Anomaly detection based on hybrid artificial immune principles

Abstract

Purpose

Anomaly detection of network attacks has become a high priority because of the need to guarantee security, privacy and reliability. This work aims to describe both intelligent immunological approaches and traditional monitoring systems for anomaly detection.

Design/methodology/approach

Author investigated different artificial immune system (AIS) theories and proposes how to combine different ideas to solve problems of network security domain. An anomaly detection system that applies those ideas was built and tested in a real time environment, to test the pros and cons of AIS and clarify its applicability. Rather than building a detailed signature based model of intrusion detection system, the scope of this study tries to explore the principle in an immune network focusing on its self-organization, adaptive learning capability, and immune feedback.

Findings

The natural immune system has its own intelligent mechanisms to detect the foreign bodies and fight them and without it, an individual cannot live, even just for several days. Network attackers evolved new types of attacks. Attacks became more complex, severe and hard to detect. This results in increasing needs for network defense systems, especially those with ability to extraordinary approaches or to face the dynamic nature of continuously changing network threats. KDD CUP'99 dataset are used as a training data to evaluate the proposed hybrid artificial immune principles anomaly detection. The average cost of the proposed model was 0.1195 where that the wining of KDD99 dataset computation had 0.233.

Originality/value

It is original to introduce investigation on the vaccination biological process. A special module was built to perform this process and check its usage and how it could be formulated in artificial life.

Citation

Salah Sobh, T. (2013), "Anomaly detection based on hybrid artificial immune principles", Information Management & Computer Security, Vol. 21 No. 4, pp. 288-314. https://doi.org/10.1108/IMCS-11-2012-0063