一种基于协议分析和免疫原理的网络入侵检测模型

通过对协议分析技术和生物免疫系统的理论分析,本文提出一种新的基于协议分析和免疫原理的网络入侵检测模型。该模型对检测器集合按照协议类型分类,生成相应的检测器子集,并设计一种新的检测器结构,对检测器进一步分类。每个子集中检测器独自进行变异、进化,整个检测器集合以子集为单位进行更新。在实际检测中,待检模式与相应的检测器子集匹配,从而能有效地提高检测速度,改进以往模型在这方面的不足。

A Network Intrusion Detection Model Based on Protocol Analysis and Immunological Principle

With theoretical analysis of protocol analysis and biological immunity system,this paper presents a new intrusion detection model based on protocol analysis and immunological principle.The model can sort the set of detectors according to the protocol type,and generate the relevant subsets of the detectors.Designing a new detector structure can sort the detectors further.The detectors of each subset can mutate,evolve alone and the whole detectors update based on subset.In practical detection,the patterns to be detected match the relevant subset of the detectors,so the detection speed can be effectively improved,making up the deficiency of past modes.