多检测引擎监测的动态负载均衡算法

为解决多引擎入侵检测系统的负载均衡问题，提出一种检测引擎的动态负载调节算法。首先，监测各引擎节点计算负载；然后，以过载或空载节点出现为调度时机，以会话为单位调度重负载节点的流量到低负载节点，并遍历节点进行负载均衡的调节。由于以会话为调度单位，算法并不以负载的绝对平均为目的，只需保障各引擎节点不出现过载或空载即达到基本目标。采用KDD cup99数据集进行模拟实验，实验结果表明，与平均分配流量算法和基于较大流调整的安全分流算法相比，所提算法对检测引擎基于会话的负载均衡效果显著，运行开销较低且降低了重负载状态下的丢包率，有利于提高入侵检测系统的检测率。

Dynamic load balancing algorithm based on monitoring and adjusting of multiple detection engines

To solve the load balance problem of multi-engine intrusion detection system, a dynamic load regulation algorithm of detection engine was proposed. Firstly, load was calculated by monitoring each engine node. Then, the scheduling of the heavy load node was performed by scheduling the overload or no-load node as a scheduling opportunity, and the nodes were traversed to adjust the load balancing. As the session for the scheduling unit, the algorithm was not the absolute average load for the purpose, just to ensure that the engine node does not appear overload or no load to achieve the basic goal. The KDD cup99 data set was used to simulate experiment. The experimental results show that compared with average load allocation algorithm and secure load allocation, the proposed algorithm has a significant effect on session-based load balancing, the running cost is lower, and the packet loss rate under heavy load are lower, which improves the detection rate of intrusion detection system.