一种自适应动态阴性选择入侵检测算法研究

STUDY ON A SELF-ADAPTED DYNAMIC NEGATIVE SELECTION ALGORITHM FOR INTRUSION DETECTION

基于亲和力培育的动态阴性选择算法用于产生能适应"非我"变化的检测器,该检测器可以用于入侵检测。由于算法参数亲和力阈值必须设定为常数,从而不能适应"自我"的变化。通过模拟T细胞的培育过程,提出了匹配区域模型,基于该模型进而提出了改进的动态阴性选择算法。通过设置匹配区域使检测器实现了自我耐受和自动适应"自我"的变化,从而解决入侵检测系统的自适应问题。通过异常检测的模拟实验表明所提出的算法更加有效,如时间耗费小、匹配区域能自动适应"自我"的变化。

Dynamic negative selection algorithm based on affinity maturation（DNSA-AM） is used in detectors which generate the variations adap- ting to non-ego,the detector is able to be used in intrusion detection. However,it can not adapt to the change of ego due to the affinity threshold of the algorithm＇s coefficient has to be the constant. In this paper,by simulating the cultivation process of T-cells maturation,a matching range model is proposed. Based on the model,an augmented dynamic negative selection algorithm is presented. By setting the matching range,self-tolerance and au- tomatic adaptation to the variation of ego on the detectors are achieved,thus the self-adapted issue in intrusion detection has been solved. The proposed algorithm is tested by simulation experiment for anomaly detection. The results show that the algorithm is more effective than DNSA-AM with several excellent characters, such as less time consuming and the matching range automatically adapts to the change of ego.