Negative Selection Algorithms Based On Further Training And Information Gain

The human immune system (HIS) has drawn researchers’great attention for its strong ability of information processing, its significant characters, such as self adaptive, parallel and distributed, bring new ideas to engineering applications, artificial immune system (AIS) has been proposed based on these characters. In consideration of the similarity between immune system and intrusion detection system, artificial immune system based algorithms are applied in intrusion detection. First, negative selection algorithm with processing of "blank region" data is proposed, and then negative selection algorithm with further training is proposed, finally, the information gain strategy is integrated in negative selection algorithm to detect network intrusion.In chapter two, we introduce the motivation of processing data in "blank region" and its framework in details, the data lied within the "blank region" are further analyzed by this strategy to determine its label more accurately. Experimental results show that, compared with V-detector, algorithm proposed in this chapter has modified the detection rate and false alarm rate.In chapter three, an algorithm, termed as negative selection algorithm with further training (FtNSA), is proposed to solve the problem of expensive computation cost in the algorithm of chapter two. The number of self samples is greatly reduced and the coverage of self region is improved by integrating the further training strategy. From the experimental results, we can see that, the computing time is reduced in FtNSA and the anomaly detection performance of which is improved.In chapter four, the information gain is introduced, negative selection algorithm with information gain is proposed and applied to the anomaly detection of KDD99data set, by which we can estimate the ability of NSA in network intrusion detection. The work in this chapter expands the application of NSA to anomaly detection in multi-dimensional data. Experimental results show that, by selecting features with big information gain, the performance of NSA in anomaly detection of KDD99data set is greatly improved.