Intrusion detection method based on tripling real value negative selection

Abstract

The invention discloses an intrusion detection method based on the tripling real value negative selection and belongs to the field of network information security. The method includes simulating the immune mechanism of an organism, and adopting own normal behavior data as an tautological set; firstly, matching alternate detectors and individuals of a mature detector set, if the matching fails, determining the alternate detectors as shortlisted ones; secondly, detecting the alternate detectors through the trained tautological set, and determining the shortlisted detectors disjointed to the trained tautological set to be elements of the mature detector set; finally, integrating and optimizing the elements of the mature detector set. By the aid of the method, the problems that in the current intrusion detecting process, the number of black holes is large, the mature detector set is large in scale and the detecting efficiency is low are solved, the mature detector set scale can be compacted, the detecting capability is improved, the theory development of the intrusion detection can be promoted, and the high application value is provided.

Description

technical field [0001] The invention belongs to the field of network information security, and in particular relates to an intrusion detection method based on triple real-value negative selection. Background technique [0002] The wide application of computer network has brought great convenience to the production and life of human beings. However, the increasingly severe network security situation is always sounding the alarm, which has become a real problem that we cannot ignore. At present, the research on network intrusion detection methods has attracted extensive attention from scholars in related fields at home and abroad, among which the negative selection algorithm for intrusion detection with a profound background in biological immunology has become a research hotspot. [0003] In biological immunology, immune cells in the body can effectively detect and attack foreign bodies. Similarly, access behaviors in computer networks can also be divided into two categories, ...

AI Technical Summary

Problems solved by technology

This type of algorithm is likely to lead to excessive elements in the mature detector set and excessive duplication of coverage between detectors, thereby reducing the detection efficiency; (2) The newly emerged improved negative selection algorithm one-sidedly emphasizes The absolute dissimilarity of the elements in the detector set, but the optimization problem of the mature detector set elements with a certain coverage among each other is rarely involved.

Therefore, to a certain extent, this type of algorithm still has the problems of too many black holes in the detection results, too large a set of mature detectors, and low detection efficiency.

Images