基于免疫和模糊综合评判的入侵检测模型研究

Study on intrusion detection model based on immune and fuzzy judgment

应用人体免疫系统的特异性免疫的分类,设计了一个入侵检测模型,将入侵检测模块分为固有检测模块和适应性检测模块。固有检测模块考虑继承目前已有的知识;适应性检测模块针对目前异常检测算法难以确定评判正常和异常的阈值以及检测特征数量多难以综合评判的问题,提出了一种具体的异常检测算法——FLADA。该算法借鉴了模糊数学的理论,采用模糊综合评判和层次分析法相结合。实验证明,该方法不仅能准确地检测出已知攻击,还能较好地检测出未知攻击。

Based on the classification of specific immunity in human immune system, a model of intrusion detection was designed, The intrusion detection module was classified to the innate detection module and the adaptive detection module in this model. The innate detection module inherits available rides. To solve the problem such as difficulty to certain the threshold of normal and anomaly and difficulty to judge synthetically for multiple data in anomaly detection, the adaptive detection module presented an algorithm of anomaly detection： Fuzzy and Level-based Anomaly Detection Algorithm （FLADA）, which has benefited from fuzzy mathematics and integrates fuzzy judgment with hierarchical analysis, Experiments show that the method can detect not only defined intrusion fast, but also undefined intrusion fairly.