关键词: 服务器安全, 异常检测, 树突状细胞算法（DCA）, 指标体系

Abstract: Web server often suffers attack or heavy load into the abnormal state and is unable to respond to user requests. To solve the problem of low accuracy for anomaly detection methods, this paper introduces the DCA in the Web server’s anomaly detection, establishes the multi-level indicator system of server operation status, then gives the indicator system to the antigen, danger signals and security signals mapping definitions and describes the Web server anomaly detection method. Comparative experiments show that this method compared with the traditional statistical methods and K-means clustering method, possesses the advantages of high accuracy, low rate of false positives, and can effectively detect abnormal Web server.

Key words: server security, anomaly detection, Dendritic Cells Algorithm（DCA）, indicator system