The Research of ID Strategy Based on Antigen Presenting Principle and its Adaptability

Because of huge size of rule set, intrusion detection systems(IDSs) usually take dynamic update strategy which realizes all of rules to be replaced once in a period of time, which is costing times for spaces. Under such strategy, IDSs may not realize the flexible detection according to different states of network security. Based on the immune principle of antigen presenting, this paper proposes a mechanism of Abnormity Presenting and Abnormity Triggering, which means detecting only when need. Once any abnormal event captured, ID system generates corresponding detectors, which discards the traditional manner to generate detectors blindly and randomly. The experimental results demonstrate the proposed schemes can realize the flexible detection.