Dynamic adaptive network anomaly detection method based on artificial immune technology

Abstract

The invention provides a dynamic adaptive network anomaly detection method based on an artificial immune technology. The dynamic adaptive network anomaly detection method comprises the following steps: (1) screening an optimal feature subset based on a heuristic dimensionality reduction algorithm; (2) in order to reduce the problem that the detection rate is reduced due to boundary diversity, grid division is carried out on the feature space according to the sample distribution density on the basis of an NSA algorithm of hybrid hierarchical division, and a specific candidate detector is generated in a boundary grid; and (3) in a non-boundary region, a clustering strategy is adopted for self-samples, so that the tolerance stage efficiency of the detector is improved. And (4) combining the real-value NSA algorithm with the optimized GWO, adaptively adjusting the generation strategy of the detector, and improving the network anomaly detection efficiency. According to the method, dynamic self-adaptive adjustment can be performed on the anomaly detection strategy based on the hybrid grid division strategy and the GWO algorithm according to the characteristics of the abnormal data and the detector, and efficient network anomaly detection is realized.

Description

technical field [0001] The invention relates to the field of network security, in particular to a dynamic adaptive network abnormality detection method based on artificial immune technology. Background technique [0002] At present, global network security threats have entered the era of unknown threats. The latest statistics from Kasper sky Labs show that in 2019, a total of 975 million cyber attacks were discovered worldwide, with an average of about 795,000 new types of attacks occurring every day. Among the cyber attacks suffered by the world, the proportion of unknown cyber threats has risen sharply, which has become an important factor affecting cyber security, involving many fields such as national politics, economy, and military, and has become an urgent problem to be solved in the current national-level cyber security confrontation. key technical problems. At present, traditional network security technologies are relatively single in purpose and function, and can ...

AI Technical Summary

Problems solved by technology

[0005] Aiming at the problem of poor detection performance caused by the lack of adaptability and self-adjustment of traditional network security defense technologies under the continuous emergence of new network attack methods, by applying the idea based on artificial immunity to network anomaly detection, it can effectively support unknown attacks Detect, achieve optimal response, and strengthen network security defense system

Images