针对免疫入侵检测数据处理速度慢以及检测实时性差的问题,提出Bregman非负矩阵分解算法,采用Bregman迭代方式改进传统非负矩阵分解过程,优化矩阵迭代过程,利用矩阵本地化方法分解矩阵,增加矩阵的约束,保留检测数据内部结构并且加快数据的处理速度。在KDD CUP 1999数据集上的仿真结果表明,该算法有效提高了入侵检测速度,增强了免疫入侵检测的时效性。
The real-valued self set in immunity-based network intrusion detection system （INIDS） has some defects： multi-area and overlapping, which are ignored before. The detectors generated by this kind of self set may have the problem of boundary holes between self and nonself regions, and the generation efficiency is low, so that, the self set needs to be optimized before generation stage. This paper proposes a self set optimization algorithm which uses the modified clustering algorithm and Gaussian distribution theory. The clustering deals with multi-area and the Gaussian distribution deals with the overlapping. The algorithm was tested by Iris data and real network data, and the results show that the optimized self set can solve the problem of boundary holes, increase the efficiency of detector generation effectively, and improve the system＇s detection rate.
邻域否定选择算法遍历每个自体样本,导致计算量大及匹配阶段重叠率高等问题。为此,对邻域否定选择算法和聚类技术进行研究,提出一种邻域检测器生成算法。将自体样本映射到构建好的邻域空间中进行聚类,同时对随机检测器予以耐受,训练出成熟的邻域检测器。在KDD CUP 1999数据集上的仿真结果表明,该算法可以缩短生成检测器的时间,有效解决高重叠问题,提高检测效率。
