基于免疫多样性的分布式入侵检测算法

Distributed Intrusion Detection Method Based on the Diversity of Immunity

提出了一种基于免疫多样性的分布式入侵检测方法,将支持向量机(SVM)作为抗体对入侵行为进行检测.首先,采用随机子空间方法生成多样化的SVM个体,再用人工免疫算法进化个体,然后通过引入Q统计量和互信息作为抗体多样性的度量,由此得到的检测器种群具有知识互补性,最后用集成的思想将种群中各检测器的结论进行合成.数值实验表明,所提方法生成的抗体更具多样性,检测精度高于单个SVM和Bagging方法,其分布式并行检测特性有利于加强检测系统的健壮性.

Based on the diversity of immunity, a distributed intrusion detection method is presented, in which the support vector machine（SVM） is used as an antibody to detect intrusion. In particular, the random subspace method is introduced to create various SVM individuals, and then the individuals are evolved with artificial immunity algorithm. By introducing Q-statistical and mutual information as the measures of the antibody＇s diversity, the detector group with the characteristic of mutual-supplied knowledge can be obtained. At last the results of all detectors in the population are integrated by the ensemble idea. This distributed parallel detection can strengthen the robustness of the system. Experiments show that this method can produce antibodies with better diversity, and the detection accuracy is better than a single SVM and Bagging method.