Article

An artificial immune system-inspired multiobjective evolutionary algorithm with application to the detection of distributed computer network intrusions

Authors:

Charles R. Haag,

Gary B. Lamont,

Paul D. Williams,

Gilbert L. PetersonAuthors Info & Claims

GECCO '07: Proceedings of the 9th annual conference companion on Genetic and evolutionary computation

Pages 2717 - 2724

https://doi.org/10.1145/1274000.1274035

Published: 07 July 2007 Publication History

Get Access

Abstract

Today's signature-based intrusion detection systems are reactive in nature and storage-limited. Their operation depends upon catching an instance of an intrusion or virus and encoding it into a signature that is stored in its anomaly database, providing a window of vulnerability to computer systems during this time. Further, the maximum size of an Internet Protocol-based message requires the database to be huge in order to maintain possible signature combinations. In order to tighten this response cycle within storage constraints, this paper presents an innovative Artificial Immune System-inspired Multiobjective Evolutionary Algorithm. This distributed intrusion detection system (IDS) is intended to measure the vector of tradeoff solutions among detectors with regard to two independent objectives: best classification fitness and optimal hypervolume size. Our antibody detectors promiscuously monitor network traffic for exact and variant abnormal system events based on only the detector's own data structure and the application domain truth set, responding heuristically. Applied to the MIT-DARPA 1999 insider intrusion detection data set, our software engineered algorithm correctly classifies normal and abnormal events at a high level which is directly attributed to a detector affinity threshold.

References

[1]

Symantec Internet Security Threat Report, Trends for January 1, 2004 - June 30, 2004, Volume VI, September, 2004, eval.veritas.com/mktginfo/enterprise/white_papers/ent-whitepaper_symantec_internet_security_threat_report_vi.pdf

Google Scholar

[2]

Michalewicz, Z., Fogel, D., How to Solve It: Modern Heuristics, Second Edition, Springer 2004.

Digital Library

Google Scholar

[3]

J. Drßo, A. Pßtrowski, P. Siarry, and E. Taillard, Metaheuristics for Hard Optimization: Methods and Case Studies, Springer-Verlag, Berlin, Germany, 2006.

Google Scholar

[4]

Haag, C.R., An Artificial Immune System-inspired Multiobjective Evolutionary Algorithm with Application to the Detection of Distributed Computer Network Intrusions, M.S. Thesis, Graduate School of Engineering and Management, Air Force Institute of Technology, WPAFB, Dayton, OH, March, 2007.

Google Scholar

[5]

Coello, C., Cortßs, N., Solving Multiobjective Optimization Problems Using an Artificial Immune System, Genetic Programming and Evolvable Machines, Vol. 6, pp.163--190, 2005.

Digital Library

Google Scholar

[6]

Edge, K., Lamont, G., Raines, R., A Retrovirus Inspired Algorithm for Virus Detection & Optimization, GECCO '06, July 8-12, 2006.

Digital Library

Google Scholar

[7]

McGee, P., Building Better Antibody Therapeutics, Drug Discovery & Development, www.dddmag.com/ShowPR.aspx?PUBCODE=090&ACCT=1600000100&ISSUE=0701&RELTYPE=DEV&PRODCODE=00000000&PRODLETT=AG&CommonCount=0.

Google Scholar

[8]

Middlemiss, M., Positive and Negative Selection in a Multilayer Artificial Immune System, Information Science Discussion Paper Series, No. 2006/03, University of Otago, January, 2006.

Google Scholar

[9]

Coello, C., Van Veldhuizen, D., Lamont, G.B., Evolutionary Algorithms for Solving Multi-Objective Problems, Springer 2002.

Digital Library

Google Scholar

[10]

De Castro, L.N., Timmis, J., Artificial Immune Systems: A New Computational Intelligence Approach, Springer 2002.

Digital Library

Google Scholar

[11]

MIT Lincoln Laboratory-DARPA Intrusion Detection Evaluation, www.ll.mit.edu/IST/ideval/.

Google Scholar

[12]

Mahoney, M., Chan, P., An Analysis of the 1999 DARPA/Lincoln Laboratory Evaluation Data for Network Anomaly Detection, Technical Report CS-2003-02, Computer Science Department, Florida Institute of Technology, 2003.

Google Scholar

[13]

Harmer, P., Williams, P., Gunsch, G., Lamont, G.B., An Artificial Immune System Architecture for Computer Security Applications, IEEE Transactions on Evolutionary Computation, Vol. 6, No. 3, June 2002.

Digital Library

Google Scholar

[14]

Williams, P., WARTHOG: Towards a Computer Immune System for Detecting "Low and Slow" Information System Attacks, AFIT Master's Thesis, March, 2001.

Google Scholar

Cited By

View all

Widuliński P(2023)Artificial Immune Systems in Local and Network Cybersecurity: An Overview of Intrusion Detection StrategiesApplied Cybersecurity & Internet Governance10.60097/ACIG/1628962:1(1-24)Online publication date: 7-Dec-2023
https://doi.org/10.60097/ACIG/162896
Sotiropoulos DTsihrintzis GSotiropoulos DTsihrintzis G(2016)Artificial Immune SystemsMachine Learning Paradigms10.1007/978-3-319-47194-5_7(159-235)Online publication date: 27-Oct-2016
https://doi.org/10.1007/978-3-319-47194-5_7
Belfiore NRudas I(2014)Applications of computational intelligence to mechanical engineering2014 IEEE 15th International Symposium on Computational Intelligence and Informatics (CINTI)10.1109/CINTI.2014.7028702(351-368)Online publication date: Nov-2014
https://doi.org/10.1109/CINTI.2014.7028702
Show More Cited By

Index Terms

An artificial immune system-inspired multiobjective evolutionary algorithm with application to the detection of distributed computer network intrusions
1. Computing methodologies
  1. Artificial intelligence
    1. Search methodologies
      1. Heuristic function construction

Recommendations

An artificial immune system-inspired multiobjective evolutionary algorithm with application to the detection of distributed computer network intrusions
ICARIS'07: Proceedings of the 6th international conference on Artificial immune systems

Contemporary signature-based intrusion detection systems are reactive in nature and are storage-limited. Their operation depends upon identifying an instance of an intrusion or virus and encoding it into a signature that is stored in its anomaly ...
Detection of DDoS attacks via an artificial immune system-inspired multiobjective evolutionary algorithm
EvoCOMNET'10: Proceedings of the 2010 international conference on Applications of Evolutionary Computation - Volume Part II

A Distributed Denial of Service Attack is a coordinated attack on the availability of services of a victim system, launched indirectly through many compromised computers. Intrusion detection systems (IDS) are network security tools that process local ...
Using artificial anomalies to detect unknown and known network intrusions

Intrusion detection systems (IDSs) must be capable of detecting new and unknown attacks, or anomalies. We study the problem of building detection models for both pure anomaly detection and combined misuse and anomaly detection (i.e., detection of both ...

Comments

Please enable JavaScript to view thecomments powered by Disqus.

Information & Contributors

Information

Published In

GECCO '07: Proceedings of the 9th annual conference companion on Genetic and evolutionary computation

July 2007

1450 pages

ISBN:9781595936981

DOI:10.1145/1274000

Program Chairs:
Peter A. N. Bosman
Centre for Mathematics & Computer Science, The Netherlands
,
Tina Yu
Memorial University of Newfoundland, Canada
,
Anikó Ekárt
Aston University, UK

Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 07 July 2007

Permissions

Request permissions for this article.

Request Permissions

Check for updates

Author Tags

Qualifiers

Article

Conference

GECCO07

Sponsor:

GECCO07: Genetic and Evolutionary Computation Conference

July 7 - 11, 2007

London, United Kingdom

Acceptance Rates

Overall Acceptance Rate 1,669 of 4,410 submissions, 38%

Contributors

Other Metrics

View Article Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

13
Total Citations
View Citations
865
Total Downloads

Downloads (Last 12 months)6
Downloads (Last 6 weeks)0

Reflects downloads up to 18 Nov 2024

Other Metrics

View Author Metrics

Citations

Cited By

View all

Widuliński P(2023)Artificial Immune Systems in Local and Network Cybersecurity: An Overview of Intrusion Detection StrategiesApplied Cybersecurity & Internet Governance10.60097/ACIG/1628962:1(1-24)Online publication date: 7-Dec-2023
https://doi.org/10.60097/ACIG/162896
Sotiropoulos DTsihrintzis GSotiropoulos DTsihrintzis G(2016)Artificial Immune SystemsMachine Learning Paradigms10.1007/978-3-319-47194-5_7(159-235)Online publication date: 27-Oct-2016
https://doi.org/10.1007/978-3-319-47194-5_7
Belfiore NRudas I(2014)Applications of computational intelligence to mechanical engineering2014 IEEE 15th International Symposium on Computational Intelligence and Informatics (CINTI)10.1109/CINTI.2014.7028702(351-368)Online publication date: Nov-2014
https://doi.org/10.1109/CINTI.2014.7028702
Gómez JGil CBaños RMárquez AMontoya FMontoya M(2013)A Pareto-based multi-objective evolutionary algorithm for automatic rule generation in network intrusion detection systemsSoft Computing - A Fusion of Foundations, Methodologies and Applications10.1007/s00500-012-0890-917:2(255-263)Online publication date: 1-Feb-2013
https://dl.acm.org/doi/10.1007/s00500-012-0890-9
Behdad MBarone LBennamoun MFrench T(2012)Nature-Inspired Techniques in the Context of Fraud DetectionIEEE Transactions on Systems, Man, and Cybernetics, Part C: Applications and Reviews10.1109/TSMCC.2012.221585142:6(1273-1290)Online publication date: 1-Nov-2012
https://dl.acm.org/doi/10.1109/TSMCC.2012.2215851
Poston H(2012)A brief taxonomy of intrusion detection strategies2012 IEEE National Aerospace and Electronics Conference (NAECON)10.1109/NAECON.2012.6531064(255-263)Online publication date: Jul-2012
https://doi.org/10.1109/NAECON.2012.6531064
Gómez JGil CBaños RMárquez AMontoya FMontoya M(2011)A multi-objective evolutionary algorithm for network intrusion detection systemsProceedings of the 11th international conference on Artificial neural networks conference on Advances in computational intelligence - Volume Part I10.5555/2023252.2023264(73-80)Online publication date: 8-Jun-2011
https://dl.acm.org/doi/10.5555/2023252.2023264
Deraman MJalil Desa AOthman Z(2011)Public domain datasets for optimizing network intrusion and machine learning approaches2011 3rd Conference on Data Mining and Optimization (DMO)10.1109/DMO.2011.5976504(51-56)Online publication date: Jun-2011
https://doi.org/10.1109/DMO.2011.5976504
Gómez JGil CBaños RMárquez AMontoya FMontoya M(2011)A Multi-Objective Evolutionary Algorithm for Network Intrusion Detection SystemsAdvances in Computational Intelligence10.1007/978-3-642-21501-8_10(73-80)Online publication date: 2011
https://doi.org/10.1007/978-3-642-21501-8_10
Deraman MDesa JOthman Z(2010)Multilayer packet tagging for network behaviour analysis2010 International Symposium on Information Technology10.1109/ITSIM.2010.5561573(909-913)Online publication date: Jun-2010
https://doi.org/10.1109/ITSIM.2010.5561573
Show More Cited By

View Options

Login options

Check if you have access through your login credentials or your institution to get full access on this article.

Cited By

Index Terms

Recommendations

An artificial immune system-inspired multiobjective evolutionary algorithm with application to the detection of distributed computer network intrusions

Detection of DDoS attacks via an artificial immune system-inspired multiobjective evolutionary algorithm

Using artificial anomalies to detect unknown and known network intrusions