Intrusion Detection Based On Immune Clone Selection Computation

With the rapid development of computer and Internet, computer network has been widely used and become the most important basic instrument, and network security has become an important issue.Intrusion detection technique, information encryption, virus defends technology and fire wall technology has become a bodyguard protecting network security. Intrusion detection system (IDS) can detect the resource of the system and the network in real time, find intruder, and prevent the legal user's mistake operation to resources. Intrusion detection system has expanded concept of safe protection and remedied deficiency of traditional safe tactics.Intrusion detection techniques can be partitioned into two main approaches: misuse detection and anomaly detection. Misuse detection approaches attempt to model attacks on a system as specific patterns, and then systematically scan the system for occurrences of these patterns. Anomaly detection approaches attempt to establish each user's normal activity profile, and to flag deviations from the established profile as possible intrusion attempts. Nowadays misuse detection approaches have been successfully used into practice, while anomaly detection approaches which are still on the research and development phases are one of the focuses of intrusion detection.In this paper, the research works are as follows:1. We study genetic algorithm and negative algorithm and analyze the advantages and disadvantages applied two algorithms to intrusion detection. New algorithm in the artificial immune system is discussed and immune clone computation is applied to intrusion detection.2. According to the dataset kddcup99 and immune clonal selection algorithm, a new rule genotype and phenotype presentation method is proposed, which decrease sharply the chromosome length and the search space.3. According to clone selection mechanism, intrusion detection based on Immune Clonal Selection Algorithms is proposed. Immune clone selection algorithm is a new intelligent algorithm which integrates global search with local search, and can effectively overcome the prematurity and slow convergence speed of traditional evolution algorithm. We compare our algorithm with the algorithm which applies genetic algorithm to intrusion detection and applies negative selection algorithm of artificial immune system to intrusion detection in the dataset kddcup99. The experiment results have shown that the rule set obtained by our algorithm can detect unknown attack behavior effectively and have higher detection rate and lower false positive rate.