基于改进基因库的检测器生成算法

在基因库生成检测器算法中,一般是把被删除的记忆检测器进行基因突变后的基因或非自体集样本加入到基因库中来初始化并更新基因库。经过若干代之后,在基因库中会出现一些相似性比较大的基因,形成基因的聚类现象。通过定期的对基因库进行聚类,变异,约减,提高成熟检测器对入侵的检测多样性。实验结果表明,该方法是有效的,能在快速生成检测器的同时,提高对未知入侵的检测能力。     

一种基于多级否定选择的入侵检测器生成算法

文中给出一种改进的基于人工免疫入侵检测系统的否定选择算法。首先是用多级否定选择算法生成不同检测尺度的成熟检测器,然后为了模仿人体免疫系统中的第二次应答机制,引入了记忆检测器的概念及相应的算法,结合亲和力成熟与体细胞突变等方法,将成熟检测器提升为识别率极高的记忆检测器。     

入侵检测系统中生成成熟检测子集的研究

提出一种将基因库进化与否定选择相结合生成成熟检测子集的算法,采用基因库易于结合抗体进化原理对基因实施进化,改进的否定选择算法维持了抗体的多样性和一般性,从而提高入侵检测系统中生成成熟检测子的效率.反馈学习双网络结构可以有效处理基因库进化中抗体突变对生成抗体带来的不利影响,同时进行反复学习使抗体不断向抗原进化,提高入侵检测的准确率.     

嵌入否定算子的网格入侵检测克隆选择算法

网格安全问题是网格普及的一大阻碍,网格入侵检测是解决网格安全瓶颈的方法之一.面向网格入侵检测需求,以现有克隆选择算法为主体,设计了嵌入否定选择算子的克隆选择算法(Negative Seleetion Operator Embedded Clonal Selection Algorithm,NCSA)作为新的检测器算法.否定算子删除了未成熟检测器中耐受性差的检测器,协助记忆检测器实现动态更新;亲和力成熟机制减少了协同刺激数量.通过实验合理设置两个影响NCSA性能的参数:不成熟检测嚣的耐受周期T和成熟检测器的生命周期L,获得满意的检测性能.相同参数和训练环境下,与传统克隆选择算法相比,NCSA获得较高非自我检测率和较低的误报率,整体检测性能有所提高.这也说明NCSA能更好识别未知入侵,适应网格环境.     

基于人工免疫的记忆检测器研究

传统的手段已不能充分地解决计算机网络的安全问题。为了确保计算机网络系统安全,建立一个有效的入侵检测系统IDS,针对IDS中成熟检测器检测率低和错误肯定率高的问题,根据人工免疫记忆原理,研究了免疫检测器集中成熟检测器激活,记忆检测器生成与变异机制以及演化,给出了记忆检测器生成算法,研究了记忆检测器变异和淘汰机制。实验结果证明记忆检测器为主的检测器集合实现了检测器自学习和联想记忆的功能,提高了入侵检测系统的自适应能力和检测率,减少了错误肯定率。     

人工免疫中一种新的基因库初始化方法

在基于人工免疫的入侵检测研究领域,一般都是应用随机产生字符串的方法来生成检测器。这种方法生成检测器的速度较慢,而且生成的检测器集的检测率低。由于非我样本中存在着关于非我空间的信息,提出通过应用非我样本来初始化基因库并应用基因库来生成检测器的方法来检测入侵。应用KDD Cup 1999入侵检测数据集,通过实验证明该方法是有效的,能更快地生成检测率更高的检测器集。     

免疫入侵检测多目标优化克隆选择算法研究

免疫入侵检测理论中克隆选择是检测器进化的关键。传统克隆选择算法通过比较样本间的亲和力累加值筛选样本,该方法具有较低的时间复杂度,但也造成了检测器的高重叠,影响迭代效率。将检测器个体的筛选与进化转化为pareto最优解的求解过程,提出了多目标优化理论的检测器克隆选择算法。实验表明,检测器基数不变的情况下,该算法明显提升了每代种群在进化过程中的检测范围,精简了记忆检测器的数量,提高了检测阶段系统的检测率。     

基于人工免疫入侵检测检测器生成算法

为了提高基于人工免疫入侵检测系统中从未成熟检测器生成成熟检测器的效率,论文提出了基因库均衡技术,并将基因库进化算法与传统阴性选择算法相结合,设计了分布式人工免疫入侵检测系统中成熟检测器生成算法,实验证明采用基因均衡技术之后提高了整个系统的计算效率。     

利用聚类改进动态克隆选择算法的自体纯净性问题

动态克隆选择算法应用于入侵检测的过程中,经过记忆检测器和成熟检测器检测后的剩余抗原被直接作为自体供未成熟检测器耐受,但这些剩余抗原并非完全是自体,有可能隐含新型攻击。为此提出利用聚类分析技术进行改进,先用聚类算法将剩余抗原分成大、小簇,然后分析小簇中的数据,发现其中隐含的新型攻击,并及时更新记忆检测器集和自体集。实验结果表明,加入聚类分析的动态克隆选择算法能够增强检测系统发现未知入侵的能力。     

人工免疫系统超变异模式识别及应用

描述了人工免疫系统(Artificial Immune System,AIS)原理,在人工免疫系统算法的基础上,对免疫系统的超变异特性进行了算法设计,并针对四种简单信号模式对人工免疫系统普通模式识别算法和超变异模式识别算法进行了比较.结果表明:人工免疫系统普通模式识别算法和超变异算法皆可对四种信号模式进行识别,超变异算法可以快速得到最优抗体,且亲和力优于普通人工免疫系统模式识别算法,并给出了人工免疫系统超变异模式识别算法在碳纤维增强复合材料板疏松缺陷超声信号检测中的应用.     

Intelligent multi-user detection using an artificial immune system

Artificial immune systems (AIS) are a kind of new computational intelligence methods which draw inspiration from the human immune system. In this study, we introduce an AIS-based optimization algorithm, called clonal selection algorithm, to solve the multi-user detection problem in code-division multiple-access communications system based on the maximum-likelihood decision rule. Through proportional cloning, hypermutation, clonal selection and clonal death, the new method performs a greedy search which reproduces individuals and selects their improved maturated progenies after the affinity maturation process. Theoretical analysis indicates that the clonal selection algorithm is suitable for solving the multi-user detection problem. Computer simulations show that the proposed approach outperforms some other approaches including two genetic algorithm-based detectors and the matched filters detector, and has the ability to find the most likely combinations.     

Transient fault detectors

We present fault detectors for transient faults, (i.e., corruptions of the memory of the processors, but not of the code of the processors). We distinguish fault detectors for tasks (i.e., the problem to be solved) from failure detectors for implementations (i.e., the algorithm that solves the problem). The aim of our fault detectors is to detect a memory corruption as soon as possible. We study the amount of memory needed by the fault detectors for some specific tasks, and give bounds for each task. The amount of memory is related to the size and the number of views that a processor has to maintain to ensure a quick detection. This work may give the implementation designer hints concerning the techniques and resources that are required for implementing a task. An extended abstract of this paper was presented at the 12th International Symposium on DIStributed Computing (DISC’98). Shlomi Dolev is partly supported by the Israeli Ministry of Science and Arts grant #6756195. Part of this research was done while Shlomi Dolev was visiting the Laboratoire de Recherche en Informatique (LRI), University of Paris Sud.     

基于多种群遗传算法的检测器生成算法研究

有效的检测器生成算法是异常检测的核心问题, 针对现有算法存在检测率低、匹配阈值固定、检测器集合庞大等问题, 本文提出了基于多种群遗传算法的检测器生成算法, 根据形态学空间的分析和覆盖问题原理, 自体集根据特征进行划分, 各个种群根据划分独立按遗传算法进化, 最后求得所有检测器种群的并集得到成熟的检测器. 所提出的算法有效降低检测器的冗余度, 减少检测器规模, 保持检测器的多样性; 并利用 maxSelf 实现匹配阈值 r 的自适应, 适用于多种匹配规则, 减小了阈值设置的局限性, 给出了算法的检测率高于传统算法的理论证明, 并通过实验验证了算法的有效性. 另外, 通过统计算法的时间复杂度, 证明算法时间复杂度没有明显增加.     

基于亲和度变异的入侵免疫识别方法

免覆入侵检测系统是异常检测的一种崭新思路，系统设计时的一个难点是要用相对有限的检测器(抗体)来识别相对无限的外界入侵(抗原)，现有工作主要通过进化学习来实现对未知抗原的识别，但实验结果并不能令人满意．本文提出一种新的基于亲和度变异机制的入侵免疫识别方法，不同于前人工作，本文对检测器引入多态性，使得检测器在学习未知入侵模式的过程中能够保持很高的多样性，并最终得到能够适应大量外界入侵的检测器集合．实验结果表明基于亲和度变异的入侵免疫识别方法能够较好地适应网络入侵检测的应用背景，对未知入侵模式的识别能力很强，采用本方法的入侵检测系统已通过科技成果鉴定．     

An antibody network inspired evolutionary framework for distributed object computing

In order to meet the increasing scale and users requirements for the distributed object computing (DOC) systems, their infrastructures are highly desirable to be redesigned. Based on the principles of immune system and the evolution mechanisms learned from an antibody network model, a novel evolutionary framework for DOC (E-DOC) is proposed. The antibody network model as well as the evolution process including clonal proliferation, immune elimination, and immune memory is studied. Then, E-DOC framework based on the antibody network is proposed, whose simulation platform is designed and implemented. On the platform, the evolutionary features are studied by: (1) diversity and stability of antibodies and genotypes, (2) detection and elimination of antigens, (3) effect of immune memory, and (4) tendency of eliminated and stimulated antigens. The experiment results show that the proposed framework can achieve the evolution ability and the promising performance, which are critical to DOC systems. E-DOC is extendable for the future design of distributed object middleware, such as WebSphere Application Server and BEA WebLogic Application Server.     

动态克隆选择算法在入侵检测应用中的研究

内嵌阴性选择算子的克隆选择算法（N-AIS）只能作为误用检测器,检测给定静态环境下的入侵行为,而不能自适应动态变化的网络环境.本文引入一种动态克隆选择算法DynamiCS对N-AIS进行扩展,并在人工生成的IDS环境中对影响DynamiCS性能的三个重要参数：耐受期、激活阈值和生命期进行了测试和分析.结果表明,它能够更好地处理和应用于入侵检测系统自身行为不断变化及每次仅提呈部分自身抗原的环境.     

基于基因库的新型检测器生成方法

提出一种新的检测器生成方法。由于非我样本中存在着关于非我空间的信息,提出通过统计非我样本中各属性的分布情况来构建基因库,并应用基因库来生成检测器的方法来检测入侵。应用KDDCup1999数据集,通过实验证明该方法能够生成检测率更高的检测器集。     

Decentralized Bayesian detection with feedback

A decentralized detection system with feedback and memory using the Bayesian formulation is investigated. The optimization of this system results in a likelihood ratio test at the local detectors for statistically independent observations. In addition, local detector thresholds and the system probability of error are shown to be a function of the fed back global decision. The issue of data transmission between local detectors and the fusion center is addressed. Two protocols are proposed and studied to reduce data transmissions. Numerical examples are also presented for illustration     

An antigen space density based real-value negative selection algorithm

The negative selection algorithm (NSA) is an important detector generation algorithm for artificial immune systems. In high-dimensional space, antigens (data samples) distribute sparsely and unevenly, and most of them reside in low-dimensional subspaces. Therefore, traditional NSAs, which randomly generate detectors without considering the distribution of the antigens, cannot effectively distinguish them. To overcome this limitation, the antigen space density based real-value NSA (ASD-RNSA) is proposed in this paper. The ASD-RNSA contains two new processes. First, in order to improve detection efficiency, ASD-RNSA utilizes the antigen space density to calculate the low-dimensional subspaces where antigens are densely gathered and directly generate detectors in these subspaces. Second, to eliminate redundant detectors and prevent the algorithm from prematurely converging in high-dimensional space, ASD-RNSA suppresses candidate detectors that are recognized by other mature detectors and adopts an “antibody suppression rate” to replace the “expected coverage” as the termination condition. Experimental results show that ASD-RNSA achieves a better detection rate and has better generation quality than classical real-value NSAs.