论文部分内容阅读
随着网络应用层内容检测技术的速度提高到10Gb/s的数量级,底层的TCP/IP协议栈已经成为制约网络入侵检测系统的检测速度的新瓶颈。该文的前期工作采用64位指令、并行计算指令和操作系统内核数据映射等软件硬件系统特性来优化TCP校验码计算、TCP连接表Hash值计算和内核态到用户态的数据复制等性能瓶颈。在此基础上,该文进一步研究了连接表Hash值计算、半开连接过滤和并行化问题,采用通用Hash(universal Hash)函数作为TCP连接表查找的Hash函数,以避免算法复杂度攻击,并利用SSE(streaming SIMD extensions)指令集中的并行指令来提高计算速度;采用Bloom过滤器过滤TCP半开连接;使用多次加载动态链接库(DLL)的方法,利用并行化获得更高的吞吐率。实验表明:经过上述改进后,使用3个处理器核心的TCP/IP协议栈,对平均包长110 B的攻击流量能达到4.4 Gb/s的吞吐率,对平均包长501 B的正常流量能达到15.2 Gb/s的吞吐率,达到原始系统的4倍以上,比该文前期工作的结果提高了50%到70%。
With the speed of network application layer content detection technology increased to the order of 10Gb / s, the underlying TCP / IP protocol stack has become a new bottleneck restricting the detection speed of network intrusion detection system. The preliminary work in this paper uses the hardware and software features of 64-bit instructions, parallel computing instructions and operating system kernel data mapping to optimize performance of TCP checksum calculation, Hash value calculation of TCP connection table, and data replication from kernel mode to user mode . On this basis, this paper further studies the problem of Hash value calculation, half-open connection filtering and parallelization, and uses universal Hash (universal Hash) function as the Hash function to find the TCP connection table to avoid algorithm complexity attack. The parallel instructions in the Streaming SIMD extensions (SSE) instruction set are used to speed up the computation. The Bloom filter is used to filter the TCP half-open connections, and the multiple DLLs are used to obtain higher throughput through parallelization. The experimental results show that the TCP / IP protocol stack with three processor cores achieves a throughput of 4.4 Gb / s for the attack traffic with an average packet length of 110 B after the above improvement. For the normal traffic with an average packet length of 501 B The throughput of 15.2 Gb / s, which is more than four times that of the original system, is 50% to 70% higher than the result of the earlier work in this paper.