Indonesian J
ournal of Ele
c
trical Engin
eering and
Computer Sci
e
nce
Vol. 2, No. 1,
April 201
6, pp. 168 ~ 17
9
DOI: 10.115
9
1
/ijeecs.v2.i1.pp16
8-1
7
9
168
Re
cei
v
ed
De
cem
ber 2
8
, 2015; Re
vi
sed
March 2, 201
6; Acce
pted
March 16, 20
16
Intrusion Prevention System Inspired Immune Systems
Yousef F
a
rh
aoui
Dep
a
rtment of Comp
uter Scie
nce, F
a
cult
y
of sci
enc
es an
d T
e
chn
i
qu
es, Mo
ula
y
Ismai
l
Uni
v
ersit
y
Errachidia, Mor
o
cco
e-mail: yo
useffarha
oui
@gma
il
.com
A
b
st
r
a
ct
In view
of new
communic
a
tio
n
and i
n
for
m
ati
o
n tech
n
o
lo
gi
es that app
ear
ed
w
i
th the emerg
ence
of
netw
o
rks and Internet, the co
mp
uter securit
y
beca
m
e a
major cha
l
l
eng
e, and w
o
rks in this researc
h
a
x
is
are incre
a
si
ngl
y numero
u
s. Vario
u
s tools an
d mec
h
a
n
is
ms
are deve
l
op
ed
in order to gu
arante
e
a safe
ty
level
up t
o
th
e req
u
ire
m
ent
s of moder
n l
i
f
e. Amo
ng th
e
m
, intrus
io
n d
e
tection
an
d p
r
eventi
on syst
ems
(IDPS) inte
nd
ed to
loc
a
te
activities
or
a
bnor
mal
be
ha
viors sus
pect
to be
d
e
trime
n
tal to
the
co
rrect
oper
ation
of th
e syste
m
. The
purp
o
se
of thi
s
w
o
rk is
the
desi
gn an
d
the
real
i
z
a
t
i
on of an
IDPS ins
p
ir
e
d
from
natur
al imm
u
ne system
s. The st
udy
of biologic
al syst
em
s t
o
get insp
ired from them
for the resolution
of co
mp
uter s
c
ienc
e pr
obl
e
m
s
is a
n
ax
is
of the
artificia
l
intel
l
i
genc
e fi
eld w
h
ich
gav
e rise
to ro
bus
t an
d
effective metho
d
s by their n
a
tural functi
on, the i
m
mu
ne
sys
tems ar
ouse
d
the inter
e
st of researc
hers in t
h
e
intrusi
on d
e
tec
t
ion fiel
d, takin
g
into acc
ount
the
similar
i
tie
s
of natural i
m
mu
ne syste
m
(NIS) an
d IDPS
obj
ectives. Within th
e fra
m
ew
ork of this w
o
rk
, w
e
conceive
d
an IDPS i
n
spir
ed fro
m
n
a
tural
immune syst
e
m
and
i
m
p
l
e
m
e
n
ted
by us
ing
a
directe
d
a
ppr
o
a
ch. A
platfor
m
w
a
s
deve
l
o
ped
an
d tests
w
e
re carrie
d
o
u
t i
n
order to asses
s
our system
performanc
es.
Ke
y
w
ord:
intr
usion pr
evention system
, intr
usion detection system
, artif
i
cial imm
u
ne
system
, sec
u
rity
system
s
Copy
right
©
2016 In
stitu
t
e o
f
Ad
van
ced
En
g
i
n
eerin
g and
Scien
ce. All
rig
h
t
s reser
ve
d
.
1. Introduc
tion
Comp
uter att
a
cks
have b
een si
nce th
eir ap
pea
ran
c
e a
real th
reat. With the
i
r gre
a
t
diversity a
n
d
sp
ecifi
c
ity to sy
stem
s, these
can
h
a
ve catastro
phic con
s
eq
uen
ce
s. Vari
ous
measures to
prevent the
s
e atta
cks o
r
re
du
ce
thei
r seve
rity exist but there
is no
com
p
le
te
s
o
lution.
The IPS is o
ne of th
ese currently mo
st effe
ctive me
asu
r
e
s
. Th
eir ro
le is to recognize
intrusi
o
n
s
or
attempted intrusi
o
n
s
by abnormal
user behavior o
r
recognitio
n
of attack from the
netwo
rk data
stream.
Different
metho
d
s
a
nd
app
roa
c
he
s have b
een ado
pted for
the de
sig
n
of
IPS. Among these method
s, one is in
sp
ired by nat
u
r
e, espe
cially immune
syste
m
s [1-3], whi
c
h
have pro
p
e
r
ties an
d gre
a
t simila
rity to IPS.
The study o
f
the immune system is prom
i
s
ing
new a
r
ea of
rese
arch (artificial
intelligen
ce
), namely, artificial immun
e
syst
em
s (AIS) [13]. T
hese are a
c
tually modeli
ng,
impleme
n
tation an
d ad
apt
ation of con
c
epts a
nd m
e
thod
s of biol
o
g
ical im
mun
e
system
s to
solve
probl
em
s.
As pa
rt of o
u
r
work,
we
focu
s on
the
immune
sy
stems for det
ection
and i
n
trusi
on
preventio
n.
Our go
al i
s
t
o
devel
op
a
n
a
r
tificial
im
mune
sy
ste
m
for ou
r int
r
usi
o
n
preve
n
tion
system, impl
ementing th
e
main immun
e
theori
e
s.
T
o
evaluate p
e
rform
a
n
c
e,
we will
co
nd
uct a
seri
es of te
sts to
analyze t
he results i
n
orde
r
to
mea
s
ure the
cont
ribution
of im
mune
syste
m
s in
the intrusi
on
preventio
n [6, 7].
Intrusio
n pre
v
ention syst
ems a
nd i
mmune
syst
ems a
r
e ch
ara
c
teri
ze
d by their
hiera
r
chi
c
al
a
r
chite
c
tu
re
an
d their di
strib
u
ted o
peratio
n
on
a set of sub
s
ystem
s
. To
b
e
tter
m
o
del
these n
o
tion
s, we will ado
p
t
a method of desi
gning a
n
IPS.
2. Natural Immune S
y
ste
m
s (NIS)
2.1. NIS Properties
The NIS is a sou
r
ce of inspiration for
ne
w bra
n
c
he
s of IT.
With very importa
nt
prop
ertie
s
, it
become
s
a
valuabl
e reference. Se
vera
l re
sea
r
ch
wo
rks h
a
ve b
e
e
n
develo
ped
on
the basi
s
of it functionin
g
.
Evaluation Warning : The document was created with Spire.PDF for Python.
ISSN: 25
02-4
752
IJEECS
Vol.
2, No. 1, April 2016 : 168 –
179
169
2.1.1. Discri
m
ination Entre Self and Non-Self
The mo
st im
portant
pro
p
e
r
ty whi
c
h i
s
the ba
si
s of i
mmune
rea
c
ti
ons i
s
the
abi
lity of the
NIS to di
stin
guish b
e
twe
e
n
self
cells a
nd n
o
n
-
se
lf
cells
and
the
ability to recogni
ze th
e e
x
act
type of each foreig
n cell [6]
,
[7].
2.1.2. Learni
ng and Mem
o
r
y
In ea
ch
conta
c
t with
a n
e
w
kind
of antig
e
n
s,
the
NIS
categori
z
e
s
it
and
ke
eps it i
n
mind,
thanks to
cel
l
division
me
cha
n
ism
follo
wed
by
a sel
e
ction process
to refine a
nd
imp
r
ove
t
he
respon
se
of NIS in the n
e
xt conta
c
t with the
sam
e
antigen. T
h
is allo
ws th
e NIS to increase
efficien
cy for the recognitio
n
of antigen
s; th
is pro
c
e
ss i
s
call
ed affinity maturation [8].
2.1.3. Communication a
n
d Dissemina
t
ion
The diffe
rent
actors
of NIS
need
to ex
ch
ange
me
ssag
es unde
r
the
form
of sign
al
s.
Two
types of dial
ogue
s exi
s
t: one-way
si
gnal
s whic
h
tran
sit by immunol
ogi
ca
l comp
one
nts o
r
contin
uou
s di
alogu
es by a
n
excha
nge o
f
molecula
r si
gnal
s [9].
2.2. Immune
Theories
The beh
avior
and re
actio
n
s of the NIS are
prima
r
ily go
verned by im
mune theo
rie
s
.
2.2.1. Nega
tiv
e
/ Positiv
e
Selection Th
eor
y
This the
o
ry m
anag
es the
proce
s
s of crea
ting
cell
s. Sp
ecifically, this theory man
a
ges th
e
cre
a
tive pro
c
ess at the level of the discriminat
ion bet
wee
n
self an
d non-self. Lympho
cytes h
a
ve
recepto
r
s o
n
their surfa
c
e
s
lymphocyte
s
from t
he bo
ne marro
w
m
i
grate to the
thymus, at this
stage th
ey are call
ed imm
a
ture o
r
naïv
e
T cell
s.
The
i
r pa
ra-to
p
e
s
unde
rgo
a proce
s
s of p
s
e
udo-
rand
om ge
ne
tic rea
rra
nge
ment, after a very importan
t
test is introd
uce
d
[10].
2.2.2. Clonal Selection Th
eor
y
The recogniti
on of an a
n
tig
en by B cell
s,
t
hey prod
uce
spe
c
ific
antib
odie
s
. The a
n
t
ibod
y
asso
ciate
wit
h
the
antige
n
u
s
ing
re
ce
ptor the
n
u
s
i
ng
cell
s such a
s
T
aide
use
s
, B
cell
s of
stimulated
an
d a proliferati
on proc
ess al
lows B cell
s t
o
rep
r
od
uce
by cre
a
ting
cl
one
s them
sel
v
es
[11]. A seco
n
d
pro
c
e
s
s wil
l
sele
ct amo
ng tho
s
e ne
w cells
with
high affinity to make mem
o
ry
cell
s [
12]
.
3. Artificial Immune Sy
stems (AIS)
The AIS is
a new b
r
an
ch of artificial
intelligence. It
is desig
n
ed to solve variou
s
probl
em
s, inspired from re
markabl
e pro
pertie
s
an
d concepts of bi
ologi
ca
l imm
une sy
stem [13].
AIS are a mathematical or
comp
uter imp
l
ementat
ion o
f
the operatio
n of natural i
mmune
syste
m
.
3.1. Modeling AIS
The
comm
on
model
known by the
Fra
m
ewo
r
k of
AI
S, defines th
e rul
e
s to be
compli
ed
by AIS and th
e pro
c
e
ss fo
r developin
g
n
e
w ap
pr
o
a
ch
es. The n
e
ce
ssary conditio
n
s are [14]:
The re
pre
s
e
n
t
ation of system com
pon
e
n
ts.
Adapting
pro
c
ed
ure
s
to
m
onitor th
e evo
l
ution
of the
system. The th
ree
co
ndition
s me
ntione
d
above are im
perative for th
e developm
e
n
t
of a framework to defin
e AIS [8].
Then, th
e form of a
n
a
n
tibody a
s
a
set of l p
a
ram
e
ters.
The
s
e
pa
ramete
rs
may be
rep
r
e
s
ente
d
by a point in a spa
c
e of l d
i
mensi
o
n
s
.
A first note
s
tha
t
in this plan, those a
n
tibod
ies
are
clo
s
e
to e
a
ch
othe
r. Po
pulation
or re
pertoi
r
e
of N individual
s i
s
modele
d
a
s
a
sp
ace forms
a
finite volume
V contai
ning
N p
o
ints. An
antigen
is re
p
r
esented
by t
he p
o
int Ag
= <Ag1,
Ag2, .
..
.Agl>, an antibody is
also represented by a poi
nt
Ab =
<Ab1,
Ab2, ...,Abl>. To measure the
degree of co
mpletene
ss b
e
twee
n the a
n
tigen an
d the antibodi
es,
several tech
nique
s can b
e
use
d
. More of
ten the distan
ce
s are u
s
e
d
[15]:
Euclide
an di
stance D=
∑
Ab
A
g
Manhattan di
stan
ce
D=
∑|
Ab
A
g
|
Evaluation Warning : The document was created with Spire.PDF for Python.
IJEECS
ISSN:
2502-4
752
Intrusio
n Pre
v
entio
n Syste
m
Inspired Im
m
une System
s
(Y
ou
sef Farhaoui
)
170
Hammi
ng di
stance
D=
∑
δ
with
δ
i =
if
D
=
=
>
Affinit
y
So, we notice that the antigen-a
n
tibod
y affinity
is relative to the distan
ce in the sp
ace
betwe
en the
m
. Once the
antigen
s an
d
antibodie
s
a
r
e re
prese
n
te
d, the quant
itative function
of
the defined
Compl
e
tene
ss deg
ree b
e
twee
n them,
it remain
s onl
y to implement the immune
theorie
s.
3.2. Immune
Algorithms
3.2.1. Clonal Selection Al
gorithm
This theo
ry is base
d
on the
princi
ple that
only the cells having the a
n
tigen re
co
gn
ize the
antigen p
r
olif
erate an
d be
come m
e
mo
ry cells. The
clon
al sele
cti
on algo
rithm is ba
sed on t
h
e
following:
Holdi
ng a set of memory ce
lls.
Selection a
n
d
clonin
g
of the most stimul
ated antibo
d
i
e
s.
Re-sel
ectio
n
clon
es p
r
op
ortionally to the affinity with the antige
n
.
Removal of u
n
stimulate
d
a
n
tibodie
s
.
The maturation of their affinity [8].
Figure 1. Clo
nal sel
e
ctio
n algorith
m
3.2.2. Nega
tiv
e
Selection Algorithm
This con
c
ept
is very interesting, e
s
pe
ci
ally for systems mo
nitori
ng appli
c
atio
ns and
detectio
n
an
d preventio
n
of abnorm
a
l
or unu
sual
use
s
[14]. The pro
b
lem
of protectio
n
o
f
comp
uter
systems is th
e l
earni
ng p
r
obl
em of
distin
g
u
ishi
ng bet
ween
self an
d
non-self. Rather,
they comp
are the load
s d
e
tection p
r
o
b
l
e
m within
system
s to the pro
c
e
ss
of adverse sele
ction
take
s pla
c
e in
the thymus [16].
Begin
P
=
set o
f
shapes to
be recognized
M
=
Population
random
individuals
w
h
ile
(
A
minimal form is
not r
ecogn
ized
)
fo
r
i
de
1
à
ta
ill
e(P)
a
f
f =
a
ffi
ni
t
e
(P
i
, M
i
)
en
d
for
Se
le
ct
n
1
elements having
the best affi
n
i
t
y
wi
th
t
h
e e
l
em
ents
of
M
Generate
copies
of these elements in pr
oportion
to their
affinity
w
ith th
e
antig
en
Mutate all
copies proportionately
with
their
aff
i
nity
w
ith
the forms of th
e
assembly
P
Add mutated
ind
i
viduals
in
the p
opulation
M
Choose
n
2
of
the
s
e m
u
tated
e
l
em
ents (opt
im
ized)
as m
e
m
o
r
y
e
nd w
h
ile
End
1
i
f
A
b
i
≠
A
g
i
δ
i
=0
i
f
not
Evaluation Warning : The document was created with Spire.PDF for Python.
ISSN: 25
02-4
752
IJEECS
Vol.
2, No. 1, April 2016 : 168 –
179
171
Figure 2. The
method of ne
gative sele
cti
o
n
Here is a su
mmary of the negative sele
ction alg
o
rith
m.
Figure 3. Neg
a
tive sele
ctio
n algorith
m
3.3. Immune
Sy
stems Intr
usion De
te
c
t
ion and Prev
ention Sy
stems (IDPS)
3.3.1. Chara
c
teris
t
ics of
IDPS
It is importa
nt to re
call the
function
s o
r
v
e
ry
impo
rtant
fundame
n
tal
prop
ertie
s
th
at must
satisfy a
n
IDPS and
sho
u
l
d
be li
sted
[1, 2]. After that, we
will t
r
y to
see
what is of
fered i
n
p
a
rall
el
artificial immu
ne syste
m
s a
nd make t
he analo
g
y between All IDPS [3], [5], [18]:
- Robu
st: The
IDPS must h
a
ve different
points
of
dete
c
tion a
nd p
r
e
v
ention, and
sho
u
ld b
e
hig
h
ly
resi
st
ant
t
o
at
t
a
ck
s.
- Config
urabl
e: The IDPS must be ea
sil
y
confi
gurabl
e based on e
a
ch ma
chi
ne
on whi
c
h it wi
ll be
deploye
d
. The degree of d
epen
den
ce o
n
the
operatin
g system mu
st be minimi
zed.
- Expanda
bl
e: Adding n
e
w ho
sts i
n
all machi
n
e
s
mu
st be
monitored el
ementa
r
y an
d th
e
depe
nden
ce
on ope
rating
system
s shou
ld not
be an o
b
sta
c
le to this extension.
- Up
gra
dabl
e: It is nece
s
sa
ry that the IDPS can fa
ce an unexp
e
cte
d
increa
se in
the flow of da
ta
to be monitored due to an
extensio
n of
all the con
s
tituents’ h
o
st
s the IDPS.
- Adaptabl
e: The IDPS m
u
st dynami
c
a
lly adapt to
chang
es (ha
r
d
w
are
or soft
ware) within the
netwo
rk in q
u
e
stion.
- Effective: T
he IDPS
sh
o
u
ld b
e
simple
and
ea
sy
to
be d
eployed
i
n
orde
r to
avoid affe
cting t
he
host
s
and n
e
twork pe
rform
ance monito
ri
ng.
- Dist
ribute
d
: Special atta
cks
can b
e
det
ected a
nd
sto
pped after
an
alysis of different sign
als a
nd
alarm
s
fro
m
different ho
st
s [19]. The I
D
PS sh
ould
be able to
recove
r vario
u
s eve
n
ts from
different stati
ons o
n
the ne
twork, analyze t
hem and send re
sp
on
se
s to different
station
s
.
Begin
S
=
s
e
t
of
el
em
ents
of
the
s
e
lf.
D
=
A de
t
ector
arr
a
y
S
e
uilA
ff
=
aff
i
nity
thr
e
shold
wh
i
l
e
(i
<
nbDetecteurs
)
Generating a
d
i
d
e
te
ctor so
tha
t
it
has no a
ffini
t
y
with a
m
e
m
b
er S
if
(
a
ffini
t
y
(d
i
, S
i
) >
S
e
uilAff)
Then
cl
as
s
i
fied
S
i
as non-self
el
se
i
f
cl
as
s
i
fied
S
i
as
s
e
lf
e
nd if
e
nd w
h
ile
return
A s
e
t of
detectors D
en
d
Evaluation Warning : The document was created with Spire.PDF for Python.
IJEECS
ISSN:
2502-4
752
Intrusio
n Pre
v
entio
n Syste
m
Inspired Im
m
une System
s
(Y
ou
sef Farhaoui
)
172
In ord
e
r to
d
e
velop a
n
eff
e
ctive IDPS
we
will try to
find the
pro
pertie
s
m
entioned
above
i
n
an
artificial immu
ne syste
m
.
3.3.2. Proper
t
ies of
AIS for Detectio
n a
nd Intrusion
Prev
ention
The imm
une
system
is capabl
e of p
r
otecti
ng
the
human
bo
dy su
rface to
bacte
ria,
viruse
s o
r
a
n
y kind of a
n
tigen
s. This fundame
n
tal role is m
a
inly base
d
o
n
discrimi
nati
on
betwe
en
self
and n
o
n
-
self. This
discrimi
nation i
s
the
key p
r
o
c
e
s
s formin
g an
im
mune
re
spo
n
s
e.
Wheth
e
r
or
n
o
t kno
w
n
anti
gen
s, the n
a
tural
im
mune
system
ca
n b
e
co
mpa
r
ed t
o
an
anom
aly
detecto
r with
a very small
numbe
r of false p
o
sitive
s and fal
s
e n
egatives [4]. The thre
e m
o
st
importa
nt pro
pertie
s
of an IDPS were fo
und in
the im
mune sy
stem
s. The immu
ne syste
m
s a
r
e
[4], [20].
This
arti
cle ta
lks abo
ut the
negative
sele
ction
al
go
rith
m. The al
go
rithm proce
e
d
s
in two
pha
se
s. The
first is to
ge
n
e
rate
a set o
f
sen
s
o
r
s
an
d the
se
cond
is to u
s
e th
e
s
e d
e
tecto
r
s
to
monitor d
a
ta by making a
comp
ari
s
o
n
. The co
mpa
r
ison may be a comp
ari
s
o
n
of the number
of
c
o
mmon bits
[16], [21], [24]
.
3.3.3. Immun
e
Sy
stems and Immune Algorithms
Once we h
a
v
e found the
nece
s
sary p
r
ope
rtie
s for
our IDPS an
d the choi
ce
of using
immune
syst
ems ha
s be
en done. It is intere
sti
ng
to have a method for cre
a
ting algo
rith
ms
comp
osed of
AIS. A compari
s
o
n
of the
compo
nents of the
immune sy
stem
s and their
equivalent
s in
immune
algo
rithms, all
o
ws us to e
a
sily
desi
gn the
al
gorithm
s fo
rm
ing ou
r a
r
tifici
al
immune syst
em
com
pon
e
n
ts.
Table 1. Co
m
parin
g immun
e
system
s an
d immune al
g
o
rithm
s
I
m
mu
n
e
S
y
st
ems
Imm
une al
gori
t
hms
Antigen
Problem to besolved
Antibod
y Vectorbetter
solu
tions
Recognitionof an
tigens
Identif
y
i
ng the P
r
oblem
Productionof anti
bodies frommem
o
r
y
ce
lls Loadingpreviouslybes
tsolutions found
Removal ofT
c
ells
Elimination ofsurplussolutions
potential
Proliferationof an
tibodies
Use of aprocessf
or creatinge
xact
copiesof the solution
By following this process we can d
e
velo
p i
mmune al
g
o
rithm. This
compa
r
ison ap
plies to
the different
probl
em
s, we will be interested on
ly in the desi
gn
of an IDPS inspi
r
ed im
m
une
system
s. The
table sho
w
s a very adapte
d
comp
ari
s
o
n
:
Table 2. Co
m
parin
g immun
e
system
s an
d IDPS
Immune S
y
stem
s
IDPS
Th
y
m
us an
dbon
emarro
w
Primar
y
I
DPS(su
pervisor)
L
y
mphno
de
Local
Host
Antibod
y Detector
Antigen Intrusion
Self Normal
activity
Noself Abnormalactivity
(
suspicious)
Based
on thi
s
comp
ari
s
on
, they prop
osed AIS for d
e
tection
and
intrusi
on p
r
e
v
ention.
These AIS co
nsi
s
ts of a
pri
m
ary IDPS which
act
s
a
s
a
sup
e
rvi
s
or
a
nd a pl
urality of se
con
d
IDPS
will be in
stalled on ea
ch h
o
st in the net
work.Th
e
fun
c
tionin
g
of this IDPS model
is as follo
ws:
3.4.4. Gener
a
ting Dete
cti
ons
These two p
o
ints a
r
e
cru
c
ial in
creatin
g a
dete
c
to
r. Once the el
e
m
ents
co
nstit
u
ting the
detector were listed with the type
of each of them, the last step
will be to define the values of
each dete
c
to
r elem
ent as follows. If th
e item is
con
t
inuou
s type, it will be re
p
r
esented
by an
interval defin
ed by two te
rminal
s. On
ce the
eleme
n
t
s and thei
r resp
ective val
ues
have be
en
listed, the det
ector
will be represented by a data
structure containing t
hese el
em
ents [17], [23].
Evaluation Warning : The document was created with Spire.PDF for Python.
ISSN: 25
02-4
752
IJEECS
Vol.
2, No. 1, April 2016 : 168 –
179
173
3.4.5. Anom
aly
Detec
t
ion and De
tec
t
ion b
y
Scenario
We h
a
ve
se
en that for the be
haviora
l detec
tio
n
, it is favorable
to use the
negative
sele
ction the
o
ry. However for the se
co
nd app
roa
c
h
(dete
c
tion pe
r scena
rio
)
a
nd whi
c
h i
s
b
a
se
d
on a set of signatures, we
will use the
clon
al se
l
e
cti
on theory a
s
follows: In the app
roa
c
h
of
detectio
n
by scena
rio, we
hav
e a databa
se co
ntai
ning the se
t
of known at
tack
signatu
r
es.
Based on these
signatures we w
ill
generate detectors all
o
wing, af
ter packet analysis, to det
ect
the pre
s
en
ce
of certain
sig
nature
s
in order to
co
ncl
u
de that an intrusi
on or int
r
usio
n attempt has
occurre
d
. Th
e choi
ce of t
he clo
nal sel
e
cti
on the
o
ry
for scena
rio
approa
ch h
a
s be
en ma
de
becau
se in this pro
c
e
s
s, this theory is u
s
ed to
gen
erate and refin
e
antibody for the detectio
n
of
kno
w
n
antig
ens. We
co
uld comp
are
the clonal
sele
ction
the
o
ry,
antibo
d
i
e
s and antig
ens
detecto
rs kno
w
n to
attack
sign
ature
s
. S
o
to con
c
lud
e
this i
s
the
m
o
st fre
que
nt
use
of immu
ne
theorie
s fo
r th
e de
sign
of in
trusio
n d
e
tect
ion sy
stem
s:
NIDPS
with d
e
tection
by scenari
o
: The
o
ry
of clonal
sele
ction HI
DPS with beh
avioral
detectio
n
: Theo
ry of negative sele
cti
on.
4. Solution Descriptio
n
a
nd Global Ar
chitec
ture o
f
the IDPS Re
sults
We opte
d
for the de
sign
of a hybrid IDPS comp
ose
d
of an NIDPS ba
se
d on the
approa
ch of analysi
s
by scena
ri
o, implementin
g the theory of clonal selection and usi
n
g a
sign
ature
dat
aba
se a
nd
a
HIDPS b
a
se
d on
beh
avio
ral a
pproa
ch,
impleme
n
tin
g
the the
o
ry
o
f
negative sele
ction an
d u
s
i
ng a u
s
er
profile databa
se. Usin
g imm
une theo
rie
s
,
the core of
our
IDPS gene
ra
tes
some
varied
sig
natures of
attacks an
d u
s
e
r
profile
s in
a
pse
udo
ra
nd
om
manner. This methodology
allows
us to
develop the
analyzer to
possibly di
scov
er new attacks
or variants
of attac
k
s
.
Our IDPS is
compo
s
ed of:
- NI
DPS: gen
erating
se
nso
r
s
on the
ba
si
s of si
gnatu
r
e
s
.
The
s
e dete
c
tors will
be u
s
ed
to analy
z
e
network
traffic
.
- HI
DPS: Based
on p
r
ofil
es of n
o
rm
al
use
r
b
ehavi
o
r in
ord
e
r t
o
gen
erate
d
e
tectors
able
to
recogni
ze u
n
u
su
al beh
aviors of u
s
e
r
s.
- Admini
strati
on Con
s
ole:
From thi
s
console,
the admini
s
trato
r
can co
nfigu
r
e
the different
para
m
eters o
f
the IDPS, s
ee the differe
nt alerts, sta
r
t learnin
g
co
ntrol.
The
com
pon
ents
of ou
r
solution to
be
deploye
d
in t
h
is
way: Th
e
NIDPS
will b
e
in
stalled
on
the
machi
ne th
at is the
network p
r
oxy to an
alyze
all
net
work pa
ckets.
While,
HIDPS
be d
eploye
d
on
all mac
h
ines
that c
o
ns
titute the LAN.
Here the overall architectu
re of our solution:
Figure 4. Glo
bal Solution d
i
agra
m
Evaluation Warning : The document was created with Spire.PDF for Python.
IJEECS
ISSN:
2502-4
752
Intrusio
n Pre
v
entio
n Syste
m
Inspired Im
m
une System
s
(Y
ou
sef Farhaoui
)
174
5. Data
bas
e
s
Used
A large am
ou
nt of informati
on is a
nalyze
d
and g
ene
ra
ted by the variou
s compo
n
ents of
our I
D
PS; wh
ether
user
profiles, t
he
ale
r
ts by th
e vari
ous
dete
c
tors or a
list of
attack si
gnatu
r
e
s
.
The
use of
d
a
taba
se
s i
s
v
e
ry imp
o
rta
n
t in the
a
r
chitecture
of ou
r
IDPS; we
opt
ed fo
r the
u
s
e of
three data
b
a
s
es:
5.1. The Da
tabase "Pro
files"
This d
a
taba
se contai
ns
all information
about
u
s
e
r
p
r
ofiles. Th
e d
a
ta contai
ne
d in the
databa
se
a
r
e
gen
erated
b
y
the
HI
DPS
du
ring
the l
earni
ng
pha
se. For
se
curit
y
rea
s
o
n
s,
u
s
er
profile
s mu
st
pass th
rou
g
h
the HI
DPS supervi
so
r
to
ensure
compl
i
ance an
d
co
nsi
s
ten
c
y of the
data in the profile.
5.2. The Da
tabase "Sign
a
ture
s"
This
data
so
urce i
s
very i
m
porta
nt; it is t
he
ba
sis o
f
NIDPS. It inclu
d
e
s
all th
e known
attacks u
s
ing
a certain fo
rmat. The format of t
he signature is im
portant in
sofa
r as all dete
c
tors
adopt thi
s
fo
rmat. Unfo
rtu
nately, there
is n
o
st
and
ard mo
del fo
r t
he
codifi
catio
n
of
sign
atures.
The si
gnatu
r
e must represe
n
t a reli
able, una
mb
i
guou
s an
d
accurate attributes that
can
recogni
ze
the
attack. We must rem
e
m
ber
that
the
sign
ature
s
wi
ll be
used
to
analyze n
e
twork
traffic. The
a
ttributes
use
d
to re
prese
n
t an atta
ck
sho
u
ld b
e
ba
sed
on th
e i
n
formatio
n in
the
packet
s
.
We
ca
n
analyze net
wo
rk traffic to m
u
lt
iple
level
s
of
granul
arity. Indeed, we
can
con
s
id
er the
traffic of a pa
cket persp
ect
i
ve, se
ssion
s
or co
nne
ctio
ns. It is nece
s
sary to defi
n
e
the set of attributes to
be u
s
ed from the
set of ex
is
ting attributes
[22]. We
pr
o
p
o
s
e
in
th
is
pa
pe
r
a particula
r model of sig
n
a
ture
s. Our
signature
mod
e
l wa
s de
sig
ned to meet the req
u
ireme
n
ts
by an
attack sig
nature. T
he atta
ck si
g
nature
mu
st rep
r
e
s
ent un
ambigu
ou
sly the
attack a
n
d
sho
u
ld only
contain info
rm
ation that all
o
ws re
co
gni
zing the attack. In our
ca
se, the sign
ature
s
are
co
ded
so
as to be
mo
difiable a
nd
can mo
del th
e
ne
w attacks,
with n
e
w an
alytical meth
ods
... etc
.
The
analys
is
and
synthes
is
of v
a
rious
netwo
rk
attac
k
s
has allowed to
c
l
ass
i
fy these into
three cl
asse
s:
- Attacks 'd
ata': The
s
e
a
r
e
all
re
cog
n
ize
d
atta
cks
by
analyzi
ng th
e
data
po
rtion
of the
pa
cke
t,
su
ch
as SQL
injectio
n atta
cks.
The
s
e
will
be
re
cog
n
iz
e
d
if the foll
owi
ng
cha
nnel
s
('' -,
or
1
= 1
)
i
s
found in the p
a
cket.
- Attacks '
H
e
aders':
The
s
e are all
recogni
zed
a
ttacks by a
nalyzi
ng p
a
cket
he
aders,
su
ch
as
DOS attacks with sp
oofing
head
ers.
- Attacks 'Re
que
sts/qu
erie
s': Th
e requ
e
s
ts
gen
erally
incl
ude
seve
ral p
a
cka
g
e
s
. Some
attacks
will be re
cog
n
ize
d
by anal
yzing the set
of packets
th
at make up t
he req
u
e
s
t, such a
s
attacks of
input validati
on o
r
buffe
r
overflow atta
cks,
whic
h
cannot b
e
recogni
zed, that
the len
g
th o
r
the
numbe
r of pa
ramete
rs
whi
c
h con
s
titute the requ
est.
In the mo
deli
ng of
differe
nt cla
s
se
s of
existing
atta
cks, o
u
r Si
g
nature
contai
ns th
e follo
wing
fields:
Id: unique ide
n
tifier of the signature.
Type: heade
r, data, querie
s/Re
que
st.
Action: The Action Analysi
s
(eg
find a sub st
ring, co
u
n
t the number of attributes, length
of a query requested
servi
c
e ... etc.)
Data: In the case of attribut
es ki
nd of stri
ngs: the de
sired strin
g
.
Val: In the c
a
s
e
of attributes
to num
e
r
ic
values: the value of the attribute.
Flag: Addition
al informatio
n
The ide
n
tifier
serve
s
a
s
a
n
index in the
si
gnatures
data
base whil
e th
e type allows
to fin
d
the table th
at co
ntains the
sig
nature. T
he a
c
ti
on
defi
ned th
e p
r
o
c
essing t
o
be
use
d
, this i
s
t
h
e
most im
porta
nt field for a
sign
ature, it
contai
n
s
a key
w
ord
that sh
ows whi
c
h
m
e
thod kn
own
for
analyzi
ng dat
a. Variou
s act
i
ons h
a
ve be
en implem
ent
ed su
ch a
s
:
Substr: Se
arch fo
r a
sub
string, thi
s
ke
yw
ord
is
use
d
mu
ch m
o
re
on the
attacks
data
and qu
erie
s.
LenStr: Cal
c
u
l
ate the lengt
h of a string,
retrieves atta
cks
su
ch a
s
DOS attacks.
ValidStr: This sho
w
s
wheth
e
r the charact
e
r stri
ng
s do
not contai
n in
valid cha
r
a
c
ters.
The '
D
ata', if you look fo
r
a strin
g
(e
g T
he
SUBST
R action
) contai
ns the
strin
g
in whi
c
h
to sea
r
ch. Th
e 'Val', in ca
se the actio
n
return
s a n
u
m
e
ric val
ue
co
ntains th
e nu
meri
c value t
hat
I
d
t
y
p
e
Action
Data
Val
Flag
Evaluation Warning : The document was created with Spire.PDF for Python.
ISSN: 25
02-4
752
IJEECS
Vol.
2, No. 1, April 2016 : 168 –
179
175
can
say that this is a
n
atta
ck. Th
e 'Flag
'
is an
optio
na
l field servin
g
param
eters for the an
alytical
method. At th
is si
gnatu
r
e
model,
we
wil
l
assign
an
int
e
rp
reter to ru
n the a
c
tion
o
f
analyzin
g e
a
ch
sign
ature. At
any time if we wa
nt to increase t
he nu
mber
of sign
ature
s
by ad
ding ne
w, ju
st use
the previou
s
l
y
defined
mo
del, an
d if yo
u ne
ed n
e
w
analytical fu
n
c
tion
s, we ad
ded th
em to t
h
e
interp
reter.
5.3. The Da
tabase "
A
lerts"
This data
b
a
s
e will list all alerts g
ene
ra
ted
by the detectors of th
e two com
p
o
nents of
IDPS (NIDP
S
and HIDP
S). An alert sho
u
ld info
rm the admini
s
trato
r
about
suspi
c
io
us
event,
providin
g eno
ugh inform
ation: time, date, sen
s
or,
si
g
nature o
r
abn
ormal be
havi
o
r, the attacker,
the victim. T
h
is
database will
be
ac
cessed
by the
admini
s
trator to id
entify traces
of attacks or
anomal
ou
s b
ehavior.
6. HIDPS
w
i
t
h
Behav
i
oral Approa
ch
The first stag
e of deploym
ent HIDPS, i
s
un
dou
btedl
y the learni
n
g
step, d
u
rin
g
whi
c
h it
trace
s
ba
ck to norm
a
l use
r
behavio
r by
creatin
g a
profile for each. Use
r
pr
ofiles are a so
urce
of
data that
can
tell us
abo
ut the be
havior of users. We
cho
s
e
to u
s
e the follo
win
g
inform
ation
to
model a u
s
e
r
profile:
- Nam
e
of the user.
- Root di
re
cto
r
y.
- Average
co
nsum
ption CPU and RAM
- Openi
ng tim
e
/ closin
g se
ssi
on
s.
Other
i
n
form
ation could
have
b
een use
d
,
such
as th
e ave
r
age
co
nsum
ption of
band
width, m
o
st visited we
bsite
s
, the re
spo
n
se sp
ee
d to the operating system
messag
es.
6.1. Architec
ture HI
DPS
Our
HIDPS
will con
s
ist o
f
a HIDPS supervi
so
r
an
d a plu
r
ality of HIDPS sl
a
v
es to be
deploye
d
through
out the
netwo
rk com
pone
nts m
a
chi
nery. T
he t
heory
of ne
g
a
tive sel
e
ctio
n is
the HIDPS core. Thi
s
the
o
ry run
s
in two pha
se
s: ge
neratio
n of d
e
tectors a
nd
attack p
r
eve
n
tio
n
and b
ehavio
r analysi
s
. T
he first
pha
se run
s
o
n
th
e HIDPS
su
pervisor,
wh
o se
nd
s ala
r
ms
gene
rated at
HIDPS slav
es to execute the se
co
n
d
pha
se of the theory. T
h
is con
s
ist
s
of
analyzi
ng the
actual be
hav
ior of the use
r
on the basi
s
of sen
s
ors.
6.2. HIDPS Superv
isor
HIDPS the s
u
pervisor's
role is
to:
- Extract the use
r
s of the d
a
taba
se profiles.
-
Ge
ne
rate d
e
tectors and
sen
d
them
to HIDPS slav
e
s
by
run
n
ing
the first ph
ase
of the th
eory
of
negative
sele
ction th
ose
g
enerating
se
nso
r
s that
g
a
t
her all
the n
e
ce
ssary i
n
fo
rmation
for t
he
analysi
s
of user beh
avior in
the future.
- Analyze the
HIDPS of rep
o
rts
slav
es a
nd list alert
s
in a databa
se.
- Send comm
and
s to start the learning p
hases,
an
alysis, laun
ch an
d stoppi
ng HI
DPS slave
s
.
6.3. HIDPS Sla
v
es
The main role of HIDPS s
l
aves
role is
to:
- Gene
rate u
s
er profiles d
u
ring the learni
ng pha
se.
- Use event sensors to extract
the cu
rren
t behavior of the user.
- Run th
e
se
con
d
p
h
a
s
e
of the the
o
ry
of ne
gat
ive sele
ction, wh
ich
i
n
volves usin
g sen
s
o
r
s
gene
rated by
the first pha
se in orde
r to analyze the b
ehavior of the
user.
6.4. Theor
y
of the
Neg
a
ti
v
e
Selection
Our
HIDPS is base
d
on thi
s
theo
ry; it can gene
rate al
arm
s
from th
e use
r
profile, and set
up at the end
to recog
n
ize
suspicio
us b
ehavior.
As we have previo
usly se
en this theory ru
ns in
two pha
se
s:
Phase I: Gen
e
ration of det
ection
s
This
stage
ru
ns on th
e HI
DPS sup
e
rvi
s
or.
Duri
ng t
h
is ph
ase, we extract u
s
e
r
profile
s
from the database. Each profile
will be considered the
self
syst
em, and
will
be used for t
h
e
Evaluation Warning : The document was created with Spire.PDF for Python.
IJEECS
ISSN:
2502-4
752
Intrusio
n Pre
v
entio
n Syste
m
Inspired Im
m
une System
s
(Y
ou
sef Farhaoui
)
176
rand
om gen
e
r
ation of dete
c
tors. Then,
a test is
set u
p
to purge all
alarm
s
gene
rated by ke
ep
ing
only those
wh
o do not re
co
gnize the self
-ch
a
in.
Figure 5. Phase I of the negative sele
cti
on (ge
n
e
r
atio
n of detection
s)
Phas
e II: Analys
is
This
pha
se
run
s
o
n
HI
DPS slaves.
Duri
ng thi
s
pha
se, we o
perate
the d
e
tectors
gene
rated
by the pre
c
e
d
in
g pha
se to
condu
ct the
a
nalysi
s
of the
curre
n
t beha
vior of the user.
The
HIDPS
slave mu
st ha
ve se
nsors t
o
inform
him
abo
ut the
current b
ehavi
o
r
of the
use
r
. A
function will measure
the degree of
re
semblan
c
e
bet
wee
n
that
co
ndu
ct and
det
ectors
previo
usly
generated and an alert is generated if
it reaches a cert
ain percentage....’
Figure 6. Phase II of negative sele
ction (Analysis)
6.5. Opera
t
ion HIDPS
The HI
DPS are depl
oying
and sta
r
ting i
n
two pha
se
s:
- Lea
rnin
g ph
ase: Th
e HI
DPS supe
rviso
r
se
nd
s the
comman
d
fro
m
the begi
nni
ng of the
learni
ng p
h
a
s
e for
different HIDS
sl
aves.
Durin
g
the learnin
g
pha
se, th
e HIDPS
sl
ave
perio
dically retrieves user
behavio
r info
rmation.
Fo
r n
u
meri
c valu
e
s
, the HI
DPS
slave
cal
c
ulat
es
the avera
ge
of different value
s
extra
c
ted. T
he p
r
ofile gene
rated
by each
HIDPS slave will
then
be se
nt to HIDPS sup
e
rvisor, who i
s
in charg
e
of the list.
- Mo
nitori
ng
Phase:
Durin
g
this p
h
a
s
e,
the s
upe
rviso
r
HIDPS extract the
p
r
ofile
s of
ea
ch
use
r
, appli
e
s the first p
h
a
s
e of the
ne
gative sel
e
cti
on theo
ry to
gene
rate d
e
tectors.
Dete
ctors
will be sent to each
slave HIDPS with the
start com
m
and of the monitoring phase.
Evaluation Warning : The document was created with Spire.PDF for Python.
ISSN: 25
02-4
752
IJEECS
Vol.
2, No. 1, April 2016 : 168 –
179
177
Figure 7. Mode of operatio
n HIDPS
7. NIDPS
w
i
t
h
Scenario Approac
h
The
se
con
d
i
m
porta
nt co
mpone
nt is th
e NIDPS
usi
n
g analy
s
is wit
h
scen
ari
o
ap
proa
ch.
This app
ro
ach requi
re
s a
databa
se
of
known
atta
ck sign
ature
s
on
the b
a
si
s
of t
hese
sign
atures,
the core of NIDPS
gen
e
r
ates d
e
tecto
r
s, ca
n re
co
gnize the ori
g
inal sig
natu
r
e, but also
the
sign
ature
s
de
rived from th
e latter. The
NIDPS co
re
contai
ns m
a
inly the analysis fun
c
tion; i
t
is
based on th
e theory of clon
al sele
cti
on. The
function analysi
s
of our NIDPS contain
s
both
detecto
rs g
e
n
e
rating p
r
o
c
e
ss a
nd their i
n
trodu
ction to
the packet-fl
ow an
alysi
s
.
7.1. Architec
ture NI
DPS
a. Manage
r
This is th
e manag
er of the
solution. The
manage
r is resp
on
sible fo
r:
- Starting
the different co
m
pone
nts.
- Assi
gnin
g
di
fferent analysis tasks.
- Extractin
g
a
ttack
sig
natures a
nd
gen
erating dete
c
to
rs, p
e
rfo
r
min
g
clo
nal
sel
e
ction al
go
rith
m.
- Re
ceive rep
o
rts an
d list a
l
erts.
b. Senso
r
The
sen
s
o
r
i
s
respon
sible
for captu
r
in
g net
work p
a
ckets.
Different 'sen
sors'
can
be
deploye
d
in our
solution t
o
make this l
i
ghter
ta
sk. If one opts fo
r the deploym
ent of several
'sensors', you must define f
o
r ea
ch the subset of network traffi
c that will capture
(eg T
C
P, UDP
... etc
.
).
c. Analyze
r
The a
nalyzer is
actu
ally compa
r
abl
e to
an
antibody
whi
c
h
is ta
sked
to mo
nitor a
n
d
recogni
ze
certain types
of
antigen
s. In o
u
r
ca
se
, the
antigen i
n
q
u
e
stion i
s
th
e
attack si
gnat
ure
to recogni
ze.
So the anal
yzer
re
ceive
s
the si
g
natures of the '
M
anag
er'
and
puts in
place
to
recogni
ze
a
type of attack. We
opted
for the
joi
n
t use of 'A
n
a
lyzers Se
nsors'. Thi
s
u
s
e
guarantee
s a
lighter an
d au
tonomou
s sol
u
tion.
7.2. Opera
t
ion NIDPS
Our
ana
lysis
u
s
e
s
NIDPS
with
sce
nario
app
ro
ach, based o
n
t
he theo
ry of clonal
sele
ctio
n;
it uses a
s
a source of data
netwo
rk p
a
ckets
. He
re are the step
s for i
t
s impleme
n
tation:
Packet Ca
pture: Th
e first
st
ep of the
analysi
s
is
capturin
g
pa
ckets, throug
h
the 'se
n
sors'
that captu
r
e a
nd tran
smit n
e
twork pa
cke
t
s to 'analyzers' to co
ndu
ct analysi
s
.
At this level, you can
also save the
capt
ured
pa
ckets
in data st
ruct
ure
s
to analy
z
e them late
r if
the admini
s
trator ch
oo
se
s to defer analy
s
is.
Extraction an
d formatting
attributes: Thi
s
step al
l
o
ws you to extract a high leve
l of attribute
vector fro
m
the captu
r
ed p
a
c
kets to be a
nalyze
d
la
ter.
This ste
p
is very importa
nt; it helps to
prep
are the p
a
ckag
es for t
he analy
s
is p
hase by maki
ng som
e
ch
a
nge
s on them
.
Evaluation Warning : The document was created with Spire.PDF for Python.