Network intrusion immunoassay method based on self set scale restraint

Abstract

The invention belongs to the field of network security and particularly relates to a network intrusion immunoassay method based on self set scale restraint. The method comprises the following steps of: firstly, constructing a self set and searching network data to extract N feature attributes of the network data; segmenting the content of the network data to acquire N non-equilong data segments which are stored into a file, extracting corresponding feature attribute values to be stored in N layers of multi-branch tree structures, and forming the self set of a system; and then performing intrusion immunoassay on the network data, classifying a network data packet according to the each layer of feature attributes of a multi-branch tree, extracting the feature attribute values and matching the feature attribute values with the feature attribute values of the self set sequentially, if the matching is failed, performing exception handling, and if the matching is successful, entering the self set file for matching, wherein the network data which are in a matching failure are intrusion data. By means of the method, a self set storage structure is normalized, a self set matching system is optimized, the speed for matching a network flow packet with the self set data is increased, self-updating of the self set is finished, and self set scale restraint is realized.

Description

technical field [0001] The invention belongs to the field of network security, and in particular relates to a network intrusion immunity detection method based on self-set scale constraints. Background technique [0002] It is impossible to prevent the attack on the internal network of the enterprise, which makes the enterprise deeply troubled by network intrusion. Although various intrusion detection systems have been developed at home and abroad, there are still many problems in the core algorithm, effectiveness, adaptability, and detection rate. This is why domestic and foreign experts are still working tirelessly. The main reason for developing new ideas. The artificial immune system based on biological immunity has developed rapidly in recent years. Because of its distribution, diversity, robustness, adaptability and specific recognition characteristics, it is the desired characteristic of the intrusion detection system, so some Immune mechanism and immune algorithm a...

AI Technical Summary

Problems solved by technology

[0004] Although many theoretical achievements and research methods have been put forward in the research of artificial immunity applied to intrusion detection system, so far there is no related intrusion detection product based on artificial immunity, which is due to the limitations of self-set used in intrusion detection system Due to the characteristics: First, when constructing a detector, it is impossible to decide whether to choose based on the self-set or the heterogeneous set. Generally, the self-set is too large to make it difficult to match, which will increase the carrying load of the system, while the heterogeneous set lacks the ability to detect unknown intrusions; Second, for some specific protected objects, the amount of heterogeneous set data that needs to be collected is larger than that of the self-set; third, the traditional self-set matching is based on bit matching, which leads to excessive calculation of the system and is difficult to implement.

Images