Abstract: It is necessary for Dendritic Cell Algorithm（DCA） to reduce the monitoring data on network, which can alleviate the burden of intrusion detection system and improve the efficiency of detection. This paper proposes an intrusion detection method by integrating the DCA with attribute reduction in rough set theory. By using the concept of attribute significance in rough set theory, it reduces the attribute of dataset and produces the input signals of DCA, then detects the intrusion by DCA. The improved algorithm is tested based on the KDD CUP 99 dataset. The results show that the improved algorithm can reduce the false positive rate when the detection rate is guaranteed. The improved algorithm realizes the auto-extracting of intrusion features and reduces the features needed exactly, accelerates the speed of algorithm. The improved algorithm performs well in combination property.

Key words: dendritic cell algorithm, rough set, intrusion detection, attribute reduction, attribute significance

摘要： 树突状细胞算法（DCA）在应用于入侵检测时，需要对网络监测数据进行约简，以降低系统负担，提高检测效率。提出一种结合粗糙集属性约简和DCA的异常入侵检测方法。采用粗糙集属性重要度对数据集进行属性约简，产生DCA输入信号，而后利用DCA算法进行入侵检测。通过KDD CUP99数据集对所提出的改进算法进行验证，结果表明，算法在保证检测率的前提下，显著降低了误报率。算法实现了入侵检测特征的自动提取，显著减少了所需检测的特征数目，加快了算法运行速度，具有良好的综合性能。

关键词: 树突状细胞算法, 粗糙集, 入侵检测, 属性约简, 属性重要度