A Review of Artificial Immune System Based Security Frameworks for MANET <s> 4) Recovery Process <s> In mobile ad hoc networks, nodes act both as terminals and information relays, and they participate in a common routing protocol, such as dynamic source routing (DSR). The network is vulnerable to routing misbehavior, due to faulty or malicious nodes. Misbehavior detection systems aim at removing this vulnerability. In this paper, we investigate the use of an artificial immune system (AIS) to detect node misbehavior in a mobile ad hoc network using DSR. The system is inspired by the natural immune system (IS) of vertebrates. Our goal is to build a system that, like its natural counterpart, automatically learns, and detects new misbehavior. We describe our solution for the classification task of the AIS; it employs negative selection and clonal selection, the algorithms for learning and adaptation used by the natural IS. We define how we map the natural IS concepts such as self, antigen, and antibody to a mobile ad hoc network and give the resulting algorithm for classifying nodes as misbehaving. We implemented the system in the network simulator Glomosim; we present detection results and discuss how the system parameters affect the performance of primary and secondary response. Further steps will extend the design by using an analogy to the innate system, danger signal, and memory cells. <s> BIB001 </s> A Review of Artificial Immune System Based Security Frameworks for MANET <s> 4) Recovery Process <s> Words mean different things to different people, and so are uncertain. We, therefore, need a fuzzy set model for a word that has the potential to capture their uncertainties. In this paper I propose that an interval type-2 fuzzy set (IT2 FS) be used as a FS model of a word, because it is characterized by its footprint of uncertainty (FOU), and therefore has the potential to capture word uncertainties. Two approaches are presented for collecting data about a word from a group of subjects and then mapping that data into a FOU for that word. The person MF approach, in which each person provides their FOU for a word, is limited to fuzzy set experts because it requires the subject to be knowledgeable about fuzzy sets. The interval end-points approach, in which each person provides the end-points for an interval that they associate with a word on a prescribed scale is not limited to fuzzy set experts. Both approaches map data collected from subjects into a parsimonious parametric model of a FOU, and illustrate the combining of fuzzy sets and statistics-type-2 fuzzistics. <s> BIB002 </s> A Review of Artificial Immune System Based Security Frameworks for MANET <s> 4) Recovery Process <s> Last decade has witnessed an enormous growth in wireless networks that naturally has brought some new research challenges. Related studies conducted have covered several research areas like routing protocols, encrypted authentication protocols, misbehavior detection system and a number of innovative solutions, biologically-inspired and not, have been suggested to several open problems. In this position paper, we present a biologically-inspired type-2 fuzzy set recognition algorithm for detecting misbehaving nodes in an ad-hoc wireless network. This work investigates the possibility of detecting misbehaving nodes, learning bad behaviors, protecting the network from reinfection and mitigating the problem of routing misbehavior without human intervention, exploiting biological techniques evolved over millions of years. In order to protect the system of unwanted behaviors and take under control the number of false positive, our solution mimics the binding process between lymphocytes receptors of the immune cells and antigens. <s> BIB003 </s> A Review of Artificial Immune System Based Security Frameworks for MANET <s> 4) Recovery Process <s> A malicious node in mobile ad hoc networks (MANETs) can falsify a route advertisement, overwhelming traffic without forwarding it, helps in forwarding corrupted data, and injecting of false or uncompleted information. Mapping immune system security mechanisms to networking security can powerfully contribute in securing MANETs, since both are sharing some similar features because of the distributability environment in each. In a step for providing secured and reliable broadband services, formal specification logic along with a novel Immune-inspired security framework (I2MANETs) have been introduced. The different immune components synchronized to the framework through an agent that has the ability to replicate, monitor, detect, classify, and block/isolate the corrupted packets and/or nodes in a federated domain. The framework functions as the Human Immune System in: first response, second response, adaptability, distributability, survivability and other immune features. The I2MANETs can basically installed in one node in the domain, then automatically spread to the rest of the domain. <s> BIB004 </s> A Review of Artificial Immune System Based Security Frameworks for MANET <s> 4) Recovery Process <s> In this paper, a security architecture is designed based on the artificial immune system by using multi-agents in mobile ad hoc networks. There are two types of immunity-based agents: one is detection agent and the other is counterattack agent. Detection agents take charge of monitoring the nodes in the network, detecting the anomaly activities, and taking response to the invader, which may be viewed as T-cell lymphocyte. Counterattack agent as antibody, is built in each regular node which is regarded as B-cell. When Detection agents find invaders, they send out instructions to activate the counterattack agents in the neighbor nodes of the invaders. These Counterattack agents will surround the invaders and finally kill them. Lastly, the paper discusses how the security architecture works and protects the MANET from violating infliction by bringing forward an example. <s> BIB005 </s> A Review of Artificial Immune System Based Security Frameworks for MANET <s> 4) Recovery Process <s> This paper presents a new approach to secure Mobile ad hoc networks (MAN Ts) based on the paradigm of Artificial Immune System (HIS). An intrusion detection system with response (IDS) that simulates a considerable number of immune system features. A considerable amount of immune properties have been mapped to ad hoc networks seeking for comprehensive security system. Negative selection, clonal selection, danger theory, immune network concept are the main paradigms that have been considered in our system. Anomaly detection, first and second response, learning capability, decentralized and reliable detection system are the features that e pected to contribute more to ad hoc network security. <s> BIB006 </s> A Review of Artificial Immune System Based Security Frameworks for MANET <s> 4) Recovery Process <s> Application of Artificial Immune System (AIS) evolves as a key Artificial Intelligence concept for detecting misbehavior, ensuring security, detecting faults and performing data mining in Mobile ad hoc Networks (MANETs). Recognition of misbehaving nodes is a must for proper functioning of a MANET. AIS approach has a unique feature of learning which is absent in other techniques (e.g. reputation system). Danger Signal and Clonal Selection are the key techniques of AIS for misbehavior detection. Different types of misbehavior occur in MANETs, and then at different network layers-Physical, Data Link, and Network. In this paper we investigate and detect misbehavior at Network Layer. We performed experiment using the concepts of danger signal and clonal selection of AIS. Result of the misbehavior detection system depends on the way we use the danger signal for misbehavior detection. We propose an enhancement in the misbehavior detection using proper handling of danger signal. We compare our proposed concept of misbehavior detection with existing concepts. We show the experimental results showing the improvement in performance of AIS for misbehavior detection. <s> BIB007 </s> A Review of Artificial Immune System Based Security Frameworks for MANET <s> 4) Recovery Process <s> Network topology in mobile ad hoc networks (MANETs) changes rapidly due to the mobility of nodes. Hence, an important challenge for these networks is to develop an approach which can detect anomalies in network traffic with high accuracy despite the dynamic changing of network topology. In this paper, we present a hybrid approach based on the artificial bee colony (ABC) and negative selection (NS) algorithms, called BeeNS, for dynamic anomaly detection in AODV-based MANETs. In the approach, every node first extracts a set of feature vectors of its own normal network traffic. Each feature vector is represented by a hyper sphere with fixed radius in the feature space. It then applies the NicheNABC algorithm to generate a set of mature negative detectors for covering of the nonself space. The negative detectors, represented by hyper spheres with variable radii, are used to detect anomalies in network traffic. It eventually updates the mature negative detectors by one of two methods of partial updating or total updating. In order to evaluate the performance of BeeNS, we simulated some routing attacks in AODV-based MANETs using the NS2 simulator. The experimental results demonstrate that BeeNS achieves comparable or better performance than the approaches previously reported in the literature, in terms of detection and false alarm rates. <s> BIB008 </s> A Review of Artificial Immune System Based Security Frameworks for MANET <s> 4) Recovery Process <s> Mobile ad hoc network (MANET) is a self-created and self organized network of wireless mobile nodes. Due to special characteristics of these networks, security issue is a difficult task to achieve. Hence, applying current intrusion detection techniques developed for fixed networks is not sufficient for MANETs. In this paper, we proposed an approach based on genetic algorithm (GA) and artificial immune system (AIS), called GAAIS, for dynamic intrusion detection in AODV-based MANETs. GAAIS is able to adapting itself to network topology changes using two updating methods: partial and total. Each normal feature vector extracted from network traffic is represented by a hypersphere with fix radius. A set of spherical detector is generated using NicheMGA algorithm for covering the nonself space. Spherical detectors are used for detecting anomaly in network traffic. The performance of GAAIS is evaluated for detecting several types of routing attacks simulated using the NS2 simulator, such as Flooding, Blackhole, Neighbor, Rushing, and Wormhole. Experimental results show that GAAIS is more efficient in comparison with similar approaches. <s> BIB009 </s> A Review of Artificial Immune System Based Security Frameworks for MANET <s> 4) Recovery Process <s> Too many researches have been done using artificial immune systems AIS to solve intrusion detection problems due to several reasons. The self and non-self model based on the Negative Selection Algorithm NSA is the dominant model since it is adopted by the vast majority of these researches. However, this model has some problems especially in terms of scalability and coverage. This paper tries to exploit some interesting concepts proposed by the new danger theory to overcome the problems associated with the self and non-self model. That by improving NSA in order to achieve better detection rates by integrating the basic danger concepts. In this approach, the intrusion detection is related to the damage that can occur in the system and that can be caused by both external elements such as internal elements. The proposed algorithm integrates and combines the basic concepts of intrusion detection systems IDS based on the role of T cells described by the negative selection algorithm, with those inspired by the role of dendritic cells to process the alarm signals and to judge thereafter whether there is presence of a dangerous element or not. <s> BIB010 </s> A Review of Artificial Immune System Based Security Frameworks for MANET <s> 4) Recovery Process <s> MANET is characterised by a set of mobile nodes in an inherently insecure environment, having limited battery capacities. Provisioning of energy efficient security in MANETs is, therefore, an open problem for which a number of solutions have been proposed. In this paper, we present an overview and comparison of the MANET security at routing layer by using the cryptographic and Artificial Immune System (AIS) approaches. The BeeAdHoc protocol, which is a Bio-inspired MANET routing protocol based on the foraging principles of honey bee colony, is taken as case study. We carry out an analysis of the three security frameworks that we have proposed earlier for securing BeeAdHoc protocol; one based on asymmetric key encryption, i.e BeeSec, and the other two using the AIS approach, i.e BeeAIS based on self non-self discrimination from adaptive immune system and BeeAIS-DC based on Dendritic Cell (DC) behavior from innate immune system. We extensively evaluate the performance of the three protocols through network simulations in ns-2 and compare with BeeAdHoc, the base protocol, as well as with state-of-the-art MANET routing protocols DSR and AODV. Our results clearly indicate that AIS based systems provide security at much lower cost to energy as compared with the cryptographic systems. Moreover, the use of dendritic cells and danger signals instead of the classical self non-self discrimination allows to detect the non-self antigens with greater accuracy. Based on the results of this investigation, we also propose a composite AIS model for BeeAdHoc security by combining the concepts from both the adaptive and the innate immune systems by modelling the attributes and behavior of the B-cells and DCs. <s> BIB011
The IA takes a snapshot of the data recovery file when it successfully attaches to the new node that intends to join the wireless domain. When a change in the node's system is detected a classification for the pattern that caused the change is also determined. This approach uses memory, where data has been fed into a database and the same data is fetched and used in the recovery process. Nauman et al.  proposed using a DC approach in combination with a BEE algorithm. The scouts and foragers of the BEE algorithm are used in the DC formation. This algorithm uses a dynamic detector set and the DCs are modeled to sample the antigens (scouts) from the body tissues (node). During this phase both self and non-self-antigens are sampled. At startup random Detectors are generated which are in turn subjected to negative selection with respect to self-antigens represented by the semi mature DCs. Using negative selection to generate Detectors involves computational overhead and generating Detectors in a dynamically varying environment like MANET is not feasible. According to Ye et al. BIB005 two IAs namely the detection agent and counterattack agent are entrusted with detection as well as response. The detecting agent may be viewed as a T-cell lymphocyte while the counterat-tack agent may be viewed as an antibody. Whenever the detection agent finds an invader, instructions are sent to the counterattack agents. The behavioral patterns of nodes identified are as follows: • Node Q received message P recorded as Recv (Q, P) • Node Q sends message P recorded as Send (Q, P) • Node Q keeps message P recorded as Keep (Q, P) • Node Q modified message P recorded as Modify (Q, P) • Node Q deletes message P recorded as Delete (Q, P) • Node Q generates new message P recorded as Make (Q, P) • Node Q verifies message P recorded as Verify (Q, P) • Node Q stores message P recorded as Store (Q, P) • Node Q broadcasts message P recorded as Broadcast (Q, P) • Message R is the reply of the message P recorded as Reply (P, R) The behavior patterns of attack nodes are kept in the Immune Memory Library to represent different attack methods: • Method 1: Recv (Q, P), Delete (Q, P). Node Q receives the message P and deletes it without transmitting it. This is an Interrupt Attack. • Method 2: Recv (Q, P), Modify (Q, P), Send (Q, P). Node Q upon receiving the message P modifies it and then transmits it. This is an Error Message Attack. • Method 3: Recv (Q, P), Reply (P, R), Send (Q, P). Node Q receives message P and sends the message via the wrong route. This is called a Black Hole Attack. • Method 4: Recv (Q, P), Keep (Q, P), Send (Q, P). Node Q receives message P and then transmits it after keeping the message for some time. This can result in a Hidden Attack. • Method 5: Make (Q, P), Broadcast (Q, P). Node Q makes and broadcasts a large number of messages in a short time which leads to node overload. This is called a Denial of Service Attack. • Method 6: Store (Q, P), Modify (Q, P), Send (Q, P). Node Q modifies the details of the route and transmits again which will result in other nodes receiving error filled routing messages. The detection agent records the behavior of each of the neighboring nodes. When the node behaviors do not match they are analyzed using the Immune Strategy Library. The creation of the Immune Memory Library and Immune Strategy Library as illustrated in Figure 4 is not mentioned in detail in BIB005 and the Detection Agent cannot record the behavior of a particular node as there are other nodes in addition to the neighboring nodes which could be compromised. If the Detection Agent was to record each node's behavior this would result in a considerable computational overhead. This has not been simulated so the accuracy and feasibility of the approach is left to future work. Fatemeh BIB009 proposed a combination of AIS and GAs that are used to adapt to changes in network topology and Spherical Detectors are generated to cover non-self-space. The technique used to generate Spherical Detectors is an area for future research that might be used to identify the equivalent to protein compound antigens that exist in body cells alongside pathogens. The innate immune system uses built in knowledge to combat against infections and a danger signal means damage caused to self-cells due to antigens coming from non-self. In Danger Theory the recognition of pathogens is not enough to get a response from the adaptive immune system but an additional sense of danger is needed before the body reacts to any infection caused by pathogens. Nauman BIB011 proposes two approaches based on AIS called BeeAIS and BeeAIS-DC. BeeAIS utilizes negative selection to detect anomalies in MANETs and with the use of negative selection the profile of the system behavior during normal routing is found. The concepts used are: a) Antigens extracted from incoming traffic in the network are created from the packet header data. Here the antigens are modeled as one of three different types; scout antigen used to detect anomalies relating to scouts and forager antigens of two types used to detect modifications to the source route. b) Antibodies and Detectors are created by combining four gene values as random numbers. c) Matching functions are when the interaction between antigen and antibody is evaluated in terms of distance in Hamming shape space. The two stages of BeeAIS operation are the Learning Phase and the Protection phase. In the Learning Phase the behavior of the system is identified under normal routing conditions where each node monitors traffic in order to collect the data required to create self-antigens. When a scout is received, a node may form a scout anti- gen and when a forager is received; forager antigens are formed. A node could receive the same self-antigen many times. Hence it matches the newly formed antigen with the antigens that have been previously collected from the traffic flow. After the end of the Learning Phase a set of Detectors are generated using a negative selection process with the self-antigen set collected during the Learning Phase. The Detectors will be generated randomly and only those that do not match with self-antigens are kept. In the Protection Phase the nodes collect antigens from the incoming traffic and carry out measurement of their affinity with the Detector sets. Whenever a match occurs it indicates an anomaly is present. However this approach fails as the algorithm learns the system behavior only once and as a result during the Protection Phase newly observed behavior is declared as malicious by the system. Whenever a node receives a forward or backward scout it creates an antigen. After extracting the relevant fields from the scout header an antigen is created. The fields which are extracted include the scout source, destination, length of route and node ID of the previous hop. DCs are formed when a node sees a scout and the DCs are initialized with the following attributes: a) DC Antigen: The sampled antigen from the scout is attached to the DC. b) DC Life: The DCs are assigned a short life and they die a natural death after that. c) DC State: Upon instantiation a DC is an immature DC and when antigens are sampled and when safe signals are present, the DC transitions to a semi-mature state. During the exposure to danger signals DCs transform to mature DCs. As the system starts, a set of random Detectors are generated by the node and the Detectors have to undergo a negative selection process during which antigens are identified. The Detectors that match with antigens are eliminated and the resulting Detectors are able to match with non-self-antigens. Mature DCs are used to activate T-cells. During matching the T-cell detector is transformed to become an activated Detector. The approach proposed in BIB011 doesn't describe the role of an activated Detector sufficiently and the process carried out after the Detector becomes active is not adequately explained. Negative selection requires a Learning Phase which is not practical in a dynamic MANET. How the role of the Detector to curb malicious activities in the MANET is to occur is not adequately explained. Yasir et al. in BIB006 propose a security approach based on immune inspired properties. Three profiles are created: 1) Gene Profile. This profile would contain the recurring events needed to establish a connection system. This is similar to self-cells in the Immune system. 2) Detector Profile. This profile is used to recognize non-self which is similar to HIS T-cells. 3) Non-Self Profile. This profile would contain events that harm the system. The Immune agents capture the self and non-self patterns during the monitoring and capturing phase and we learn that U = S f ∪ N f represents the collection of patterns monitored while packets transfer, it contains both self and non-self patterns. N f = {n f1 , n f2 … n fm }, S f = {s f1 , s f2 … s fn } represents the set of all self and non-self patterns captured by the Immune Agent. In order to simulate the T-cells the Immune agent will be equipped with detectors that are randomly generated. Ð = {d 1 , d 2 … d m } represents the set of the generated Detectors, Ð´ = {d´1, d´2…d´m} the set of maturated Detectors. The negative selection algorithm is used to get the maturated Detectors in order to ensure that the generated Detectors do not match any self. The next step is clonal selection where a Detector will be cloned if it attains a score after matching to non-self. The algorithm is as given below: 1) Let: d´i score = 0 2) For N f = {n f1 , n f2 … n fm }; bind d´i to n fj , (for i, j = 1, 2…, m); 3) If d´i detects n fj , then d´i score++; end if 4) While {d´i score ≥ max score} do clone d´i // proliferation phase 5) d´i = d˝i; 6) If d˝i match s fi ; (1≤ i ≥n); then delete d˝i ;// negative selection 7) Else Ð´ = Ð´ + d˝i // Update the Detectors Profile In order to utilize the Danger Theory concept, the immune agent keeps a replica of data necessary to regain a node. Consider β a system with components at time t: βt = {β 1 , β 2 … β n }. A copy of β t is available in the Immune Agent Database. Therefore any change in the system components can be identified. Let ε be a change that occurs in the system after time Δt. The Immune Agent checks the system and observes βt+Δt = β ± ε; As ε is not recognized it is considered as a suspect pattern and will be included in the non-self-set to be blocked in future. This approach is not implemented and simulated so the accuracy of this approach cannot be validated. Ansari et al. in BIB007 use the concepts of clonal selection and danger signal for misbehavior detection using DSR. The protocol events of a node are mapped to HIS elements. Genes of a node are designed based on the performance of the network, the node's observations of neighboring nodes. These genes form the basis to detect if a node is misbehaving. Antigens are represented by a pattern of observed events generated by the protocol. The events generated at the monitored node when it receives a packet originating at sender node are as given below The antigen set is represented as: Where G k denotes the k th gene, Num denotes the number of occurrences, * denotes "zero" or more occurrence. Each bit in the antigen set D is termed as a nucleotide. Antibodies are generated randomly after which they are passed for negative selection. • Ab 1 = {1010100011,0001101100,1100100010,0110001010} • Ab 2 = {1010111000,0101100100,1010101010,0110101110} • Self Ag = ({0000100000,0000000100,0000000010},{0000000000,0000000000,0000100000,0000010000}..) Self Ag denotes self-antigen and the node saves this information when it is in learning phase. Whenever a node experiences packet loss a danger signal is generated. The criteria to realize the self-antigen is not mentioned. The question arises if an antigen is generated by an attacker node in the same time frame. This would result in all nodes considering Self Ag to be a trustworthy pattern and generate antibodies that cannot accurately detect misbehaving nodes. Whenever a "1" occurs in an antibody pattern which matches with the "1" in Self antigen, the antibody will be deleted. Sarafijanovic et al. BIB001 attempt to detect node misbehavior by making the nodes learn what normal behavior is in a protected environment. In this scenario a self-antigen pattern would be generated and antibody patterns are deleted if there is "1" in every position the antigen has a "1". Here again the question arises if the same antigen pattern could be generated by an attacker node. In the approach proposed by Barani et al.  each node extracts a set of feature vectors y out of normal network traffic. Each feature vector is represented by a hypersphere with a fixed radius in the feature space. At each time slot ∆t i ε t every node extracts a q dimensional feature vector y i . The equation (1) A feature vector y i ε S p at time t is termed normal if it belongs to a normal network state. To generate a set of negative Detectors N(t) every negative Detector n j ϵ N(t) is defined as a hypersphere (a j , bj) where a j is the centre of the hypersphere and b j is the radius. Let P(t) be the set of positive antigens. The Niche NABC algorithm BIB008 takes P(t) as input and generates a set of N(t) of mature negative detectors. Immature food sources are created so that there will be a minimum overlap with positive antigens. When the quality of food sources cannot be improved further the food source will be abandoned. In this approach there is offline learning phase and online learning phase. The offline learning phase is run in a protected environment and leads to the creation of negative Detectors. This approach does not map a food source to any of the routing or MANET parameters. Anass et al. BIB010 proposes a detection generation algorithm. In each generation the DCs deliver a set of elements that are of fixed size randomly chosen from the antigens. Based on the context of the element which is presented a number of operations is established to allow memory Detectors to detect intrusive behavior. When the context of the element is dangerous then the algorithm checks if the memory detectors are able to detect the antigen. If the dangerous element is not detected by the memory Detector the algorithm checks if the mature Detectors are able to detect this element. If there is a mature Detector which is able to detect then this mature element is added to the group of memory Detectors. In case the presented element is harmless the algorithm checks if this element is detectable by the memory Detectors in order to remove the corresponding detector. The context upon which the element is classified to be "dangerous" is not detailed. This experiment is not validated hence it is not possible to verify the authenticity of this approach. Visconti et al. BIB003 suggests a type 2 fuzzy set based algorithm for detecting misbehaving nodes that is triggered by network danger signals and antigen presenting cells. The person MF BIB002 approach is used in order to capture the real behavior of a node and the experts provide the Footprint of Uncertainty (FOU). A red region indicates misbehavior of the network pattern, a yellow region indicates suspicious behavior and a white region indicates normal behavior. The binding process invokes the helper T-cells to measure the actual changes v i of the network parameter f i and find the region (Red, Yellow, White) to which the Interval type 2 fuzzy parameter is closer. Therefore to conclude if a node is good or bad I2FM is built for the whole network based on all M network parameters. The proposed approach is considered to be a work in progress. In BIB004 an immune system approach has been proposed for securing MANET. The Immune Agent consists of three profiles: gene profile, non-self-profile and Detector profile. Gene profile consists of the frequently occurring events for connection establishments. Detector profile is similar to T-cells in the human body for detecting the non-self. The non-self profile contains events that harm the system. The Immune Agent captures and stores the information pertaining to the protocol during the Training phase (Secure) as well as in the insecure phase. The Immune agent will be equipped with Detectors that are randomly generated. The negative selection algorithm ensures that the generated Detectors do not match self. The Detectors that come out of the negative selection stage are cloned whenever they attain a score detecting non-self and the detector profile is updated. This is followed by node in the network sending route request to a node in which Immune Agent (IA) is installed to which the Immune agent installed node sends a reply with a license for IA. The node that generated route request accepts the IA license and establishes connection. The periodic system checker does the monitoring of incoming packets and compares them against earlier stored patterns. If there is no match the pattern the blocking process is called followed by the recovery process.