Research Of Intrusion Detection Model Based On Artificial Immune

Biological immune system and intrusion detection system are similar in the field of natural protection .The theory that the immune system can protect body from invasion provided a new method to design the intrusion detection system. So, Intrusion detection system based on the immune mechanism has become the leading issue of research in the field of intrusion detection. This system uses the principle, rule and mechanism of biologic immune system to realize the invasion detection and response. And the purpose is to provide a better solution for the intrusion detection problem.Firstly, a high-level instruction about the intrusion detection system mentioned above was given, including the development and status quo in this domain and an overview of the concept, mechanism and algorithm of intrusion detection system, biological immune system and artificial immune system. Especially, the dynamic clonal selection algorithm was introduced.Secondly, an improved dynamic clonal selection algorithm is proposed. And through this new algorithm, a new intrusion detection model based on artificial immune system is designed. In this model, some innovations are included. At first, using a division mutation algorithm to produce immature detectors. The algorithm can avoid a large number of invalid detectors. And then, using the multi-point crossover to evolve mature detectors, and proposing a fuzzy method to compute the number of crossovers. This fuzzy method can improve the diversity of mature detectors. At last, modifying the lifecycle of memory detectors through deleting the incompetent detectors to ensure the validity and real time capability of memory detectors. These three mechanisms can drop detection rate, improve false positive rate and capability of detecting the unknown attack behavior.Finally, using the data sets kddcup99 do some comparisons between the improved algorithm proposed by this paper and the original dynamic clonal selection algorithm. The experiment results prove that the proposed model can obtain higher detection rate and lower false positive rate, and detect the unknown attack behavior effectively.