Abstract: Grid Intrusion Detection is a method to solve the bottleneck of grid security. This paper proposed Negative Selection Operator Embedded Clonal Selection Algorithm (NCSA) as the new detector algorithm, based on Clonal Selection Algorithm. Negative selection operators as a component avoided self-tolerance phenomena of detectors, assisted memory detectors to complete dynamic updating; and affinity maturation decreased the numbers of co-simulations; so delectors could cover non-self space better. In order to obtain satisfactory TP and FP ratio, by experiments we set two affeeling NCSA behaviors' parameters, immature detectors' toleration period ( T) and mature detectors' lifespan (L) to appropriate values. With the same parameters and training conditions, comparing with CSA, the results show that NCSA gains higher TP ratio and lower FP ratio, improves the whole detection performance. Also the higher TP ratios and lower FP ratios mean that NCSA can recognize unknown intrusions and fit dynamic grid environments better.

Key words: Grid intrusion detection, Negative operator, Clonal selection algorithm, False positive, True positive