| The development of Internet technology brings convenience to people,but it is also accompanied by network security problems.In order to protect personal information from being violated in the network environment,firewall,data encryption,intrusion detection and other technologies are widely used.Among them,intrusion detection technology is a typical technology to maintain network security,which maintains host or network security by identifying and responding to attack data.Negative selection algorithm(NSA)is an abstract algorithm that simulates the human immune system to identify self and non-self to protect the body from harm.Its principle is very similar to the process of intrusion detection.Therefore,the application of negative selection algorithm to intrusion detection is an important direction of intrusion detection research.With the development of information technology,the characteristics of network attack behavior are diversified.In the actual network intrusion prevention,the attack type will change with the change of time,network environment and the information technology of the intruder.The traditional negative selection algorithm mainly focuses on the detection efficiency of the detector under the existing data samples,and it will have the problems of low detection rate and high false positive rate over time when it is applied to intrusion detection in the changing attack environment.To solve this problem,combined with the forgetting mechanism’s ability to guide the update of old and new knowledge in the changing environment,this paper proposes a negative selection algorithm based on forgetting mechanism,which makes the detector self-adjust with the change of external environmental factors,and applies the improved algorithm to the intrusion detection model.The main work of this paper is as follows:(1)In order to solve the problem of long detection time caused by detector retention,firstly,the attenuation theory that guides the processing of outdated memories in the forgetting mechanism is used to appropriately forget the inactive detectors that are gradually not adapted to the current detection environment in the process of time,so as to alleviate the detector retention and reduce the detection time.Then,the interference theory in the forgetting mechanism is used to guide the processing of the consistency or conflict between the old and new memories,and the activity of the detector is promoted or suppressed according to the detection results,and the more active detector is used first.(2)In view of the problem that the detection rate of the detector decreases and the false positive rate increases after the change of the data environment,the detector suddenly becomes unqualified in the process of rapid forgetting detection by referring to the stress forgetting theory which guides the processing of stress memory in the forgetting mechanism,and the detector is supplemented in the new data form to reduce the false positive rate and ensure the detection rate.(3)Aiming at the problem that it is difficult to maintain a good detection effect in the complex and varied network environment in intrusion detection,the improved algorithm is applied to intrusion detection by using data sets UNSW-NB15 and NSL-KDD to verify the effectiveness of the improved algorithm,and the intrusion detection model based on the improved algorithm is constructed.In order to verify the detection effect of the model in actual network data,the common intrusion detection data sets NCL-KDD and CSE-CIC-IDS2018 are used to simulate various access connections in network traffic.Experimental results show that the proposed model can timely adjust the detector to adapt to the current attack environment with the change of intrusion data,which is more stable than the comparison model. |
