改进的人工免疫入侵检测模型

摘要

针对现有的人工免疫入侵检测系统存在的缺陷,在Hofmeyr的分布式人工免疫系统(ARTIS)基础上,提出了改进的人工免疫入侵检测模型.在改进模型中,用协议分析技术对免疫模块进行协同刺激,以提高记忆检测器和成熟检测器的质量,并降低检测器的规模；通过按协议生成和组织检测器,解决传统人工免疫系统检测效率低下的问题；采用基于权值的r-连续位匹配规则提高抗体和抗原匹配的准确度；同时协同刺激模块也能够在发生风暴型攻击时自动生成动态防火墙过滤规则,以提高在发生大规模攻击情况下的性能.最后,使用MIT Lincoln实验室的DARPA数据集对改进模型和ARTIS模型进行了模拟测试及对比分析,验证了所提模型的可行性和有效性.%An improved artificial immune intrusion detection model was proposed based on ARTIS (ARTificial Immune System) - a distributed intrusion detection model proposed by Hofmeyr. It aimed to overcome defects of the existing artificial immune Intrusion Detection Systems (IDS). To improve the quality and reduce the scale of memory and mature detectors, the improved model used the protocol analysis technology to make co-stimulation of the immune module. The protocols were taken into account while generating and organizing detectors, so the inefficiency of traditional AIS can be overcomed. Weight based r-continuous matching rules were taken to improve matching accuracy of the antibody-antigen reactions. Meanwhile, the co-stimulation module can automatically generate dynamic Filter rules for firewall when flood attack occurs. Finally, the authors had a simulation test and comparative analysis on improved model and ARTIS model by using DARPA data sets owned by MIT Lincoln laboratory and the results evaluate the feasibility and effectiveness of the improved model.