基于ISM特性的检测器生成算法及模型  

Detector generating algorithm and model based on immune-softman

作　　者：马占飞[1] 杨树英 郭广丰[1] 

机构地区：[1]内蒙古科技大学包头师范学院计算机系,内蒙古包头014030 [2]包头服务管理职业学校信息技术系,内蒙古包头014030

出　　处：《控制与决策》2016年第3期528-534,共7页Control and Decision

基　　金：国家自然科学基金项目(61163025);内蒙古自治区自然科学基金项目(2010BS0904);内蒙古自治区高等学校科学研究基金重点项目(NJ10162);包头市科学研究基金项目(2014S2004-3-1-26)

摘　　要：针对现有检测器生成算法存在效率低、自适应性差、生成的检测器集庞大且冗余等问题,借鉴生物免疫系统中抗体的克隆机制和亲和度变异机制,并融合小生境策略以及检测器的变异和优化等,构建基于免疫软件人(ISM)特性的检测器生成算法及模型.与传统算法相比,该算法能够降低检测器的冗余度,减少检测器集的规模,保持检测器的多样性;通过合理地改变其匹配阈值,能够实现以较小的检测器集检测出更多的异常行为的目的.实验结果表明,所提出的算法具有较强的自适应性,且拥有较高的检测效率和性能.Aiming at the low true-positive rate, poor adaptability, large size and redundant detector set of existent detector generation algorithms, a self-adaptive detector generation algorithm and model based on immune-softman（ISM） characteristics is proposed. The algorithm model draws lessons from the antibodies cloning mechanism and affinity variation mechanism of the biological immune system（BIS）, and integrates the niching strategy and the variation and optimization operations of the detector. Compared with traditional detector generation algorithms, the proposed algorithm can decrease effectively the redundancy of detectors, minimize the size of detector set, and maintain the diversity of detectors. At the same time, by changing continuously the matching threshold of effective detectors, the algorithm can detect quickly abnormal behaviors in the scale of the non-self space by a smaller detector set. The experiment results show that the algorithm has better adaptability and higher detection efficiency and performance.

关 键 词：网络安全 入侵检测 免疫软件人 检测器生成算法 小生境 变异 自适应 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]