Immune System Based Intrusion Detection System (IS-IDS): A Proposed Model

IEEE Access

Indra Kanta Maitra¹  Samarjeet Borah²  Inadyuti Dutt² 

[1] Controller of Examinations Department, St. Xavier&x2019;Department of Computer Applications, Sikkim Manipal Institute of Technology, Sikkim Manipal University, Majhitar, India;

关键词: Computer networks;    computer security;    intrusion detection;    immune system;    anomaly detection;    network;   

DOI  :  10.1109/ACCESS.2020.2973608

来源: DOAJ

【 摘 要 】

This paper explores the immunological model and implements it in the domain of intrusion detection on computer networks. The main objective of the paper is to monitor, log the network traffic and apply detection algorithms for detecting intrusions within the network. The proposed model mimics the natural Immune System (IS) by considering both of its layers, innate immune system and adaptive immune system respectively. The current work proposes Statistical Modeling based Anomaly Detection (SMAD) as the first layer of Intrusion Detection System (IDS). It works as the Innate Immune System (IIS) interface and captures the initial traffic of a network to find out the first-hand vulnerability. The second layer, Adaptive Immune-based Anomaly Detection (AIAD) has been considered for determining the features of the suspicious network packets for detection of anomaly. It imitates the adaptive immune system by taking into consideration the activation of the T-cells and the B-cells. It captures relevant features from header and payload portions for effective detection of intrusion. Experiments have been conducted on both the real-time network traffic and the standard datasets KDD99 and UNSW-NB15 for intrusion detection. The SMAD model yields as high as 96.04% true positive rate and around 97% true positive rate using real-time traffic and standard data sets. Highly suspicious traffic detected in the SMAD model is further tested for vulnerability in the AIAD model. Results show significant true positive rate, closer to almost 99% of accurately detecting the file-based and user-based anomalies for both the real-time traffic and standard data sets.

【 授权许可】

Unknown