An Artificial Bioindicator System for Network Intrusion Detection

Abstract

An artificial bioindicator system is developed in order to solve a network intrusion detection problem. The system, inspired by an ecological approach to biological immune systems, evolves a population of agents that learn to survive in their environment. An adaptation process allows the transformation of the agent population into a bioindicator that is capable of reacting to system anomalies. Two characteristics stand out in our proposal. On the one hand, it is able to discover new, previously unseen attacks, and on the other hand, contrary to most of the existing systems for network intrusion detection, it does not need any previous training. We experimentally compare our proposal with three state-of-the-art algorithms and show that it outperforms the competing approaches on widely used benchmark data.

A secondary immune response based on co-evolutive populations of agents for anomaly detection and characterization

“…The ABS (Blum et al [3]) was built under an ecological point of view, from the BIS and tested in a cybersecurity scenario. In this context, ABS deals with the problem of network intrusion detection.…”

“…We consider a set of binary characteristics extracted from headers of the Transport and Network layer of (TCP-UDP)/IP connections. We also consider SANS reference over the most attacked service ports for individualizing some critical services [3]. The selection of these characteristics is justified because they are used by ABS and allow a fair comparison between the algorithms.…”

“…In this context we deal with the modeling task, using the Agent-Based Modeling (ABM) approach. A previous work entitled Artificial Bioindicators System (ABS) (Blum et al [3]) shows the evidence of the usefulness of the population of agents for the detection of anomalies in the context of computer security.…”

“…These new agents are deployed for the implementation of the secondary immune response of the system. The objective of this article is to report the progress of the development of the Reactive Artificial Bioindicators System (R-ABS), with a significant improvement of the capacities of the ABS (Blum et al [3]). The original model proposes an IDS inspired by an ecological approach to BIS, evolving a population of agents learning to survive in their environment.…”

A Prefix Hijacking Detection Model Based on the Immune Network Theory

“…Jamali and Fotohi [37] proposed to combat wormhole attacks by applying immune network theory. Blum et al [38] proposed a network intrusion detection based on immune network theory. In these efforts, the immune network theory has adequately verified the detection of abnormal data.…”