一种采用混合检测器的入侵检测系统

Intrusion detection system with hybrid detector

传统的基于免疫的入侵检测系统采用低级别的二进制检测器,妨碍了有意义的知识提取,对Nonself空间的覆盖也不完备。对二进制Self集的确定和有效检测器的生成方法进行了改进,研究了实值否定选择算法,加入了实值检测器,构成混合检测器集合,在检测阶段对会话和数据包同时进行异常检测。实验结果ROC曲线表明有较高的检测率和较低的误报率。

The low-level （binary） detector that the traditional artificial-immunity-based network intrusion detection systems adopt prevents the extraction of meaningful domain knowledge, and leads to incomplete cover of Nonself space. In this paper, the method of constructing binary self set and generating valid detector were improved. Real-valued negative selection algorithm was studied and the real-valued detectors were added to construct the hybrid detector congregation to detect abnormal behavior of both packets and sessions at detection stage. The ROC curves of experimental results show that it has higher detection rate and lower false alarm rate.