CN106022134A - Method for setting weight of intrusion detection DCA - Google Patents

Abstract

The invention aims at providing a method which can be used for adjusting the weight of a Dendritic Cell Algorithm (DCA) according to an actual network environment so as to solve the problem of low detection precision of the DCA. According to the method, the weight of the DCA in synthesis of half-mature signals and mature signals is optimized and set; an optimization issue related to weight variable changes is constructed, and then the optimal value is obtained with the artificial intelligence algorithm according to known sample information. By means of the method, the weight of the DCA can be set according to the actual network environment, so that the intrusion detection performance of the DCA is improved, the false detection rate and the missed detection rate are reduced.

Description

A kind of method setting intrusion detection DCA algorithm weights

Technical field

The present invention relates to a kind of method setting intrusion detection DCA algorithm weights.

Background technology

Explanation of nouns:

DCA algorithm: (Dendritic Cell Algorithm), dendritic cell algorithm.

PAMP signal: (pathogen-associated molecular pattern) pathogen associated molecular pattern signal.

MACV:(mature context antigen value) ripe environmental antigens value.

DCA algorithm has 3 kinds of signals, i.e. costimulatory signal, half ripe signal and ripe signal.Every kind of signal all passes through Safety signal (safe signal), danger signal (danger signal) and the PAMP that the external world is gathered by corresponding one group of weights Signal carries out being synthesized into.

For each immature DC cell, the safety signal that it is gathered (safe signal), danger signal (danger signal) and PAMP signal, synthesize corresponding costimulatory signal, half ripe signal and ripe signal.Its synthesis Formula is as follows:

o_csm=(1+IC) (w_P,csm*P+w_D,csm*D+w_S,csm*S)

o_semi=(1+IC) (w_P,semi*P+w_D,semi*D+w_S,semi*S) (1)

o_mat=(1+IC) (w_P,mat*P+w_D,mat*D+w_S,mat*S)

o_csm、o_semi、o_matRepresent corresponding costimulatory signal, half ripe signal and ripe signal respectively.w_P,csmRepresent synthesis The weights of PAMP signal during costimulatory signal；w_D,csmThe weights of danger signal when representing synthesis costimulatory signal；w_S,csmTable The weights of safety signal when showing synthesis costimulatory signal；w_P,semiThe weights of PAMP signal when representing synthesis half ripe signal； w_D,semiThe weights of danger signal when representing synthesis half ripe signal；w_S,semiThe power of safety signal when representing synthesis half ripe signal Value；w_P,matThe weights of PAMP signal when representing synthesis ripe signal；w_D,matThe power of danger signal when representing synthesis ripe signal Value；w_S,matThe weights of safety signal when representing synthesis ripe signal；P represents PAMP signal；D represents danger signal；S represents safety Signal；

Each immature DC cell constantly accumulates gathered costimulatory signal, half ripe signal and ripe letter Number, as follows:

C_csm(t)=C_csm(t-1)+O_csm(t)

C_semi(t)=C_semi(t-1)+O_semi(t) (2)

C_mat(t)=C_mat(t-1)+O_mat(t),

C_csm(t)、C_semi(t)、C_matT () represents the costimulatory signal value of accumulation after current collection signal, half ripe respectively Signal value and ripe signal value.

If the costimulatory signal value of accumulation is more than or equal to presetting threshold value, then stops gathering signal, and judge Size between half ripe signal and the ripe signal of accumulation of accumulation, determines whether band DC cell is ripe or half ripe is thin Born of the same parents.If i.e. C_semi(t)>C_matT (), then this immature DC cell is divided into a semi-matured DC cell, is otherwise divided into One ripe DC cell.

In DCA algorithm, each DC cell can gather the signal of different type network behavior, and according to corresponding network Behavior carries out the accumulation of signal.Therefore for every kind of network behavior, it is possible to judge the safety of its behavior according to MACV, MACV's Computing formula is as follows:

If the value of such network behavior is more than or equal to the threshold value set, then it is assumed that an abnormal network behavior, is just otherwise Normal network behavior.

At present DCA algorithm is employed successfully in the fields such as intrusion detection, but synthesizes its ripe signal and half ripe signal Weights are general the most directly uses fixing setting value, it is impossible to transfer to adjust in real time weights according to actual complex network environment, from And cause accuracy of detection the highest.

Summary of the invention

It is an object of the invention to provide a kind of method, it is possible to adjust synthesis DCA algorithm according to actual network environment Middle ripe signal and the weights of half ripe signal, thus solve the problem that DCA algorithm accuracy of detection is the highest.

To achieve these goals, the technical solution used in the present invention is as follows:

A kind of method setting intrusion detection DCA algorithm weights, utilizes the network behavior of immature DC cell collection sample, root Detect network behavior according to the DC cell after differentiation, set synthesis half ripe signal and maturation according to actual optimization of network environment The PAMP signal of signal, danger signal, the weights of safety signal, improve the accuracy of detection of DCA algorithm.

For each immature DC cell, synthesis costimulatory signal, synthesis half ripe signal and the method for ripe signal For:

o_csm=(1+IC) (w_P,csm*P+w_D,csm*D+w_S,csm*S)

o_semi=(1+IC) (w_P,semi*P+w_D,semi*D+w_S,semi*S) (1)

o_mat=(1+IC) (w_P,mat*P+w_D,mat*D+w_S,mat*S)

P represents PAMP signal；D represents danger signal；S represents safety signal；o_csmRepresent costimulatory signal, o_semiRepresent half Ripe signal, o_matRepresent ripe signal；w_P,csmThe weights of PAMP signal when representing synthesis costimulatory signal；w_D,csmRepresent and close The weights of danger signal when becoming costimulatory signal；w_S,csmThe weights of safety signal when representing synthesis costimulatory signal；w_P,semi The weights of PAMP signal when representing synthesis half ripe signal；w_D,semiThe weights of danger signal when representing synthesis half ripe signal； w_S,semiThe weights of safety signal when representing synthesis half ripe signal；w_P,matThe power of PAMP signal during the ripe signal of expression synthesis Value；w_D,matThe weights of danger signal when representing synthesis ripe signal；w_S,matThe power of safety signal when representing synthesis ripe signal Value；IC represents inflammatory signal.

Each immature DC cell constantly accumulates gathered costimulatory signal, half ripe signal and ripe signal

C_csm(t)=C_csm(t-1)+O_csm(t)

C_semi(t)=C_semi(t-1)+O_semi(t) (2)

C_mat(t)=C_mat(t-1)+O_mat(t),

C_csm(t)、C_semi(t)、C_mat(t) represent respectively costimulatory signal value that current period accumulates, half ripe signal value and Ripe signal value, t represents current period number；If the costimulatory signal value of accumulation is more than or equal to presetting threshold value, then Stop gathering signal；If C_semi(t) ＞ C_mat(t), then this immature DC cell is divided into a semi-matured DC cell, Otherwise it is divided into a ripe DC cell, simultaneously this DC cell death；

For each network behavior, calculate its MACV value:

The sample containing n heterogeneous networks behavior is selected to set the PAMP letter of its synthesis half ripe signal and ripe signal respectively Number, the weights of danger signal, safety signal, set up following optimization problem:

$\max \underset{i=1}{\overset{n}{\Σ}}{f}_c^i$

N represents a total of different types of network behavior of n kind in selected sample, and i is the network behavior of the i-th type, MACVⁱRepresent the MACV value of i-th network behavior,I ∈ 1 ..., n} is the judged result of the network behavior of the i-th type The most correct evaluation, it is judged that correct then be 1, is otherwise-1；Represent and obtain the correct judgement to n network behavior Maximum times；Synthesis half ripe signal and the weights of ripe the PAMP signal of signal, danger signal, safety signal each optimum It is and makesObtain the value during maximum times of the correct judgement of n network behavior.

Further improve, a type of network behavior is only gathered for each immature DC cell, if this DC is thin Born of the same parents are dead, then generate a new DC cell and gather such network behavior.

Further improve, keep constant for synthesizing the weights of costimulatory signal.

Further improve, use artificial intelligence optimization's algorithm adjust synthesis half ripe signal and the PAMP signal of ripe signal, Danger signal, the weights of safety signal；Described artificial intelligence optimization's algorithm includes particle swarm optimization algorithm and genetic algorithm

This optimization problem can use the artificial intelligent optimization algorithm such as particle swarm optimization algorithm, genetic algorithm to solve.

Compared with the fixing weights of existing DCA, the method can determine according to actual network environment and is more suitable for reality The weights of situation, thus improve accuracy of detection.

Accompanying drawing explanation

Fig. 1 is weights defined in the present invention and the graph of a relation between the ripe signal of synthesis and half ripe signal；

Fig. 2 is the optimization process of embodiment 1；

Fig. 3 is the optimization process of embodiment 2.

Detailed description of the invention

The invention will be further described with embodiment below in conjunction with the accompanying drawings, and embodiments of the present invention include but not limited to The following example.

Embodiment

Keep constant for synthesizing one group of weights of costimulatory signal, construct one with synthesis half ripe signal and synthesis maturation Two groups of weights of signal are the optimization problem of variable, obtain the weights of optimum.For each immature DC cell, by it Safety signal (safe signal), danger signal (danger signal) and the PAMP signal gathered, the corresponding association of synthesis Same stimulus signal, half ripe signal and ripe signal.Definition w_P,csm、w_D,csm、w_S,csmFor one group during synthesis costimulatory signal Weights, define w_P,semi、w_D,semi、w_S,semiFor one group of weights during synthesis half ripe signal, define w_P,mat、w_D,mat、w_S,matFor One group of weights during the ripe signal of synthesis, its composite formula is

o_csm=(1+IC) (w_P,csm*P+w_D,csm*D+w_S,csm*S)

o_semi=(1+IC) (w_P,semi*P+w_D,semi*D+w_S,semi*S) (4)

o_mat=(1+IC) (w_P,mat*P+w_D,mat*D+w_S,mat*S)

o_csm、o_semi、o_matRepresent corresponding costimulatory signal, half ripe signal and ripe signal respectively.w_P,csmRepresent synthesis The weights of PAMP signal during costimulatory signal；w_D,csmThe weights of danger signal when representing synthesis costimulatory signal；w_S,csmTable The weights of safety signal when showing synthesis costimulatory signal；w_P,semiThe weights of PAMP signal when representing synthesis half ripe signal； w_D,semiThe weights of danger signal when representing synthesis half ripe signal；w_S,semiThe power of safety signal when representing synthesis half ripe signal Value；w_P,matThe weights of PAMP signal when representing synthesis ripe signal；w_D,matThe power of danger signal when representing synthesis ripe signal Value；w_S,matThe weights of safety signal when representing synthesis ripe signal；P represents PAMP signal；D represents danger signal；S represents safety Signal；

Each immature DC cell constantly accumulates gathered costimulatory signal, half ripe signal and ripe signal, as Shown in lower:

C_csm(t)=C_csm(t-1)+O_csm(t)

C_semi(t)=C_semi(t-1)+O_semi(t) (5)

C_mat(t)=C_mat(t-1)+O_mat(t),

C_csm(t)、C_semi(t)、C_matT () represents the costimulatory signal value of accumulation after current collection signal, half ripe respectively Signal value and ripe signal value.If the costimulatory signal value of accumulation is more than or equal to presetting threshold value, then stop gathering Signal, and break up.Size between half ripe signal and the ripe signal of accumulation accumulated by judgement, determines this DC cell It is divided into maturation or is divided into blast.If i.e. C_semi(t) ＞ C_mat(t), the then differentiation of this immature DC cell It is a semi-matured DC cell, is otherwise a ripe DC cell.This DC cell death simultaneously.In this algorithm, each DC only gathers a type of network behavior, if after this DC cell death, then can generate a new DC cell and gather this Class network behavior.

For each network behavior, calculate its MACV value, if greater than or be then judged as Deviant Behavior equal to given threshold value, Being otherwise proper network behavior, the computing formula of MACV is as follows:

The sample containing n heterogeneous networks behavior is selected to set the ripe signal of synthesis and the weights of half ripe signal, the most permissible Set up following optimization problem:

$\max \underset{i=1}{\overset{n}{\Σ}}{f}_c^i$

In above formula, n represents a total of different types of network behavior of n kind in selected sample, and i is the network of the i-th type Behavior, MACVⁱRepresent the MACV value of i-th network behavior,I ∈ 1 ..., n} is the judgement of the network behavior of the i-th type The evaluation that result is the most correct, it is judged that correct then be 1, is otherwise-1.Expression is to obtain n network behavior The correct maximum times judged.

By optimizing the w of formula (4)_P,semi、w_D,semi、w_S,semi、w_P,mat、w_D,mat、w_S,matValue, it is possible to obtain different The ripe signal of synthesis and half ripe signal, and then obtain different accumulation maturation signal values and accumulation half ripe signal value, finally Obtain maximum

As a example by KDD Cup 1999 data set, first pick out 1000 samples from data set, comprise 9 kinds dissimilar Network behavior.Each sample packages contains 41 attributes and 1 attack type.Attack type as antigen, attribute 25,26,29, 38,40 are used for synthesizing PAMP signal, attribute 23, and 24 are used for synthesizing safe signal, attribute 12,31, and 32 are used for synthesizing danger letter Number, in this experiment, IC signal is set to 0.Take after the attribute of each sample is normalized to interval [0,100] respectively average for As PAMP signal, safe signal, danger signal.The threshold value of MACV is set to 0.75, the threshold value of the costimulatory signal of accumulation It is set to the random number of [100,500].For synthesizing the weights (w of costimulatory signal_P,csm,w_D,csm,w_P,semi) fixing be set to (2, 1,2).Several practical situations according to algorithm of organizing of the initial weight of synthesis half ripe signal and ripe signal determine.Wherein one Group (w_P,semi,w_D,semi,w_S,semi,w_P,mat,w_D,mat,w_S,mat) initial value be set as (0,0,3,2,1 ,-3), and other group Initial weight is then by randomly generating.

Embodiment 1

Utilize particle cluster algorithm to optimize weights.The vector structure of each particle is (w_P,semi,w_D,semi,w_S,semi,w_P,mat, w_D,mat,w_S,mat), population quantity is set to 30, and maximum iteration time is 100 times.Particle cluster algorithm parameter c1, c2 are set to 2. One group of (w in 30 groups of initial weights of population_P,semi,w_D,semi,w_S,semi,w_P,mat,w_D,mat,w_S,mat) value be set as (0, 0,3,2,1 ,-3), other initial weights of 29 groups are then by randomly generating, and the random number of generation is integer and is positioned at [-3,3] model In enclosing.The fitness function of particle is the object function of optimization problem, in evolutionary process, the change in displacement scope of particle be [-3, 3], the speed variation of particle is [-1,1].When obtaining maximumEqual to 9, or reach maximum iterations Time, optimization process terminates.Optimization process is as in figure 2 it is shown, after 13 iteration, it is thus achieved that optimal particle be required power Value is i.e. (0,0,3,2,1 ,-1).

Embodiment 2

Utilize genetic algorithm to optimize weights.w_P,semi、w_D,semi、w_S,semi、w_P,mat、w_D,mat、w_S,matBase for chromosome Cause, is transformed into binary form, and the structure of the most each chromosome is (II (w_P,semi),II(w_D,semi),II(w_S,semi),II (w_P,mat),II(w_D,mat),II(w_S,mat)), II represents the binary form of corresponding weight value, and the gene scope of binary representation is [-3,3], as 011 represents 3,111 expressions-3.The quantity of chromosome is set to 30, and maximum iteration time is 100 times.Use wheel disc Gambling selection method obtains selection opertor, and crossover operator is set to 0.1, and mutation operator is set to 0.05.The fitness function of genetic algorithm For the object function of optimization problem, at the end of optimization process, it is thus achieved that optimum chromosome be required weights.30 groups of dyes One group of (w in the initial weight of colour solid_P,semi,w_D,semi,w_S,semi,w_P,mat,w_D,mat,w_S,mat) value be set as (0,0,3,2, 1 ,-3), other initial weights of 29 groups are then by randomly generating, in the range of the random number of generation is integer and is positioned at [-3,3]. The fitness function of genetic algorithm is the object function of optimization problem, when obtaining maximumEqual to n, or reach maximum Iterations time.Fig. 3 is the optimum results figure of genetic algorithm, obtain during the 16th iteration optimum weights (0,0,3,2, 1,-1)。

Claims (5)

1. the method setting intrusion detection DCA algorithm weights, utilizes the network behavior of immature DC cell collection sample, Network behavior is detected, it is characterised in that set synthesis half according to actual optimization of network environment according to the DC cell after differentiation Ripe signal and ripe the PAMP signal of signal, danger signal, the weights of safety signal, improve the accuracy of detection of DCA algorithm.

A kind of method setting intrusion detection DCA algorithm weights the most as claimed in claim 1, it is characterised in that for each Individual immature DC cell, the method for synthesis costimulatory signal, synthesis half ripe signal and ripe signal is:

$\begin{array}{c}{o}_{\mathrm{csm}}=(1+\mathrm{IC})(w_{P,\mathrm{csm}}*P+w_{D,\mathrm{csm}}*D+w_{S,\mathrm{csm}}*S)\\ o_{\mathrm{semi}}=(1+\mathrm{IC})(w_{P,\mathrm{semi}}*P+w_{D,\mathrm{semi}}*D+w_{S,\mathrm{semi}}*S)\\ o_{\mathrm{mat}}=(1+\mathrm{IC})(w_{P,\mathrm{mat}}*P+w_{D,\mathrm{mat}}*D+w_{S,\mathrm{mat}}*S)\end{array}---\left(1\right)$

P represents PAMP signal；D represents danger signal；S represents safety signal；o_csmRepresent costimulatory signal, o_semiRepresent that half becomes Ripe signal, o_matRepresent ripe signal；w_P,csmThe weights of PAMP signal when representing synthesis costimulatory signal；w_D,csmRepresent synthesis The weights of danger signal during costimulatory signal；w_S,csmThe weights of safety signal when representing synthesis costimulatory signal；w_P,semiTable The weights of PAMP signal when showing synthesis half ripe signal；w_D,semiThe weights of danger signal when representing synthesis half ripe signal； w_S,semiThe weights of safety signal when representing synthesis half ripe signal；w_P,matThe power of PAMP signal during the ripe signal of expression synthesis Value；w_D,matThe weights of danger signal when representing synthesis ripe signal；w_S,matThe power of safety signal when representing synthesis ripe signal Value；IC represents inflammatory signal；

Each immature DC cell constantly accumulates gathered costimulatory signal, half ripe signal and ripe signal

$\begin{array}{c}{C}_{\mathrm{csm}}\left(t\right)=C_{\mathrm{csm}}(t-1)+O_{\mathrm{csm}}\left(t\right)\\ C_{\mathrm{semi}}\left(t\right)=C_{\mathrm{semi}}(t-1)+O_{\mathrm{semi}}\left(t\right)\\ C_{\mathrm{mat}}\left(t\right)=C_{\mathrm{mat}}(t-1)+O_{\mathrm{mat}}\left(t\right),\end{array}---\left(2\right)$

C_csm(t)、C_semi(t)、C_matT () represents costimulatory signal value that current period accumulates, half ripe signal value respectively and becomes Ripe signal value, t represents current period number；If the costimulatory signal value of accumulation is more than or equal to presetting threshold value, then stop Only gather signal；If C_semi(t) ＞ C_matT (), then this immature DC cell is divided into a semi-matured DC cell, no Then it is divided into a ripe DC cell, simultaneously this DC cell death；

For each network behavior, calculate its MACV value:

The sample containing n heterogeneous networks behavior is selected to set the PAMP letter of its synthesis half ripe signal and ripe signal respectively Number, the weights of danger signal, safety signal, set up following optimization problem:

$max\underset{i=1}{\overset{n}{\Σ}}{f}_c^i$

N represents a total of different types of network behavior of n kind in selected sample, and i is the network behavior of the i-th type, MACVⁱRepresent the MACV value of i-th network behavior,I ∈ 1 ..., n} is that the judged result of the network behavior of the i-th type is No correct evaluation, it is judged that correct then be 1, is otherwise-1；Represent and obtain the correct judgement to n network behavior Maximum times；The weights of synthesis half ripe signal and ripe the PAMP signal of signal, danger signal, safety signal each optimum are i.e. For makingObtain the value during maximum times of the correct judgement of n network behavior.

A kind of method setting intrusion detection DCA algorithm weights the most as claimed in claim 1, it is characterised in that for each Individual immature DC cell only gathers a type of network behavior, if this DC cell death, then generates a new DC thin Born of the same parents gather such network behavior.

A kind of method setting intrusion detection DCA algorithm weights, it is characterised in that be used for synthesizing The weights of costimulatory signal keep constant.

A kind of method setting intrusion detection DCA algorithm weights, it is characterised in that use artificial Intelligent optimization algorithm adjusts synthesis half ripe signal and ripe the PAMP signal of signal, danger signal, the weights of safety signal；Institute State artificial intelligence optimization's algorithm and include particle swarm optimization algorithm and genetic algorithm.