嵌入否定算子的网格入侵检测克隆选择算法  

Negative Operator Embedded Clonal Selection Algorithm for Grid Intrusion Detection

作　　者：杨明慧[1] 王汝传[1] 

机构地区：[1]南京邮电大学计算机学院,南京210003

出　　处：《计算机科学》2009年第12期37-40,45,共5页Computer Science

基　　金：国家自然科学基金(60573141和60773041);江苏省自然科学基金(BK2008451);国家高科技863项目(2007AA01Z404;2007AA01Z478);现代通信国家重点实验室基金(9140C1105040805);江苏高校科技创新计划项目(CX08B-085Z;CX08B-086Z);江苏省六大高峰人才项目资助

摘　　要：网格安全问题是网格普及的一大阻碍,网格入侵检测是解决网格安全瓶颈的方法之一。面向网格入侵检测需求,以现有克隆选择算法为主体,设计了嵌入否定选择算子的克隆选择算法(Negative Selection Operator Embedded Clonal Selection Algorithm,NCSA)作为新的检测器算法。否定算子删除了未成熟检测器中耐受性差的检测器,协助记忆检测器实现动态更新;亲和力成熟机制减少了协同刺激数量。通过实验合理设置两个影响NCSA性能的参数:不成熟检测器的耐受周期T和成熟检测器的生命周期L,获得满意的检测性能。相同参数和训练环境下,与传统克隆选择算法相比,NCSA获得较高非自我检测率和较低的误报率,整体检测性能有所提高。这也说明NCSA能更好识别未知入侵,适应网格环境。Grid Intrusion Detection is a method to solve the bottleneck of grid security. This paper proposed Negative Selection Operator Embedded Clonal Selection Algorithm （NCSA） as the new detector algorithm, based on Clonal Selection Algorithm. Negative selection operators as a component avoided self-tolerance phenomena of detectors, assisted memory detectors to complete dynamic updating;and affinity maturation decreased the numbers of co-simulations;so de- tectors could cover non-self space better. In order to obtain satisfactory TP and FP ratio, by experiments we set two affecting NCSA behaviors＇ parameters, immature detectors＇ toleration period （T） and mature detectors＇ lifespan （L） to appropriate values. With the same parameters and training conditions, comparing with CSA, the results show that NCSA gains higher rip ratio and lower FP ratio, improves the whole detection performance. Also the higher rip ratios and lower FP ratios mean that NCSA can recognize unknown intrusions and fit dynamic grid environments better.

关 键 词：网格入侵检测 否定算子 克隆选择算法 误报率 检测率 

分 类 号：TP311.13[自动化与计算机技术—计算机软件与理论] TP393.08[自动化与计算机技术—计算机科学与技术]