Detector Evolution Method Based On Immune Mechanism

With the rapid development of computer network technology,the problem of network security has been strongly concerned by the state and society.The characteristics of intrusion detection system are very similar to biological immune system.Bionic intrusion detection technology based on biological immune mechanism arises at the historic moment.The traditional artificial immune algorithm based on "self" and "non-self" model has the problems of large self set,low detector generated efficiency,low detection rate and high false alarm rate.It can not adapt to the complex and changeable network security,and has great limitations in the practical application process.In this paper,a four level modular adaptive detection model(FLMD model)is proposed based on three major signals of danger theory and immune idiotypic network theory.The FLMD model constructs normal features and abnormal feature databases at the same time.It does not take into account the self tolerance problem,and helps to improve the detection performance.The FLMD model is composed of multiple mutation adaptive detection module,decision fusion module,danger signal perception module and adaptive response module.In the multi-mutation adaptive detection module,multi-mutation self-adaption idiotypic network detection algorithm(MSIN algorithm)is mainly proposed.The MSIN algorithm establishes the connection of similar antibodies,thus constructing the immune network,selecting the cloned individual by calculating the incentive level and mutating the antibody towards the antigen direction by multi variation,thus effectively reducing the number of training and improving the recognition ability of the variant antigen.In the decision fusion module,the decision-template-adjustable fusion method(DTAF method)is mainly proposed.By establishing the normal and abnormal decision template,the fusion of multiple primary detection results in the multi variant adaptive module is realized,and the cooperative stimulation signal is produced to start the hazard signal sensing module,and the decision template is dynamically adjusted to update the template online,thus effectively improving the detection rate and accelerating the twice immune response.In danger signal perception module,the danger perception algorithm(DPA algorithm)is mainly proposed.Based on the risk classification,the DPA algorithm constructs different types of danger perception cells.By calculating the affinity of various dangerous sensing cells to perceive the danger,the further confirmation of suspicious signals can be realized so as to achieve better detection results..At the end of this paper,the KDD-CUP-99 data set is used to simulate the FLMD model.The experimental results show that the FLMD model and the related algorithms can effectively improve the detection rate of network attacks,reduce the false alarm rate,enhance the learning and adaptive ability of the unknown attack,and enhance the stability of the detection.