一种基于人工免疫网络聚类的入侵检测方法  

Intrusion detection based on artificial immune network clustering

作　　者：陈诗平[1] 许家珆[1] 

机构地区：[1]电子科技大学应用数学学院,四川成都610054

出　　处：《成都信息工程学院学报》2009年第4期374-378,共5页Journal of Chengdu University of Information Technology

摘　　要：提出了一种基于自适应半径免疫算法(ARIA)的入侵检测方法。ARIA训练得到的抗体网络充分保留了原始数据的密度分布信息,具有准确的空间形态;再用最小生成树算法和Zahn划分标准对抗体网络细胞聚类,聚类得到的簇被标记为正常或异常并用于网络异常检测中。对KDD CUP 99数据集的实验结果表明:相对于基于aiNet的入侵检测方法,新的算法检测率高、误报率低,能够有效识别KDD中的已知攻击和未知攻击。An intrusion detection method based on the Adaptive Radius Immune Algorithm （ARIA） is proposed. It maximally lpreserves the density information of the data set and is capable of producing more accurate data representa- tions after compression. The outputs of the ARIA are considered as cells of the immune network. The minimal span- ning tree （MST） of the immune network cells is separated by Zahn＇s partition criterion to generate clusters. The clusters are labeled as normal or abnormal to detect known and unknown attacks. The computer simulations over the KDD CUP 99 dataset show that this method achieves higher detection rate and lower false positive rate. It is more ef- fective than other artificial immune network clustering-based intrusion detection method such as aiNet.

关 键 词：自适应半径 免疫算法 抗体网络 数据聚类 异常检测 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]