Errors Estimating of Incompletion and Updating Strategy in IDS

Because there existed the problem of incomplete training sets in current intrusion detection systems, it results in false positive errors. In the paper, an ID model-IAIDM (immune-based adaptive intrusion detection model) is firstly put forward. Based on the characteristics of IAIDM, a analytical method of discrete random process is introduced to estimate the ratio of false positive errors. The analytical results show that incomplete training sets mainly affect the peripheral regions of self space instead of the whole of sample space. According to the analytical results, an incremental algorithm (IA) is proposed to update incomplete training sets dynamically. The experiment results demonstrate IA algorithm can update local self space having changed instead of the whole space incrementally and dynamically so that IAIDM can adjust itself to the current network environment quickly