Research Of Intrusion Detection Based On Artificial Immune Algorithm

In the era of Internet rapid development, network security is getting more and more important and intrusion detection plays an increasingly important role in network security. Traditional intrusion detection methods have a strong dependence of rule base data, and do not recognize unknown attacks. Researchers introduced artificial immune into the detection field, and made the field have a new breakthrough in theory. It is a new direction in the research of intrusion detection field and has made many achievements, but the low detection rate and high rate of false positives still exist. Therefore, the emphasis of research in this field is still to improve the effect of detection through different means.On the basic of insight into intrusion detection and artificial immune, in view of the advantages and disadvantages of immune algorithms, clonal selection algorithm and multi-colony immune algorithm were selected to research. The parallel mechanism, hybrid and optimal operator of multi-colony immune algorithm were introduced into the clonal selection algorithm. In combination with the advantages of both, multi-colony clonal selection algorithm was proposed. Then, based on the characteristics of the kddcup99 dataset, four types of attack data which were encoded and removed duplicate data were regard as the initial populations of this algorithm for immune operation.The r matching rule based on string matching was analyzed, the r value’s effect to matching effect was illustrated with matching probability formula, the problems of binary string based on kdcup99 data set that the length was too long and the optimal value of r was not easy to test were pointed out, and the matching rule was improved.Finally, simulation experiment was finished by kddcup99 data set. Based on the principle that normal data is larger than the abnormal data, in turn, experimental data set matched with the normal data set and the optimal model. The results of experiment show that the algorithm can improve detection rate.