The Study On Nonself Classification Of Computer Immunology

Consulting the principle of biologic immunology system, computer immune system is presented to solve computer secure problems with superior performance to traditional secure technology. And the study on computer immune system has been paying far more attention to immune detection than immune response. The computer immune system GECISM (GEneral Computer Immune System Model) is designed with the functions of immune detection, immune response and immune adjustment. As an important intelligent agent of GECISM, imitate TH agent classifies the nonself detected by imitate MC Agent, which is the joint of immune detection and immune response. In this paper, a brief model of imitate TH agent is designed firstly on the base of expounding computer immune theory. And the research of nonself classification is concentrated on the several aspects listed hereinafter: system call sequence is selected as the uniform data source by analysis 3 kinds of nonself classification rules data source; Referring to the algorithm of data mining, an algorithm named as NFERR (Nonself Feature Extracting Algorithm based on Rules Reorganization) is brought forward to extract nonself classification features which can show nonself classific feature more accurately from system call sequence, and the experiment result shows its validity in this application; To getting higher accuracy, multi-level nonself eliminates method is applied to feedback the result of classification and to adjust the strategy of immune response. Applying these research result, an experiment system of imitate TH agent is implemented in the end of this paper.