Information Technology Reference
In-Depth Information
including lengths (number of seconds) of the connection, number of data bytes from
source to destination, data bytes from destination to source, and so forth.
According to the IC model of data fusion, consider a matrix M of dimension
106×33, and represent the 33-dimensional rows of the matrix as points in 3D shape
space of SFIN.
This representation has been computed and visualized by the immunochip emula-
tor. A screenshot of the emulator is shown in Fig. 1. The emulator allows user to se-
lect the most effective data fusion when points in the shape space form visual clusters
(see right-hand screen of the emulator). The representation corresponds to 2D shape
space formed by 5th and 6th right singular vectors.
Fig. 1. Immunochip emulator for intrusion detection
Consider these points as initial population of the following SFIN:
N=2, m=2, h=0.05, B-cells ={B i }, S i =ltm, P i =[w i1 , w i2 ], i=1,…,106 ,
where w i1 and w i2 are binding energies of i -th string of the matrix M with right singular
vectors R 5 and R 6 .
Run simulation of SFIN behavior, and compute the steady population. After 12
generations, the population of such SFIN becomes steady. The population is reduced
to ten B-cells, which are shown in left-hand screen of the emulator.
This result represents a classification of network connections by 10 classes. Ac-
cording to [1], cells B 6 and B 7 recognize normal behavior of network connection,
while other cells B 1 -B 5 , B 8 -B 10 recognize several types of intrusions.
Consider intrusion detection by the emulator.
Search WWH ::




Custom Search