Research On Key Technologies Of Network Security Autonomous Defense Based On Digital Ant System

Existing network security mechanisms has not got rid of artificial participation,which is difficult to respond flexibly when face to complex and dynamic networking environment.Therefore,it is of great research value to strengthen the development of network security defense technology in the direction of intelligence,autonomy and coordination.Machine learning technology has high detection accuracy in the field of intrusion detection and has ability for detecting unknown threats.Digital ant system has the advantage of moving and self-organizing between different hosts.Combining the advantages of machine learning and digital ant system,this paper proposes a distributed intrusion detection system based on digital ant system,the details of the paper studies are as follows:1.Based on the analysis of mobile agent technology and digital ant technology,this paper proposes a distributed intrusion detection system based on digital ant(DA-DIDS),in which mobile agents are patrolled in the monitored network domain to achieve independent detection and elimination of common threats.2.Aiming at the model of network traffic intrusion detection in the DA-DIDS framework,an improved naive Bayesian intrusion detection model based on secondary training is proposed.Methods of improved variance discrimination and Pearson correlation coefficient are used for feature selection.And a new weight extraction method for secondary training is used.Experiments show that this method improves the detection accuracy of small sample attack types.3.Aiming at the model of malicious code detection in the DA-DIDS framework,a malicious code detection model based on Bayesian optimization and Xgboost algorithm is proposes.The API call function and other dynamic behaviors are extracted as the feature data.And automatic parameter adjustment is realized through Bayesian optimized Xgboost algorithm.Experiments show that the optimized Xgboost algorithm has better detection accuracy on malicious code samples.