Caiming Liu

Dynamical Network Forensics Based on Immune Agent

Current network forensics systems are static and not real-time. In order to overcome the shortages, a dynamical network forensics model based on artificial immune theory and multi-agent theory, referred to as DNF, is introduced here. Comparing with traditional computer forensics methods, the new method provides the capacity that gathering real-time evidence dynamically as soon as network intrusions take place and saving the evidence in a safe way to prepare for the collection and analysis of the original evidence. In this paper, architecture of the model and the definitions of its components inspired by the immunity theory are given out. The experiment shows that it is able to insure the authenticity, integrality and validity of the digital evidence, and it is a new method for dynamic computer forensics.

A Feedback Negative Selection Algorithm to Anomaly Detection

Negative selection algorithm (NSA) lacks adaptability and needs a large number of self elements to build the profile of the system and train detectors. In order to overcome these limitations and build an appropriate profile of the system in a varying self and nonself condition, this paper presents a feedback negative selection algorithm, which is referred to FNSA algorithm, and its applications to anomaly detection. The proposed approach uses the feedback technique, which adjusts the self radius of self elements, the detection radius of detectors and the number of detectors, to adapt the varieties of self nonself space and build the appropriate profile of the system based on some of self elements. Furthermore, the approach can increase the accuracy in solving the anomaly detection problem. To determine the performance of the approach, the experiments with well-known dataset were performed and compared with other works reported in the literature. Results exhibited that our proposed approach outperforms the previous techniques.

A Computer Forensics Model Based On Danger Theory

To effectively collect electronic evidences of computer crime, a novel danger theory based computer dynamic model (Demed) is proposed. With definitions of self, non-self and detector, the intrusion detection sub-model is given, which is composed of memory cell set, mature cells set, and immature cells set. Then, the danger theory based computer dynamic forensics sub-model is further given. Both the theory analysis and experimental results show that Demed provides an effective approach for computer dynamic forensics.

An Artificial Immune Network Based Algorithm for Diabetes Diagnosis

A novel artificial immune network based algorithm for the diagnosis of diabetes is presented. The algorithms implementation includes: (1) creating the initial immune antibody network; (2) the network is evolved with the learning from foreign antigens; (3) diagnosis process is accomplished by majority vote of the k nearest neighbor antibodies.

Artificial Immunity-Based Discovery for Popular Information in WEB Pages

An artificial immunity-based discovery method for popular information is proposed. Principles of evolution and concentration of antibodies in artificial immune system are simulated. Key words in web pages are extracted and simulated as antibody and antigen. Antibodies are evolved and excreted dynamically. Concentration of antibodies is computed to attain accurately the degree of popular measurement in quantity. The proposed method improves the intelligent degree of information discovery and provides a new way to discover WEB information.

A Supervised Classifier Based on Artificial Immune System

Artificial immune recognition system (AIRS) has been convincingly proved a highly effective classifier, which has been successfully applied to pattern recognition and etc. However, there are two shortcomings that limit its further applications, one is the huge size of evolved memory cells pool, and the other is low classification accuracy. In order to overcome these limitations, a supervised artificial immune classifier, UCAIS, is presented. The implementation of UCAIS includes: the first is to create a pool of memory cells. Then, B-cell population is evolved and the memory cells pool is updated until the stopping criterion is met. Finally, classification is accomplished by majority vote of the k nearest memory cells. Compared with AIRS, UCAIS not only reduces the huge size of evolved memory cells pool, but also improves the classification accuracy on the four famous datasets, the Iris dataset, the Ionosphere dataset, the Diabetes dataset, and the Sonar dataset.

Exploration of Network Security Information Hid in Web Pages Based on Immunology

To discover information endangering network security, an exploration method of network security information based on immunology is proposed. Antibody and antigen in biological immune system are used to denote keywords hid in HTML pages. Proposed method generates new antibodies to recognize unknown keywords through immune rules. By mechanisms of self-learning and evolution, antibody families form to represent distribution of different network security information. All antibodies in the same family are totalized to evaluate the information distribution degree. Simulation experiments show that the proposed method is able to find useful information threatening network and improve the intelligent degree of evaluating security of Web information.

An immune-based model for service survivability

In order to enhance service survivability, an immune-based model for service survivability, referred to as ISSM, is presented. In the model, the concepts and formal definitions of self, nonself, immunocyte, diversity system, and etc., are given; the antibody concentration and the dynamic change process of host status are described. Building on the relationship between the antibody concentration and the state of an illness in the human immune system, the systemic service capability and the service risk are calculated quantitatively. Based on the differences of the immune system among individuals, a service survivability algorithm, dynamic service migration algorithm, is put forth. Simulation results show that the model is real-time and adaptive, thus providing an effective solution for service survivability.