基于免疫机理的入侵检测系统的数学描述

Mathematic Description of Intrusion Detection System Based on Immune Mechanism

入侵检测问题可以看作是一种模式分类问题,但由于该问题具有一些固有特点如高维特征空间、模式之间的线性不可分性、正常和异常数据的严重不均匀性,使得直接使用传统的模式识别方法进行攻击检测时比较困难。自然免疫系统实际上是一个分布的具有自适应性和自学习能力的分类器,它通过学习、记忆和联想提取来解决识别和分类任务,基于自然免疫机理设计了一个入侵检测系统,并给出了它的性能指标的数学描述。重点是基于免疫机理设计了具有多层次性、多样性、独特性、异常检测能力、抑制虚警能力、健壮性、自适应性和动态防护性的入侵检测系统AI-IDS。

Intrusion detection can be looked as a problem of pattern classification. Since intrusion detection has some intrinsic characteristic such as high dimensional feature spaces, linearity non-differentiation, severe unevenness of normal pattern and anomaly pattern, it is very difficult to detect intrusion by using classical pattern recognition method directly. Nature immune system is a self-adaptive and self-learning classifier, which can accomplish recognition and classification by learning, remembrance and association. In this paper first we used four-tuple to define nature immune system and intrusion detection system, and then we gave the mathematic formalization description of performance index of intrusion detection system. Finally we put emphasis on designing an intrusion detection system based on immune mechanism, named AIIDS, which has many good features such as multiple layers, distributablility, diversity, uniqueness, anomaly detection, restraining false positive alarm, robustness, adaptability, dynamic defensive.