IPv6环境下异常检测系统地关键技术研究.pdf

的提高。 异常检测算法的设计目标是提高检测的效率和准确性。生物免疫和计算机安全 系统所面临及需要解决的问题十分类似，采用生物免疫思想的异常检测技术可以获 得更加准确、可靠的结果，大大地提高检测性能。通过引入实数编码，精确排挤小 生态算法，对遗传算法进行改进，研究了基于背离等级的检测算法（Deviation Levels based Detection Algorithm ，简称DLDA ），同时为了提高检测的准确性，引入了一种 生成模糊检测规则的演进算法，使用模糊异常检测算法，对网络中的异常行为进行 模糊检测。在不同数据集（DARPA1999 ，DARPA2000 ）以及实际网络流量上对异常 检测原型系统以及开放源码的异常检测系统 snort 进行对比实验，实验结果表明所提 出的算法在误报率、漏报率上都有了很大的提高。 IPv6 环境下异常检测系统的输入对象为全新的协议，地址长度和数据量都有了 极大的增长，使得上述算法在新环境下无法高效运转。为此对上述算法进行了改进， 进行随机实数编码，引入基于亲和度的非我识别方法，使用分段匹配的高效匹配算 法，以提高检测效率。 上述研究成果已综合应用到一个面向下一代互联网的异常检测系统中，使用自 定义的数据集（构造攻击数据和实际网络流量的结合）以及实际 IPv6 网络流量进行 了性能和效能测量，结果证明系统能在IPv6 环境下运转良好。 关键词：网络安全，下一代互联网，人工免疫，否定选择，模糊规则 II Abstract The current generation Internet protocol IPv4 is replaced by the new generation Internet protocol IPv6 because of its huge address space and favorable security architecture. However, as the development of the next generation Internet Protocol and the popularization of new type of applications, security problems of the networks based on IPv6 Protocol should be presented. Traditional anomaly detection algorithms can not detecte these new types of attack effectively and can not support the new protocol, either. An anomaly detection system must be excogitated that can support IPv6 protocol and do abnormity checking rapidly even under a high-traffic network environment as well. It is necessary to study anomaly detection algorithms based on NGI, which has theoretical significance and practical importanc. Therefore, it has become a significant international topic that needs to be urgently solved. In order to ensure the security of NGI, we must be able to differentiate and response to i