Host machine intrusion detection method based on biological immune mechanism

Abstract

A host machine intrusion detection method based on a biological immune mechanism includes that firstly, history intrusion cases already existing in host machine audit data are subjected to attribute reduction and united coding, and language terminology and membership function of each attribute are determined; initial antibody population is randomly generated, an individual with highest affinity in a certain proportion is chosen to be subjected to cloning and mutation operation, then antibody population and memory population are updated, and finally an established fuzzy associate rule library is obtained; the intrusion detection is performed on real time data of host machine monitoring behaviors by means of the obtained fuzzy associate rule library; and if a novel attack type appears in the host machine monitoring behaviors, a novel associate rule is determined according to the attack type and is added into the fuzzy associate rule library. The detection method is characterized of having self-adaption, self-organization, high efficiency and high comprehensibility. The fuzzy associate rule library can be self-adaptively determined, the fuzzy associate rule library is added based on a dynamic change of intrusion behaviors, and information safety of a host machine system is protected.

Description

technical field [0001] The invention relates to a host intrusion detection method in computing security technology, specifically a method for determining a fuzzy association rule base based on a biological immune mechanism, and implementing intrusion detection for host monitoring behavior through fuzzy classification based on the fuzzy association rule base. Background technique [0002] With the development of computer network technology, more and more attention has been paid to computer system security. The host-based intrusion detection technology detects and analyzes the audit data of a specific host host, discovers intrusion and attack behaviors aimed at the host, and makes timely and effective corresponding protection measures. Host intrusion detection technology is an active system security strategy and scheme, which can make up for many deficiencies and weaknesses exposed by traditional network firewall technology. [0003] Since the monitoring behavior of the h...

AI Technical Summary

Problems solved by technology

Usually, the exhaustive search strategy is adopted in the fuzzy association rule mining method, and the running time of the algorithm is long and the efficiency is low.

Images