Towards an immunity-based anomaly detection system for network traffic

Authors:
Takeshi Okamoto;Yoshiteru Ishida
Affiliations:
Department of Network Engineering, Kanagawa Institute of Technology, Atsugi, Kanagawa, Japan;Department of Knowledge-Based Information Engineering, Toyohashi University of Technology, Toyohashi, Aichi, Japan
Venue:
KES'06 Proceedings of the 10th international conference on Knowledge-Based Intelligent Information and Engineering Systems - Volume Part II
Year:
2006

Citing 3
Cited 4

Throttling Viruses: Restricting propagation to defeat malicious mobile code

ACSAC '02 Proceedings of the 18th Annual Computer Security Applications Conference
A taxonomy of computer worms

Proceedings of the 2003 ACM workshop on Rapid malcode
A worm filter based on the number of unacknowledged requests

KES'05 Proceedings of the 9th international conference on Knowledge-Based Intelligent Information and Engineering Systems - Volume Part II

Dynamic Updating of Profiles for an Immunity-Based Anomaly Detection System

KES '08 Proceedings of the 12th international conference on Knowledge-Based Intelligent Information and Engineering Systems, Part III
Framework of an immunity-based anomaly detection system for user behavior

KES'07/WIRN'07 Proceedings of the 11th international conference, KES 2007 and XVII Italian workshop on neural networks conference on Knowledge-based intelligent information and engineering systems: Part III
Evaluations for immunity-based anomaly detection with dynamic updating of profiles

Artificial Life and Robotics
An artificial intelligence membrane to detect network intrusion

Artificial Life and Robotics

Quantified Score

Hi-index	0.00

Visualization

Abstract

We have applied our previous immunity-based system to anomaly detection for network traffic, and confirmed that our system outperformed the single-profile method. For internal masquerader detection, the missed alarm rate was 11.21% with no false alarms. For worm detection, four random-scanning worms and the simulated metaserver worm were detected with no missed alarms and no false alarms, while a simulated passive worm was detected with a missed alarm rate of 80.57%.