Xiaojie Liu

An immune-based model for computer virus detection

Inspired by biological immune systems, a new immune-based model for computer virus detection is proposed in this paper. Quantitative description of the model is given. A dynamic evolution model for self/nonself description is presented, which reduces the size of self set. Furthermore, an evolutive gene library is introduced to improve the generating efficiency of mature detectors, reducing the system time spending, false-negative and false-positive rates. Experiments show that this model has better time efficiency and detecting ability than the classical model ARTIS.

A new model for dynamic intrusion detection

Building on the concepts and the formal definitions of self, nonself, antigen, and detector introduced in the research of network intrusion detection, the dynamic evolution models and the corresponding recursive equations of self, antigen, immune-tolerance, lifecycle of mature detectors, and immune memory are presented. Following that, an immune-based model, referred to as AIBM, for dynamic intrusion detection is developed. Simulation results show that the proposed model has several desirable features including self-learning, self-adaption and diversity, thus providing a effective solution for network intrusion detection.

A negative selection algorithm based on hierarchical clustering of self set

Negative selection algorithm (NSA) is an important method of generating artificial immune detectors. However, the traditional NSAs aim at eliminating the self-recognized invalid detectors, by matching candidate detectors with the whole self set. The matching process results in extremely low generation efficiency and significantly limits the application of NSAs. In this paper, an improved NSA called CB-RNSA, which is based on the hierarchical clustering of self set, is proposed. In CB-RNSA, the self data is first preprocessed by hierarchical clustering, and then replaced by the self cluster centers to match with candidate detectors in order to reduce the distance calculation cost. During the detector generation process, the candidate detectors are restricted to the lower coverage space to reduce the detector redundancy. In the paper, probabilistic analysis is performed on non-self coverage of detectors. Accordingly, termination condition of the detector generation procedure in CB-RNSA is given. It is more reasonable than that of traditional NSAs, which are based on predefined detector numbers. The theoretical analysis shows the time complexity of CB-RNSA is irrelevant to the self set size. Therefore, the difficult problem, in which the detector training cost is exponentially related to the size of self set in traditional NSAs, is resolved, and the efficiency of the detector generation under a big self set is also improved. The experimental results show that: under the same data set and expected coverage, the detection rate of CB-RNSA is higher than that of the classic RNSA and V-detector algorithms by 12.3% and 7.4% respectively. Moreover, the false alarm rate is lower by 8.5% and 4.9% respectively, and the time cost of CB-RNSA is lower by 67.6% and 75.7% respectively.

A novel intrusion detection approach learned from the change of antibody concentration in biological immune response

Inspired by the relationship between the antibody concentration and the intrusion network traffic pattern intensity, we present a Novel Intrusion Detection Approach learned from the change of Antibody Concentration in biological immune response (NIDAAC) to reduce false alarm rate without affecting detection rate. In NIDAAC, the concepts and formal definitions of self, nonself, antibody, antigen and detector in the intrusion detection domain are given. Then, in initial IDS, new detectors are generated from the gene library and tested by the negative selection. In every effective IDS node, according to the intrusion network traffic pattern intensity, the change of antibody number is recorded from the process of clone proliferation based on the detector evolution. Finally, building upon the above works, a probabilistic calculation model for intrusion alarm production, which is based on the correlation between the antibody concentration and the intrusion network traffic pattern intensity, is proposed. Compared with Naive Bayes (NB), Multilevel Classifier (AdaBoost) and Hidden Markov Model (HMM), the false alarm rate of NIDAAC is reduced by 8.66%, 4.93% and 6.36%, respectively. Our theoretical analysis and experimental results show that NIDAAC has a better performance than previous approaches.

A Feedback Negative Selection Algorithm to Anomaly Detection

Negative selection algorithm (NSA) lacks adaptability and needs a large number of self elements to build the profile of the system and train detectors. In order to overcome these limitations and build an appropriate profile of the system in a varying self and nonself condition, this paper presents a feedback negative selection algorithm, which is referred to FNSA algorithm, and its applications to anomaly detection. The proposed approach uses the feedback technique, which adjusts the self radius of self elements, the detection radius of detectors and the number of detectors, to adapt the varieties of self nonself space and build the appropriate profile of the system based on some of self elements. Furthermore, the approach can increase the accuracy in solving the anomaly detection problem. To determine the performance of the approach, the experiments with well-known dataset were performed and compared with other works reported in the literature. Results exhibited that our proposed approach outperforms the previous techniques.

A Negative Selection Algorithm Based on Hierarchical Clustering of Self Set and its Application in Anomaly Detection

A negative selection algorithm based on the hierarchical clustering of self set HC-RNSA is introduced in this paper. Several strategies are applied to improve the algorithm performance. First, the self data set is replaced by the self cluster centers to compare with the detector candidates in each cluster level. As the number of self clusters is much less than the self set size, the detector generation efficiency is improved. Second, during the detector generation process, the detector candidates are restricted to the lower coverage space to reduce detector redundancy. In the article, the problem that the distances between antigens coverage to a constant value in the high dimensional space is analyzed, accordingly the Principle Component Analysis (PCA) method is used to reduce the data dimension, and the fractional distance function is employed to enhance the distinctiveness between the self and non-self antigens. The detector generation procedure is terminated when the expected non-self coverage is reach...

A new model of immune-based network surveillance and dynamic computer forensics

Dynamically evolutive models and recursive equations for self, antigen, dynamic computer forensics, immune tolerance, mature-lymphocyte lifecycle and immune memory are presented. Following that, a new model, referred to as Insdcf, for computer network surveillance and dynamic computer forensics is proposed. Simulation results show that the proposed model has the features of real-time processing, self-learning, self-adaptivity, and diversity, thus providing a good solution for computer network surveillance and dynamic computer forensics.

An Artificial Immune Network Based Algorithm for Diabetes Diagnosis

A novel artificial immune network based algorithm for the diagnosis of diabetes is presented. The algorithms implementation includes: (1) creating the initial immune antibody network; (2) the network is evolved with the learning from foreign antigens; (3) diagnosis process is accomplished by majority vote of the k nearest neighbor antibodies.

A Genetic Algorithm Based on Immune and Chaos

An immune chaos genetic algorithm is presented to keep populations diversity, avoid local optimum and improve performance of genetic algorithm. Immune selection is used to adjust antibodys density, and the advantage of individuals is exerted by introducing vaccination. By virtue of the over-spread character of chaos sequence, it is used to generate the pool of antibody to overcome redundancies. At the same time, searching space is enlarged by using sensitivity of chaos initial value. The result of simulation experiments shows that the algorithm has good performance in the aspects of both the convergence speed and the global optimum.

Artificial Immunity-Based Discovery for Popular Information in WEB Pages

An artificial immunity-based discovery method for popular information is proposed. Principles of evolution and concentration of antibodies in artificial immune system are simulated. Key words in web pages are extracted and simulated as antibody and antigen. Antibodies are evolved and excreted dynamically. Concentration of antibodies is computed to attain accurately the degree of popular measurement in quantity. The proposed method improves the intelligent degree of information discovery and provides a new way to discover WEB information.