Method for dynamically detecting network anomaly in real time based on immunization

Abstract

The invention provides a method for dynamically detecting a network anomaly in real time based on an artificial immunity principle, belonging to the field of information security. The invention provides a new method for dynamically detecting the network anomaly in real time based on immunization according to a good self-learning adaptive mechanism of a human immune system. According to the method provided by the invention, a detection mode is subjected to dynamic description (namely, dynamic generation and extinction, dynamic learning and dynamic self-organization) and is combined with an antibody cell dynamic cloning principle, so that the detection mode is synchronously evolved with an actual network condition. Furthermore, cooperative treatment is carried out by immune vaccination and vaccine distribution, so as to improve the accuracy and the timeliness of network anomaly detection. With the adoption of the method provided by the invention, the key problems such as low detection rate, difficulty in real-time detection and poor cooperativity, which are caused by static detection mode description in the existing large-scale network anomaly detection research can be solved. Therefore, the method can be used for rapid and effective monitoring when large-scale security events, thereby wining time for network protection and play an important role.

Description

technical field [0001] The invention relates to a digital information transmission system, in particular to an Internet security system. Background technique [0002] With the rapid development of the Internet, the situation of network security is becoming more and more serious, and the rapid change of network attack technology puts forward higher requirements for network monitoring. The network intrusion detection system (Intrusion Detection System, IDS) plays an important role in the network information security system, and has become a research and application hotspot in the field of network information security in recent years. Technically, IDS is mainly divided into two categories: feature detection and anomaly detection. Feature detection uses known attack features to detect, and the detection rate is high, but the disadvantage is that attack features need to be manually extracted, which consumes a lot of manpower, and the attack may have caused losses during the peri...

AI Technical Summary

Problems solved by technology

This method has the excellent characteristics of biological immune system such as self-learning, self-adaptation, clone selection, immune network and immune memory, so as to solve the problem of low detection rate and difficulty in real-time detection caused by static detection mode description in current large-scale network anomaly detection research. It will play an important role in quickly and effectively monitoring when a large-scale security incident breaks out and gaining time for network defense

Images