Intrusion Detection Model Based on Fuzzy Comprehensive Evaluation

Abstract:

An intrusion detection model was designed based on the specific immune classification of human immune system. The intrusion detection module was divided into inherent detection module and adaptive detection module. The inherent detection module inherits currently available rules, and the adaptive detection module proposes an anomaly detection algorithm. The algorithm draws on the theory of fuzzy math, integrates fuzzy comprehensive evaluation with analytic hierarchy, and establishes multi-level fuzzy comprehensive detection model by introducing the concept of fuzzy evaluation tree to improve the accuracy of detection. The results show that the model can accurately detect known attacks and can better detect unknown attacks.

• Periodical: Applied Mechanics and Materials (Volumes 635-637)
• Pages: 1574-1577
• DOI: https://doi.org/10.4028/www.scientific.net/AMM.635-637.1574
• Online since: September 2014
• Authors: Xia Ling Zeng*, Lin Zhang
• Keywords: Analytic Hierarchy, Fuzzy Comprehensive Evaluation, Immune, Intrusion Detection

References

[1] Hongwei Mo, in: Principles and Applications of Artificial Immune System, edited by Harbin Institute of Technology Press, Harbin, 2003 (in Chinese).

[2] Xingui He, in: Theory and Technology of Fuzzy Knowledge Processes, edited by National Defense Industry Press, Beijing, 1998 (in Chinese).

[3] Jijian Xie, Chengping Liu. In: The Methodology and Application of Fuzzy Mathematics, edited by Huazhong University of Science and Technology Press, Wuhan, 2000 (in Chinese).

[4] Darpa dataset, http: /www. ll. mit. edu/IST/ideval/data/1999/1999_data_index. html, (1999).

[5] Kruegel C, Toth T, Kirda E. Service specific anomaly detection for network intrusion detection[C]. In: Proceedings of the 2002 ACM Symposium on Applied Computing, Madrid, Spain, 2002, pp: 201-208.

DOI: 10.1145/508791.508835

[6] Liao Y, Vemuri V R. Use of text categorization techniques for intrusion detection[C]. In: Proceedings of 11th USENIX Security Symposium, San Francisco, CA, (2002).

[7] Ning P, Cui Y, Reeves D S. Constructing attack scenarios through correlation of intrusion alerts [C]. In: Proceedings of the 9th ACM Conference on Computer & Communications Security, Washington, USA: ACM Press, 2002, pp: 245-254.

DOI: 10.1145/586110.586144

[8] Valdes A, Skinner K. Probabilistic alert correlation [C]. In: Proceedings of the 4th International Symposium on Recent Advances in Intrusion Detection, Springer-Verlag, 2001, pp: 54-68.

DOI: 10.1007/3-540-45474-8_4

[9] Chengpo Mu, Houkuan Huang, Shengfeng Tian, Youfang Lin, Yuanhui Qin. Journal of Computer Research and Development, 2005, 42(10): 1679~1685 (in Chinese).

[10] Brian Caswell, Jay Beale, James C. Foster, et al. Snort 2. 0 Intrusion Detection. Sebastopol, CA: Syngress Publishing, (2003).