基于危险理论的自动入侵响应系统模型  

Automated intrusion response system model based on danger theory

作　　者：彭凌西[1,2] 谢冬青[1] 付颖芳[3] 熊伟[1] 沈玉利[4] 

机构地区：[1]广州大学计算机科学与教育软件学院,广东广州510006 [2]网络与数据安全四川省重点实验室,四川成都611731 [3]北京工业大学计算机学院,北京100124 [4]仲恺农业工程学院计算机科学与工程学院,广东广州510225

出　　处：《通信学报》2012年第1期136-144,共9页Journal on Communications

基　　金：国家自然科学基金资助项目(61100150);广东省自然科学基金资助项目(S2011040004528;10451009101004574)~~

摘　　要：提出了一种基于危险理论的自动入侵响应系统模型(AIRSDT),对网络活动中自体、非自体、免疫细胞、记忆检测器、成熟检测器和未成熟检测器进行了形式化描述,建立了主机和网络实时危险定量计算方程,并根据主机和网络当前所面临攻击的各类攻击和总体网络危险强度,自动调整入侵响应策略。理论分析和实验结果充分表明,模型有助于解决自动入侵响应研究中难以判断真正"危险"的入侵或者攻击行为的问题,降低入侵响应次数和响应综合代价。A novel automated response system model based on the danger theory （AIRSDT） was given. With the descrip- tions of self, non-self, immunocyte, memory detector, mature detector and immature detector of the network transactions, network danger evaluation equations for host and network were built up. Then, the automated response actions were taken or adjusted according to the danger of each network attack, including holistic risk degrees of the host and network. Both the theory analysis and experimental results prove that AIRSDT not only helps to solve the problem that the current automated response models could not detect the ＇true＇ intrusion or attack action, but also greatly reduces the response times and response cost.

关 键 词：危险理论 自动入侵响应系统 网络实时危险评估 人工免疫 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]