Immune Theory Based Network Intrusion Detector Generating Algorithm And Its Model

This paper is supported by the science and technology office of Si Chuan Province. The item No.04JY029-017-1, about intelligent intrusion detection system.Network intrusion detection which based on the principle of human's immunity is currently one of the research hotpots, It has many advantages that the old technology absent. There are many things need to research deeply. Such as constructing more reasonable models, generating high quality detector, advancing new immunity algorithm.In this paper the author pay more attention to the Intrusion detection models based on the principle of immunity and the algorithm of generating detector. As follows is the simply explain about the results of research.First, the author advances the model of intrusion detection which based on the principle of human's immunity systems (NDHDD). The model with the function of network data analysis and processing, generating representative mature detector sets, communicating between models of intrusion detection based on host, updating the detectors dynamically, and so on.Second, According the ways of host detection model, author proposes two stages real-valued negative selection algorithm with mutation. On the stage of detectors generating, the algorithm combines the mind of tissue, data cluster, negative selection, mutation. So, the algorithm can select the representative data, reduce the data redundancy and promote the detector generation efficiency.Third, Author advances new mutation formula on the basement of researching the characteristic of normal and intrusion data. New mutation formula is self-adaptive and can be controlled well. It ensures that the variation data far away the correct data, make sure the data of variation in the space of shape and let the distribution of data become more well.Forth, Author makes the simulation testing about the algorithm. The tests data shows that the algorithm can generate better representation detectors, reduce the average of false negative rate and false alarm rate efficiently. The new mutation formula is more steady than the way of random mutation.