The analysis process of original dendritic cells algorithm ( DCA) is offline,which results in time difference,producing false a-larms and increasing false negative rate,and leading to the success of the attack,which is fatal for an intrusion detection system. Propose integrating online analysis with the DCA using segmentation idea,that is,segmentation involves partitioning a sequence of processed in-formation into relative smaller segments,in terms of the number of data items or time. The analysis is performed within each individual segment. Intrusions appeared within the duration of this segment can be identified. The pseudo code of DCA with online analysis module is also presented,and it is applied to experiments of detection of SYN port scan. The experimental results indicate that the DCA with on-line analysis module can effectively improve detection speed without compromising detection accuracy.%原始树突状细胞算法( DCA)的离线分析过程,将会导致时间差异,从而产生假警报,增加了虚警率,也会导致攻击的成功发生,这对一个入侵检测系统来说是致命的。因此,文中的目的就是在不影响检测精度的前提下提高检测速度。于是文中提出了分片思想的在线分析组件与DCA相集成的方法,即根据抗原采样数量或者时间将一系列已处理的信息分割成为更小的部分,使得每个分片独立地进行实时的、周期性的分析,这样在每个分片内的入侵攻击就能及时地被识别出来。文中给出了DCA在线分析模块的伪代码描述,并且将其应用于SYN端口扫描的检测实验中。结果表明,DCA在线分析模块在不影响检测精度的前提下有效地提高了检测速度。
展开▼
