The Research Of Intrusion Detection Technology Based On Quantum-Behaved Particle Swarm Optimization

In recent years, along with the development of computer technology and the expansion of network scale, the system are suffered by more and more the intrusion and attack, and the network and the information security questions are more and more prominent. As an important component of network security, Intrusion Detection System (IDS) has been used more and more widely. But the new problems has been faced in the development of IDS, how to differentiate the anomaly state and normal state has became one of the most main questions, and the accuracy of intrusion detection could be enhanced.In view of this question, the data mining (DM) technology has been introduced, and the data mining as a new artificial intelligence method in recent years, has been obtained universal application in the intrusion detection. However, the question of "the incisive boundary" is existed in the data mining, so fuzzy set theory is introduced, namely fuzzy data mining. But in a fuzzy set, because of the parameters and membership functions too relied on the expert domain knowledge, thus the accuracy of the intrusion detection has been affected.To solve these problems above, an approach that applies Quantum-Behaved Particle Swarm Optimization (QPSO) to optimize parameters of membership functions in anomaly detection is presented. The application of QPSO in the intrusion detection is discussed. According to the local area network, four attributes correlated the network traffic are chosen, data from the normal state and anomaly state are collected, and the appropriate membership functions is established. In optimized process, parameters of membership functions are arranged into particle swarm, an optimal parameter-set could be derived by embedding fuzzy data mining in the process of evolution of particle, the prime parameters could be searched. According to the prime parameters, the similarity of the normal state and anomaly state could be accounted, according to the small similarity, normal state and anomaly state could be differentiated in the most extent, and the accuracy of anomaly detection is improved greatly.The feasibility of the approach is proved according to the experiments on anomaly detection to network traffic.