Abstract—Nature has always been an inspiration to researcherswith its diversity and robustness of its systems, and ArtiﬁcialImmune Systems are one of them. Many algorithms were inspiredby ongoing discoveries of biological immune systems techniquesand approaches. One of the basic and most common approachis the Negative Selection Approach, which is simple and easy toimplement. It was applied in many ﬁelds, but mostly in anomalydetection for the similarity of its basic idea. In this paper, areview is given on the application of negative selection approachin network security, speciﬁcally the intrusion detection system.As the work in this ﬁeld is limited, we need to understand whatthe challenges of this approach are. Recommendations are givenby the end of the paper for future work. I. I NTRODUCTION Networks are more vulnerable by time to intrusions andattacks, from inside and outside. Cyber-attacks are makingnews headlines worldwide, as threats to networks are gettingbolder and more sophisticated. Reports of 2011 and 2012are showing an increase in network attacks, with Denial ofService (DoS) and targeted attacks having a big share in it.As reported by many web sites like [1] [2] [3], ﬁgures 1 and 2show motivations behind attacks and targeted customer typesrespectively.Internal threats and Advanced Persistent Threats (APT)are the biggest threats to a network, as they are carefullyconstructed and dangerous, due to internal users’ privilegesto access network resources. Figure 3 shows internal networksecurity concerns. With this in mind, and the increasing so-phistication of attacks, new approaches to protect the networkresources are always under investigation, and the one thatis concerned with inside and outside threats is the IntrusionDetection System.Intrusion detection systems [4] [5] [6] have been around forquite some time, as a successful security system. An IntrusionDetection System (IDS) is a system that deﬁnes and detectspossible threats within a computer or a network, by gatheringand analysing information from the surrounding environment.
In @cite_39 , a review of different AIS approaches to intrusion detection systems along with the implementations of different algorithms and their results were given. They discuss it from the point of view that most of the techniques followed to build an IDS are not able to cope with the dynamic and complex nature of computer systems security. In 2009, @cite_3 presented a literature review on the recent years work of malicious activity detection methods using AIS, and the available platforms and research projects in this area. In @cite_41 , they presented a review of CI core methods and their application in intrusion detection. The most applied CI approaches in intrusion detection are: Artificial Neural Networks (ANN) @cite_20 @cite_15 , Fuzzy sets @cite_11 @cite_5 , Evolutionary Computation (EC) @cite_40 , AIS, and Swarm Intelligence (SI) @cite_29 . In 2010, multiple studies were made @cite_30 @cite_37 @cite_4 giving a review on recent work and advances in AIS and their applications.
@cite_30 @cite_37 @cite_4 @cite_41 @cite_29 @cite_3 @cite_39 @cite_40 @cite_5 @cite_15 @cite_20 @cite_11
2139669429 2160502705 2100537916 32779056
Intrusion detection based upon computational intelligence is currently attracting considerable interest from the research community. Characteristics of computational intelligence (CI) systems, such as adaptation, fault tolerance, high computational speed and error resilience in the face of noisy information, fit the requirements of building a good intrusion detection model. Here we want to provide an overview of the research progress in applying CI methods to the problem of intrusion detection. The scope of this review will encompass core methods of CI, including artificial neural networks, fuzzy systems, evolutionary computation, artificial immune systems, swarm intelligence, and soft computing. The research contributions in each field are systematically summarized and compared, allowing us to clearly define existing research challenges, and to highlight promising new research directions. The findings of this review should provide useful insights into the current IDS literature and be a good source for anyone who is interested in the application of CI approaches to IDSs or related fields. Due to the dynamic, distributed, and heterogeneous nature of today's networks, intrusion detection systems (IDSs) have become a necessary addition to the security infrastructure and are widely deployed as a complementary line of defense to classical security approaches. In this paper, we address the intrusion detection problem in heterogeneous networks consisting of nodes with different noncorrelated security assets. In our study, two crucial questions are: What are the expected behaviors of rational attackers? What is the optimal strategy of the defenders (IDSs)? We answer the questions by formulating the network intrusion detection as a noncooperative game and performing an in-depth analysis on the Nash equilibrium and the engineering implications behind. Based on our game theoretical analysis, we derive the expected behaviors of rational attackers, the minimum monitor resource requirement, and the optimal strategy of the defenders. We then provide guidelines for IDS design and deployment. We also show how our game theoretical framework can be applied to configure the intrusion detection strategies in realistic scenarios via a case study. Finally, we evaluate the proposed game theoretical framework via simulations. The simulation results show both the correctness of the analytical results and the effectiveness of the proposed guidelines. Prevention of security breaches completely using the existing security technologies is unrealistic. As a result, intrusion detection is an important component in network security. However, many current intrusion detection systems (IDSs) are rule-based systems, which have limitations to detect novel intrusions. Moreover, encoding rules is time-consuming and highly depends on the knowledge of known intrusions. Therefore, we propose new systematic frameworks that apply a data mining algorithm called random forests in misuse, anomaly, and hybrid-network-based IDSs. In misuse detection, patterns of intrusions are built automatically by the random forests algorithm over training data. After that, intrusions are detected by matching network activities against the patterns. In anomaly detection, novel intrusions are detected by the outlier detection mechanism of the random forests algorithm. After building the patterns of network services by the random forests algorithm, outliers related to the patterns are determined by the outlier detection algorithm. The hybrid detection system improves the detection performance by combining the advantages of the misuse and anomaly detection. We evaluate our approaches over the knowledge discovery and data mining 1999 (KDDpsila99) dataset. The experimental results demonstrate that the performance provided by the proposed misuse approach is better than the best KDDpsila99 result; compared to other reported unsupervised anomaly detection approaches, our anomaly detection approach achieves higher detection rate when the false positive rate is low; and the presented hybrid system can improve the overall performance of the aforementioned IDSs. The timely and accurate detection of computer and network system intrusions has always been an elusive goal for system administrators and information security researchers. Existing intrusion detection approaches require either manual coding of new attacks in expert systems or the complete retraining of a neural network to improve analysis or learn new attacks. This paper presents a new approach to applying adaptive neural networks to intrusion detection that is capable of autonomously learning new attacks rapidly through the use of a modified reinforcement learning method that uses feedback from the protected system. The approach has been demonstrated to be extremely effective in learning new attacks, detecting previously learned attacks in a network data stream, and in autonomously improving its analysis over time using feedback from the protected system.