基于粗糙集和人工免疫的集成入侵检测模型  

Integrated intrusion detection model based on rough set and artificial immune

作　　者：张玲[1,2] 白中英[1] 罗守山[1,2] 谢康[2,3] 崔冠宁[1,2] 孙茂华[1,2] 

机构地区：[1]北京邮电大学信息安全中心,北京100876 [2]云安全北京工程实验室,北京100876 [3]山东大学信息科学与工程学院,山东济南250100

出　　处：《通信学报》2013年第9期166-176,共11页Journal on Communications

基　　金：国家自然科学基金资助项目(61121061;61161140320)~~

摘　　要：针对当前入侵检测存在的问题,通过引入粗糙集方法,综合误用检测和异常检测设计了一种基于粗糙集和人工免疫的集成入侵检测(RSAI-IID)模型,提出了一种在入侵检测中实现疫苗注入的方法。采用粗糙集方法获取疫苗,并保证了疫苗的优良性,优化检测性能;误用检测筛掉已知的入侵行为,提高检测的速度;异常检测针对未知攻击进行实时检测。最后在KDD99数据集上进行实验仿真,验证了模型的可行性和有效性。According to the problems of intrusion detection, an integrated intrusion detection model based on rough set and artificial immune （RSAI-IID） was proposed by using rough set and integrating misuse detection and anomaly detec-tion. The rough set method was used to achieve the vaccine which was injected in the model, to get better vaccine, and to optimum the performances of detection; misuse detection was used to get off the known intrusions; anomaly detection was used to detect the novel intrusions. RSAI-IID model was validated on KDD 99 dataset. The experimental results show its feasibility and effectiveness.

关 键 词：粗糙集 人工免疫 误用检测 异常检测 RSAI-IID模型 

分 类 号：TP391.4[自动化与计算机技术—计算机应用技术]