Research On Application Of Negative Selection Algorithm Based On Antigen Density Clustering In Intrusion Detection

With the development of information technology,computer network has rapidly occupied people's work,life and learning,it is convenient and fast in daily life,but followed by a variety of network security problems are increasingly serious.Intrusion detection technology is a common technique to maintain network security.Intrusion detection based on artificial immunity is a hot topic in the field of intrusion detection.Negative Selection Algorithm(NSA)is one of the basic algorithms of artificial immune system,which is widely used in intrusion detection.In order to solve the problems of low accuracy and high false positive rate when NSA algorithms cover each other during the generation of detectors and the redundancy of detector sets is high,this paper proposes a Negative Selection Algorithm Based on Antigen Density Clustering(ADC-NSA)and applies it to intrusion detection.The main work of this paper is as follows:(1)As the non-uniform distribution of self and non-self antigens is not considered in the traditional negative selection algorithm,which leads to a large number of redundant detectors and is difficult to fully cover the non-self region,this paper proposes to generate a class of known mature detectors through density clustering of non-self antigens,which can detect known intrusion behaviors.(2)Aiming at the problems of low detection accuracy and high false positive rate,this paper defines a new criterion for judging outliers.The outliers are first used as candidate detector centers,and the second type of mature detectors are generated through calculation,which can detect unknown intrusion behaviors.Because the data features of intrusion detection data sets are too complex,this paper uses Principal Component Analysis(PCA)to reduce the dimension of the data,and preprocesses the data such as Z-score standardization and numerical normalization.(3)In the same experimental environment,this paper conducted experimental verification of the proposed algorithm.BCW and KDDCUP99 data sets are used to conduct experiments with normal samples as self and other abnormal samples mixed as non-self.The detection rate and false positive rate are selected as evaluation indexes to verify the effectiveness of the proposed algorithm.In order to better verify the experimental effect of the algorithm applied in intrusion detection,the algorithm is simulated on KDDCUP99 and CSECIC-IDS2018 data sets respectively.Normal data are taken as self,various attack types are taken as non-self,and accuracy and false positive rate are selected as evaluation indexes to carry out experimental verification.The experimental results show that the proposed algorithm has a lower false positive rate and a higher accuracy rate and detection rate on the two groups of experiments and three data sets,which verifies that the proposed improved method has a better detection effect in the application of intrusion detection model.