关键词: 入侵检测, 人工免疫, 协同刺激, 协议分析

Abstract: An improved artificial immune intrusion detection model is proposed based on ARTIS(Artificial Immune System)--a distributed intrusion detection model proposed by Hofmeyr. It aims to overcome defects of the existing artificial immune IDS. To improve the quality and reduce the scale of memory and mature detector, the improved model uses the protocol analysis technology to make co-stimulation of the immune module. The protocols are taken into account while generating and organizing detectors, so the inefficiency of traditional AIS can be covered. Weight based r-continuous matching rules are taken to improve matching accuracy of the antibody-antigen reactions. Meanwhile, the co-stimulation module can automatically generate dynamic filter rules for firewall when Flood attack occurs. Finally, we have a simulation test and comparative analysis on improved model and ARTIS model by using DARPA data sets owned by MIT Lincoln lab and the results evaluate the feasibility and effectiveness of our improved model.

Key words: intrusion detection, artificial immune, costimulation, protocol analysis