多目标免疫入侵检测策略研究

发布时间：2018-04-20 02:36

本文选题：免疫入侵检测 + 多目标优化　；参考：《哈尔滨理工大学》2017年硕士论文

【摘要】：随着互联网技术逐步发展,网络安全问题日益严峻,围绕着反编译技术,逆向工程以及嵌入式驱动理论的各种病毒,木马以及流氓软件给网络用户的个人隐私,财产安全都带来的严重的威胁。为解决网络环境的安全问题,各种理论的入侵检测技术应运而生。鉴于生物免疫系统自身极高的鲁棒性和自适应性,以及良好的自我修复性,基于人工免疫理论的入侵检测技术逐渐成为网络安全领域的研究热点。免疫入侵检测技术属于误用检测范畴。该技术将检测目标分为自体与非自体两种类型,分别利用否定选择算法和克隆选择算法生成和训练成熟检测器。通过成熟检测器,实现对网络行为的识别,同时根据实时正常的数据流量生成新的成熟检测器,保证系统的动态自适应性。通过模拟生物进化的克隆选择算法对成熟检测器实施进化,以不断提高检测器的检测能力,提高系统的检测率。所以免疫入侵检测系统不仅能对网络行为进行识别,更具备了良好的自学习,自更新能力。由于通过亲和力累加值策略实现样本选择,造成了样本检测范围的高重叠,最终影响迭代效率。本文提出了一种结合多目标优化理论的克隆选择算法。该算法将父代,子代与抗原的检测结果记录成标记向量。通过计算帕累托非支配向量,映射出进入下一代的成熟检测器。同时对受支配检测器进行高频变异和自体耐受,并加入新的成熟检测以保证固定的种群规模。实验表明,该算法有效地改善了种群进化的效率,增加了种群的多样性,提高了系统的检测率。鉴于多目标规划理论对于多分类问题的良好效果,本文结合支持向量机的理论基础,提出了一种多目标规划异常检测算法。该算法对不同类别的训练样本,直接规划了多个分类空间,将抗原分类问题转化为求解多元函数条件极值问题。经拉格朗日乘数法迭代计算,得到训练集的得分向量。根据该向量与检测样本内积的所属范围,判定样本的类型。实验表明,该方法解决了支持向量中单个超维面对于多分类问题的限制,具有更少的训练耗时。
[Abstract]:With the gradual development of Internet technology, the network security problem is becoming increasingly serious, around the decompilation technology, reverse engineering and embedded driving theory of various viruses, Trojans and rogue software to give network users personal privacy, A serious threat to property security. In order to solve the security problems in the network environment, various theoretical intrusion detection techniques emerge as the times require. In view of the high robustness, self-adaptability and good self-repair of biological immune system, intrusion detection technology based on artificial immune theory has gradually become the research hotspot in the field of network security. Immune intrusion detection belongs to the category of misuse detection. The detection target is divided into two types: autologous and non-autologous. The negative selection algorithm and the clonal selection algorithm are used to generate and train the mature detector respectively. Through the mature detector, the network behavior is recognized, and a new mature detector is generated according to the real time normal data flow, which ensures the dynamic adaptability of the system. In order to improve the detection ability of the detector and improve the detection rate of the system, the clone selection algorithm which simulates biological evolution evolves the mature detector. So the immune intrusion detection system not only can identify the network behavior, but also has the ability of self-learning and self-updating. Because the sample selection is realized by the affinity accumulation strategy, the high overlap of sample detection range is caused, and the iterative efficiency is ultimately affected. In this paper, a clone selection algorithm based on multi-objective optimization theory is proposed. The algorithm records the detection results of parent, offspring and antigen as marker vectors. By calculating the Pareto non-dominant vector, a mature detector is mapped into the next generation. At the same time, high frequency variation and autologous tolerance of the dominant detector were carried out, and a new mature detection was added to ensure the fixed population size. Experiments show that the algorithm can effectively improve the efficiency of population evolution, increase population diversity and improve the detection rate of the system. In view of the good effect of multi-objective programming theory on multi-classification problems, a multi-objective programming anomaly detection algorithm is proposed based on the support vector machine theory. In this algorithm, several classification spaces are directly planned for different types of training samples, and the antigen classification problem is transformed into solving the conditional extremum problem of multivariate functions. The score vector of the training set is obtained by iterative calculation by Lagrange multiplier method. According to the range of the vector and the inner product of the detected sample, the type of the sample is determined. The experimental results show that this method solves the limitation of single super-dimension in support vector facing multi-classification problem and has less training time.
【学位授予单位】：哈尔滨理工大学
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TP393.08

【相似文献】