基于ISM 特性的检测器生成算法及模型

针对现有检测器生成算法存在效率低、自适应性差、生成的检测器集庞大且冗余等问题, 借鉴生物免疫系统中抗体的克隆机制和亲和度变异机制, 并融合小生境策略以及检测器的变异和优化等, 构建基于免疫软件人(ISM) 特性的检测器生成算法及模型. 与传统算法相比, 该算法能够降低检测器的冗余度, 减少检测器集的规模, 保持检测器的多样性; 通过合理地改变其匹配阈值, 能够实现以较小的检测器集检测出更多的异常行为的目的. 实验结果表明, 所提出的算法具有较强的自适应性, 且拥有较高的检测效率和性能.

Detector generating algorithm and model based on immune-softman

Aiming at the low true-positive rate, poor adaptability, large size and redundant detector set of existent detector generation algorithms, a self-adaptive detector generation algorithm and model based on immune-softman(ISM) characteristics is proposed. The algorithm model draws lessons from the antibodies cloning mechanism and affinity variation mechanism of the biological immune system(BIS), and integrates the niching strategy and the variation and optimization operations of the detector. Compared with traditional detector generation algorithms, the proposed algorithm can decrease effectively the redundancy of detectors, minimize the size of detector set, and maintain the diversity of detectors. At the same time, by changing continuously the matching threshold of effective detectors, the algorithm can detect quickly abnormal behaviors in the scale of the non-self space by a smaller detector set. The experiment results show that the algorithm has better adaptability and higher detection efficiency and performance.