A Danger-Based Approach to Intrusion Detection.
Year: 2014
Type: preprint
Abstract: We propose a protocol for intrusion detection in distributed systems based on a relatively recent theory in immunology called danger theory. Based on danger theory, immune response in natural systems is a result of sensing corruption as well as sensing unknown substances. In contrast, traditional self-nonself discrimination theory states that immune response is only initiated by sensing nonself (unknown) patterns. Danger theory solves many problems that could only be partially explained by the traditional model. Although the traditional model is simpler, such problems result in high false positive rates in immune-inspired intrusion detection systems. We believe using danger theory in a multi-agent environment that computationally emulates the behavior of natural immune systems is effective in reducing false positive rates. We first describe a simplified scenario of immune response in natural systems based on danger theory and then, convert it to a computational model as a network protocol. In our protocol, we define several immune signals and model cell signaling via message passing between agents that emulate cells. Most messages include application-specific patterns that must be meaningfully extracted from various system properties. We finally provide a few rules of thumb to simplify the task of pattern extraction in most distributed systems. “Do not just declare things to be irreducibly complex...” Richard Dawkins
Source: arXiv (Cornell University)
Authors: Mahdi Zamani, Mahnush Movahedi, Mohammad Mehdi Ebadzadeh, Hossein Pedram
Institution: University of New Mexico
Language: English
Subfield: Artificial Intelligence
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W1867052115