Multi-agent network intrusion active defense model based on immune theory

Abstract

Inspired by the immune theory and multi-agent systems, an immune multi-agent active defense model for network intrusion is established. The concept of immune agent is introduced， and its running mechanism is established. The method, which uses antibody concentration to quantitatively describe the degree of intrusion danger, is presented. This model implements the multi-layer and distributed active defense mechanism for network intrusion. The experiment results show that this model is a good solution to the network security defense.With the rapid development of information technology and Internet, many network intrusion technologies have continuously changed, which result in more and more serious damages. However, these intrusion detection technologies [1] , including statistics analysis, feature analysis, data mining, etc., all have some limitations, lack self-adaptation and can only detect the known attacks other than new attack models; The system also lacks robustness, which means that even the error in a local place can affect the whole works. So it is very urgent to build an active defense system, which has the features of self-adaptation, early warning and robustness. The biological immune system (BIS) can identify and kill the intrusion antigens. It can be seen as a distributed autonomous system. Artificial immune systems (AIS) [2][3][4] derived from BIS, and have become an important research direction in the realm of artificial intelligence technologies. In 1994, the negative selection algorithm and the concept of computer immune system were proposed by Forrest [5] . In 1999, Kim [3] proposed dynamic clone selection algorithm, which was used in the network intrusion detection. Agent [6,7] is an entity that has the ability of consciousness, solving problems and communication. With the cooperation and coordination during the isolated agents in a multi-agent system (MAS) [8] , the problems in the complex environment can be solved and it has the features of distribution, robustness.

Immune Multiagent System for Network Intrusion Detection using Non-linear Classification Algorithm

“…The false positive error is decreased significantly compared to IMAAD [21] in table 2 while the true positive rate is increased. The accuracy for the U2R test reached 100 % detection of the behavior.…”

Intelligent agent based artificial immune system for computer security—a review

“…The simulation environment simulates users with different behaviors, resources and agents. Liu et al (2007) have used the above proposed system for network security.…”

“…A multi agent model based on immune system is proposed by Liu et al (2007) and Hu et al (2007). The model introduces an active defense mechanism with the help of immune agents (IA).…”

“…Through the coordination which is accomplished through conversations, the CDIS by Harmer et al (2002) as a whole is able to detect, identify, and remove malicious code from the system. Other systems use various agents to exchange information like B agents (Zhang et al 2005), communicator agents CoAs (Gong et al 2006a,b,c), Immune agent (IA) (Liu et al 2007;Hu et al 2007), and message agents (Yang et al 2009). While in the systems by Byrski and Carvalho (2008), Hilker (2008), Zhongmin et al (2007) and Yeom and Park (2005) agents which are artificial cells exchange information about self and non-self among each other.…”

“…The active response, which is carried out by a mobile agent autonomously, disables the compromised service. A few systems use co-ordinated decision making by consultation among agents as in Byrski and Carvalho (2008), Greensmith et al (2008), Hilker (2008), Liu et al (2007) and Hu et al (2007), while others like Zhang et al (2005), Okamoto and Ishida (2007) and Luther et al (2007) use agents to raise alarm and to send information to the administrator to take action.…”