Research Of Network Intrusion Detection Based On Immune And Evolutionary Computation

Nowadays, human beings have entered into the network age. However, they have to confront the severe information security problem while they benefit from the tremendous chances bringed from information revolution.The intrusion detection technique is an important method to insure the computer network security. It is becoming one of hot research topics in information security field. The operating mechanism of intrusion detection systems is naturally similar to the human immune system. The theory that the immune system can protect body from invasion provides an important approach to investigating the intrusion detection technique.Firstly, in this paper, the biology immune mechanisms such as Self and None-self recognition, antibody diversity, positive selection, negative selection, colonal selection, affinity maturation and association memory are analysed. The function between biology immune systems and intrusion detection systems is compared. The feasibility of applying immunity principle to intrusion detection systems is analyzed. Based on the immunity principle and evolutionary computation, an intrusion detection model is proposed. The model that simulates the biology immune mechanisms and applies genetic algorithm is auto-organized, auto-adapted and self-learning.Also, a few important sub-models are proposed. They are Self-set constructing model, detector structure model, detector lifecycle model and memorial-detector evolution model.Finally, a new mature-detector generation algorithm is proposed and designed. This algorithm that has profited from the biology immune system positive selection and negative selection as well as the evolutionary computation genetic algorithm, has auto-adapted characteristics and so on as well as randomness, has overcome the shortcoming of too much expenses of the tradition algorithm based on negative selection. Also, a new memorial-detector generation algorithm is proposed and designed. This algorithm that has profited from the colone theory the affinity maturation process generates the memorial-detectors using the evolutionary strategy while the tradtition algorithm just tags the active-detectors as the memorial-detectors.