Mixed Intrusion Detection Research Based On Artificial Immune System

The opening and sharing of network brings hidden danger for the security as well as it enriches the network resources. Network intrusion behavior is difficult to find, and it is not restricted by time and geography. It mainly reflects in the following aspects such as:The invaders invade the system by using program virus; Illegal user use unauthorized account to login and modify system files maliciously; Legal/illegal users steal the documents outside the authority maliciously; Illegal/legal users malicious leaked sensitive files; Thus the security of network has been a subject of concern. Besides that, with the rapid development of information technology and network, users can get more data from the network, and the dimension of the data characteristics is becoming more and more. In intrusion detection, the existence of the redundant and unrelated features will lead to the opposite effect. This redundant and useless information can reduce the accurate precision of detection and increase the time needed for testing, thus it makes the overall effect of detection reduced greatly. The so-called "data rich, information redundancy" and "dimension disaster" is the embodiment of the informative but lack of effective information. So, the feature selection algorithm achieves the purpose of dimension reduction by analyzing and removing redundant and useless information, it can reduce the testing time and improve the accuracy of detection obviously. Based on this, feature selection in the intrusion detection has become a research hotspot.In review of the shortages of the existing intrusion detection technology and feature extraction technology, we do the following research work in this article:(1) We described the concept and method of intrusion detection algorithm, and introduced the AIS (artificial immune system) applied to the principle and method of intrusion detection, we choose clonal selection algorithm and improve it. The improved method detects the intrusion behavior by selecting the best individual overall and cloning them. Experimental results show that the improved algorithm achieves very good performance when applied to intrusion detection. And it is shown that the algorithm is better than neural network with its 99.5% accuracy and 0.1% false positive rate.(2) We expound the concept and definition of feature selection algorithm, and according to the low accuracy, the high false positive rate and the long detection time of the existing feature selection algorithm, we put forward a feature selection algorithm towards efficient intrusion detection; this algorithm chooses the optimal feature subset by combining the correlation algorithm and redundancy algorithm. And we analyzed the extracted feature subsets through the experiment and the results show the algorithm shows even better performance in different classifiers.(3) We proposed that we can combine improved clonal selection algorithm to detect feature subsets extracted by improved feature selection algorithm. This not only reduce the dimension of data, reduce the modeling time, and at the same time, combined with the improved clonal selection algorithm, verify the validity of the experiment.