基于免疫的异常检测改进算法

An improved algorithm of anomaly detection based on IMMUNOLOGY

为了解决异常检测中误报率高、自适应性差的问题,本文提出了一种基于免疫的异常检测改进算法。考虑到系统调用序列的稳定性,算法采用特权程序的系统调用短序列作为抗原与抗体,并建立了基于特权程序的系统调用的Markov模型优化抗体库的变异方向。实验结果表明,该算法相比已有的异常检测算法具有自适应、误报率低的优点,相比传统免疫算法具有变异成功率高、计算量小的优点。

In order to solve the problem of high false positive rate and low adaptability, an improved algorithm of anomaly detection based-on immunology is presented in this paper. Considering the stability of system calls, the algorithm uses the system call sequence of privileged program as antigen and antibody and establishes a Markov model to optimize the variation of antibody set. The experiment shows that the algorithm is more adaptable than other algorithms and has a low false positive rate. Meanwhile, comparing to traditional immune algorithms, the algorithm has higher successful variation rate and less computation.