Research On Anomaly Detection Based On Biological Immunology

Along with the development of computer science,Internet has become an important safeguard in keeping the society normal functions.The loss of knowledge and property caused by information leakage in large scales of Internet attacks is immeasurable.How to solve problems in information security has risen to be a national strategy.Artificial Immune system is a bionic technology,based on biological immunology,to simulate biological immune system in the use of Artificial Intelligence.The Artificial Immune system could detect abnormity by separating "self"and 'nonself'.As a core algorithm in Artificial Immune system,Negative Selection could protect computer system from being attacked effectively,which is significant in guiding research in computer information security.The article elaborates and conducts a simulation experiment on two data processing methods in Negative Selection,actual value and binary system algorithm.It mainly compares three classical matching algorithms in binary system,including Rcb matching algorithm,Rab matching algorithm and Hamming distance matching algorithm.On the basis of the comparison and combination of the advantages of Rcb and Hamming distance matching algorithm,the article proposes an improved double detection algorithm,which has been proved to have significantly higher space covering rates and detection rates.Under the same condition,the number of detectors decreases significantly,which proves the validity of the improved double detection algorithm.Applied in actual detecting situation,the improved algorithm,designed to aim at five kinds of malicious codes include Netsky?Bagle?Bagle1?MyDoom?Zhetalin and these variants,could generate a broader-range covering detector and defend more malicious codes.The simulate experiment proves the validity of detection model and illustrates that Negative Selection has a great capacity in recognizing malicious codes.