A Cooperative AIS Framework for Intrusion Detection

Bye

2009 IEEE International Conference on Communications

et al. 2009

Self Cite

196

104

Abstract-Smartphones are getting increasingly popular and several malwares appeared targeting these devices. General countermeasures to smartphone malwares are currently limited to signature-based antivirus scanners which efficiently detect known malwares, but they have serious shortcomings with new and unknown malwares creating a window of opportunity for attackers. As smartphones become host for sensitive data and applications, extended malware detection mechanisms are necessary complying with the resource constraints.The contribution of this paper is twofold. First, we perform static analysis on the executables to extract their function calls in Android environment using the command readelf. Function call lists are compared with malware executables for classifying them with PART, Prism and Nearest Neighbor Algorithms. Second, we present a collaborative malware detection approach to extend these results. Corresponding simulation results are presented.

Section: Resultsmentioning

confidence: 99%

Static Analysis of Executables for Collaborative Malware Detection on Android

Bye

2009 IEEE International Conference on Communications

et al. 2009

Self Cite

196

104

Communications in Computer and Information Science

“…Collaborative or cooperative IDPS is a hot topic that had been discussed previously in several researches [2,5,6,10]. However, those studies targeted distributive environments in general and did not consider cloud computing requirements and challenges.…”

Section: Study Backgroundmentioning

confidence: 98%

“…The Intrusion Detection Message Exchange Format (IDMEF) has been proposed as a standard to enable interoperability among different IDS approaches [4]. Collaborative or cooperative IDS had been a hot topic for the last few years [5,6]. However, few only consider cooperative IDS in cloud based infrastructures [3,4,7].…”

Section: Introductionmentioning

confidence: 99%

cl-CIDPS: A Cloud Computing Based Cooperative Intrusion Detection and Prevention System Framework

Al-Mousa

Nasir

2015

Abstract. Cloud Computing is one of today's most promising technologies due to its cost-efficiency, flexibility and scalability for computing processes. However, the complex architecture of cloud infrastructure and the different levels of users lead to special requirements especially in security area. The Cloud provider is responsible for providing secure, reliable and trustful services to its consumers. Network intrusion detection system and network intrusion prevention system (IDPS), is a pioneer active security-defensive mechanism that is ideal to be used in cloud computing. Collaborative or cooperative IDS had been a hot topic for the last few years. However, there were some limitations in previous techniques indicating that they are not sufficient to cover all security threats in clouds. The main objective is to propose a cloud based cooperative intrusion detection and prevention system (cl-CIDPS). The system adds several contributions to the area of IDPS in clouds by proposing an integrated design that considers detection, prevention and logging capabilities applying both signature and anomaly detection mechanisms. cl-CIDPS was evaluated using a powerful network security simulator tool (Nessi2) that is capable of testing detection units and communication schemas. NeSSi2 was extended for a cloudbased IDPS presenting a valuable simulation background that can be used by future researches to evaluate similar proposed techniques for cloud computing infrastructure.

“…A cooperative intrusion detection approach inspired by biological immune system and P2P communication techniques has been developed for distributed anomaly detection by Luther et al (2007). Dynamic collaboration between individual AIS agents is used to address the well-known false positive problem in anomaly detection.…”

Section: Security Mechanisms Providedmentioning

confidence: 99%

Intelligent agent based artificial immune system for computer security—a review

Ramakrishnan¹,

Srinivasan²

2009

Artif Intell Rev

Since its introduction in the 1990s the internet has proliferated in the life of human kind in many numbers of ways. The two by-products of the internet are intelligent agents and intrusions which are far away from each other in the intention of their creation while similar in their characteristics. With automated code roaming the network intruding the users on one side as worms, viruses, and Trojans and autonomous agents tending to help the users on the other side, the internet has given great research challenges to the computer scientists. The greatest challenge of the internet is intrusion, which has increased and never decreased. There are various security systems for the internet. As the Human Immune System protects human body from external attacks, these security systems tend to protect the internet from intruders. Thus the internet security systems are comparable with human immune systems in which autonomous cells move throughout the body to protect it while learning to tackle new threats and keeping them in their memory for the future. These properties are comparable with that of autonomous agents in the internet. Thus intelligent agent technology combined with ideas from human immune system is a great area of research which is still in its developing phase. In this paper, state of the art of security systems which use both these technologies of intelligent agents and artificial immune system i.e., Agent Based Artificial Immune System (ABAIS) for security are reviewed, paying special attention to features of human immune system used in the system, the role of the agents in the ABAIS and the security mechanisms provided against intrusions.