Network intrusion detection model based on genetic ant colony algorithm

Abstract

The traditional network intrusion detection is performed on single-dimensional data feature of invasion, once the intrusion has intrusion feature of abnormally high-dimensional data, which can not achieve a unified detection rules, resulting in decreasing efficiency and accuracy of detection. This paper proposes a network intrusion detection method based on genetic ant colony optimization algorithm. According to genetic algorithm building individual coding, employing fitness function to initialize the population, setting pheromone of ants and establishing global pheromone updating rules by ant colony state transition rules, and then ultimately intrusion detection network is accomplished. Experimental results show that modified algorithm for network intrusion detection can improve the speed of training and testing, with significant advantages on increasing detection rate and reducing fault rate. Introduction With the rapid development of information technology, network sharing and openness widening, more and more businesses and individuals dependent on the network, hence arising invasion problems of network security is under increasing threat, which has extremely adverse impact on enterprises and individuals’ interest, therefore, effective network intrusion detection method has become focused subject by experts and scholars [1-3]. Regular network intrusion detection methods are mainly based on artificial immune algorithm [4], neural network algorithm [5] and rough set algorithm. Effective network intrusion detection method can improve the efficiency and detection rate, ensure network security, so as to become hot issue in this intrusion field with broad prospects. Network intrusion detection principles For high-dimensional abnormal invasion feature complete network intrusion detection is of great significance. Specific principles are described as follows: Network intrusion detection is based on machine learning theory, building normal and abnormal sample library, through machine learning of normal behavior and abnormal behavior patterns to judge effectively. Assumed x as the independent variable, y as the dependent variable, given that x and y has unknown relationship, their joint probability distribution ( , ) F x y is unknown, 1 1 2 2 3 3 ( , ),( , ),( , ),...,( , ) n n x y x y x y x y describes observed sample of n independent distribution, risk function of training process is: ( ) ( , ( , )) ( , ) R d S y f x d dF x y = ∫ (1) As 0 ( , ) f x d represents the minimum optimal function,and satisfies { } 0 ( ( , ) ( , ) ) f x d f x d ∈ . { } ( , ) f x d which describes the set of candidate prediction function, as d is function parameters. (( , ( , )) S y f x d describes loss function, indicating difference between actual output ( , ) f x d and the desired output with fixed x . Due to unpredictability of ( , ) F x y , sample empirical risk is employed as approximate expectation risk: 1 1 ( ) ( , ( , )) n emp i i i R d S y f x d n = = ∑ (2) International Conference on Automation, Mechanical Control and Computational Engineering (AMCCE 2015) © 2015. The authors Published by Atlantis Press 1150 Considering training classification, function set is specified, the relationship between experiential risk and actual risk can be expressed as (1 (2 / ) 1 1 ( / 4)) ( ) ( ) emp h n n h n A R d R d n + − ≤ + (3) The formula can be simplified to: ( ) ( ) ( ) emp n R d R d h φ ≤ + (4) By minimizing the summation of two terms on the right side of formula, adjusting VC dimension, reducing the value h , minimizing risk, improving generalization ability training, the accuracy of network intrusion detection is approved. GA-ACO Task Scheduling Algorithm Task scheduling design of genetic algorithm. 1)Individual coding Chromosome coding is the key to solving CMP task scheduling. In order to take full account of the interdependence of relevant factors and the location information of each sub-task, a threedimensional coding scheme is proposed as follows: