【作者】 张建；

【导师】 公茂果；

【作者基本信息】 西安电子科技大学 ， 电子与通信工程， 2012， 硕士

【摘要】 人体免疫系统因其强大的信息处理能力受到研究者的关注,它的自适应性、并行和分布式的特点为解决工程应用问题开辟了思路,在此基础上诞生了人工免疫系统。鉴于免疫系统与入侵检测系统的相似性,基于人工免疫系统的算法被应用于入侵检测。本文首先提出了“空洞”处理的否定选择算法,然后提出了深度训练的否定选择算法,最后将信息增益与否定选择算法相融合,并将其应用于入侵检测。第二章重点介绍了“空洞”区域数据处理的动机和思想,该算法对落入“空洞”区域的数据进一步分析,以更准确的判定其是否为异常数据。实验结果表明：相比V-detector算法,本章提出的算法在正检率和虚警率上都有所改善。第三章提出了深度训练的否定选择算法,以解决上一章算法中存在的计算量大的问题,采用深度训练机制减少了自体样本的数量,并提高了自体区域的覆盖率。通过实验分析得出,深度训练机制减少了算法的运行时间,并在一定程度上改善了算法的异常检测效果。第四章引入了信息增益分析,提出了基于信息增益的否定选择算法,并将其应用于KDD99数据集的检测,以评估否定选择算法对网络入侵行为的检测能力。本章的工作将否定选择算法的应用扩展至高维数据中的异常检测。实验结果显示,通过选取信息增益大的特征,显著提高了否定选择算法在KDD99数据异常检测中的表现。更多还原

【Abstract】 The human immune system (HIS) has drawn researchers’great attention for its strong ability of information processing, its significant characters, such as self adaptive, parallel and distributed, bring new ideas to engineering applications, artificial immune system (AIS) has been proposed based on these characters. In consideration of the similarity between immune system and intrusion detection system, artificial immune system based algorithms are applied in intrusion detection. First, negative selection algorithm with processing of "blank region" data is proposed, and then negative selection algorithm with further training is proposed, finally, the information gain strategy is integrated in negative selection algorithm to detect network intrusion.In chapter two, we introduce the motivation of processing data in "blank region" and its framework in details, the data lied within the "blank region" are further analyzed by this strategy to determine its label more accurately. Experimental results show that, compared with V-detector, algorithm proposed in this chapter has modified the detection rate and false alarm rate.In chapter three, an algorithm, termed as negative selection algorithm with further training (FtNSA), is proposed to solve the problem of expensive computation cost in the algorithm of chapter two. The number of self samples is greatly reduced and the coverage of self region is improved by integrating the further training strategy. From the experimental results, we can see that, the computing time is reduced in FtNSA and the anomaly detection performance of which is improved.In chapter four, the information gain is introduced, negative selection algorithm with information gain is proposed and applied to the anomaly detection of KDD99data set, by which we can estimate the ability of NSA in network intrusion detection. The work in this chapter expands the application of NSA to anomaly detection in multi-dimensional data. Experimental results show that, by selecting features with big information gain, the performance of NSA in anomaly detection of KDD99data set is greatly improved.更多还原