一种改进的否定选择算法在入侵检测中的应用

APPLICATION OF AN IMPROVED NEGATIVE SELECTION ALGORITHM IN INTRUSION DETECTION

有效的检测器生成算法是入侵检测的核心问题。针对现有算法存在检测率低、匹配阈值固定、检测器集合庞大等问题,通过对人工免疫系统中否定选择算法原理的分析,提出一种生成最有效检测器集的变阈值模糊匹配否定选择免疫算法,并将该算法应用到入侵检测系统中。算法采用随机生成和基因库相结合的候选检测器生成机制,在保证检测器多样性的同时,提高了候选检测器成为成熟检测器的比率。为了消除冗余检测器的产生,提高检测器集的检测效率,算法在模糊匹配的基础上生成有效检测器集。同时,匹配阈值可变,可大幅降低黑洞数量。实验结果表明,该算法提高了入侵检测率,降低了虚警率,整体检测性能较好。

Efficient detector generation algorithm is the core of intrusion detection.Aiming at the problems of existing algorithms such as low detection rate,unhandy matching threshold value and large detector set size,in this paper we analyse the negative selection algorithm principle in artificial immune system,put forward an adjustable threshold and fuzzy matching negative selection immune algorithm for generating the most effective detector set,and apply the algorithm to intrusion detection system.The algorithm adopts the candidate detector generation mechanism which combines random generation with gene library,it ensures the diversity of detector while increasing the proportion of making candidate detectors to mature ones.In order to eliminate the occurrence of redundant detectors and increase the detecting efficiency of detector sets,in the algorithm an effective detector set is created on the basis of fuzzy matching.At the same time,the number of black holes can be reduced sharply through adjusting the matching threshold.Experimental results show that the algorithm improves the detection rate and reduces the false alarm rate,so it has a better overall detection performance.