30 results about "Negative selection algorithm" patented technology

The invention provides a method for detecting network abnormality based on secondary negative selection, belonging to the technical field of information security. The method comprises: selecting normal network connection data as an autologous set by simulating the immune tolerance process of a biological immune system, using a secondary negative selection algorithm to perform tolerance training on a randomly-generated candidate detector, removing the candidate detectors with unsuccessful tolerance and autologous tolerance of the detector set to generate a mature detector set, utilizing autologous clustering to generate an authentication detector, detecting network connection data to be detected by utilizing the mature detector set, and finally using the authentication detector to confirm the detection result. The method mainly overcomes the defects of redundant detectors, low generation efficiency and high false alarm ratio, effectively reduces the size of the generated mature detector sets, improves the generation efficiency of the mature detector, maintains the stability of the detection rate, reduces the false alarm ratio and guarantees the network security, thereby having a wide application prospect.

A method for detecting intrusion is provided using a combination of two AIS algorithms: Negative Selection Algorithm (NSA) and Dendritic Cell Algorithm (DCA). The method includes the following steps, or some functional subset of these steps: periodic monitoring of a data processing system for anomalous behavior that may indicate the presence of an intruder or an undesirable software; using the NSA for the generation of a population of detectors that are used for detecting anomalies in the monitored system via a matching criterion; using the DCA (which runs in parallel to the NSA) to sample traffic and signals coming in or out of the data processing system; using an aggregation system to combine the individual decisions of the NSA and the DCA to form a single final decision.

The invention discloses a method for deploying component services for a data-intensive service cooperation system. By the method, the component services are optimally deployed by the aid of a multi-object optimization algorithm on the basis of negative selection. The method includes mapping the component service deployment on the basis of data-intensive service cooperation into a negative selection algorithm, mapping a single deployment scheme of each single component service into a gene, mapping a deployment scheme of all the component services as an antibody and creating all possible genes to form a gene library; sequentially iteratively matching antibodies on the basis of a negative selection process and circularly iteratively matching the antibodies repeatedly to finally obtain antigens, and using the deployment schemes corresponding to the certain antibodies as the optimal deployment schemes. The method has the advantages that in each iteration procedure, a certain quantity of antibodies are generated by means of gene recombination at first, antibody groups are formed, then low-quality antibodies in the antibody groups are eliminated by means of negative selection, and accordingly search space is reduced; a gene warehouse is updated according to an iteration result after each iteration procedure is completed, so that optimal antibodies can be assuredly generated by means of gene recombination in each follow-up iteration procedure.

The invention discloses an active defense system and method based on biological immunity. The system includes: a terminal equipped with a known behavior library trained through the cloud, and through a mechanism similar to biological immunity, the behavior generated based on internal and external data Carry out local detection, real-time monitoring, first-level active defense, and send unidentified unknown behaviors to the cloud; the cloud has a known behavior library trained on the cloud to collect unknown behaviors sent by the terminal, Introduce deep learning, carry out cloud detection and behavior early warning, and push new behaviors to the terminal in real time for second-level defense. Safe computer behavior, realize the overall defense and active defense of the cloud-terminal collaborative computing environment.

The invention discloses a quick software and hardware division method used for guaranteeing quality. The quick software and hardware division method retains the crossover operation and the mutation operation of a genetic algorithm, imports a negative selection process of a negative selection algorithm and a strategy that a new individual is generated on the basis of allele concentration, and a novel evolution method is adopted to quicken an evolution process and guarantee the quality of the individual so as to overcome the defect of long time consumption of a traditional genetic algorithm and the defects that the negative selection algorithm is high in result randomness and is likely to fall into local optimum.

The invention discloses a cyberspace security situation real-time detection method. The method comprises the following steps: original characteristic extraction that original network data packet characteristics are obtained from a network, multi-scale entropy calculations that sample entropy of an original data packet characteristic sequence is calculated at different time scales, detector training that a mature immunization detector is trained and generated by utilizing a sample entropy characteristic vector and a negative-selection algorithm at the different time scales, network threat security detection that a network sample is detected by utilizing the trained mature immunization detector at the different time scales, cyberspace security situation calculations that cyberspace security situations at the different time scales and different network layers, and situation visualization that the cyberspace security situations are expressed by different colors of curve charts at different time and the different network layers. The time scales considered in the method is relatively comprehensive, the fusion level is high, a situation assessment result is relatively accurate, a complex characteristics of a network behavior can be described, and the whole process of a network threat behavior can be carved in a fine-grained manner.