Abstract: With the rapid development of Internet bandwidth, the parallel processing technique can greatly improve the performance of network intrusion detection system. Network Intrusion Detection System (NIDS) in parallel environment requires complete connection while balancing the traffic load. That is, packets belonging to one session should go to the same processing node. Based on the stability and balance characteristics of B+ tree, this paper proposed a feedback load balancing algorithm based on B+ tree fast tuning. B+ tree has characteristics of high search efficiency and stability. This algorithm tuned the B+ tree structure and remapped flow table when unbalanced. The simulation results show that this algorithm is able to balance the connection density of B+ tree, achieves a really satisfactory balance of the sensors' load and reduces the packet loss rate.

Key words: Network Intrusion Detection System （NIDS）, load balance, B+ tree

摘要： 网络带宽飞速发展，应用并行处理技术可以大幅度提高网络入侵检测系统（NIDS）的性能。并行处理环境下的NIDS要求在对报文进行负载均衡分配时要保持连接的完整性，即相关的报文要分配到同一个处理节点。基于B+树的稳定和均衡特性，提出基于B+树快速调优的反馈式负载平衡算法(BLB)。该算法利用B+树搜索性能高、完全平衡的特性，当负载不均衡时，对B+树结构的流表进行快速调优，重映射流表，达到负载均衡。通过仿真实验，证明了该方案能快速使B+树结构连接密集度达到平衡，有效地均衡负载，降低系统的丢包率。

关键词: 网络入侵检测系统, 负载均衡, B+树