基于轻量级人工免疫计算的混合入侵检测方法  

Hybrid Intrusion Detection Method Based on Light-Weighted Artificial Immune Computation

作　　者：陈晋音[1] 杨东勇[1] 

机构地区：[1]浙江工业大学信息工程学院,浙江杭州310023

出　　处：《信息与控制》2012年第5期529-536,共8页Information and Control

基　　金：浙江省自然科学基金资助项目(Y1100378)

摘　　要：针对大规模网络环境下的入侵检测系统需要处理的网络数据含有大量的冗余与噪音的问题,设计了一种基于轻量级人工免疫计算的混合入侵检测方法.利用最小信息熵离散化算法预处理检测数据,根据主元分析算法(PCA)进行特征提取,通过提取特征矩阵降低数据维度;设计了基于否定选择算法的在线检测,对于未知的或者大规模的连接则提取其特征并实现基于人工免疫计算的入侵检测.最后利用进化能力的异常检测器进行训练和检测,并将提取的异常特征模式加入到快速匹配的数据库来及时地更新数据库.仿真实验表明算法能够提高混合检测器系统的检测效率,同时检测速度能够满足实时性的要求.For the large redundancy and noise problem in the network data which the intrusion detection system has to deal with under the large-scale Internet environment,a hybrid intrusion detection method based on light-weighted artificial immune computation is proposed.The minimum information entropy discretization method is used to pre-process the detection data,and principal component analysis is applied to extracting the features.Negative selection algorithm is applied to online detection,and the characters are extracted for unknow or large-scale unknown connections,so the intrusion detection is realized by the artificial immune algorithm.Finally,the detector with evolutionary capacity anomaly is used to training and testing,and the extracted anomaly features are added into the fast matching database to update the database in time.Simulation results show that the algorithm can improve detection efficiency of the whole hybrid intrusion detection system and the detection velocity can satisfy the real time request.

关 键 词：轻量级 人工免疫计算 最小信息熵离散化 主元分析算法(PCA) 静态克隆选择算法 动态克隆选择算法 混合入侵检测系统 

分 类 号：TP18[自动化与计算机技术—控制理论与控制工程]