基于免疫的网络动态实时异常检测模型

Dynamic and real-time network anomaly detection model——inspired by immune

网络异常检测已成为入侵检测系统发展的重要方向.现有异常检测模型对检测模式描述为一种静态方式,缺乏良好的自适应性和协同性,检测率低,难以满足高速网络环境下实时检测的需求.针对此,借鉴人体免疫系统优异的自学习自适应机制,提出了一种新的基于免疫的网络动态实时异常检测模型NAIM.该模型通过对检测模式进行动态描述,结合抗体细胞动态克隆原理,探讨种痘及疫苗分发机制,实现检测模式随真实网络环境同步演化,从而提高网络异常检测的准确性和及时性.

The network anomaly detection has become the promising direction of intrusion detection system. The existing anomaly detection models depict the detection pattern with a static way, which lack good adaptability and interoperability with low detection rate, so it is difficult to implement the real-time detection under the high- speed network environment. Our research uses the excellent mechanism of Self-learning and adaptability of the human immune system, and a novel real-time immune-based anomaly detection model（NAIM） is proposed. The model dynamically depicts detection model, combining the antibody＇s clone theory and disscussing the vaccina- tion and bacterin distribution mechanism, which achieves the detection mode＇s synchronous evolvement with the real network enviroment, thus improves the network anomaly detection＇s veracity and timeliness.