CAJ | 학술논문

原始树突状细胞算法( DCA)的离线分析过程,将会导致时间差异,从而产生假警报,增加了虚警率,也会导致攻击的成功发生,这对一个入侵检测系统来说是致命的。因此,文中的目的就是在不影响检测精度的前提下提高检测速度。于是文中提出了分片思想的在线分析组件与DCA相集成的方法,即根据抗原采样数量或者时间将一系列已处理的信息分割成为更小的部分,使得每个分片独立地进行实时的、周期性的分析,这样在每个分片内的入侵攻击就能及时地被识别出来。文中给出了DCA在线分析模块的伪代码描述,并且将其应用于SYN端口扫描的检测实验中。结果表明,DCA在线分析模块在不影响检测精度的前提下有效地提高了检测速度。
원시수돌상세포산법( DCA)적리선분석과정,장회도치시간차이,종이산생가경보,증가료허경솔,야회도치공격적성공발생,저대일개입침검측계통래설시치명적。인차,문중적목적취시재불영향검측정도적전제하제고검측속도。우시문중제출료분편사상적재선분석조건여DCA상집성적방법,즉근거항원채양수량혹자시간장일계렬이처리적신식분할성위경소적부분,사득매개분편독입지진행실시적、주기성적분석,저양재매개분편내적입침공격취능급시지피식별출래。문중급출료DCA재선분석모괴적위대마묘술,병차장기응용우SYN단구소묘적검측실험중。결과표명,DCA재선분석모괴재불영향검측정도적전제하유효지제고료검측속도。
The analysis process of original dendritic cells algorithm ( DCA) is offline,which results in time difference,producing false a-larms and increasing false negative rate,and leading to the success of the attack,which is fatal for an intrusion detection system. Propose integrating online analysis with the DCA using segmentation idea,that is,segmentation involves partitioning a sequence of processed in-formation into relative smaller segments,in terms of the number of data items or time. The analysis is performed within each individual segment. Intrusions appeared within the duration of this segment can be identified. The pseudo code of DCA with online analysis module is also presented,and it is applied to experiments of detection of SYN port scan. The experimental results indicate that the DCA with on-line analysis module can effectively improve detection speed without compromising detection accuracy.