Artificial Immune
System
for
Computer Security
The
threats and intrusions in IT systems can basically be compared to human
diseases with the difference that the human body has an effective way to deal with
them, what still need to be designed for IT systems. The human immune system
(HIS) can detect and defend against yet unseen intruders, is distributed,
adaptive and multilayered to name only a few of its
features.
Our immune system incorporates a powerful and diverse set of characteristics
which are very interesting to use in AIS . in AIS I am working on computer
security . as I think security should be our first priority.
WHAT IS AIS
Artificial Immune Systems (AIS)
is a branch of biologically inspired computation focusing on many aspects of
immune systems. AIS development can be seen as having two target domains: the
provision of solutions to engineering problems through the adoption of immune
system inspired concepts; and the provision of models and simulations with
which to study immune system theories.
KEY
WORDS
AIS ,
immunue system , artificial immune system, virus, negative selection model , Hierarchical Artificial Immune Model
How AIS related
with biological immune system
In medical science, historically,
the term immunity refers to the condition in which an organism can resist
disease, more specifically infectious disease. However, a broader definition of
immunity is a reaction to foreign (or dangerous) substances.
Immunology concerns the study of
the immune system and the effects of its operation on the body. The immune
system is normally defined in relation to its perceived function: a defence
system that has evolved to protect its host from pathogens (harmful
micro-organisms such as bacteria, viruses and parasites) [Goldsby et al. 2003].
It comprises a variety of specialised cells that circulate and monitor the
body, various extra-cellular molecules, and immune organs that provide an
environment for immune cells to interact, mature and respond. The collective
action of immune cells and molecules forms a complex network leading to the
detection and recognition of pathogens within the body. This is followed by a
specific effector response aimed at
eliminating the pathogen. This
recognition and response process is vastly complicated with many of the details
not yet properly understood.
Human
Immune System Components
Bio and
Artificial Immune mapping
Biological Immune
System
|
Artificial Immune System
|
Human Body
|
Computer network
|
Organisms/ Organs
|
Nodes / Files
|
Antibodies
|
Mobile Agents
|
Antigens
|
Software Virus
|
Immunity,
Suppression
|
Immunity, Tolerance
|
Neural Controller
|
Server
|
Immune memory
|
Look up Table
|
Training patterns
|
Virus Signatures
|
Receptors
|
Detectors
|
Bio Connectivity
|
Wireless/ Wired
Link
|
Organ address
|
IP Address
|
Time of Attack
|
Time of Virus
Detection
|
Cloning Agent
|
Replication
|
Recovery Time
|
Agent Life Time
|
Natural Immunity
|
Built –in Security
|
Acquired Immunity
|
Agent based
Security
|
Natural Death
|
Dead PC
|
What
Motivated Them?
Why is it
that engineers are attracted to the immune system for inspiration? The immune
system exhibits several properties that engineers recognise as being desirable
in their systems. [Timmis & Andrews 2007, Timmis et al. 2008a, de Castro
& Timmis 2002a] have identified these as:-
1)Distribution
and self-organization:-
The
behavior of the immune system is deployed through the actions of billions of
agents (cells and molecules) distributed throughout the body. Their collective
effects can be highly complex with no central controller. An organised response
emerges as a system wide property derived from the low level agent behaviours.
These immune agents act concurrently making immune processes naturally parallised.
2)Learning,
adaption, and memory.
The
immune system is capable of recognizing previously unseen pathogens, thus
exibits the ability to learn. Learning implies the presence of memory, which is
present in the immune system enabling it to ‘remember’ previously encounted
pathogens. This is encapsuatled by the phenomenon of primary and secondary
responses: the first time a pathogen is encountered an immune response (the
primary response) is elicited. The next time that pathogen is encounted a faster
and often more aggressive response is mounted (the secondary response).
3)Pattern
recognition.
Through
its various receptors and molecules the immune system is capable of recognising
a diverse range of patterns. This is accomplished through receptors that
perceive antigenic materials in differing contexts (processed molecules, whole
molecules, additional signals etc). Receptors of the innate immune system vary
little, whilst receptors of the adaptive immune system, such as as antibodies
and T-cell receptors are subject to huge diversity.
4)Classification
The
immune system is very effective at distinguishing harmful substances (non-self)
from the body’s own tissues (self), and directing its actions accordingly. From
a computational perspective, it does this with access to only a single class of
data, self molecules [Stibor et al. 2005]. Creation of a system that
effectively classifies data into two classes, having been trained on examples
from only one, is a challenging task.
Different models of Artificial Immune Systems
Artificial
Immune Systems (AIS) emerged in the 1990s as a new branch in Computational
Intelligence (CI).A number of AIS models exist, and they are used in pattern
recognition, fault detection, computer security, and a variety of other
applications researchers are exploring in the field of science and engineering
. Although the AIS research has been gaining its momentum, the changes in the
fundamental methodologies have not been dramatic. Among various mechanisms in
the biological immune system that are explored as AISs, negative selection,
immune network model and clonal selection are still the most discussed models.
But now I am going to focusing only on Negative selection , as it has
huge application on computer security .
Negative
Selection
Negative
selection is a process of selection that takes place in the thymus gland. T
cells are produced in the bone marrow and before they are released into the
lymphatic system, undergo a maturation process in the thymus gland. The
maturationof the T cells is conceptually very simple. T cells are exposed to
self-proteins in a binding process. If this binding activates the T cell, then
the T cell is killed, otherwise it is allowed into the lymphatic system. This
process of censoring prevents cells that are reactive to self from entering the
lymph system, thus endowing (in part) the host’s immune system with the ability
to distinguish between self and non-self agents.
Artificial
Negative Selection
The
negative selection algorithm Forrest et al. , is one of the computational
models of self/nonself discrimination, first designed as a change detection
method. It is one of the earliest AIS algorithms that were applied in various
real-world applications. Since it was first conceived, it has attracted many
AIS researchers and practitioners and has gone through some phenomenal
evolution. In spite of evolution and diversification of this method, the main
characteristics of a negative selection algorithm described by Forrest et al.
In
generation stage, the detectors are generated by some random process and
censored by trying to match self samples. Those candidates that match are
eliminated and the rest are kept as detectors. In the detection stage, the
collection of detectors (or detector set) is used
to check
whether an incoming data instance is self or non-self.
If it
matches any detector, then it is claimed as non-self or anomaly. This
description is limited to some extent, but conveys the essential idea. Like any
other Computational Intelligence technique, different negative selection
algorithms are characterized by particular representation schemes, matching
rules and detector generation processes.
AIS Applications
Artificial
Immune Systems (AIS) are being used in many applications
such as:-
1)anomaly
detection
2)pattern
recognition
3)data
mining
4)computer
security
5)adaptive
control
6)fault
detection .
Computer
Security
I am
working on computer security only . I choose this as because computer security
should be our first priority .world has
become a more interconnected place. Electronic communication, e-commerce,
network services and the Internet have become vital components of business strategies, government operations,
and private communications. Many organizations have become dependent on the
wired world for their daily activities. This interconnectivity has also brought
forth those who wish to exploit it. Computer security has, thus, become a
necessity in the digital age. While information dependence is increasing, the
threat from malicious code, such as computer viruses, is also on the rise. The
number of computer viruses has been increasing exponentially from their first
appearance in 1986 to over 55 000 different strains identified today . Viruses
were once spread by sharing disks; now, global connectivity allows malicious
code to spread farther and faster. Similarly, computer misuse through network intrusion is on the rise.
With the
rapid development of computer technology, new anti-malware technologies are
required because malware is becoming more complex with a faster propagation
speed and a stronger ability for latency, destruction, and infection.
Many
companies have released anti-malware software, most of which is based on
signatures and can detect known malware very quickly. However, the software
often fails to detect new variations and unknown malware. Based on metamorphic
and polymorphous techniques, even a layman is able to develop new variations of
known malware easily using malware automaton. Thus, traditional malware
detection methods based on signatures are no longer suitable for new
environments; as well, heuristics have started to emerge.
For the
past few years, applying immune mechanisms to computer security has developed
into a new field, attracting many researchers. Forrest applied immune theory to computer
abnormality detection for the first time in 1994 . Since then, many
researchers have proposed various different malware detection models and
achieved some success.
Immunological
computation has also been applied to other problem domains, not all of which
are in the computer-security field. Some
of the more interesting examples include anomaly
detection in time series data , fault diagnosis , decision support systems
,multi optimization problems , robust scheduling , and loan application fraud
detection . The similarity in all of
these
applications is that they utilize the
pattern-matching and “learning” mechanisms of the immune system model to
perform desired system features. A lot of theoretical groundwork
in
immunological computation has been completed, but only a handful of AISs have been build.
Many AIS
MODELS are there to detect virus & malware code.
For virus
detection
A Hierarchical Artificial Immune Model for Virus
Detection
Model Architecture
The model is composed
of two modules:
1)virus
gene library
2)generating
module
3)self-nonself
classification module.
virus gene library
The first
module is used for the training phase, whose
function
is to generate a detecting gene library to accomplish
the
training of given data.
A.Generating
module
This
module is assigned as the detecting phase in terms of the results from first
module for detection of the suspicious programs. we all know that in biology
the genetic information is
mainly
stored in DNA, but not all the fragments in DNA can express useful information.
Only gene is a fragment of DNA with genetic information. Gene is made up of
several deoxyribonucleotides (ODN)..
• DNA: The whole bit-string
of a procedure.
• Gene: Virus detector, a
fragment of virus DNA, the
compared
unit for virus detection.
• ODN: Every two bytes of
a bit-string.
The
relation of DNA, gene and ODN is shown
DNA
 ODN |
ODN
|
ODN
|
ODN
|
ODN
|
ODN
|
ODN
|
ODN
|
ODN
|
Gene is a fragment of DNA
which contains genetic information._
A series of ODNs compose a gene.
The relationship among DNA, gene &
ODN.
The codes
of a virus correspond to the DNA in the
organism.
small quanity of codes which will perform as Viral code & will regard as the genes of a virus.
These virus genes are composed of several virus ODNs which are the smallest
unit to analyze the virus. . At this stage, the most important task of the
model is to extract the genes of a virus.
B. Virus Gene Library Generating Module
Virus
gene library generating module works on the training
set
consisted of legal and virus programs.
Firstly,
this module is to count the ODNs in a DNA of legal and virus programs by a
sliding window, respectively, in order to extract ODNs which are regarded as
the representative of the virus. A virus ODN library is built by the obtained
statistical information.
Secondly, the DNAs in virus and legal programs are traversed by
the ODNs in the virus ODN library to
generate virus candidate gene library and legal virus-like gene library.
Finally, according to the negative selection mechanism, we match all the
genes in the candidate virus gene
library with the genes in the legal virus-like
gene library, and delete those genes which appear in both libraries. In such a way, the candidate library is upgraded as the detecting virus gene library.
2)
Candidate virus gene library:
The basic storage
block in the virus candidate gene library is virus sample. All the genes
in each sample are stored to make different genes in one virus storage
and genes in different virus storage separately. This kind of storage
mode is called signature storage on individual level in this
paper. The gene library mentioned below would apply this storage mode to
keep the
relevance
between different extracted genes in a same virus. Comparison between programs can be made on individual level with integrated information of virus
signatures. The model uses
continuous matching to match the virus DNA
with ODNs in the virus ODN library. It means, from the first matching position, that a sliding window is employed to move forward until a mismatching happens.
Then the number, of which ODNs in the virus ODN library take part in the
matching from the beginning to the end is recorded. If this number is larger
than a presenting threshold
3) Detecting virus gene library:
Using the
same method for generating the candidate virus gene library, this model can also be used to
generate a legal virus-like gene library by matching the legal programs
with ODNs in the virus ODN library.
Taking
the legal virus-like genes as self, and the candidate virus genes as nonself,
the NSA is applied to generate the detecting virus gene library.
It is a fuzzy
matching method, allowing some faults in matching.
C. Self-Nonself Classification Module
Repeating
the method that generates candidate virus gene library, the ODNs in the detecting virus gene library are used to generate the suspicious virus-like
gene library. Then we match virus-like genes in the suspicious program with
Matching degree between two genes:
This
module still use T-successive
consistency matching for two genes’ matching
Suspicious program detection
If the suspicious
program matches with each virus sample in the detecting virus gene library, the
similarity value is calculated. All the values for this program are added together as the similarity
value between the program and detecting virus gene library.
Summarized –
In the
above whatever I have written, that all are I have studied from either some books
or research papers. But now I am giving my idea based on this. What I have learnt.
Whatever I have written below is purely based on my idea. Something different.
Negative
Selection Algorithm (NSA) an algorithm for change detection based on the principles
of self-nonself discrimination (by T cell receptors) in the immune system. The
receptors can detect antigens. Partition of the Universe of Antigens SNS: self
and nonself .
Illustration
of NS Algorithm:
Match or Don’t
Match Self
Let r=2
1011 1011
Strings
(S) 1000 1101
There
exists efficient BNS algorithm that runs on linear time with the size of self .Efficient
algorithm to count number of binary numbers.
Generate
a set R of detectors, each of which fails to match any string in S.
Monitor
new observations (of S) for changes by continually testing the detectors
matching against representatives of S. If any detector ever matches, a change (or
deviation) must have occurred in system behavior.
Partial
matching rule –
string of
length l=20 , matching r=5
01010011001100010101
01110011011100011001
Anomaly
detection-
110011
|
10110
|
11000
|
……………………………
|
110001
|
Symbolically representation
of binary or alphabet
slide window for patter recognisation
CODE for detect the
viral code & legal code -
let Ni = Legal_code
let Nj = pseudo_ code
let No = Viral_code
creating a training set &
comprised of self pattern
initially Ni != Nj
& Ni !=
No
for(i=0;I<10;i++)
for(j=0;j<=10;j++)
use sliding window principle
if Ni match with Nj
& Ni
mismatch with No
then Nj = legal code
& No = viral code
end
CONCLUSION :-
Here I have learnt that using
negative
selection algorithms are characterized by particular representation schemes,
matching rules and detector generation processes. Many models are there to recognize
the virus & malicious codes.
This is
just my summarized one. My original work yet not completed, even if whatever I
have written here, just like a summery. My complete work may take more time. Here
I have given just fundamental idea based on AIS ON COMPUTER SECURITY.
This algorithm is self written
(without any help / copy) may be mistake is there. As I have not complete my
work fully. I hope in my future work I can give better algorithm.
This is my minor project for 7th
sem. hope I’ll get chance to research on it in my future. Just praying before
my God. Even if I’ll continue it in my 8th sem. hope may something
new I can show you further.
When my work will be complete
after that I can show you my whole work. Till now it’s near about 55 pages. I
don’t know how much time it will take & how many pages. Hope for the best.
You may get my whole work after
one month; means fully correct one & purely my work. This project is done
by me (alone). For this I wanna show my special gratitude towards my professors
who ever helped me / help me here.
REFERENCES
[1] P. S. Deng, J. Wang, W. Shieh et al. “Intelligent
automatic malicious
code signatures extraction”, IEEE
37th Annual 2003 International
Carnahan Conference on
Security Technology, pp. 600-603.
[2] K. P. Anchor, P. D. Williams, G. H. Gunsch et al. “The Computer
Defense Immune System: Current and Future Research in Intrusion
Detection”, Evolutionary Computation, 2002, pp.
1027-1032.
[3] J. O. Kephart. “A Biologically Inspired Immune System for
Computers”,
in Artificial Life IV, Proceedings of the
Fourth International Workshop
on the Synthesis and
Simulation of Living Systems, 1994, pp. 130-139.
[4] S. Forrest, A. S. Perelson, L. Allen et al. “Self - Nonself Discrimination
in a Computer”, Security and Privacy, Oakland CA,
pp. 202-212, 1994.
[5] P. D’haeseleer, S. Forrest, P. Helman. “An immunological approach to
change detection: algorithms, analysis, and implications”, Proceedings
of IEEE Symposium on
Research in Security and Privacy, Oakland, CA,
pp. 110 - 119, May 1996.
[6] H. Lee, W. Kim, M. Hong. “Artificial Immune System against Viral
Attack”, ICCS 2004, Lecture Notes in Computer Science 3037, pp. 499-
506, 2004.
[7] K. S. Edge, G. B. Lamont, R. A. Raines. “A retrovirus inspired
algorithm for virus detection & optimization”, 8th Annual Genetic and
Evolutionary Computation
Conference, Seattle WA, 2006, pp. 103-110.
[8] T. Li. Computer Immunology, Beijing:
Publishing house of electronics
industry, pp. 187-191, 2004.
[9] D. Dasgupta, N. Attoh-Okine. “Immunity-Based Systems: A survey”,
1997 IEEE International
Conference on Systems, Man, and Cybernetics,
Computational Cybernetics and Simulation, 1997, pp. 369-374.
[10] P. K. Harmer, P. D. Williams, G. H. Gunsch et al. “An Artificial
Immune System Architecture for Computer Security Applications”,
IEEE Transactions on
Evolutionary Computation, vol. 6(3), pp. 252-
280, 2002.
[11] M. D. Preda, M. Christodorescu, S. Jhaet al. “A Semantics-Based Approach
to Malware Detection”, 34th
Annual Symposium on Principles
of Programming Languages, vol. 42(1),
pp. 377-388, 2007.
[12] O. Henchiri, N. Japkowicz, J. Nathalie. “A Feature Selection and
Evaluation Scheme for Computer Virus Detection”, Sixth International
Conference on Data Mining, Hong Kong,
China, 2006, pp. 891-895.
[13]Beer, R.D., Chiel, H.J. and Sterling, S., A Biological
Perspective on Autonomous Agent Design, In Robotics and
Autonomous systems, Vol. 6, (1990), 169 – 186.
[14] Dasgupta, D, Artificial Immune Systems and Their
Applications, Heidelberg, Germany: Springer-Verlag, 1999.
[15] Dasgupta, D., An artificial immune system as a multi-agent
decision support system, Proc.
IEEE Int. Conf. Systems, Man
and Cybernetics ,(Oct. 1998),
pp. 3816–3820.
[16] David Kotz and Robert S. Gray, Mobile Agents and the
Future of the Internet, ACM
Operating Systems Review,
(Aug. 1999), 7-13.
[17] Desel, J., and Reisig, W., Place/Transition Petri Nets. In
Lecture on Petri nets I: Basic Models, vol 1491 of Lecture
Notes in Computer Science, Springer -
Verlag, 1998.
[18] Forrest S., Perelson A.S., Allen L., and Cherukuri, R., Self–
Nonself Discrimination in a Computer, Proceedings
of the
IEEE Symposium on Research
in Security and Privacy(Los
Alamos, CA: IEEE Computer Society Press), 1994.
[19] Goel, S and Bush S.F., Biological Models of Security for
Virus Propagation in Computer Networks login:, vol. 29, no.
6, (Dec. 2004), 49-56.
[20] Kaariboga Mobile Agents (Sep. 2003). [Online]. Available:
http:// http://www.projectory.de/kaariboga/index
[21] Kephart, J.O., Biologically Inspired Defenses against
Computer Viruses, Proceedings of IJCA ’95, (1995) 985–
996.
[22] Paul K. Harmer et al, An Artificial
Immune System
Architecture for Computer Security Applications, IEEE
Transactions on
Evolutionary Computation, vol. 6, no. 3,
(Jun. 2002), 252 – 280.
[23] Virus Information and Statistics, [Online]. Available: http://
http://www.avira.com/en/threats/
Proceedings of the World Congress on
Engineering 2008 Vol I
WCE 2008, July 2 - 4, 2008, London, U.K.
ISBN:
