A Study of Detector Generation Algorithms Based on Artificial Immune in Intrusion Detection System

Transcription

1 A Study of Detector Generaton Algorthms Based on Artfcal Immune n Intruson Detecton System Jnyn Chen [1], Dongyong Yang [1], and Matsumoto Naofum [2] [1] Software Department, Zhejang Unversty of Technology, Hangzhou, Chna [2] Informaton Department, Ashkaga Insttute of Technology, Ashkaga, Japan chenjnyn@163.com Abstract: - Detector plays an mportant role n self and non-self dscrmnaton for ntruson detecton system, whch makes detector generaton a kernel algorthm for artfcal mmune system. In ths paper, frstly current used bnary matchng rules are lsted, characterstcs of whch are analyzed. And detector generaton algorthm s dvded nto three man processes, ncludng gene lbrary, negatve selecton and clone selecton. Evoluton for gene lbrary s explaned based on the gene lbrary theory. Several new methods are adopted to mprove the performance of NSA, and fnally cooperatve co-evoluton detector generaton model s constructed whch s a novel structure for ntruson detecton system. Ths paper s amed for researchers to focus problems on three man deas concluded n last chapter. Key-Words: - Detector generaton algorthm, artfcal mmune, ntruson detecton system, NSA, CSA, GA, Co-operaton cooperatve, maturaton algorthm 1 Introducton of detector generaton based on artfcal mmune systems Wth the development of network, tradtonal network protecton system cannot meet the demand of ntruson detecton. Artfcal mmune system s an emergent bo-nspred research feld [1-3], whch has been proved effcent for network ntruson detecton especally for anomaly detecton and related applcatons [4-6]. Detectors play an mportant role n Immune Detecton System (IDS), whch makes the algorthm for detector generaton and maturaton especally sgnfcant. More than twenty papers have brought up novel detector generaton algorthms n varous ways, most of whch are amed at ncreasng TP rate and mantanng low FP rate. However most of them are stll of large tme complexty and space complexty. In the followng segments, matchng rules are lsted and analyzed, based on whch gene lbrary, Negatve Selecton Algorthm (NSA) and Clone Selecton Algorthm (CSA) are summarzed, ncludng specfc advantages and shortcomngs of varous novel technques. Based on the current technques, detector generaton algorthm scheme based on cooperatve co-evoluton s come up to solve the problem of large tme and space complexty, whch s also sutable for varous knds of anomaly ntrusons. 2 Bnary matchng rules for artfcal mmune system In artfcal mmune system, affnty between 29

2 antbodes and antgens are calculated accordng to dfferent models [7]. The detecton capablty of a detector manly depends on the affnty between the detector and antgen, whch makes the affnty model an mportant role n artfcal mmune system. Currently several models are adopted based on bnary coded antbody and antgen. (1) Eucldean dstance If the coordnates of an antbody are gven by < ab 1, ab2, K, ab antgen are gven by > and the coordnates of an < ag 1, ag 2, K, ag then dstance(d) between them s presented n Equaton (1). D = = 1 2 ( ab ag ) (1) Shape-spaces that use real-valued coordnates and that measure dstance s the form of Equaton (1) are called Eucldean shape-spaces. It s sutable for real-valued coordnates, however f coordnates length s much longer than regular stuaton, calculatng dstance costs much longer tme. Besdes n condton of larger real-value, Eucldean dstance can be very complex to calculate. As a result Eucldean dstance s only adopted n smple real-valued case. (2) Manhattan dstance [8] Manhattan dstance s calculated as Equaton (2). Shape-spaces that use real-valued coordnates are called Manhattan shape-spaces. D = = 1 ab ag > (2) Although no report of t has yet been found n the lterature, the Manhattan dstance consttuted an nterestng alternatve to Eucldean dstance, manly for parallel mplementaton of algorthms based on the shape-space formalsm. (3) Hammng dstance In Hammng shape-space antgens and antbodes are represented as sequences of symbols. Such sequences can be loosely nterpreted as peptdes. The mappng between sequence and shape s not fully understood, but n the context of artfcal mmune systems, they are assumed to be equvalent. Equaton (3) depcts the Hammng dstance measure. 1 f ab ag D = δ, whereδ = (3) = 1 0 otherwse Hammng dstance s only appled for bnary-coded antbody and antgen. It has an obvous advantage s that hammng dstance sn t a complex value whch s n range of [0, ]. (4) Rogers & Tanmoto dstance [8] Roger & Tanmoto dstance matchng rule, a varaton of the Hammng dstance, produced the best performance and defned as follows: gven an antbody < ab 1, ab2, K, ab > and an antgen < ag 1, ag 2, K, ag >, the two matches wth each other f and only f formula (4) holds. ab ag ab ag + 2 ab ag r (4) Ths dstance, nspred by bology, s wdely employed to self and non-self dscrmnaton n human body. It s obvous that the calculaton of ths dstance takes more steps to complement whch lmts ts applcaton area. (5) r-contguous dstance The frst verson of the NSA [9] used bnary strngs of fxed length, and the matchng between antbody and antgen s determned by a rule called r-contguous matchng. The bnary matchng process s defned as follows: gven an antbody ab, ab, ab > and an 2, antgen < 1 K < ag 1, ag 2, K, ag >. The antbody matches the antgen f and only f r + 1 such that ab = ag for j =, K + r 1holds. j j (6) r-chunk dstance Ths matchng rule subsumes r-contguous 30

3 matchng, that s, any r-contguous antgens and antbodes. The r-chunk matchng rule s defned as follows: gven an antbody < ab and 1, ab2, K, ab > antgen < ag, 1, ag 2, K, ag > wth m n and m + 1, the antbody matches the antgen f and only f ab = for j =, K, + m 1holds. j ag j 3 Detector generaton algorthms Detector generaton algorthm s extremely mportant for artfcal mmune system [9-11] and varous mproved detector generaton algorthms have been brought up ever snce negatve selecton algorthm put forward. Accordng to the prncple of detector generaton, the process could be dvded nto three processes and most of the betterments for generaton algorthm are a part of the process. 3.1 Gene lbrary evoluton Gene lbrary s frstly used for generatng ntal premature detectors and usually n statc form, n other word statc gene lbrary s unchangeable through the whole detector mature process [13]. In statc gene lbrary algorthm, each part of detector code s derved from specfc part of the gene lbrary as shown n fgure 1. Fg. 1. Statc gene lbrary for detector generaton In current research, J Km found t s necessary to evolve the gene lbrary durng the detector generaton process [13]. Based on the avalablty analyss of gene lbrary evoluton, there are two methods employed by the currently avalable AIS n order to evolve ther gene lbrares. The frst approach drects gene lbrary evoluton through the Baldwn effect and the second approach allows provson of drect feedback from learnng results to a gene lbrary. So the clone selecton was extended by elmnatng memory detectors and evolvng gene lbrary. Ths extended system has hgher TP and lower FP compared to tradtonal clone selecton algorthm [13]. However accordng to the experments results, t costs much more CPU tme, n other word, t has larger tme complexty whch needs to be mproved mmedately. 3.2 Negatve selecton algorthm Negatve selecton algorthm, frstly brought up by Forrest, s successful for self and non-self dscrmnaton n detector maturaton [12-13]. However the tradtonal NSA has large tme cost complexty and space complexty, amng at whch varous technques are adopted to mprove the performance. Four types of mended NSAs are lsted as follows Negatve selecton wth detector rules (NSDR) Ths algorthm uses a genetc algorthm to evolve detectors wth a hyper-rectangular shape that can cover the non-self space. These detectors can be nterpreted as If-Then rules, whch produce a hgh-level characterzaton of the self/non-self space. The ntal verson of the algorthm [14] used a sequental nchng technque to evolve multple detectors. And NSDR s an mproved verson of the algorthm usng determnstc crowdng as the nchng technque. The algorthm was appled to detect attacks n network traffc data. GA-based NSDR s come up n [7] genetc algorthm s used to evolve rules to cover the non-self space. The goodness of a rule s determned by varous factors: the number of normal samples that t covers, ts area, and the overlappng wth other rules. Ths s a mult-objectve, mult-modal optmzaton problem. A nchng technque s used wth GA to generate dfferent rules. Experments results testfed that postve characterzaton appears 31

4 to be more precse, but t requres more tme and space resources Negatve selecton wth fuzzy detector rules (NSFDR) NSFDR s extended NSDR algorthm wth fuzzy rules. Ths mproves the accuracy of the method and produces a measure of devaton from the normal that does not need a dscrete dvson of the non-self space Real-valued negatve selecton (RNS) Ths algorthm takes as nput a set of hyper-sphercal antbodes (detectors) randomly dstrbuted n the self/non-self space. The algorthm apples a heurstc process that changes teratvely the poston of the detectors drven by two goals: to maxmze the coverage of the non-self subspace and to mnmze the coverage of the self samples. Ths algorthm was combned wth a hybrd mmune learnng algorthm [15] and appled t to dfferent data sets. 3.3 Clone selecton algorthm Km and Bentley adopt such a strategy as a clone selecton operator wth negatve selecton operator for network ntruson detecton. They conclude that the embedded negatve selecton operator plays an mportant role. Yajng Zhang proposed a nchng colon selecton genetc algorthm (NCSA). The man dea s that for those vald detectors generated, f a bt or several bts are changed, ther ftness score wll not vary n a large extent. Thus more vald detectors wll be obtaned n a short tme. The flow chart s shown as follows Randomzed real-valued negatve selecton (RRNS) ke the RNS algorthm, the goal of ths algorthm s to cover the non-self space wth hyper-sphercal antbodes. The man dfference s that the RRNS algorthm has a good mathematcal foundaton that solves some of the drawbacks of the RNS algorthm. Specfcally, t can produce a good estmate of the optmal number of detectors needed to cover the non-self space, and maxmzaton of the non-self coverage s done through an optmzaton algorthm wth proved convergence propertes. The algorthm s based on a type of randomzed algorthms called Monte Carlo methods. Specfcally, t uses Monte Carlo ntegraton and smulated annealng. However there are ssues that prevent NSA from beng appled more extensvely, as scalablty, low-level detector presentaton, sharp dstncton exsts between the normal and abnormal and other mmune-nspred algorthms use hgher level representaton (e.g. real valued vectors). Fg. 2. Flow chart of NCSA 4 Mult-detectors cooperatve co-evoluton based on evoluton algorthms A dfferent approach based on a cooperatve and co-evoluton model of the mmune system s brought up recently [16]. Genetc algorthms are very successful for optmzaton problems even though n most of the cases they may not lead to the best answer. A genetc algorthm repeatedly modfes a populaton of ndvduals whle seekng for the best 32

5 possble choce. An extended approach used n here, s a cooperatve co-evoluton genetc algorthm method. Co-evoluton s the smultaneous evoluton of two or more genetcally dstnct populatons wth coupled ftness landscapes. Fg. 3. The cooperatve co-evolutonary based detectors generaton method As shown the cooperatve co-evoluton ncludes some subcomponents whch are represented as genetcally solated speces and evolves n a parallel mechansm. Indvdual member from each speces collaborate wth other members and mproves ts ftness accordng to specfc objectve functon. The cooperatve co-evoluton mmune system conssts of several speces and each speces contans several detectors, collecton of a selected detector n each speces forms a detector set. Each speces represents only a partal soluton,.e. a collecton of smlar detectors. The representaton of ndvdual as follows. Fg. 4. Detector and event pattern representaton Three segments have dfferent functons explaned n paper [16]. The followng relatons present, as a set of a bt strng of attackng traffc andt as a set b T a of b bt strng of normal traffc (non-attack). The goal s to fnd M that s set that matches as strongly as possble tot and T. When a detector evolves n one a b speces, t collaborates wth representatves of all other speces n the system. The selected representatves have the best ftness compared to other members wth target set. The ndvduals from multple dfferent speces collaborate to fnd the optmum detector for the target set. As a result, the populaton would converge nto a collecton of non-smlar detector whch guarantees the dversty of detectors. Applcatons of ths method on Jn grd platform has been mproved effcent [16]. 5 Conclusons The summary of detector generaton methods can attract computer scentsts research on mmune system approaches to ntruson detecton. An ncreasng amount of work has been publshed on ths topc recently and here we have collated the algorthms used, the development of detector generaton for mmune system. The paper focused on provdng an overvew of detector generaton n mmune system for ntruson detecton system for researchers to dentfy sutable ntruson detecton research problems. Through careful examnaton of lterature presented n ths paper, one can conclude that current methods for detector generaton stll have much room to grow and many areas to explore. And the research n ths area has shown a clear focus on three major deas: 1. Methods nspred by gene lbrary evoluton that employ gene evolve wth detector maturaton [13]. 2. The negatve selecton paradgm combned wth current new technques such as nchng, fuzzy, renforcement learnng, vector machnes and cooperatve co-evoluton [9-12]. Detector set may evolve based on GA to mature optmzed detectors for IDS. 3. Framework of detector generaton and maturaton for mmune system, wth younger methods based on alternatve approaches stll beng developed [17-18]. 33

6 References: [1].N. de Castro, J. I. Tmms, Artfcal mmune systems as a novel soft computng paradgm, Soft computng, 2003, 7(8): [2] Tao, Xaoje u, Hongbn, A new model for dynamc ntruson detecton, CANS 2005, NCS 3810, pp , [3] Jungwon Km, Peter J. Bentley, Uwe Ackeln, Jule Greensmth, Gann Tecesco, Jame Twycross, Immune system approches to ntruson detecton a revew, Proceedng nternatonal conference on artfcal mmune systems [C]. Catana, Italy, [4] Yanxn Wang, Smrut Ranjan Behera, Johnny Wong, Guy Helmer, Vasant Honavar, es Mller, Robyn utz, Mark Slagell, Towards the automatc generaton of moble agents for dstrbuted ntruson detecton system, The journal of systems and software 79(2006) [5] atfur Khan, Mamoun Awad, Bhavan Thurasngham, A new ntruson detecton system usng support vector machnes and herarchcal clusterng, The VDB journal, volume 16, ssue 4, October 2007: [6] Fabo A. Gonzalez, Dpankar Dasgupta, An mmunogenetc technque to detect anomales n network traffc, Proceedng of the nternatonal conference genetc and evolutonary computaton (GECCO), [7] F Gonzalez, A study of artfcal mmune systems appled to anomaly detecton [D]. PhD dssertaton, unversty of Memphs, [8] eandro Nunes de Castro, Fernando Jose Von Zuben, Artfcal mmune systems: part onebasc theory and applcatons, Theory and Applcatons. Techncal Report-RT DCA, 1999 (1): 89. [9] Yajng Zhang, Chaozhen Hou, Fang Wang, mn Su, A nchng negatve selecton genetc algorthm for self-nonself dscrmnaton n a computer, proceedngs of the frst nternatonal conference on machne learnng and cybernetcs, Bejn, 4-5 November [10] Yngje Yang, Fanyuan Ma, Antropy-based unsupervsed anomaly detecton pattern learnng algorthm, Journal of Harbn Insttute of Technology (New Seres), Vol. 12, No.1, [11] anhua Zhang, Guanhua Zhang, Intruson detecton usng rough set classfcaton, Journal of Zhejang Unversty Scence, (9): [12] Bopng Qn, Xanwe Zhou, Grey-theory based ntruson detecton model, Journal of Systems Engneerng and Electroncs, Vol. 17, No.1, 2006, pp: [13] J.Km, P.J.Bentley, A model of gene lbrary evoluton n the dynamc clonal selecton algorthm, Proceedngs of the frst nternatonal conference on artfcal mmune systems (ICARIS) Canterbury, 2002: [14] D. Dagupta, F. Gonzalez, An mmunty-based technque to characterze ntrusons n computer networks, eee transactons on evolutonary computaton, vol. 6, no. 3, pp , June [15] F. Gonzalez, D. Dasgupta, R. Kozma, Combnng negatve selecton and classfcaton technques for anomaly detecton, n proceedngs of the 2002 congress on evolutonary computaton CEC2002, D.B. Fogel, M. A. El-Sharkaw, X. Yao, G. Greenwood, H. Iba, P. Marrow, and M. Shackleton, Eds. USA: IEEE Press, May 2002, pp: [16] Mohammad Reza Ahmad, Davood Malek, A co-evolutonary mmune system framework n a grd envronment for enterprse network securty, SSI 2006, 8 th Internatonal symposum on systems and Informaton securty Sao Jose dos Campos, Sao Paulo, Brazl, November 08-10, [17] Mohamed Abou-El-Nasr, Mohamed Azab, Mohamed Rzk, FPGA-based hardware mplementaton for network ntruson detecton system system rule matchng module, WSEA 34

7 transactons on crcuts and systems, Issue 1, Vol 5, Jan. 2006, pp: [18] Wu Yang, Yong-Tan Yang, Usng nductve reasonng for network ntruson detecton, WSEAS transactons on systems, Issue 11, Vol 4, Nov 2005, pp: