KR20020024507A - Parallel processing system for decision on intrusion - Google Patents

Abstract

The present invention relates to a system of board type hardware that can be mounted on a network gateway server, and performs intrusion detection at a high speed using parallel processing for packets flowing into an internal communication network.

The system to which the present invention is applied is composed of an intrusion detection engine 11, an intrusion pattern store 12, and an input / output interface 13. The intrusion detection engine 11 performs pattern matching in parallel with the intrusion case pattern stored in the intrusion pattern store 12 with respect to the network packet input as a parallel processor. The input / output interface 13 provides an interface with a computer on which a hardware board is mounted.

The device devised by the present invention can inspect network packets at a high speed, and when installed and operated at a network gateway, it is possible to effectively defend against external intrusions into internal communication networks and computer systems.

Description

Parallel processing system for decision on intrusion

It is a board-type hardware that can be mounted on a network gateway server, and relates to a system that performs intrusion detection at a high speed by using parallel processing for packets flowing into an internal communication network.

Detection of intrusions generated through external communication networks is performed in software at network gateways or individual computers. This method requires an excessive load on the system, which is a factor that degrades the overall performance of the system. In addition, when the intrusion cases are diversified and the number of intrusion patterns increases, efficient coping becomes difficult.

The present invention is to solve the problem of the conventional inefficient intrusion detection as described above,

Storing the pattern of intrusion cases in a separate storage (memory);

Receive a network packet through an interface with a computer system;

Its purpose is to perform fast intrusion detection by comparing incoming network packets with stored intrusion case patterns at high speed using a hardware parallel processor.

1 is a view showing the components and configuration diagram to which the present invention is applied.

◎ Explanation of symbols for main part of drawing

11: intrusion detection engine 12: intrusion pattern storage

13: interface

The present invention for achieving the above object is a hardware parallel processing system consisting of an intrusion detection engine 11, intrusion pattern storage 12 and input and output interface 13,

Has built-in memory to store patterns for intrusion cases

It provides input / output interface with a computer, and receives the packet that enters the network through this interface.

Characterized in that it consists of a parallel processor for comparing the input network packet and the stored intrusion case pattern.

Hereinafter, specific configurations and preferred embodiments of the present invention will be described with reference to the accompanying drawings.

1 is a schematic configuration diagram of a system to which the present invention is applied and includes an intrusion detection engine 11, an intrusion pattern store 12, and an input / output interface 13.

The intrusion detection engine 11 compares a single network packet input in parallel with a plurality of intrusion case patterns and compares the network packet input to the parallel processor with the intrusion case pattern.

The intrusion pattern store 12 is used for matching (matching) matching with a network packet input into an internal memory that stores intrusion case patterns collected from existing intrusion cases.

The input / output interface 13 provides a passage for transmitting and receiving data (network packet and match comparison result) with a computer equipped with the hardware devised by the present invention. The specification of the interface depends on the computer system to be mounted.

Packets introduced through the communication network are first stored in a specific buffer memory through the interface 13 of the system of the present invention, and the stored input packets are stored in the intrusion pattern store 12 by the intrusion detection engine 11. Matches with existing intrusion cases. As a result of the match comparison, normal network packets are forwarded to the internal network or to each computer. Packets suspected of intrusion are stored in a separate storage space, and an alert is issued to the network administrator or a user of the computer to make a separate determination and action.

As described above, the present invention performs the detection of current software network packets by using high-speed parallel processing hardware, enabling fast and accurate determination of input packets, thereby improving the efficiency of network and computer information protection. The effect can be maximized.

Claims (1)

In the hardware parallel processing system consisting of the intrusion detection engine 11, intrusion pattern storage 12 and input and output interface 13, Has built-in memory to store patterns for intrusion cases It provides input / output interface with a computer, and receives the packet that enters the network through this interface. A system comprising a parallel processor for comparing input network packets with stored intrusion case patterns.