【作者】 张凤斌；

【导师】 杨永田；

【作者基本信息】 哈尔滨工程大学 ， 计算机应用技术， 2005， 博士

【摘要】 人工免疫系统的研究旨在抽取生物免疫系统中独特的信息处理机制,研究和设计相应的模型和算法,进而解决各种复杂问题。人工免疫是继人工神经网络、进化计算之后新的智能计算研究领域,是生命科学和计算机科学相互交叉而形成的学科,目前已成为研究热点。 生物免疫系统的基本功能是识别自体和非自体,并将非自体分类清除,具有免疫识别、免疫记忆、免疫调节、免疫宽容和免疫监视等功能特征,是一个自适应、自学习、自组织、并行处理和分布协调的复杂系统。通过深入研究生物免疫系统所蕴含的各种信息处理机制,构建和设计有效的入侵检测模型和算法,对于建立基于生物免疫系统的入侵检测新理论、新方法,改变当前网络安全状况具有至关重要的意义。 本论文深入探索和研究生物免疫系统所蕴含的学习与检测机制,面向入侵检测系统设计高效的模型和算法,进而建立基于人工免疫的入侵检测系统。在设计基于生物免疫机制的检测模型和算法时,不仅考虑了生物免疫系统自身的功能特征和体系结构,而且充分借鉴了免疫学的理论研究成果,从各个层次对生物免疫系统的自我保护功能进行建模和分析,强调多角度对生物免疫机制进行建模及算法设计。具体而言,本论文主要研究工作有: 借助于生物免疫系统基因的表示形式,提出采用自体/非自体空间的实值矢量表示,克服了目前普遍存在的二进制表示的局限性,有益于定义不同的检测器表示法,有助于基于生物免疫的多种算法的结合,有利于在非自体空间更好地分配检测器,最小化自体重叠和最大化非自体覆盖。 借鉴生物免疫系统的抗体生长和成熟机制,提出并解决了检测器自适应生成问题。针对原有免疫算法存在的可测量性差的缺陷,分别提出了基于检测规则和模糊检测规则的否定选择算法等检测器自适应生成算法,使用遗传算法进化好的检测规则,用能覆盖非自体空间的超矩形模型来进化检测器。采用模糊检测规则代替脆弱规则,以此来确定一个新样本是正常还是异常,生成了与正常偏差的度量。实验表明,两种算法都能发现在网络传输数据与更多还原

【Abstract】 The research purpose of Artificial Immune System is to extract special information processing mechanisms contained in biological immune system, and then to study and design the corresponding models and algorithms that could be used to solve many kinds of complex problems. Artificial Immune System is a novel intelligent Computing research field following the invention of Artificial Neural Network and Evolutionary Computation, and it is an emergent interdisciplinary research field generated by life science and computer science and has become a hot point.The basic function of biological immune system is to recognize self and non-self, and then to classify and eliminate non-self. Biological immune system has the characteristics of immune recognition, immune memory, immune regulation, immune tolerance, immune surveillance etc. It is a complex system of self-adaptive, self-learning, self-organization, parallel processing and distributed coordination. By deeply researching into various information processing mechanisms contained in biological immune system, many effective models of intrusion detection and algorithms can be established and designed, and it is of great significance to the establishment of new theory and new method of intrusion detection based on biological immune system, also to the change of the current situation of network security.The purpose of this dissertation is to explore and research into the learning and detecting mechanisms contained in biological immune system, and then to design efficient models and algorithms for intrusion detection system, to establish intrusion detection system based on biological immune system. The detecting models and algorithms based on biological immune mechanisms are designed with consideration of the function and characteristics of biological immune system, at the same time using the theoretical research results of immunology for references. The designs model and analyze the self-protection function from different levels, emphasizing designing models and algorithms from different aspects of biological immune mechanisms. The main research work of thisdissertation can be summarized as follows:By means of the manifestation of gene in biological immune system, this dissertation chooses a real-valued vector to represent the self/non-self space, overcomes the limitations of binary representation used currently. This will be beneficial for the definition of different detector representation, the combination of manifold algorithms based on biological immune system and the distribution of detectors in the non-self space, and will maximize the coverage of the non-self space and minimize the coverage of self-overlap.With the aid of antibody growing and maturation mechanisms of biological immune system, the detectors self-adaptively generating problem are provided and solved. Aiming at the defects of measurability of currently-used immune algorithms, the detectors’ adaptively generating algorithms such as Negative Selection Algorithm with Detection Rules and Negative Selection Algorithm with Fuzzy Detection Rules are presented respectively. The evolution of detect rules is achieved by using genetic algorithm and evolution of detectors by a hyper rectangular shape that can cover the non-self space. Fuzzy rules are used instead of crisp rules to determine whether a new sample is normal or abnormal, and to produce measurement of deviation from the normal. Experiment shows that the two algorithms can detect the abnormality in network transmission data and comprehensive time sequence data.Aiming at the detector distribution problem, Real-valued Negative Selection Algorithm and Randomized Real-valued Negative Selection Algorithm are put forward by extracting the information processing mechanisms contained in immune regulation of biological immune system. This algorithm takes as input a set of hyper-spherical antibodies (detectors) randomly distributed in the self/non-self space and changes iteratively the position of the detectors to maximize the coverage of the non-self space and to minimize the coverage of the self samples overlap, at the same time produces a better estimate of the optimal number of detectors needed to cover the non-self space. The maximization of the non-self coverage is done through an optimization algorithm proved to be of convergence properties (Monte Carlo integration and simulated annealing).By extracting the rich information processing mechanisms of biological immune system, this dissertation proposes detectors adaptively generating algorithms; detectors distributing strategy and the learning algorithms based on biological immune regulation mechanisms. An Intrusion Detection System based on Hierarchical Collaborative Distributed (HCDIDS) is designed and accomplished. HCDIDS is proved efficient by experiments. It increases the detection rate and reduced the false alarm rate. HCDIDS integrates the merits of hierarchical IDS and collaborative IDS, adopts efficient self/non-self recognizing technology and immune genetic algorithm and detects correctly the distributed attacks via information fusion technology. The work is not only of great importance to the research of the novel intrusion detection mechanism, but also of great significance to the development of the related interdisciplinary courses.更多还原