基于免疫多样性的分布式入侵检测算法  

Distributed Intrusion Detection Method Based on the Diversity of Immunity

作　　者：谷雨[1] 赵佳枢[2] 张天军[3] 徐宗本[2] 

机构地区：[1]西安交通大学电子与信息工程学院,西安710049 [2]西安交通大学理学院,西安710049 [3]云南民族大学网络信息中心,昆明650031

出　　处：《西安交通大学学报》2006年第10期1052-1055,共4页Journal of Xi'an Jiaotong University

基　　金：国家自然科学基金资助项目(60575045);云南省自然科学基金资助项目(2005F0028Q);云南省教育基金资助项目(5Y0588D);云南民族大学重点课程建设项目

摘　　要：提出了一种基于免疫多样性的分布式入侵检测方法,将支持向量机(SVM)作为抗体对入侵行为进行检测.首先,采用随机子空间方法生成多样化的SVM个体,再用人工免疫算法进化个体,然后通过引入Q统计量和互信息作为抗体多样性的度量,由此得到的检测器种群具有知识互补性,最后用集成的思想将种群中各检测器的结论进行合成.数值实验表明,所提方法生成的抗体更具多样性,检测精度高于单个SVM和Bagging方法,其分布式并行检测特性有利于加强检测系统的健壮性.Based on the diversity of immunity, a distributed intrusion detection method is presented, in which the support vector machine（SVM） is used as an antibody to detect intrusion. In particular, the random subspace method is introduced to create various SVM individuals, and then the individuals are evolved with artificial immunity algorithm. By introducing Q-statistical and mutual information as the measures of the antibody＇s diversity, the detector group with the characteristic of mutual-supplied knowledge can be obtained. At last the results of all detectors in the population are integrated by the ensemble idea. This distributed parallel detection can strengthen the robustness of the system. Experiments show that this method can produce antibodies with better diversity, and the detection accuracy is better than a single SVM and Bagging method.

关 键 词：入侵检测 人工免疫 多样性 支持向量机 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]