According to the idea of intelligent complementary fusion,a combination of immunodominance,inverse operation, clonal selection,non-uniform mutation and forbidden clone was employed in a novel clustering method with network structure for intrusion detection. The clustering process was adjusted in accordance with affinity function and evolution strategies. So an intelligent .self-adaptive and self-learning network was 'evolved' to reflect the distribution of o-riginal data. Then the minimal spanning tree was employed to perform clustering analysis and obtain the classification of normal and anormal data. The simulations through the KDD CUP99 dataset show that the novel method can deal with massive unlabeled data to distinguish normal case and anomaly and even can detect unknown intrusions effectively.%基于智能融合互补的观点,将免疫优势、倒位、克隆选择、非一致性变异和禁忌克隆等多种人工免疫系统算子引入网络结构聚类算法中,构造亲合度函数来指导聚类过程,得到一种能够自学习、自适应的进化网络来进行入侵检测数据的训练学习,通过该网络映射出大规模数据集的内在聚类结构,然后利用图论中的最小生成树对网络结构进行聚类分析,最终获得描述正常和异常行为的数据特征.在KDD CUP99数据集中进行了对比仿真实验,结果表明,该方法可高效地对大规模网络数据进行异常检测,以区分正常和攻击行为,并有效地检测出未知攻击.
展开▼
