关键词: 入侵检测, 并行重组, 应用层协议

Abstract: Nowadays, the procedure of IP fragments and TCP flows serial reassembling technology have not been satisfied with the high speed network requirements. Meanwhile, every whole conversation in the network is almost similar from each other. Little distinctions exist among protocols of different application layers. It is suitable for adopting parallel reassembling algorithm. A parallel reassembling algorithm in application layer was introduced. Through this method, the balance of IP fragments and TCP flows reassembling was distributed reasonably in parallel reassembly process. A two-dimensional linked list was used to save key information. Too heavy work load of NIDS was avoided. An example of SMTP protocol was analyzed thoroughly．At last, in the light of the weakness of original algorithm，an improved algorithm was put forward. The whole mission was distributed in parts and computing ability of each node was fully used. So the parallel reassembling was reached. The test result shows that the improved algorithm is much more efficient than that of the original algorithm.

Key words: Intrusion detection, Parallel reassembling, Application protocol