混合型入侵检测系统  

Intrusion detection system of mixed

作　　者：龙鹏飞[1] 林勇[1] 许萍萍[2] 

机构地区：[1]长沙理工大学计算机与通信工程学院,湖南长沙410076 [2]云南师范大学计算机科学与信息技术学院,云南昆明650000

出　　处：《计算机工程与设计》2008年第19期4917-4919,4925,共4页Computer Engineering and Design

基　　金：湖南省教育厅科研基金项目(06C115)

摘　　要：为了提高检测效率并减小误报率,提出了一种基于免疫算法和诱捕技术的网络入侵检测模型。在诱捕服务器中提取记录进行格式转换,然后在否定选择算法中引入诱捕服务器的记录,以代替部分随机生成数据,即把误用检测和异常检测结合起来,将目前的独立配合模式改为相互联系的配合模式,充分利用各自独立的系统数据资源并使之共享,最后通过算法分析和模拟实验,证明了该系统具有较高的正确率和较低的误报率。In order to improve the efficiency ofdetection and reduce the false positive rate, one kind ofintrusion detection model is pro- posed based on immunity algorithm and deception technology. The format ofthe records ofdeception server is changed at first, andthen the records of deception server in negative selection algorithm is used to replace of part of data which generated at random. In another word, it＇ s connection between misuse detection and anomaly detection. And present independent coordinate pattern is changed to a related pattern, each independent system data resources is used and shared. The result shows that this system has high detection rate and low false positive rate by the analysis of algorithms and experiment.

关 键 词：入侵检测 免疫原理 诱捕技术 非随机 否定选择 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]