Research Of Intrusion Detection Method Based On Artificial Immunology

With wide use of computer network, people are paying more and more attention to network security problem. Intrusion detection is an essential component of information security protection system, which guarantees the security of the network resource. The problem of intrusion detection may boil down to the differentiation between the valid authorized use of computer system (self) and the invalid authorized use of computer system (nonself), which is similar to immune system. In recent years, the researchers who apply themselves to intrusion detection study have focused on intrusion detection technology based on immunology, whose prominent characteristic is to detect intrusion by immune system theories, architecture and algorithms. The main shortcomings of current intrusion detection study include poor expansibility, poor adaptability and incapability of detecting unknown attacks. Aiming at these deficiencies, this paper applies negative selection algorithm in immune system to intrusion detection field.In this paper, a new method based on negative selection is studied to detect intrusion. This method includes three parts:(1) Define a "self set;(2) Initialize the set of valid detectors whose element can not match any element of the "self set;(3) Use the valid detectors initialized above to detect intrusion.Because the method proposed in this paper applys the idea of the composite detection, it has the advantages of Misuse Detection and Anomaly Detection. The experiment results show that the method proposed in this paper has high True Positive Rate and low False Positive Rate, is able to detect the unknown intrusion whose type is known with pertinency and has a certain extent adaptability.