Artificial Immune System
Description
More details
Other editions
Additional editions
Person
Content
Preface xiii
About Author xxi
Acknowledgements xxiii
1 Artificial Immune System 1
1.1 Introduction 1
1.2 Biological Immune System 2
1.2.1 Overview 2
1.2.2 Adaptive Immune Process 3
1.3 Characteristics of BIS 4
1.4 Artificial Immune System 6
1.5 AIS Models and Algorithms 8
1.5.1 Negative Selection Algorithm 8
1.5.2 Clonal Selection Algorithm 9
1.5.3 Immune Network Model 11
1.5.4 Danger Theory 12
1.5.5 Immune Concentration 13
1.5.6 Other Methods 14
1.6 Characteristics of AIS 15
1.7 Applications of Artificial Immune System 16
1.7.1 Virus Detection 16
1.7.2 Spam Filtering 16
1.7.3 Robots 20
1.7.4 Control Engineering 21
1.7.5 Fault Diagnosis 22
1.7.6 Optimized Design 22
1.7.7 Data Analysis 22
1.8 Summary 22
2 Malware Detection 27
2.1 Introduction 27
2.2 Malware 28
2.2.1 Definition and Features 28
2.2.2 The Development Phases of Malware 29
2.3 Classic Malware Detection Approaches 30
2.3.1 Static Techniques 31
2.3.2 Dynamic Techniques 31
2.3.3 Heuristics 32
2.4 Immune Based Malware Detection Approaches 34
2.4.1 An Overview of Artificial Immune System 34
2.4.2 An Overview of Artificial Immune System for Malware Detection 35
2.4.3 An Immune Based Virus Detection System Using Affinity Vectors 36
2.4.4 A Hierarchical Artificial Immune Model for Virus Detection 38
2.4.5 A Malware Detection Model Based on a Negative Selection Algorithm with Penalty Factor 2.5 Summary 43
3 Immune Principle and Neural Networks Based Malware Detection 47
3.1 Introduction 47
3.2 Immune System for Malicious Executable Detection 48
3.2.1 Non-self Detection Principles 48
3.2.2 Anomaly Detection Based on Thickness 48
3.2.3 Relationship Between Diversity of Detector Representation and Anomaly Detection Hole 48
3.3 Experimental Dataset 48
3.4 Malware Detection Algorithm 49
3.4.1 Definition of Data Structures 49
3.4.2 Detection Principle and Algorithm 49
3.4.3 Generation of Detector Set 50
3.4.4 Extraction of Anomaly Characteristics 50
3.4.5 Classifier 52
3.5 Experiment 52
3.5.1 Experimental Procedure 53
3.5.2 Experimental Results 53
3.5.3 Comparison With Matthew G. Schultz's Method 55
3.6 Summary 57
4 Multiple-Point Bit Mutation Method of Detector Generation 59
4.1 Introduction 59
4.2 Current Detector Generating Algorithms 60
4.3 Growth Algorithms 60
4.4 Multiple Point Bit Mutation Method 62
4.5 Experiments 62
4.5.1 Experiments on Random Dataset 62
4.5.2 Change Detection of Static Files 65
4.6 Summary 65
5 Malware Detection System Using Affinity Vectors 67
5.1 Introduction 67
5.2 Malware Detection Using Affinity Vectors 68
5.2.1 Sliding Window 68
5.2.2 Negative Selection 68
5.2.3 Clonal Selection 69
5.2.4 Distances 70
5.2.5 Affinity Vector 71
5.2.6 Training Classifiers with Affinity Vectors 71
5.3 Evaluation of Affinity Vectors based malware detection System 73
5.3.1 Dataset 73
5.3.2 Length of Data Fragment 73
5.3.3 Experimental Results 73
5.4 Summary 74
6 Hierarchical Artificial Immune Model 79
6.1 Introduction 79
6.2 Architecture of HAIM 80
6.3 Virus Gene Library Generating Module 80
6.3.1 Virus ODN Library 82
6.3.2 Candidate Virus Gene Library 82
6.3.3 Detecting Virus Gene Library 83
6.4 Self-Nonself Classification Module 84
6.4.1 Matching Degree between Two Genes 84
6.4.2 Suspicious Program Detection 85
6.5 Simulation Results of Hierarchical Artificial Immune Model 86
6.5.1 Data Set 86
6.5.2 Description of Experiments 86
6.6 Summary 89
7 Negative Selection Algorithm with Penalty Factor 91
7.1 Introduction 91
7.2 Framework of NSAPF 92
7.3 Malware signature extraction module 93
7.3.1 Malware Instruction Library (MIL) 93
7.3.2 Malware Candidate Signature Library 94
7.3.3 NSAPF and Malware Detection Signature Library 96
7.4 Suspicious Program Detection Module 97
7.4.1 Signature Matching 97
7.4.2 Matching between Suspicious Programs and the MDSL 97
7.4.3 Analysis of Penalty Factor 98
7.5 Experiments and Analysis 99
7.5.1 Experimental Datasets 99
7.5.2 Experiments on Henchiri dataset 100
7.5.3 Experiments on CILPKU08 Dataset 103
7.5.4 Experiments on VX Heavens Dataset 104
7.5.5 Parameter Analysis 104
7.6 Summary 105
8 Danger Feature Based Negative Selection Algorithm 107
8.1 Introduction 107
8.1.1 Danger Feature 107
8.1.2 Framework of Danger Feature Based Negative Selection Algorithm 107
8.2 DFNSA for Malware Detection 109
8.2.1 Danger Feature Extraction 109
8.2.2 Danger Feature Vector 110
8.3 Experiments 111
8.3.1 Datasets 111
8.3.2 Experimental Setup 111
8.3.3 Selection of Parameters 112
8.3.4 Experimental Results 113
8.4 Discussions 113
8.4.1 Comparison of Detecting Feature Libraries 113
8.4.2 Comparison of Detection Time 114
8.5 Summary 114
9 Immune Concentration Based Malware Detection Approaches 117
9.1 Introduction 117
9.2 Generation of Detector Libraries 117
9.3 Construction of Feature Vector for Local Concentration 122
9.4 Parameters Optimization based on Particle Swarm Optimization 124
9.5 Construction of Feature Vector for Hybrid Concentration 124
9.5.1 Hybrid Concentration 124
9.5.2 Strategies for Definition of Local Areas 126
9.5.3 HC-based Malware Detection Method 127
9.5.4 Discussions 128
9.6 Experiments 130
9.6.1 Experiments of Local Concentration 130
9.6.2 Experiments of Hybrid Concentration 138
9.7 Summary 142
10 Immune Cooperation Mechanism Based Learning Framework 145
10.1 Introduction 145
10.2 Immune Signal Cooperation Mechanism based Learning Framework 148
10.3 Malware Detection Model 151
10.4 Experiments of Malware Detection Model 152
10.4.1 Experimental setup 152
10.4.2 Selection of Parameters 153
10.4.3 Experimental Results 153
10.4.4 Statistical Analysis 155
10.5 Discussions 157
10.5.1 Advantages 157
10.5.2 Time Complexity 157
10.6 Summary 158
11 Class-wise Information Gain 161
11.1 Introduction 161
11.2 Problem Statement 163
11.2.1 Definition of the Generalized Class 163
11.2.2 Malware Recognition Problem 163
11.3 Class-wise Information Gain 164
11.3.1 Definition 164
11.3.2 Analysis 166
11.4 CIG-based Malware Detection Method 170
11.4.1 Feature Selection Module 170
11.4.2 Classification Module 171
11.5 Dataset 172
11.5.1 Benign Program Dataset 172
11.5.2 Malware Dataset 172
11.6 Selection of Parameter 174
11.6.1 Experimental Setup 174
11.6.2 Experiments of Selection of Parameter 174
11.7 Experimental Results 175
11.7.1 Experiments on the VXHeavens Dataset 177
11.7.2 Experiments on the Henchiri Dataset 179
11.7.3 Experiments on the CILPKU08 Dataset 180
11.8 Discussions 180
11.8.1 The Relationship Among IG-A, DFCIG-B and DFCIG-M 181
11.8.2 Space Complexity 182
11.9 Summary 183
Index 185
Preface
The most terrible threats to the security of computers and networking systems are the so-called computer virus and unknown intrusion. The rapid development of evasion techniques used in viruses invalidate the well-known signature-based computer virus detection techniques, so a number of novel virus detection approaches have been proposed to cope with this vital security issue. Because the natural similarities between the biological immune system (BIS) and computer security system, the artificial immune system (AIS) has been developed as a new field in the community of anti-virus researches. The various principles and mechanisms in BIS provide unique opportunities to build novel computer virus detection models with abilities of robustness and adaptiveness in detecting the known and unknown viruses.
Biological immune systems are hierarchical natural systems featuring high distribution, parallelization, and the ability to process complex information, among other useful features. It is also a dynamically adjusting system that is characterized by the abilities of learning, memory, recognition, and cognition, such that the BIS is good at recognizing and removing antigens effectively for the purpose of protection of the organism. The BIS makes full use of various intelligent ways to react to an antigen's intrusions, producing accurate immune responses by means of intrinsic and adaptive immune abilities. Through mutation, evolution, and learning to adapt to new environments, along with memory mechanisms, BIS can react much stronger and faster against foreign antigens and their likes. The BIS consists of intrinsic immune (i.e., non-specific immune) and adaptive immune (i.e., specific immune) responses that mutually cooperate to defend against foreign antigens.
An artificial immune system is an adaptive system inspired by theoretical immunology and observed immune functions, principles, and models, which are applied for problem solving. In another words, the AIS is a computational system inspired by the BIS, sometime also referred to as the second brain, made up of computational intelligence paradigms. The AIS is a dynamic, adaptive, robust, and distributed learning system. Because it has fault tolerance and noise resistance, it is very suitable for applications in time-varying unknown environments. The AIS has been applied to many complex problem fields, such as optimization, pattern recognition, fault and anomaly diagnosis, network intrusion detection, and virus detection, as well as many others.
Generally speaking, the AIS could be roughly classified into two major categories: population-based and network-based algorithms. Network-based algorithms make use of the concepts of immune network theory, while population-based algorithms use theories and models such as negative selection principle, clonal principle, danger theory, and others. During the past decades, there have been a large number of immune theories and models, such as self and nonself models, clonal selection algorithm, immune network, dendritic cell algorithms, danger theory, and so on. By mimicking BIS's mechanisms and functions, AIS has developed and is now widely used in anomaly detection, fault detection, pattern recognition, optimization, learning, and so on. Like its biological counterpart, AIS is also characterized by noise-tolerance, unsupervised learning, self-organization, memorizing, recognition, and so on.
In particular, anomaly detection techniques decide whether an unknown test sample is produced by the underlying probability distribution that corresponds to the training set of normal examples. The pioneering work of Forrest and associates led to a great deal of research and proposals of immune-inspired anomaly detection systems. For example, as for the self and nonself model, the central challenges with anomaly detection is determining the difference between normal and potentially harmful activity. Usually, only self (normal) class is available for training the system regardless of nonself (anomaly) class. Thus, the essence of the anomaly detection task is that the training set contains instances only from the self class, while the test set contains instances of both self and nonself classes. Specifically, computer security and virus detection should be regarded as the typical examples of anomaly detection in artificial immune systems whose task is protecting computers from viruses, unauthorized users, and so on. In computer security, AIS has a very strong capability of anomaly detection for defending against unknown viruses and intrusions. The adaptability is also a very important feature for AIS to learn unknown viruses and intrusions as well as quickly reacting to the learned ones. Other features of AIS like distributability, autonomy, diversity, and disposability are also required for the flexibility and stability of AIS.
Therefore, the features of the BIS are just what a computer security system needs, meanwhile the functions of BIS and computer security system are similar to each other to some extent. Therefore, the biological immune principles provide effective solutions to computer security issues. The research and development of AIS-based computer security detection are receiving increasing attention. The application of immune principles and mechanisms can better protect the computer and improve the network environment greatly.
In recent years, computer and networking technologies have developed rapidly and been used more and more widely in our daily life. At the same time, computer security issues appear frequently. The large varieties of malwares, especially new variants and unknown ones, always seriously threaten computers. What is worse is that malwares are getting more complicated and delicate, with faster speed and greater damage. Meanwhile, a huge number of spam not only occupy storage and network bandwidth, but also waste users' time to handle them, resulting in a great loss of productivity. Although many classic solutions have been proposed, there are still many limitations in dealing with the real-world computer security issues.
A computer virus is a program or a piece of code that can infect other programs by modifying them to include an evolved copy of it. Broadly, one can regard the computer virus as the malicious code designed to harm or secretly access a computer system without the owners' informed consent, such as viruses, worms, backdoors, Trojans, harmful Apps, hacker codes, and so on. All programs that are not authorized by users and that perform harmful operations in the background are referred to as viruses; they are characterized by several salient features including infectivity, destruction, concealment, latency, triggering, and so on.
Computer viruses have evolved with computer technologies and systems. Generally speaking, the development of viruses has gone through several phases, including the DOS boot phase, DOS executable phase, virus generator phase, macro virus phase, as well as virus techniques merging with hacker techniques. As computer viruses have developed and proliferated, they have become the main urgent threat to the security of computers and Internet.
The battle between viruses and anti-virus techniques is an endless warfare. Computer viruses disguise themselves by means of various kinds of evasion techniques, including metamorphic and polymorphous techniques, packer and encryption techniques, to name a few. To confront these critical situations, anti-virus techniques have to unpack the suspicious programs, decrypt them, and try to be robust to these evasion techniques. The viruses are also trying to evolve to anti-unpack, anti-decrypt, and develop to obfuscate the anti-virus techniques. The fighting between viruses and anti-virus techniques is very serious and will last forever.
Nowadays, varieties of novel viruses' techniques are continuously emergent and are often one step ahead of the anti-virus techniques. A good anti-virus technique should have to increase the difficulty of viruses' intrusion, decrease the losses caused by the viruses, and react to an outbreak of viruses as quickly as possible.
Many host-based anti-virus solutions have been proposed by researchers and companies, which could be roughly classified into three categories-static techniques, dynamic techniques, and heuristics.
Static techniques usually work on bit strings, assembly codes, and application programming interface (API) calls of a program without running the program. One of the most famous static techniques is the signature-based virus detection technique, in which a signature usually is a bit string divided from a virus sample and can identify the virus uniquely.
Dynamic techniques keep watching over the execution of every program in real time and observe the behaviors of the program. The dynamic techniques usually utilize the operating system's API sequences, system calls, and other kinds of behavior characteristics to identify the purpose of a program.
Heuristic approaches make full use of various heuristic knowledge and information in the program and its environments, by using intelligent computing techniques such as machine learning, data mining, evolutionary computing, AIS, and so on, for detecting viruses, which not only can fight the known viruses efficiently, but also can detect new variants and unseen viruses.
Because classic detection approaches of computer viruses are not able to efficiently detect new variants of viruses and unseen viruses, it is urgent to study novel virus detection approaches in depth. As for this point, the immune principle-based computer virus detection approaches have been becoming a priority choice in the community of the anti-virus...
