Artificial Immune System

Description

This book deals with malware detection in terms of Artificial Immune System (AIS), and presents a number of AIS models and immune-based feature extraction approaches as well as their applications in computer security

Covers all of the current achievements in computer security based on immune principles, which were obtained by the Computational Intelligence Laboratory of Peking University, China
Includes state-of-the-art information on designing and developing artificial immune systems (AIS) and AIS-based solutions to computer security issues
Presents new concepts such as immune danger theory, immune concentration, and class-wise information gain (CIG)

Artificial Immune System: Applications in Computer Security 2
- Contents 10
- List of Figures 16
- List of Tables 20
- Preface 22
- Acknowledgments 28
- About the Author 30
- Chapter 1: Artificial Immune System 32
  - 1.1 Introduction 32
  - 1.2 Biological Immune System 33
    - 1.2.1 Overview 33
    - 1.2.2 Adaptive Immune Process 33
  - 1.3 Characteristics of a Biological Immune System 35
  - 1.4 Artificial Immune System 36

Artificial Immune System: Applications in Computer Security 2
- Contents 10
- List of Figures 16
- List of Tables 20
- Preface 22
- Acknowledgments 28
- About the Author 30
- Chapter 1: Artificial Immune System 32
  - 1.1 Introduction 32
  - 1.2 Biological Immune System 33
    - 1.2.1 Overview 33
    - 1.2.2 Adaptive Immune Process 33
  - 1.3 Characteristics of a Biological Immune System 35
  - 1.4 Artificial Immune System 36
  - 1.5 Artificial Immune System Models and Algorithms 38
    - 1.5.1 Negative Selection Algorithm 38
    - 1.5.2 Clonal Selection Algorithm 40
    - 1.5.4 Danger Theory 42
    - 1.5.3 Immune Network Model 42
    - 1.5.5 Immune Concentration 43
    - 1.5.6 Other Methods 45
  - 1.6 Characteristics of the Artificial Immune System 45
    - 1.6.2 Detection of Abnormality 46
    - 1.6.5 Incomplete Detection 46
    - 1.6.3 Learning and Memory 46
    - 1.6.1 Distributed Detection 46
    - 1.6.4 Diversity 46
  - 1.7 Applications of Artificial Immune System 47
    - 1.7.1 Virus Detection 47
    - 1.7.2 Spam Filtering 47
      - 1.7.2.1 Concentration-Based Feature Representation 48
      - 1.7.2.2 Danger Theory Inspired Ensemble Method 49
      - 1.7.2.3 Immune-Based Dynamic Updating Strategies 50
    - 1.7.3 Robots 51
    - 1.7.6 Optimized Design 52
    - 1.7.4 Control Engineering 52
    - 1.7.7 Data Analysis 52
    - 1.7.5 Fault Diagnosis 52
  - References 53
  - 1.8 Summary 53
- Chapter 2: Malware Detection 57
  - 2.1 Introduction 57
  - 2.2 Malware 58
    - 2.2.1 Definition and Features 58
    - 2.2.2 The Development Phases of Malware 59
  - 2.3 Classic Malware Detection Approaches 60
    - 2.3.2 Dynamic Techniques 61
    - 2.3.1 Static Techniques 61
    - 2.3.3 Heuristics 62
  - 2.4 Immune-Based Malware Detection Approaches 63
    - 2.4.1 An Overview of Artificial Immune System 63
      - 2.4.1.1 Artificial Immune System 63
      - 2.4.1.2 Motivations of Applying Immune Mechanisms to Malware Detection 64
    - 2.4.2 An Overview of Artificial Immune System for Malware Detection 65
    - 2.4.3 An Immune-Based Virus Detection System Using Affinity Vectors 66
      - 2.4.3.1 Overview 66
      - 2.4.3.2 Experiments and Analysis 66
    - 2.4.4 A Hierarchical Artificial Immune Model for Virus Detection 67
      - 2.4.4.1 Overview 67
      - 2.4.4.2 Experiments and Analysis 68
    - 2.4.5 A Malware Detection Model Based on a Negative Selection Algorithm with a Penalty Factor 69
      - 2.4.5.1 Overview 69
      - 2.4.5.2 Experiments and Analysis 71
    - 2.5 Summary 73
    - References 73
  - Chapter 3: Immune Principle and Neural Networks-Based Malware Detection 77
    - 3.1 Introduction 77
    - 3.3 Experimental Dataset 78
    - 3.2 Immune System for Malicious Executable Detection 78
      - 3.2.1 Nonself Detection Principles 78
      - 3.2.2 Anomaly Detection Based on Thickness 78
      - 3.2.3 Relationship Between Diversity of Detector Representation and Anomaly Detection Hole 78
    - 3.4 Malware Detection Algorithm 79
      - 3.4.2 Detection Principle and Algorithm 79
      - 3.4.1 Definition of Data Structures 79
      - 3.4.3 Generation of Detector Set 80
        
        3.4.3.1 Detector Code 80
        
        3.4.3.2 Generation of Detector Set 80
      - 3.4.4 Extraction of Anomaly Characteristics 80
        
        3.4.4.1 Nonself Detection 80
        
        3.4.4.2 Extraction of Anomaly Property Vector 81
      - 3.4.5 Classifier 82
    - 3.5 Experiment 82
      - 3.5.1 Experimental Procedure 82
        
        3.5.1.1 Partitioning Dataset 82
        
        3.5.1.2 Generating Detector Set 82
      - 3.5.2 Experimental Results 82
        
        3.5.2.1 When to Use a Single Detector Set 82
        
        3.5.2.2 When to Use Multi-Datasets and BP Network Classifier 83
      - 3.5.3 Comparison With Matthew G. Schultz's Method 84
        
        3.5.3.1 Comparison of Datasets 84
        
        3.5.3.2 Comparison of Algorithmic Performance 84
      - 3.6 Summary 86
      - References 86
    - Chapter 4: Multiple-Point Bit Mutation Method of Detector Generation 88
      - 4.1 Introduction 88
      - 4.2 Current Detector Generating Algorithms 89
      - 4.3 Growth Algorithms 89
      - 4.4 Multiple-Point Bit Mutation Method 90
      - 4.5 Experiments 91
        
        4.5.1 Experiments on Random Dataset 91
        
        4.5.1.1 8-Bit Dataset 91
        
        4.5.1.2 16-Bit and 24-Bit Datasets 93
        
        4.5.2 Change Detection of Static Files 93
      - 4.6 Summary 94
      - References 95
    - Chapter 5: Malware Detection System Using Affinity Vectors 96
      - 5.1 Introduction 96
      - 5.2 Malware Detection Using Affinity Vectors 97
        
        5.2.3 Clonal Selection 97
        
        5.2.1 Sliding Window 97
        
        5.2.2 Negative Selection 97
        
        5.2.4 Distances 98
        
        5.2.4.2 Shift r-Continuous Bit Distance 99
        
        5.2.4.1 Hamming-Max Distance 99
        
        5.2.5 Affinity Vector 99
        
        5.2.6 Training Classifiers with Affinity Vectors 100
      - 5.3 Evaluation of Affinity Vectors-Based Malware Detection System 101
        
        5.3.2 Length of Data Fragment 101
        
        5.3.1 Dataset 101
        
        5.3.3 Experimental Results 102
      - References 104
      - 5.4 Summary 104
    - Chapter 6: Hierarchical Artificial Immune Model 106
      - 6.1 Introduction 106
      - 6.2 Architecture of Haim 107
      - 6.3 Virus Gene Library Generating Module 107
        
        6.3.1 Virus ODN Library 108
        
        6.3.2 Candidate Virus Gene Library 109
        
        6.3.3 Detecting the Virus Gene Library 109
      - 6.4 Self-Nonself Classification Module 110
        
        6.4.1 Matching Degree Between Two Genes 110
        
        6.4.2 Suspicious Program Detection 111
      - 6.5 Simulation Results of Hierarchical Artificial Immune Model 112
        
        6.5.2 Description of Experiments 112
        
        6.5.2.1 Experiments of Class 1 112
        
        6.5.2.3 Experiments of Class 3 113
        
        6.5.2.2 Experiments of Class 2 113
        
        6.5.2.4 Experiments of Class 4 115
        
        6.5.1 Dataset 112
        
        6.6 Summary 115
        
        References 116
      - Chapter 7: Negative Selection Algorithm with Penalty Factor 117
        
        7.1 Introduction 117
        
        7.2 Framework of Nsapf 118
        
        7.3 Malware Signature Extraction Module 119
        
        7.3.1 Malware Instruction Library (MIL) 119
        
        7.3.3 NSAPF and Malware Detection Signature Library 121
        
        7.3.2 Malware Candidate Signature Library 121
        
        7.4 Suspicious Program Detection Module 122
        
        7.4.1 Signature Matching 122
        
        7.4.2 Matching Between Suspicious Programs and the MDSL 123
        
        7.4.3 Analysis of Penalty Factor 123
        
        7.5 Experiments and Analysis 124
        
        7.5.1 Experimental Datasets 124
        
        7.5.1.2 CILPKU08 Dataset 124
        
        7.5.1.1 Henchiri Dataset 124
        
        7.5.1.3 VX Heavens Dataset 125
        
        7.5.2 Experiments on the Henchiri Dataset 125
        
        7.5.2.1 Cross Validation 125
        
        7.5.2.2 Negative Direction Cross Validation 127
        
        7.5.3 Experiments on CILPKU08 Dataset 128
        
        7.5.4 Experiments on VX Heavens Dataset 129
        
        7.5.5 Parameter Analysis 129
        
        7.6 Summary 131
        
        References 131
      - Chapter 8: Danger Feature-Based Negative Selection Algorithm 132
        
        8.1 Introduction 132
        
        8.1.1 Danger Feature 132
        
        8.1.2 Framework of Danger Feature-Based Negative Selection Algorithm 133
        
        8.2 DFNSA for Malware Detection 134
        
        8.2.1 Danger Feature Extraction 134
        
        8.2.1.1 Malware Instruction Library 134
        
        8.2.1.2 NCDFL and SCDFL 135
        
        8.2.1.3 Detecting Feature Library 135
        
        8.2.2 Danger Feature Vector 135
        
        8.3 Experiments 136
        
        8.3.2 Experimental Setup 136
        
        8.3.1 Datasets 136
        
        8.3.3 Selection of Parameters 137
        
        8.3.4 Experimental Results 138
        
        8.4 Discussions 138
        
        8.4.1 Comparison of Detecting Feature Libraries 138
        
        8.4.2 Comparison of Detection Time 139
        
        8.5 Summary 139
        
        References 139
      - Chapter 9: Immune Concentration-Based Malware Detection Approaches 141
        
        9.1 Introduction 141
        
        9.2 Generation of Detector Libraries 142
        
        9.3 Construction of Feature Vector for Local Concentration 145
        
        9.4 Parameters Optimization Based on Particle Swarm Optimization 147
        
        9.5 Construction of Feature Vector for Hybrid Concentration 148
        
        9.5.1 Hybrid Concentration 148
        
        9.5.3 HC-Based Malware Detection Method 150
        
        9.5.2 Strategies for Definition of Local Areas 150
        
        9.5.4 Discussion 151
        
        9.5.4.1 Advantages of the HC 151
        
        9.5.4.2 Advantages of the HCMD Method 152
        
        9.5.4.3 Time Complexity 153
        
        9.6 Experiments 153
        
        9.6.1 Experiments of Local Concentration 153
        
        9.6.1.1 Experiments for Different Window Size and Number of Windows 153
        
        9.6.1.2 Experiments for Different Proportional Selection of All the Fragments 154
        
        9.6.1.4 Contrast Experiments 156
        
        9.6.1.3 Length of the Detector 156
        
        9.6.1.5 Parameters Optimization Based on PSO 159
        
        9.6.2 Experiments of Hybrid Concentration 160
        
        9.6.2.1 Experimental Datasets 160
        
        9.6.2.2 Experimental Setup 161
        
        9.6.2.3 Selection of Parameters 162
        
        9.6.2.4 Experimental Results 163
        
        References 166
        
        9.7 Summary 166
        
        Chapter 10: Immune Cooperation Mechanism-Based Learning Framework 167
        
        10.1 Introduction 167
        
        10.2 Immune Signal Cooperation Mechanism-Based Learning Framework 170
        
        10.3 Malware Detection Model 173
        
        10.4 Experiments Using the Malware Detection Model 174
        
        10.4.1 Experimental Setup 174
        
        10.4.2 Selection of Parameters 175
        
        10.4.3 Experimental Results 176
        
        10.4.4 Statistical Analysis 177
        
        10.5 Discussion 178
        
        10.5.1 Advantages 178
        
        10.5.2 Time Complexity 179
        
        References 180
        
        10.6 Summary 180
        
        Chapter 11: Class-Wise Information Gain 181
        
        11.1 Introduction 181
        
        11.2 Problem Statement 182
        
        11.2.1 Definition of the Generalized Class 182
        
        11.2.2 Malware Recognition Problem 183
        
        11.3 Class-Wise Information Gain 184
        
        11.3.1 Definition 184
        
        11.3.2 Analysis 185
        
        11.4 Cig-Based Malware Detection Method 189
        
        11.4.1 Feature Selection Module 189
        
        11.4.2 Classification Module 191
        
        11.5 Dataset 191
        
        11.5.1 Benign Program Dataset 191
        
        11.5.2 Malware Dataset 192
        
        11.5.2.2 Henchiri Dataset 192
        
        11.5.2.3 CILPKU08 Dataset 192
        
        11.5.2.1 VXHeavens Dataset 192
        
        11.6 Selection of Parameters 193
        
        11.6.1 Experimental Setup 193
        
        11.6.2 Experiments of Selection of Parameter 194
        
        11.7 Experimental Results 196
        
        11.7.1 Experiments on the VXHeavens Dataset 196
        
        11.7.2 Experiments on the Henchiri Dataset 198
        
        11.7.3 Experiments on the CILPKU08 Dataset 199
        
        11.8 Discussion 199
        
        11.8.1 The Relationship Among IG-A, DFCIG-B, and DFCIG-M 200
        
        11.8.2 Space Complexity 201
        
        11.9 Summary 202
        
        References 203
        
        Index 204
        
        End User License Agreement 206

Applications in Computer Security

Description

TOC

Reviews (0)