Abstract: The traditional intrusion detection systems mostly adopt the analysis engine of the concentrating type, so it is already difficult to meet extensive security demand of the distributed network environment. While dealing with the exotic pathogeny, the biological immune system demonstrates many characteristics, such as distribution, variety, adaptability and efficiency etc, which offers a new thought of the study of the intrusion detection systems. An immunity-based model combining immune theory and data mining technique for distributed intrusion detection was proposed in this paper. Moreover a detail description was given to the architecture and work mechanism of the model, and the character of the model was analyzed. Finally the future research was presented.

Key words: network security, intrusion detection, immunology, data mining, negative selection

摘要： 传统的入侵检测系统大多采用集中式的分析引擎,误报率较高且缺乏自适应性,已难以满足日益发展的大规模分布式网络环境的安全需求。生物免疫系统处理外来异体时呈现出的分布性、多样性、自适应性和高效性等多种特性,为入侵检测系统的研究提供了一个新的思路。引用生物免疫机制,并结合数据挖掘技术提出了一种基于免疫的分布式入侵检测系统模型。文中详细描述了模型的体系结构和工作机制,并对模型特性进行了分析。

关键词: 网络安全, 入侵检测, 免疫, 数据挖掘, 负向选择