An Improved Artificial Immune System-Based Network Intrusion Detection by Using Rough Set

With theincreasing worldwide network attacks, intrusion detection (ID) hasbecome a popularresearch topic inlast decade.Several artificial intelligence techniques such as neural networks and fuzzy logichave been applied in ID. The results are varied. Theintrusion detection accuracy is themain focus for intrusion detection systems (IDS). Most research activities in the area aiming to improve the ID accuracy. In this paper, anartificial immune system (AIS) based network intrusion detection scheme is proposed. An optimized feature selection using Rough Set (RS) theory is defined. The complexity issue is addressed in the design of the algorithms. The scheme is tested on the widely used KDD CUP 99 dataset. The result shows that theproposed scheme outperforms other schemes in detection accuracy.

Intrusion detection based on rough set and artificial immune

In order to increase intrusion detection rate and decrease false positive detection rate,a novel intrusion detection algorithm based on rough set and artificial immune( RSAI-IDA) is proposed.Using artificial immune in intrusion detection,anomaly actions are detected adaptively,and with rough set,effective antibodies can be obtained. A scheme,in which antibodies are partly generated randomly and others are from the artificial immune algorithm,is applied to ensure the antibodies diversity. Finally,simulations of RSAI-IDA and comparisons with other algorithms are given. The experimental results illustrate that the novel algorithm achieves more effective performances on anomaly intrusion detection,where the algorithm's time complexity decreases,the true positive detection rate increases,and the false positive detection rate is decreased.

Multi-Agent Network Intrusion Active Defense Model Based on Immune Theory

Inspired by the immune theory and multi-agent systems, an immune multi-agent active defense model for network intrusion is established. The concept of immune agent is introduced, and its running mechanism is established. The method, which uses antibody concentration to quantitatively describe the degree of intrusion danger, is presented. This model implements the multi-layer and distributed active defense mechanism for network intrusion. The experiment results show that this model is a good solution to the network security defense.

A Network Intrusion Detection Model Based on Immune Multi-Agent

A new network intrusion detection model based on immune multi-agent theory is established and the concept of multi-agents is advanced to realize the logical structure and running mechanism of immune multi-agent as well as multi-level and distributed detection mechanism against network intrusion, using the adaptability, diversity and memory properties of artificial immune algorithm and combing the robustness and distributed character of multi-agents system structure. The experiment results conclude that this system is working pretty well in network security detection.

Novel design concepts for network intrusion systems based on dendritic cells processes

An abstraction and an investigation to the worth of dendritic cells (DCs) ability to collect, process and present antigens are presented. Computationally, this ability is shown to provide a feature reduction mechanism that could be used to reduce the complexity of a search space, a mechanism for development of highly specialized detector sets as well as a selective mechanism used in directing subsets of detectors to be activated when certain danger signals are present. It is shown that DCs, primed by different danger signals, provide a basis for different anomaly detection pathways. Different antigen-peptides are developed based on different danger signals present, and these peptides are presented to different adaptive layer detectors that correspond to the given danger signal. Experiments are then undertaken that compare current approaches, where a full antigen structure and the whole repertoire of detectors are used, with the proposed approach. Experiment results indicate that such an approach is feasible and can help reduce the complexity of the problem by significant levels. It also improves the efficiency of the system, given that only a subset of detectors are involved during the detection process. Having several different sets of detectors increases the robustness of the resulting system. Detectors developed based on peptides are also highly discriminative, which reduces the false positives rates, making the approach feasible for a real time environment.

Multimodal Evolution Approach to Multidimensional Intrusion Detection

An artificial immunity based multimodal evolution algorithm is developed to generate detectors with variable coverage for multidimensional intrusion detection. In this algorithm, a proper fitness function is used to drive the detectors to fill in those detection holes close to self set or among self spheres, and genetic algorithm is adopted to reduce the negative effects that different distribution of self imposes on the detector generating process. The validity of the algorithm is tested with spherical and rectangular detectors, respectively, and experiments performed on two real data sets （machine learning database and DAPRA99） indicate that the proposed algorithm can obtain good results on spherical detectors, and that its performances in detection rate, false alarm rate, stabih＇ty, time cost, and adaptability to incomplete training set on spherical detectors are all better than on rectangular ones.

基于人工智能技术的轻量级网络入侵检测系统设计

以提升网络入侵检测技术水平为目的,设计基于人工智能技术的轻量级网络入侵检测系统。该系统数据采集层利用若干个用户探针连接IDS检测服务器后,使用网络数据包捕获模块捕获用户网络运行数据,再通过传输层内防火墙、核心交换机和MQTT/CoAP通信协议将用户网络运行数据发送到逻辑运算层内,该层利用数据预处理模块对用户网络运行数据进行去噪预处理后,将其输入到基于人工智能的网络入侵检测模块内,通过该模块输出轻量级网络入侵检测结果,然后将检测结果发送到展示层,通过入侵告警信息、数据可视化展示等模块实现人机交互。实验表明:该系统运行较为稳定,可有效检测不同类型网络入侵的同时,其检测及时性和入侵告警能力较好,应用效果良好。

An immunity-based technique to detect network intrusions

This paper briefly reviews other people’s works on negative selection algorithm and their shortcomings. With a view to the real problem to be solved, authors bring forward two assumptions, based on which a new immune algorithm, multi-level negative selection algorithm, is developed. In essence, compared with Forrest’s negative selection algorithm, it enhances detector generation efficiency. This algorithm integrates clonal selection process into negative selection process for the first time. After careful analyses, this algorithm was applied to network intrusion detection and achieved good results.

内生安全支撑的新型网络体系结构与关键技术研究构想与成果展望

目前,网络威胁已进入未知威胁时代。然而,传统网络安全基于“马奇诺”式的静态被动防御,缺乏自主性以及自我演化进化的内生安全能力,对未知威胁基本上只能通过“打补丁”的方式事后弥补。这种亡羊补牢的处理方法往往伴随巨大的损失,必须寻求新的思路。网络安全保护系统与人体免疫系统具有惊人的相似性,免疫系统无需病毒先验知识,学习推演能力强,天生具备未知病毒的灭活能力。有鉴于此,本文以“未知威胁”为核心,以“人工免疫”为创新手段,紧紧围绕未知威胁环境下网络安全系统自身演进机理、未知威胁环境下网络自适应可信传输条件、不完备条件下未知威胁快速发现机制,以及不完备条件下未知威胁快速应对策略等四大关键科学问题,分别开展1个基础理论、3大关键技术及1套原型系统的研究。通过面向内生安全基于免疫的新型网络体系结构与基础理论,基于mRNA免疫的可信任网络寻址与路由控制技术、大规模动态可信行为分析与未知网络威胁发现技术、基于免疫的网络动态风险评估与控制技术等研究,突破传统网络安全以“打补丁”为主被动防御的技术瓶颈,藉此奠定内生安全免疫支撑的新型网络系统的基础理论和方法。通过构建一个面向内生安全基于免疫的新型网络原型系统,对研究成果进行技术验证,同时根据验证结果对所提出理论及方法进行改进和提高。通过上述研究实现以下5个方面创新:一是,面向内生安全的网络空间安全免疫体系结构;二是,基于mRNA免疫的可信任网络寻址与路由控制方法;三是,基于基因进化演化的未知网络威胁自适应发现方法;四是,基于人体体温预警机制的网络动态风险实时定量计算方法;五是,基于特异性免疫的快速动态反馈迭代网络风险控制方法。本研究成果对网络空间安全保护的科学研究、技术研发、产业发展等具有十分重要的理论意义和实际应用价值。

An immune based dynamic intrusion detection model

With the dynamic description method for self and antigen, and the concept of dynamic immune tolerance for lymphocytes in network-security domain presented in this paper, a new immune based dynamic intrusion detection model (Idid) is proposed. In Idid, the dynamic models and the corresponding recursive equations of the lifecycle of ma- ture lymphocytes, and the immune memory are built. Therefore, the problem of the dynamic description of self and nonself in computer immune systems is solved, and the defect of the low efficiency of mature lymphocyte generating in traditional computer immune systems is overcome. Simu- lations of this model are performed, and the comparison experiment results show that the proposed dynamic intrusion detection model has a better adaptability than the traditional methods.

基于人工免疫的高效通信网络入侵检测方法

当前的通信网络入侵检测节点多为分布式设置,限制检测范围的扩展,导致误检率提高,为此提出对基于人工免疫的高效通信网络入侵检测方法的设计与验证分析。根据实际检测需求及标准的变化,先进行入侵特征提取,采用多目标的形式,扩大实际的检测范围,布设多目标检测节点,构建人工免疫网络入侵检测模型,采用自适应匹配实现入侵检测。最终的测试结果表明:对比于设定传统改进Adaboost算法通信网络入侵检测组、传统自监督特征增强CNN-BiLSTM网络入侵检测组,本次所设计的人工免疫通信网络入侵检测组最终得出的误检率被较好地控制在了20%以下,说明该种入侵检测方法的针对性更强,检测覆盖范围较为灵活,误差可控,具有实际的应用价值。

基于粗糙集和人工免疫的集成入侵检测模型

针对当前入侵检测存在的问题,通过引入粗糙集方法,综合误用检测和异常检测设计了一种基于粗糙集和人工免疫的集成入侵检测(RSAI-IID)模型,提出了一种在入侵检测中实现疫苗注入的方法。采用粗糙集方法获取疫苗,并保证了疫苗的优良性,优化检测性能;误用检测筛掉已知的入侵行为,提高检测的速度;异常检测针对未知攻击进行实时检测。最后在KDD99数据集上进行实验仿真,验证了模型的可行性和有效性。

基于免疫危险理论的新型网络入侵检测方法研究

该文提出了一种基于免疫危险理论(Immune Danger Theory,IDT)的新型网络入侵检测方法.该方法给出了抗原凋亡和坏死过程的定义,定量计算危险信号,并以此检测网络攻击.仿真实验表明该方法不仅保持传统AIS自学习、自适应、多样性等优点,而且能降低免疫学习时间和错误肯定率,是一种网络入侵检测的好方法.

一种基于人工免疫的网络安全实时风险检测方法

依据人体免疫系统中抗体浓度的变化与人体生病的严重程度的对应关系,本文提出了一种基于人工免疫的网络安全实时风险检测的方法,给出了自体、非自体、抗体和抗原实现方式,建立了抗体的克隆选择、学习机制以及生命周期模型,提出了基于抗体浓度的网络安全风险的定量计算模型.实验表明该方法具有定量计算、实时性等优点,是网络安全实时风险检测的一个较好的解决方案.

基于人工免疫模型的入侵检测系统中检测器生成算法的分析与改进

对检测器生成算法中的逐级反向选择算法进行改进,通过对检测器表示方式和检测器生成算法的修改,解决了原算法中检测器数量过多的问题,提高了检测器的生成效率和检测效率.算法的测试结果表明,改进后的算法在检测精度不变的前提下降低了描述相同非自体空间需要的检测器数量,提高了算法执行效率,使其更接近实时监测的要求.

人工免疫原理在网络入侵检测中的应用

分析研究了人工免疫原理在网络入侵检测中应用的可行性，结合人工免疫模型和数据挖掘技术建立了一个网络入侵检测系统模型，对抗体生成过程中的关键算法进行了描述。

基于人工免疫的新型入侵检测系统研究

分析研究了人工免疫原理在网络入侵检测中应用的可行性,结合人工免疫模型和数据挖掘技术建立了一个网络入侵检测系统模型。对抗体生成过程中的关键算法进行了描述。为克服在抗体生成阶段由于采用遗传算子导致时空效率不佳的缺陷,将数据流分割成字符串集合,根据数理统计原理,讨论了分割参数和检测器数目的选定,使它在通用性、鲁棒性上具有优势。

基于危险理论的无线传感器网络入侵检测模型

针对无线传感器网络入侵检测技术面临的挑战,利用了人工免疫技术的基本原理,提出一种基于危险理论的入侵检测模型。模型采用了分布式合作机制,与采用混杂模式监听获取全局知识的方法相比,在检测性能和能耗上都具有优势。仿真结果表明,相比于传统的单一阈值Watchdog算法和自我非我(SNS)模型,基于危险理论的检测模型能够提供较高的检测率和较低的误检率,并且有效降低了系统的能耗。

基于人工免疫的NIDS研究进展(英文)

现有网络入侵检测系统的关键不足在于不能识别未知模式的入侵 ,智能水平低 .生物免疫系统的自我保护机制对设计新的网络入侵检测系统具有很好的借鉴意义 .论文通过抽取生物免疫系统中所蕴涵的各种信息处理机制 ,将网络数据传输行为分为正常和异常行为 ,分别对应为网络的自我与非我 ,建立了一个基于人工免疫的网络入侵检测系统原型 .系统中蕴涵的生物免疫机制主要有非我识别机制、免疫进化机制等 .本文着重介绍此原型系统的结构和特征、免疫识别算法 ,并进行了实际检测实验 .实验结果表明生物免疫的自我保护机制在网络入侵检测系统方面具有很强的应用前景 .

免疫机制在计算机网络入侵检测中的应用研究

首先对当前入侵检测中所应用的免疫机制进行了简要的介绍 ;接着 ,对迄今所提出的 3个基于免疫机制的入侵检测模型做了较为详细的描述和分析 ;最后 ,根据在免疫机制研究中的一些体验 ,提出了一些值得研究的机制和方向 。