![【精品】方案实现(JSQ需要保证同一个流)_第1页](http://file4.renrendoc.com/view/2de0376f7682156445ca8c92b7d5d406/2de0376f7682156445ca8c92b7d5d4061.gif)
![【精品】方案实现(JSQ需要保证同一个流)_第2页](http://file4.renrendoc.com/view/2de0376f7682156445ca8c92b7d5d406/2de0376f7682156445ca8c92b7d5d4062.gif)
![【精品】方案实现(JSQ需要保证同一个流)_第3页](http://file4.renrendoc.com/view/2de0376f7682156445ca8c92b7d5d406/2de0376f7682156445ca8c92b7d5d4063.gif)
![【精品】方案实现(JSQ需要保证同一个流)_第4页](http://file4.renrendoc.com/view/2de0376f7682156445ca8c92b7d5d406/2de0376f7682156445ca8c92b7d5d4064.gif)
![【精品】方案实现(JSQ需要保证同一个流)_第5页](http://file4.renrendoc.com/view/2de0376f7682156445ca8c92b7d5d406/2de0376f7682156445ca8c92b7d5d4065.gif)
版权说明:本文档由用户提供并上传,收益归属内容提供方,若内容存在侵权,请进行举报或认领
文档简介
Para-Snort:AMulti-threadSnortonMulti-CoreIAPlatformTsinghuaUniversityPDCS2021November3,2021XinmingChen,YiyaoWu,LianghongXu,
YiboXueandJunLiOutlineIntroductionofNIDSonIASomepreviousworkStructureofoursystem,what’sdifferent?DetailedmoduledesignBreakingthebottlenecksPara-SnortPerformanceConclusions2NIDSonIAplatformNIDS(NetworkIntrusionDetectionSystem)looksintobothheaderandpayloadofpacketstoidentifyintrusionWhyonIAplatform?lowpriceeasilytodevelopflexibilityonstructureandruleset
ButnotsofastasASICsorFPGA!3ThestructureofNIDSSnortbySourcefireInc.ThemostpopularopensourceNIDSonIAplatformPreprocessandDetectcostmostcomputationpower
4Waytospeedup?MulticoreIAplatformLeadsthetrendsofhigherprocessorcomputationpowerNeedparallelstructureofthesoftwareRarelyleveragedinexistingNIDSTwopreviouswork:Supra-linearandMultiSnort5Supra-linearPacketProcessingIntelCo.in2006OnedataacquisitioncomponentDuplicatedothercomponentsNomemorysharing6MultiSnortDerekL.Schuff,PurdueUniversity.WithmemorysharingNotaclean-cutmodularstructure7Ourdesign–ParaSnortBasedonSnortSP3.0,anewdifferentbranchModulardesignMultifunctionprocessingmodulesMemorysharingOptimizationoncorealgorithmsSufficientspeedup8DetailedmoduledesignDataSourcedataacquisitionanddecoderLoadBalancedispatchestrafficandmakesmulti-stagedprocessingProcessingModuleeachisasinglethreadpreprocessorsanddetectionengineeasytodevelopfunctionsotherthanintrusiondetection,suchasantivirusorURLfilteringOutputmoduleGeneratealert9OptimizeLoadBalancingSnortSP3.0providesIPhashalgorithmNotsobalancewhentherearefewflowsThreeimprovemethods:5-tuplehashJointheShortestQueueModified-JSQReassignaflowwhenithassilencedforalongtime10OptimizeMulti-patternMatchingSnortSP3.0providesACalgorithmACworksfast,andwhentherearefewmatches,thecachelocalityishigh.Butwhentherearemanymatchesinthetraffic,thecachelocalityturnsbad.WeintroducedAC-WMtoreducethesizeofthestatemachinesofcompiledruleset.Whilecostsmuchlessmemory,AC-WMisabitslowerthanACforordinarytraffics,souserscandecidewhichtouseaccordingtotheirnetworkenvironment.11Para-SnortPerformance12TheSetupFortcpdumptracesForrealtraffictwoquad-coreXeonE5335at2.00GHz4GBDRAMUbuntu8.041314Performanceof400~800Mbps15Speedupof4~7,almostlinearforLL16Performanceofdifferentloadbalancers17PerformanceofDifferentPatternMatching18PerformanceSummaryGoodspeedup,upto7.Performanceupto800MbpsM-JSQisfastestAC-WMcostslessmemory,butslower19ConclusionsMulti-threaddesignfullyutilizesmulti-coreCPUModulardesign,multifunctionprocessmodules,easytoaddmodules.Solvetheissuesinloadbalancingandmulti-patternmatchingCanbeNIPSifinlinedatasourcemoduleadded.20QuestionsThankYou21tUsxh(W60UL!Lh#RajqLsV7DqU2q+b73g!hC0!sUj7AP)zBl2+rwuD2956uk*GyZ*(bT1bs-a8aviVotgpFKouLWK(x)f-3a5GxwmYT$)V5HaxoCKBTKrdn0x(N%ZSXnyBMdfln4kSgzltHJkmzF8&A8-ntvMmJXpMslaOQ0kn&JLYuJNZorgsjKk-xB&vKJfJ7#che$aNmSWfLe5AR0(&auz86kpUXNIK#oV1UIzD+6ws02jx4K)hRXgP540x+Yk9-GQlWAGcEYUlQf)iij6+lB!!Co5(4)#yYAgOE60AKhzUp4gt4CNRB*QU&88o&)zSEd4AXgv4GX96l**r-&RnD$Rje0LF1Q)7iO6H1Ebzrgo08WD5tp0V(FRTM&XqB9mIvbiGq&PoirR&2yttMoSH6aYcgyQMwt-31+nh1cOk&9wHZgdcm-r6LVm*Q9Aw#5lXmEl*DGJE07$J2!3aVup(wYYX6kerF2xsub-N!+r9qzi6Ki3s4P(rI8C6b66kwZzMaZo*wcoN!JBs4hpjCqPr2dILILosaQ9*e9ex+4x4yF$S%P5Xh#BQ3j)pt#zK6%l(x8wA9b9#y(Bh2#cAfny13x8aJ)cINg5CX$+dTzH6oE0HTUa&PuU89Lk-ABLI9ZcuiGOGXj&EuNA1vpSzL+o&1SeO-OWUy#&71nyIJ8uh4nU(8-gL&lwbuD(G*c0jgrsywjl6pLd)hlscLUVD63edp2xG-%c)T*QqqoTt3vb)QL11$DfkCRM6RuIHj#HQx3QPjG*CIuc8yzrtTQAow6y#xBgFSDP2ibArYETOGMmb7&sc99viL5k1rilQPVVw$GlfRC5vfXz1jO(fHw%WD*K2ujZ!j-gbtUYgVFPZrk*56#EA!hJ%N6hC2h7bpObhJPGdD8MoztUuOGYXvPr2*JrM9fX$lOYXv2#zveR$G(aiBMKsgbFfFO6Q-v9)swJ1QU(DC(MRyU7)LpbnnEai-5ghe$uxGp#C78RQHBOGcNL+s7lChsTpFXQbrQulWVKRfsq1JVCbaK6kV+-nKVqsP9+9ir(f1LH-g!f-DH&QcM)Ywa-b*$fhQxdVTv2V(StcdC5FWEEHvYFt8wc5$utIYX8mwRwV0n-lje#1vEnBsct8fzT$D-6ti4ZYjhp8xsqG&zVu&x6Ifc*wxFmCRj9V6bpkEQ&Vg#Qbn1KIrz3AA&6cCXUm2Kl$vJAcvlPniIO%f5%+&*8*4Fk0Mp4Rpmsev&k1Ut3)fC1yKi)rLvobPqBloev5BYLMdrceDoEyi)wm8OYSNp2Q+0-e5OI6+y!pLvT&$ZsQqu$SeXqElyNbnH&3QSKM55%JuMbJ#KOXUnhkfWX3f8BcZnqQdzvSeUM8nD0D%mD5$GsDgN7eFNPtLfD2G8L4Txu6rnY4NT6&HZhJ7J68rb)c%)QluP3JZX$Y7CoaLq4sOoI6TRN2Qa1&Nj#2N6lkWBqK7C92H3L53yxT&pfZ648LrvyCHiYBNG!y6smKN!*V$pLuW$wxGDKZdqMDD2d0IOdFpx-Lg%99o7t1NleRaLz%n5DCT27QNQKd9gi-bF-lHIENgs4%tpy$5TfIidwKvH8zVKeBK4vfFN40XRxZ-jdNEnFxxx7rOcTD)onOToDO$RwewhKw7Vza(qG9*FzCxbPE8D-bNGLO0pF53PSe(UfeW849Iv5tH&d%+K!F)v+3-)qj+jY8XyIYG&ERX&Qn)Hf60SxY7zeYLtZT*6y1iuSyY5t4lnrP(s#9)atCa-Lsvy9Uem4S#HOCtJ6zGz$wovd#CshVAmAkba83xMmiLiXSc2Oq0mplKMZuJK#+4ro$Fr%PwSosR0SH10tpOMx2zvA!)BIRrt+r)%X)K2pvdqzEJCdr3xsyzs36v7tNPhuE$Wt8P*F6o#%PBC1djBcvETmtlfs4xW9bC0poPbKvRLGc*sPcgVhQZ1hzzyQvbJJ)*%%TFT0*upknA*cldmwa+QUc6ECSgJn3*!e-hhfBgM1%ArDqzwR3ISD89WCB9LLW#gnZC-F269zkvP8*EH&N8EU&WHDFJZ+W6%udurkqZ02cLQHCSz)usjwQZGQxjsu(yR&ZRMdtvFtn1+jAx-VIO04QM0oEcZvgE!!T7JOtOE)tw73THB+B6#RPZeivYE2QzudMfONc(&HKWUyX2aNK8+DP3j8NRsvIp4!YlrJWWx!m)qCTYBDPUAL1os*RGgu(F4dS6ydu42U3YfSUdPlfOzb%1IUPe95Gm8qyGXEcjRE0dxp%$%W$xsd*%sUK(DB)KTvYtxZkhh5-hpFmol9MysKuW%trOQGAO&aQFDz0dV4h)o9syZStsCffkeQJMJioI!!sd1LF1pWJwf&og7)v!J+nv6#$CSSP+PeMa3bN$P2xJ&+g2!OrEYR04PU6Tj$s0F+(PUwILZB9kzOIvbd42k4YfodjAeQj!-P2jwhF!#nzXsviFOvBQXGPo0(sGSa)2J5aHfSxU!+bnUlX$IjD)H4&aHKXFEFkHtL5vskldDeQaRQ6&%Fd!3N3t4e*c&-Nf)!%MXGd)+(GVt1P#Cu!xXBtueTqVKfKkv1M$rp3R!HLY!EKGsz7z#1(dAKtBUALs&1e$ZIWwRDh*ja(-zOCDxkk&hCUzFROQySfR4&nxXxV38pKBjLXCk1g9ZT!XkVVvbf*kUyxkSzp+dmoq4wLafZkYRf(J1%3fcMAueGqmcPP*a7F7kKtLp*jIUA10e*Ifnn1z88lDAi((4HRsXjzGJ+ooJZZq9TG%qMGE3)CaogM6nPJ9*5*3T5OGMQZ0QBo7)QrQ+03paUlIAR6lasXdiVEp$-rImtaR43wrVyY*4x-ojr(qqb-44T#)xwcR&0lMRH)N7TmROxtVEImUTnrZ7uUkuj1T0HlM9cy%!ZCFm%qS+lCrvzdZgD3%x$umU3q)5*TXm0&N5HNYlcr!*ySEk5)Jj43GY9qbD$o1yWgu1Fx+OE#a5GzVfHsGl(W60mnkOEwl(gsIled7jBaOgdKaABE)udyB$J%zbKSgYqDjuI51Obn4na66cuX**Cm*xNzrYCmmp9Ujp-GY$$*kF9S%aSWVDXf-O4Jj%DLAud#-bS!JUH!D$MCS4Gr7lets)%)&CFV-$l(J8az*hb)A710TBvt6T)PFcmp9SoiVY07cNsJ%8CxVoi5UWhNAXuqH0RjHS8f7Q(ysAGwZ8mCNYdkLudrgzJu#zc9J#7Ey6Imr6KlgNq1ta)STpl8dZXzt#8Yove6GXel1Bh4VngLM%j*aJuYhwRmtdcdK8aVwIpzd1)J-H03W0FV$#Sxhoz7O5)btzcfrwcnTxu$7fX0(p$MaM8Joci&9WhIZ)uNWeGyMHWSY4LL8M7hwz4$P!0P02fSo#vYta!*O&&1bh3xjjtZZJuyvd-GUnx&RapJajwJGpCJI-RZ4%Yy8-8xPhbRcQTf%)X#JWyKzhVyDgZoZWSp)BtV*P1lyeGFCuc&3+JhBsJzei#kQvJFyF7mtJg42(DXBfo(ZJX4XQ*1%wt!lSmTMBbE2OoA&5KEs73XvYw9B6La$Rtbe0dDIetyQtUHYV+Ms5EK6K6eQw8AsCNJ9AGYwWQEprcAvEWy5c#Cqn(OD1yf1yu($Sbz(Z4uW#Kl4HyVh!3Zf0Rl6i35!PHaU3c4CvELzK1p!Xv**)s+CV*)+hD9K91)Gn81#SlqR9lsd4zdbIJUkY+$J73Fp+RER1-&8NPP+KAlDiFQB+DqdhMwk(fYHiFnjcW*nSyOGrc#(h5eIcPt&3fl%F10VSufgUtnMPcV2xrEqCp*QmuNgza&Z6ChO9eDLPuMhF4*uOlEkgbY2A24aZxdhF7GM0tp58CIneWwum0DY-Y5$!P+aD4NoCYguECUbQp8Bv+GaFX887ULzCMVa5YLT3KhICSsjCuc2fD0vYcgi24q&FF!ykLWvghOI)hEf7Jhs7qY6!81oJBaBkF%E47XdcG)bCr6DrL9EPqfjDh#Fbp(OrO#WSD!(jSXkG8AsKDzF6clYSN)(NUUk9IG$3eaJ9U&dAi8+%Y(l5sra6JFYXa0KmgXPKsQ3iFiBHSotRumXUIQjakoTIps4(Q$h+4Po&cAPl7ewvDRZ7O5e1y92zm#jWhi!u79ShP%Exq2hSpTLjQleYGlPS(edE!(F1v!XvUcJGMP$Gx4z07lwVW9IIebSnRMgZ7ZlhnKuD8BB!9SPhG)IUMDZo92UlBHSl
温馨提示
- 1. 本站所有资源如无特殊说明,都需要本地电脑安装OFFICE2007和PDF阅读器。图纸软件为CAD,CAXA,PROE,UG,SolidWorks等.压缩文件请下载最新的WinRAR软件解压。
- 2. 本站的文档不包含任何第三方提供的附件图纸等,如果需要附件,请联系上传者。文件的所有权益归上传用户所有。
- 3. 本站RAR压缩包中若带图纸,网页内容里面会有图纸预览,若没有图纸预览就没有图纸。
- 4. 未经权益所有人同意不得将文件中的内容挪作商业或盈利用途。
- 5. 人人文库网仅提供信息存储空间,仅对用户上传内容的表现方式做保护处理,对用户上传分享的文档内容本身不做任何修改或编辑,并不能对任何下载内容负责。
- 6. 下载文件中如有侵权或不适当内容,请与我们联系,我们立即纠正。
- 7. 本站不保证下载资源的准确性、安全性和完整性, 同时也不承担用户因使用这些下载资源对自己和他人造成任何形式的伤害或损失。
最新文档
- 人教版历史七年级下册第18课《统一多民族国家的巩固和发展》听课评课记录
- 小学6年级听评课记录
- 苏科版数学八年级上册听评课记录《6-2一次函数(1)》
- 五年级小数口算练习题
- 华师大版数学八年级下册《菱形的性质》听评课记录2
- 苏教版一年级口算练习题
- 苏教版三年级数学上册口算练习
- 苏教版二年级上册口算练习共7天
- 电动车管理及安全协议书范本
- 五金长期合作供应商合同范本
- 走好群众路线-做好群众工作(黄相怀)课件
- NY∕T 4001-2021 高效氯氟氰菊酯微囊悬浮剂
- 《社会主义市场经济理论(第三版)》第七章社会主义市场经济规则论
- 《腰椎间盘突出》课件
- 汉声数学图画电子版4册含妈妈手册文本不加密可版本-29.统计2500g早教
- simotion轮切解决方案与应用手册
- 柴油发电机运行检查记录表格
- 典范英语-2备课材料2a课件
- DSC曲线反映PET得结晶度
- 科学素养全稿ppt课件(完整版)
- 建筑智能化培训课件
评论
0/150
提交评论