:2018-01-15 Online:2018-05-15 Published:2020-05-11

RichHTML

20

PDF (PC)

646

摘要：

面对日益严峻的网络安全威胁,NIDS/NIPS成为实现网络安全防护的重要手段。针对现有NIDS/NIPS软件Snort和Iptables数据处理性能的不足,文章提出一种基于DPDK的虚拟化网络入侵防护系统vD-IPS。vD-IPS系统的整体架构,重点设计和实现了基于DPDK零拷贝的入侵检测模块、流量清洗模块。针对多元的攻击环境,设计并实现了模式匹配算法的选择机制。经过实验验证,vD-IPS满足入侵检测、流量清洗的功能需求,vD-IPS接收与检测报文单核比Snort提升约1.64倍,双核提升约2.62倍;vD-IPS转发报文单核比Iptables提升约1.56倍,双核提升约1.89倍,三核提升约2.21倍。与Snort和Iptables相比,vD-IPS在具有相同的入侵检测与防护能力的情况下还具有更优的性能,并且随着核数的增加,vD-IPS性能有进一步的提升。另外, vD-IPS 具备模式匹配算法选择功能,对于不同的模式串规模和字符串长度, vD-IPS 可以灵活选择对应最优的算法。

关键词: NIPS, DPDK, 入侵检测, 流量清洗, 模式匹配

Abstract:

As the threat of network security, NIDS/NIPS have become an important way to protect network environment. Considering the existing NIDS/NIPS software, such as Snort and Iptables have ineffective data processing performance, this paper propose a DPDK based Virtual NIPS(vD-IPS).This paper design the overall architecture of the system, highlighting the packet connection and detection module and packet cleaning module. Considering the multiple attack environments, this paper design and implement a mechanism of pattern matching algorithm selection. After experimental verification, vD-IPS Satisfy the requirements of intrusion detection and packet cleaning. Compare to Snort, the performance of packet connection and detection of vD-IPS with one core increased by 1.64 times and two cores has increased by 2.62 times. Comparing to Iptables, the performance of packet cleaning of vD-IPS with one core has increased by 1.56 times and two cores have increased by 1.89 times and three cores have increased by 2.21 times. In conclusion, vD-IPS performs better with the same abilities of detection and protection comparing to Snort and Iptables. With the increasing numbers of cores, vD-IPS has further improvement of performance. vD-IPS can select different pattern matching algorithm which has the best matching effect according to the character set size and string length of different pattern string.

Key words: NIPS, DPDK, intrusion detection, packet cleaning, pattern matching

中图分类号: