基于模糊规则的免疫算法在网络入侵中的应用  

Application of immune algorithm based on fuzzy rules in network intrusion

作　　者：白鹏翔[1,2] 张清华[2] 段富[1] 杨忠明[3] 

机构地区：[1]太原理工大学计算机科学与技术学院,山西太原030024 [2]广东石油化工学院计算机与电子信息学院,广东茂名525000 [3]广东科学技术职业学院计算机工程技术学院,广东珠海519090

出　　处：《计算机工程与设计》2015年第12期3246-3249,3257,共5页Computer Engineering and Design

基　　金：国家自然科学基金项目(61174113);广东省自然科学基金项目(S2011020002735);广东省工业高新技术领域科技计划基金项目(2013B010401036)

摘　　要：在网络入侵检测系统中会产生大量误报警,针对该问题,提出一种基于模糊规则的人工免疫优化算法。通过发现并学习两个报警之间的联系程度,计算其关联概率,在关联概率的基础上利用模糊规则对两个报警进行关联,使用人工免疫算法加以优化并通过与阈值的比较做出判断。在模糊规则的基础上使用人工免疫算法可以极大减少误报警的数量,减小入侵检测系统的负载并减轻管理人员处理报警的压力。进行实验仿真并与其它算法在检测率、测试时间等标准上做比较验证,其结果表明,该算法具有一定的可行性和高效性。One of the severe problems existing in the network intrusion system is the huge number of false alerts generated, and an artificial immune algorithm based on fuzzy rules was proposed to solve it. The correlation probability was computed by disco- vering and learning the degree of correlation of two alerts, and to correlate two alerts, the fuzzy rules based on the correlation probability was used, and then the artificial immune algorithm was employed to optimize it before comparing the correlation pro- bability with the threshold value to make a judgment. Using the proposed algorithm can not only reduce the number of false alerts, but also decrease the load of the detection system and ease the pressure of administrator on processing alerts. Thus, com- paring with the other algorithms in terms of detection rate, detecting time and other standards by the simulation experiment, this method illustrates its feasibility and validation.

关 键 词：网络入侵 误报警 模糊规则 关联概率 人工免疫算法 

分 类 号：TP391[自动化与计算机技术—计算机应用技术]