Research On Design Intrusion Detection System Based On Artificial Immune

With wide use of computer in various fields, the security of the computer has becomeincreasingly important; it helps to promote the technology of intrusion detection too. In recentyears, the intrusion detection technology based on immunology is the hot point. It uses thenatural immune principles and mechanism to achieve intrusion detection. At present,traditional intrusion detection system is able to detect the simple attacks but high falsedetection rate; and it only detects the known attack and can not detect dynamic and inconstantnetwork. However, the intrusion detection system based on artificial immune takes theexacting legal access data from dynamic network as the characteristic, and this characteristicis updated to detection system. It can detect network according to the operation of networkand promotes the network security.This thesis introduces the issues and development direction of system structure,classification, existence of network intrusion system. Moreover, this thesis introduces basictheory and main arithmetic of artificial immune. In addition, this thesis introduces associationmining theory and algorithm.The following innovation points of this thesis:1. This thesis presents the model based on artificial immune; this model uses Life-cyclemechanism and memory antibody, Mature antibody, Immature antibody, and builds theintrusion detection system adapting dynamic network.2. This system adopts association rules mining method that belongs to data mining toprocessing legal access data of alarming data, and adds this characteristic to Mature antibody.It makes the system to detect network intrusion dynamically, at the same time, decreases thefalse rate.3. This thesis presents that autologous mode class detects normal access data thatpromotes the access speed.Finally, this thesis adopts the Massachusetts Institute of Technology Lincoln LaboratoryDARPA intrusion detection evaluation data set to simulate a dynamic network environment.The experimental results show that this model can adapt to dynamic network change, anddecrease alarm and reduce detection false rate.