基于免疫的入侵检测方法研究

Study on Immune-Based Intrusion Detection Approach

生物的免疫系统和计算机安全系统所面临及需要解决的问题十分类似,采用生物免疫思想的入侵检测技术可以结合 异常检测和误用检测的优点．研究了基于免疫的入侵检测方法,对Self集的确定和有效检测器的生成方法进行了研宛和改进, 基于反向选择机制提出了一种新的有效检测器生成算法,可以使用较少的有效检测器检测网络中的异常行为,从而提高了有效 检测器生成和入侵检测的速度．通过与基于已有的有效检测器生成算法的系统进行比较,使用本文的方法构造的入侵检测系统 速度更快,且有较高的准确性．

The problems a computer security system faced and needed to solve is quite similar with those of a biological immune system. Immune based intrusion detection techniques can incorporate the advantages of both anomaly intrusion detection and misuse intrusion detection. In this paper, immune based intrusion detection approaches are studied. The methods of constructing self set and generating valid detectors are researched and improved. A novel valid detector generation algorithm is proposed based on the negative selection mechanism. According to the new algorithm, less valid detectors are needed to detect the abnormal activities in the network. Therefore, the speed of generating valid detectors and intrusion detection is improved. By comparing with those based on existing algorithms, the intrusion detection system based on the new algorithm has higher speed and is accuracy.