关键词: 入侵检测, 并行重组, 二维链表, 负载平衡

Abstract: A new parallel reassembly approach ALPPR and its prototype are presented in the light of the weakness of present Network Intrusion Detection Systems (NIDS), especially the procedure of IP fragments and TCP flows reassembling. We adopted an idea based on LogP model and masterslave mode to complete parallel task allocation and implementation. Some key information such as sessions and their corresponding states, operation results were saved by using a twodimensional linked list in parallel reassembly process. Meanwhile, a dynamic allocation strategy was used to keep load balancing. Experimental results show that ALPPR has good effectiveness and high performance.

Key words: intrusion detection, parallel reassembling, twodimensional linked list, load balance