Architecture of Intrusion Detection for High-Speed Networks

The architecture of intrusion detection for high speed networks environment is put forward The architecture effectively solves the performance problems of network security analysis in multi line and large bandwidth backbone networks by integrating raw signal capture （i e packets capture and stream reassemble）, aggression and balance, and efficient data stream engine The architecture has clear hierarchy, high scalability and flexibility and it can fit complex network environment and many types of interfaces from low speed access networks to high speed backbone networks （i e multi OC48c lines） The ID system based on such architecture can achieve line speed performance in eight OC48c lines network environment when sixteen data streams are configured, which exceeds the best formally claimed performance report of nowadays ID systems