中文摘要：

网络入侵检测系统的处理速度越来越难以跟上网络的速度，使用多个探测器并行处理网络数据流可以大幅度提高网络入侵检测系统的性能，其关键问题是如何将网络流量划分给多个探测器．考虑负载均衡、攻击证据保持和效率三个方面的要求，提出了一种称为PABCS的流量划分算法．该算法利用TCP连接的状态进行流量的划分，提供了比通常使用的基于Hash的算法更好的负载均衡能力，同时，PABCS保证划分后不丢失检测攻击所需的信息．实验表明，文中算法能够达到1Gbps的处理能力．

英文摘要：

As the band of networks increases, the process speed of network-based intrusion detection systems （NIDSes） hardly keep up with the speed of networks. By arranging several sensors to deal with the traffic in parallel, the intrusion detection system＇s speed can be significantly increased. How to split the traffic to the sensors is the key problem of a parallel intrusion detection system. To resolve the problems, load balance, attack evidence keeping, and efficiency have to be concerned. Existing traffic partition algorithms cannot satisfy these requirements well, especially load balance, which directly affect the performance of a parallel intrusion detection system. A traffic partition algorithm called PABCS is proposed in the paper, which splits the traffic according to connections＇ states. PABCS provides better load balance than the usually used hashbased algorithm and guarantees that no attacks＇ evidence for intrusion detection is lost after partition. Moreover, in the experiment, the algorithm＇s process speed reaches 1Gbps.