匹配预测在人工免疫入侵检测中的研究与应用

RESEARCH AND APPLICATION OF MATCHING PREDICTION IN ARTIFICIAL IMMUNE INTRUSION DETECTION

将人工免疫算法用于入侵检测,建立基于自体集的网络入侵检测系统,能有效检测出未知入侵方式,具有很好的适应性,但是仍存在辨别待检测模式速度过慢的问题。基于网络数据流的局部性,提出建立自体预测表记录当前成功与未知模式匹配过的自体的存储地址,通过优先匹配预测表中有记录的自体来节省冗余匹配次数提高检测系统的工作效率。通过分析和实验找出了预测表大小的最佳取值范围,并分析和证明了通过预测表匹配检测的效率要明显高于顺序匹配方法。

It is able to effectively detect the unknown intrusion patterns by applying the artificial immune algorithm to intrusion detection and establishing the self set-based networks intrusion detection system, and this has very good adaptability. However, there is the problem of too slow in distinguishing the modes to be detected. Based on the networks dataflow locality, we propose to build a prediction statement for the self to mark the storage addresses of them which have recently been successfully matched with unknown pattern. The redundant matching times are decreased and the efficiency of the system is improved by matching in prior those selves recorded in the prediction statement. In this paper we find out the best valuing range of the prediction statement size through analysis and experiment, we also analyse and prove that the efficiency of detection through prediction statement matching is clearly higher than through sequential matching approach.