A Synthetic Reverse Model Based on AIS and the Application - Advances in Computational Science and Engineering - page 255

Definition 3. Normal Degree
Let AN represents the normal behavior sample set in IDS database. Then we define
the similarity between X and AN as

S

X
AN

, called the normal degree of the behavior

vector X . See formula (5).

S X
AN

(5)

= Sim ( X , AN ) = max{ Sim ( X , AN ), AN ∈ AN , j = 0 L , m }

j j

Definition 4: Abnormal Degree
Let AI presents the abnormal behavior sample set in IDS database. Then we define the
similarity between X and AI as

X
AI

S

, called the abnormal degree of the behavior vec-

tor X . See formula (6).

S AI

(6)

= Sim ( X , AI ) = max{ Sim ( X , AI ), AI ∈ AI , j = 0 L , m }

j j

Definition 5: Intrusion Probability
Taking both the normal degree and the abnormal degree of X into consider, we de-
fine the intrusion probability of X as

P ( X , AN , AI )

. It can be calculated by means

of formula (7).

S

X
AI

P ( X , AN , AI ) = , ( β ≥ 0

(7)

X
AI

X
AN

S + β • S

In formula 7,
β

is the contribution coefficient of the normal degree of X to the intrusion
probability

β

. The value of is not less than 0.

P ( X , AN , AI )

5 The Dimension Reduction Method of Behavior Samples

5.1 Mapping to 2-Dimension Points

According to formula (3) and formula (4), every network behavior X can be respec-
tively result in a normal degree

A S ,
then, X can be mapped into a binary tuples < u , v >. Regard u as the longitudinal co-
ordinates, and v as the abscissa, then ( u , v ) is a point in a 2-dimensional plane.
Taked notice of

S

X
AN

and anomaly degree

X
AI

. If let u =

A S v =

X

S

X

∈ v , a network behavior will be mapped into a point
within the rectangle region from (0,0) to (1,1). This mapping is illustrated in Figure 4.
Point ( u 1 , v 1 ) and ( u 2 , v 2 ) respectively represent the behavior vector

and

u ∈ [ 0 [ 0

X and

X

.

2