An Intrusion Detection Model Based on Immune and Rough Sets Theory

• Information security • Previous Articles Next Articles

An Intrusion Detection Model Based on Immune and Rough Sets Theory

广东药学院医药商学院计算机系

Received:2005-11-10 Revised:2005-12-29 Online:2006-05-01 Published:2006-05-01

基于免疫原理与粗糙集理论的入侵检测方法

蒋世忠, 杨进, 张英

广东药学院医药商学院计算机系

通讯作者: 蒋世忠

Abstract

Abstract: Intrusion detection system has become the research hotspot because it can provide dynamic protection for computer system. Aiming at the problems existed in actual methods or models of intrusion detection, an effective method for intrusion detection based on immune theory and rough sets theory was presented in this paper. The circular sequences of system call sequences generated during the normal execution of a process is replaced by circular body, then, a little data is extracted from normal system call sequences, and is transformed to decisive table, afterward, the decisive table is reduced and the simplest rules that present normal behavior mode is extracted from reduct by rough sets theory. These rules can be used to detect anomalous behavior. In order to realize the quick detection of known intrusion, an engine of quick detection inspired by immune system theory was presented in this paper. Compared with other methods in the literature, the method presented in this paper is not only able to extract a set of effective detection rules with the minimum size from part of records of system call sequences, but also can detect the known intrusion quickly. Experiments show that this method in this paper is better than other methods based on system call.

Key words: intrusion detection, rough sets theory, immune theory, system call, circular sequence, rule, quick detection

摘要： 针对目前基于进程系统调用的入侵检测方法中存在的问题，提出了一种基于免疫原理与粗糙集理论的入侵检测方法。该方法在对系统调用序列中的循环序列进行置换的基础上，借助于粗糙集理论，提取出一个简单的最小预测规则模型；同时融合免疫原理的有关机制，在检测模型中加入对已知入侵的快速检测引擎。同其他方法相比,该方法不需要完备的进程系统调用数据,而且得到的规则简单，更适用于实时检测。实验结果表明,该方法的检测效果优于同类的其他方法。

关键词: 入侵检测, 粗糙集理论, 免疫原理, 系统调用, 循环序列, 规则, 快速检测

;;. An Intrusion Detection Model Based on Immune and Rough Sets Theory[J]. Journal of Computer Applications.

蒋世忠; 杨进; 张英. 基于免疫原理与粗糙集理论的入侵检测方法[J]. 计算机应用.

[1]	Jiepo FANG, Chongben TAO. Hybrid internet of vehicles intrusion detection system for zero-day attacks [J]. Journal of Computer Applications, 2024, 44(9): 2763-2769.
[2]	Haixiang HUANG, Shuanghe PENG, Ziyu ZHONG. Binary code identification based on user system call sequences [J]. Journal of Computer Applications, 2024, 44(7): 2160-2167.
[3]	Shipan JIANG, Shuwei CHEN, Guoyan ZENG. Strategy of invalid clause elimination in first-order logic theorem prover [J]. Journal of Computer Applications, 2024, 44(3): 677-682.
[4]	Zhongyu WANG, Xiaodong QIAN. Optimization of edge connection rules for supply chain network based on improved expectation maximization algorithm [J]. Journal of Computer Applications, 2024, 44(11): 3386-3395.
[5]	Jihui LIU, Chengwan HE. Online detection of SQL injection attacks based on ECA rules and dynamic taint analysis [J]. Journal of Computer Applications, 2023, 43(5): 1534-1542.
[6]	Shaochen HAO, Zizuan WEI, Yao MA, Dan YU, Yongle CHEN. Network intrusion detection model based on efficient federated learning algorithm [J]. Journal of Computer Applications, 2023, 43(4): 1169-1175.
[7]	LI Xingjia, YANG Qiuhui, HONG Mei, PAN Chunxia, LIU Ruihang. Test case prioritization approach based on historical data and multi-objective optimization [J]. Journal of Computer Applications, 2023, 43(1): 221-226.
[8]	LIU Yongmin, YANG Yujin, LUO Haoyi, HUANG Hao, XIE Tieqiang. Intrusion detection method for wireless sensor network based on bidirectional circulation generative adversarial network [J]. Journal of Computer Applications, 2023, 43(1): 160-168.
[9]	Ning DONG, Xiaorong CHENG, Mingquan ZHANG. Intrusion detection system with dynamic weight loss function based on internet of things platform [J]. Journal of Computer Applications, 2022, 42(7): 2118-2124.
[10]	Bing GAO, Ya ZHENG, Jing QIN, Qijie ZOU, Zumin WANG. Network intrusion detection algorithm based on sparrow search algorithm and improved particle swarm optimization algorithm [J]. Journal of Computer Applications, 2022, 42(4): 1201-1206.
[11]	Liqun ZHANG, Haitao LIN, Wenming HUAN, Wenting BI. Software defined network flow rule conflict detection system based on OpenFlow [J]. Journal of Computer Applications, 2022, 42(2): 528-533.
[12]	Shunkun YU, Hongxu YAN. Heuristic attribute value reduction model based on certainty factor [J]. Journal of Computer Applications, 2022, 42(2): 469-474.
[13]	Jingwei LEI, Peng YI, Xiang CHEN, Liang WANG, Ming MAO. PDF document detection model based on system calls and data provenance [J]. Journal of Computer Applications, 2022, 42(12): 3831-3840.
[14]	Duoqin LI, Xianwen FANG. Process modeling recommendation method based on behavioral profile definition target rules [J]. Journal of Computer Applications, 2022, 42(1): 223-229.
[15]	ZHANG Shipeng, LI Yongzhong, DU Xiangtong. Intrusion detection model based on semi-supervised learning and three-way decision [J]. Journal of Computer Applications, 2021, 41(9): 2602-2608.