基于蚁群算法和改进 SSO 的混合网络入侵检测方法

针对一般网络入侵检测方法在不断增加复杂攻击和恶意软件的网络环境下,难以有效保护网络的问题,提出了一种混合入侵检测方法.对网络数据进行预处理,采用蚁群算法(ant colony algorithm,ACO)进行特征选择,数据挖掘,在此过程,为了改善简化群优化(simplified swarm optimization,SSO)分类器性能,提出在SSO中加入一种加权局部搜索策略,即改进的简化群优化(improved simplified optimization optimization,ISSO),这种新局部搜索策略的目的是从由SSO产生当前解的邻域内找到更好的解,从而获得入侵报告.在KDDCup 99数据集上进行了混合检测方法的相关实验.实验结果表明,在粒子数为30,最大代为30时,ISSO就已经达到最好的分类结果93.5％,相比于其他智能算法具有更少的粒子数和更小的最大代.此外,还模拟了3种类型的网络攻击DOS,PROB和U2R,结果表明,大多数情况下该方法的准确率都高于其他检测方法.

Hybrid network intrusion detection method based on ant colony algorithm and improved simplified swarm optimization

As the problem that it is hard to fully protect the network for traditional network intrusion detection method under the condition of increasing complexity and malice software, a hybrid intrusion detection method is proposed. Firstly, the pretreatment is on network data, and ant colony algorithm (ACO) is used to select features. Then, the data mining starts.In order to improve the performance of the classifier simplified swarm optimization (SSO) in the process of data mining, a weighted local search strategy is presented in SSO method, which is called improved simplified swarm optimization(ISSO)in this paper. And the purpose of presenting the new local search strategy is to generate a better solution from the neighborhood of the current solutions. Finally, the invasion report is given. Experiments of the hybrid detection method are tested on KDDCup 99 data sets. The experimental results show that the best classification result of ISSO can be 93.5% in the case of 30 particles and 30 max generations. Compared with other intelligent algorithms, the number of particles and max generations are much fewer. In addition, three kinds of network attacks DOS, PROB and U2R are simulated. The experimental results show that the exact rate is higher than that of other detection method in most cases.