Dynamic load balancing for network intrusion detection systems based on distributed architectures

摘要: Increasing traffic and the necessity of stateful analyses impose strong computational requirements on network intrusion detection systems (NIDS), motivate need distributed architectures with multiple sensors. In a context high heavy tailed characteristics, static rules for dispatching slices among sensors cause severe imbalance. Hence, NIDS architecture must be combined adequate mechanisms dynamic load redistribution. this paper, we propose compare different policies activation/deactivation balancer. particular, consider single vs. double threshold schemes, representations based resource measures aggregation models. Our experimental results show that best combination scheme linear is able to achieve really satisfactory balance sensor loads together sensible reduction number balancer activations.