Danger theory: The link between AIS and IDS?

Uwe Aickelin, Peter Bentley, Steve Cayzer, Jungwon Kim, Julie McLeod

Research output: Chapter or section in a book/report/conference proceedingOther chapter contribution

240 Citations (SciVal)

Abstract

We present ideas about creating a next generation Intrusion Detection System (IDS) based on the latest immunological theories. The central challenge with computer security is determining the difference between normal and potentially harmful activity. For half a century, developers have protected their systems by coding rules that identify and block specific events. However, the nature of current and future threats in conjunction with ever larger IT systems urgently requires the development of automated and adaptive defensive tools. A promising solution is emerging in the form of Artificial Immune Systems (AIS): The Human Immune System (HIS) can detect and defend against harmful and previously unseen invaders, so can we not build a similar Intrusion Detection System (IDS) for our computers? Presumably, those systems would then have the same beneficial properties as HIS like error tolerance, adaptation and self-monitoring. Current AIS have been successful on test systems, but the algorithms rely on self-nonself discrimination, as stipulated in classical immunology. However, immunologist are increasingly finding fault with traditional self-nonself thinking and a new ‘Danger Theory’ (DT) is emerging. This new theory suggests that the immune system reacts to threats based on the correlation of various (danger) signals and it provides a method of ‘grounding’ the immune response, i.e. linking it directly to the attacker. Little is currently understood of the precise nature and correlation of these signals and the theory is a topic of hot debate. It is the aim of this research to investigate this correlation and to translate the DT into the realms of computer security, thereby creating AIS that are no longer limited by self-nonself discrimination. It should be noted that we do not intend to defend this controversial theory per se, although as a deliverable this project will add to the body of knowledge in this area. Rather we are interested in its merits for scaling up AIS applications by overcoming self-nonself discrimination problems.
Original languageEnglish
Title of host publicationArtificial Immune Systems
Subtitle of host publicationSecond International Conference, ICARIS 2003, Edinburgh, UK, September 1-3, 2003. Proceedings
PublisherSpringer
Pages147-155
Number of pages9
Volume2787
ISBN (Electronic)978-3-540-45192-1
ISBN (Print)978-3-540-40766-9
DOIs
Publication statusPublished - 2003

Fingerprint

Dive into the research topics of 'Danger theory: The link between AIS and IDS?'. Together they form a unique fingerprint.

Cite this