为了检测出入侵检测中异常数据的类型以及解决成熟检测器的聚类问题,提出一种检测器的标识学习和优化算法。该算法首先对初始化的成熟检测器,以每个非己抗原为中心进行聚类学习,得到每个类内检测器的标识,用以识别异常数据的类型;然后在经过 N 代之后,对成熟检测器集中的重叠检测器进行变异和删除操作,来提高在非己空间的覆盖率。实验结果表明,该算法在提高检测器性能的同时,能够检测出异常数据的类型。
Abstract
In order to detect the types of abnormal database in intrusion detection and to solve the clustering problem of mature detectors
an algorithm of identification learning and optimization for detectors is proposed.Firstly
each initialization mature detector is clustered as the center of non-self antigens to obtain the label of every detector in class
which identifies the types of abnormal database.Then
variation and deleting are operated on the overlapping detectors which are in the set of mature detectors to improve the coverage of non-self space after N-generation. Experimental results show that the proposed algorithm is able to improve the detection performance of the detectors as well as indicating the type of abnormal database.