一种基于免疫的网络安全态势感知方法  

Method of Network Security Situation Awareness Based on Artificial Immunity System

作　　者：刘念[1,2] 刘孙俊[3] 刘勇[4] 赵辉[1] 

机构地区：[1]四川大学计算机学院,成都610065 [2]四川大学电气信息学院,成都610065 [3]成都信息工程学院软件工程学院,成都610225 [4]中国科学院成都计算机应用研究所,成都610041

出　　处：《计算机科学》2010年第1期126-129,200,共5页Computer Science

基　　金：国家自然科学基金项目(60373110;60573130);国家863计划项目(2006AA01Z435)资助

摘　　要：网络安全态势感知技术作为积极主动的防御技术,目前已成为网络安全领域新的研究方向。在分析与总结国内外网络安全态势感知技术的基础上,提出了一种基于免疫的网络安全态势感知系统。该方法采用基于免疫的入侵检测模型作为态势感知的基础,实现对网络中已知和未知入侵行为的检测;依据生物免疫系统抗体浓度的变化与病原体入侵强度的对应关系,建立网络安全态势定量评估模型,并采用灰色马尔可夫模型对网络安全态势进行预测。实验结果表明,该方法有助于及时有效地调整网络安全策略,为系统提供更全面的安全保障,是网络安全主动防御的一个较好的解决方案。As a positive defense technology, Network Security Situational Awareness has become the orientation of research in the field of network security. Based on the analysis of the papers from domestic and foreign on technologies for network security situational awareness,a method of network security situational awareness based on the profound research of AIS was designed and built. The method uses network intrusion detection based on the theory of immunity as the base of Situational awareness, to detect known and unknown intrusions with the help of biological technology. According to correspondence relations of density change of antibody in the artificial immune systems and pathogen invasion intensity, a novel network security situational evaluation model was also established. In the tendency prediction for network security situational, this paper used Grey Markov Model to make quantitative prediction. Experiment results show that this model is also helpful to resemble network security tragedy effectively, therefore,it is a better solution for network security initiatives defense.

关 键 词：人工免疫 网络安全 网络安全态势 

分 类 号：TP391[自动化与计算机技术—计算机应用技术]