Sunjun Liu

Distributed agents model for intrusion detection based on AIS

Artificial immune systems (AIS) is a complicated system with the ability of self-adapting, self-learning, self-organizing, parallel processing and distributed coordinating, and it also has the basic function to distinguish self and non-self and clean non-self. One significant feature of the theory immunology is the ability to adapt to changing environments and dynamically learning continuously. Inspired by the theory of artificial immune systems, a novel model of Agents of Network Danger Evaluation is presented. The concepts and formal definitions of immune cells are given, and dynamically evaluative equations for self, antigen, immune tolerance, mature-lymphocyte lifecycle and immune memory are presented, and the hierarchical and distributed management framework of the proposed model are built. Furthermore, the idea of dynamic immunological surveillance period is applied for enhancing the self-learning ability to adapt continuously variety environments. The experimental results show that the proposed model has the features of real-time processing that provide a good solution for network surveillance.

Dynamical Network Forensics Based on Immune Agent

Current network forensics systems are static and not real-time. In order to overcome the shortages, a dynamical network forensics model based on artificial immune theory and multi-agent theory, referred to as DNF, is introduced here. Comparing with traditional computer forensics methods, the new method provides the capacity that gathering real-time evidence dynamically as soon as network intrusions take place and saving the evidence in a safe way to prepare for the collection and analysis of the original evidence. In this paper, architecture of the model and the definitions of its components inspired by the immunity theory are given out. The experiment shows that it is able to insure the authenticity, integrality and validity of the digital evidence, and it is a new method for dynamic computer forensics.

Immune multi-agent active defense model for network intrusion

Inspired by the immune theory and multi-agent systems, an immune multi-agent active defense model for network intrusion is established. The concept of immune agent is introduced. While its logical structure and running mechanism are established. The method which uses antibody concentration to quantitatively describe the degree of intrusion danger is presented. The proposed model implements a multi-layer and distributed active defense mechanism for network intrusion, and it is a new way to the network security.

An immune mobile agent based grid intrusion detection model

This paper proposes a novel immune mobile agent based grid intrusion detection (IMGID) model, and gives the concepts and formal definitions of self, nonself, antibody, antigen, agentand match algorithm in the grid security domain. Then, the mathematical models of mature MoA (monitoring agent) anddynamic memory MoAsurvival are improved. Besides, effects of the important parameter P in the models of dynamic memory MoA survival on system performance are showed. Our theoretical analyses and the experiment results show the model that enhances detection efficiency and assures steady performance is a good solution to grid intrusion detection.

A Novel Network Security Evaluation System Based on Immune Principle

One significant feature of the theory immunology is the ability to adapt to changing environments and dy- namically learning continuously. Inspired by the the- ory of artificial immune systems (AIS), a novel model of Agents of Network Danger Evaluation is presented. The concepts and formal definitions of immune cells are given, and dynamically evaluative equations for self, antigen, immune tolerance, mature-lymphocyte lifecycle and immune memory are presented, and the hierarchical and distributed management framework of the proposed model are built. Furthermore, the idea of dynamic immunological surveillance period is ap- plied for enhancing the self-learning ability to adapt continuously variety environments. The experimental results show that the proposed model has the features of real-time processing that provide a good solution for network surveillance.

Immune-Based dynamic intrusion response model

Inspired by the immunity theory, a new immune-based dynamic intrusion response model, referred to as IDIR, is presented. An intrusion detection mechanism based on self-tolerance, clone selection, and immune surveillance, is established. The method, which uses antibody concentration to quantitatively describe the degree of intrusion danger, is demonstrated. And quantitative calculations of response cost and benefit are achieved. Then, the response decision-making mechanism of maximum response benefit is developed, and a dynamic intrusion response system which is self-adaptation is set up. The experiment results show that the proposed model is a good solution to intrusion response in the network.

An Immune Evolutionary Algorithm Based on Chaos Mutation

A chaos immune evolutionary algorithm is presented to keep populations diversity, avoid local optimization and improve performance of evolutionary algorithm. To overcome redundancies, over-spread character of chaos sequence was used. To enlarge searching space and chaos initial value, sensitivity was used. At the same time, immune selection operator was used to adjust density, and vaccination was used to exert the advantage of individual. The experimental results show that the algorithm has good performance in the aspects of both convergence speed and the global convergence