基于人工免疫理论的异常检测动态模型研究  

Research on dynamic model of anomaly detection based on artifical immune theory

作　　者：李晓鹏[1] 王京辉[1] 王怀彬[1] 

机构地区：[1]天津理工大学计算机与通信工程学院,天津300384

出　　处：《天津理工大学学报》2015年第3期6-11,共6页Journal of Tianjin University of Technology

基　　金：天津市科技支撑计划项目(14ZCZBGX00044)

摘　　要：针对目前基于人工免疫理论的入侵检测系统表现出来的检测率低、误检率高的缺点.本文通过对免疫理论在入侵检测方面的研究,提出一种基于人工免疫理论的异常检测动态模型.该模型采用数据包报文协议分析策略,来应对不同协议报文对系统的攻击;增加了基因库模块,且采用多位点基因重组算法和随机动态生成检测器相结合的方式,使生成的检测器具有多样性和高效性,提高了检测效率.最后,该模型通过模拟仿真实验,并与r-连续位匹配改进算法、LISYS和DynamiCS的实验结果进行对比分析,验证了本文模型的可行性和有效性.Accoding to the weeknesses of low detection rate and high false positive rate showed by the intrusion system based on artifical immnue theory. The paper puts forward a dynamic model of anomaly detection through the research of immnue theory in intrusion detection. The model adopts the strategy of protocol analysis of packet message to deal with the attack of different protocol messages on the system. Moreover, the model increases the gene pool module, and uses the method combining the recombination technique of mutiple locus gene with stochastic dynamic generating detectors which makes the generating detectors with diversity and high efficiency and improves the efficiency of detection. Besides, the model proves its feasibility and validity through the simulation experiment by comparing the experiment results with improved r-continual position match algorithm, LISYS and DynamiCS.

关 键 词：人工免疫 异常检测 协议分析 基因重组 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]