Danger Theory: The Link between AIS and IDS?

Abstract

We present ideas about creating a next generation Intrusion Detection System (IDS) based on the latest immunological theories. The central challenge with computer security is determining the difference between normal and potentially harmful activity. For half a century, developers have protected their systems by coding rules that identify and block specific events. However, the nature of current and future threats in conjunction with ever larger IT systems urgently requires the development of automated and adaptive defensive tools. A promising solution is emerging in the form of Artificial Immune Systems (AIS): The Human Immune System (HIS) can detect and defend against harmful and previously unseen invaders, so can we not build a similar Intrusion Detection System (IDS) for our computers? Presumably, those systems would then have the same beneficial properties as HIS like error tolerance, adaptation and self-monitoring. Current AIS have been successful on test systems, but the algorithms rely on self-nonself discrimination, as stipulated in classical immunology. However, immunologist are increasingly finding fault with traditional self-nonself thinking and a new 'Danger Theory' (DT) is emerging. This new theory suggests that the immune system reacts to threats based on the correlation of various (danger) signals and it provides a method of 'grounding' the immune response, i.e. linking it directly to the attacker. Little is currently understood of the precise nature and correlation of these signals and the theory is a topic of hot debate. It is the aim of this research to investigate this correlation and to translate the DT into the realms of computer security, thereby creating AIS that are no longer limited by self-nonself discrimination. It should be noted that we do not intend to defend this controversial theory per se, although as a deliverable this project will add to the body of knowledge in this area. Rather we are interested in its merits for scaling up AIS applications by overcoming self-nonself discrimination problems.

A Machine Learning Based AIS IDS

“…In this model we replace the negative selection module in our previous model in [2] with a new one. In the new negative selection module instead of using only normal profile to distinguish and classified packets into two different classes of "Normal" and "Anomaly", we do future process on each packet using our expert rules, produced before based on the normal profile table.…”

“…Artificial immune system can use biological immune theoretic for references to search and design relevant models and algorithms to solve the various problems occurred in the field of computer security [2].…”

A taxonomy of biologically inspired research in computer networking

“…According to their evaluation, the danger signal greatly reduced the number of false positives [64]. However, the majority of publications on the use of the danger theory in AIS have been produced by its most outspoken proponents, Aickelin et al [62,65,66].…”

Integrating Innate and Adaptive Immunity in Intrusion Detection

“…For this purpose the "libtissue" [9,10] AIS framework, a product of a danger theory project [1], will model a number of innate immune system components such as dendritic cells in order to direct an adaptive T-cell based response. Dendritic cells will carry the responsibility of discerning dangerous and safe contexts as well as carrying out their role of presenting antigen and signals to a population of T-cells as in [4].…”