一种基于免疫的入侵检测关联报警模型  

An artificial immune-inspired alert model in network intrusion detection

作　　者：彭凌西[1] 杨进[2] 胡晓[3] 曾金全[4] 刘才铭[2] 

机构地区：[1]广州大学计算机科学与教育软件学院,广东广州510006 [2]乐山师范学院计算机学院,四川乐山614000 [3]广州大学机械与电气工程学院,广东广州510006 [4]电子科技大学计算机科学与工程学院,四川成都610054

出　　处：《电子技术应用》2013年第7期60-62,共3页Application of Electronic Technique

基　　金：国家自然科学基金项目(60903165;61103249;61100150);广州市属高校科研计划项目(2012A077)

摘　　要：在入侵检测系统Snort的基础上,结合网络实时危险评估技术,提出了一种基于免疫的网络入侵检测报警模型SAIM。给出了网络环境下记忆细胞的表示方法,以及记忆细胞实时危险计算过程,建立了主机分类及总体实时危险计算方程,在此基础上给出了网络入侵检测报警模型。理论分析和试验结果均表明,SAIM模型能有效进行关联报警,提高报警质量。Based on the Snort intrusion detection system and combing with the real-time network risk evaluation theory, a new artificial immune-inspired intrusion detection alarm model, referred as SAIM, is presented. The definition of memory cell in the network security domain is depicted, and the real-time network risk calculation of memory cell is given. The risk of each type net- work attack, as well as holistic risk degrees of the host, can be calculated quantificationally and in real time. Finally, the network intrusion detection alarm model is built. Both the theory analysis and experimental results show that SAIM can associate the related alarm information and improve the alarm quality.

关 键 词：入侵检测 人工免疫 关联报警 

分 类 号：TP301[自动化与计算机技术—计算机系统结构]