基于二次否定剪切选择的入侵检测方法

Technique for Intrusion Detection Based on Dual Negative Splitting Selection Algorithm

针对传统否定选择算法可能引起检测器"流失"而降低检测率的缺陷,提出一种基于二次否性剪切选择的入侵检测方法。该算法将新生成的检测器与成熟检测器集合作比对,提升检测器的耐受性;将通过耐受性检测的检测器与训练的自体集作比对,如果出现覆盖则对检测器进行剪切,并将其置入成熟检测器集合;最后,对成熟检测器集合进行优化。实验结果表明,与现有的几种检测方法相比,该方法拥有更高的检测率、更低的误报率以及更少的检测器数量。

Due to the possible case of detection-rate declining from detectors-losing of traditional negative selection algorithms,a novel technique for intrusion detection based on dual negative splitting selection is proposed.Firstly,the comparison between the newly generated detector and the ones in the mature detector set is conducted to enhance the tolerance of the detectors.Then,the training self-sets are compared with the qualified detectors passing the tolerance examination.If there are intersections between the above two,‘splitting’will be done towards the detectors.And the several new ones will be included by the mature detector set.Finally,the optimization will be conducted to increase the detecting performance.Experimental results demonstrate that,compared with the current several detecting techniques,the proposed one owns much higher detecting rate,less false-alarm rate and fewer detectors.