Method for detecting network abnormality based on secondary negative selection

Abstract

The invention provides a method for detecting network abnormality based on secondary negative selection, belonging to the technical field of information security. The method comprises: selecting normal network connection data as an autologous set by simulating the immune tolerance process of a biological immune system, using a secondary negative selection algorithm to perform tolerance training on a randomly-generated candidate detector, removing the candidate detectors with unsuccessful tolerance and autologous tolerance of the detector set to generate a mature detector set, utilizing autologous clustering to generate an authentication detector, detecting network connection data to be detected by utilizing the mature detector set, and finally using the authentication detector to confirm the detection result. The method mainly overcomes the defects of redundant detectors, low generation efficiency and high false alarm ratio, effectively reduces the size of the generated mature detector sets, improves the generation efficiency of the mature detector, maintains the stability of the detection rate, reduces the false alarm ratio and guarantees the network security, thereby having a wide application prospect.

Description

Technical field: [0001] The invention relates to a network anomaly detection technology, which belongs to the technical field of information security. Background technique: [0002] With the popularization and development of computer networks, the Internet has become one of the indispensable tools for people to study, work and live, but at the same time, the openness of the Internet also makes viruses and network attacks a disaster on the Internet. Network attacks affect the network from many aspects and bring harm to the network. These harms mainly include: harm to computer resources and network resources, harm to normal services, harm to economy, politics, society and culture, etc. At present, my country's network infrastructure is relatively backward, the demand for network security is more stringent and urgent, and the security line of defense against network attacks such as virus spread and hacker attacks is also more fragile. Against this demand background, there is...

AI Technical Summary

Problems solved by technology

The present invention mainly solves the shortcomings of too many detectors, too low detector generation efficiency and too high detection false alarm rate in the artificial immune anomaly detection method in the prior art, effectively reduces the number of mature detectors generated, and improves the maturity of mature detectors. The generation efficiency is high, and while the detection rate is kept stable, the detection false positive rate is further reduced, ensuring network security, and has broad application prospects

Images