基于危险理论的人工免疫模型研究
|
摘要
随着人类对生物细胞深入的了解以及生物体能很好的防御病毒的秘密逐步被揭开,生物体的防病毒的能力也在计算机安全中被模仿和借鉴。目前,大部分人工免疫的原理都是建立在传统的“self-nonself”(SNS)识别模式的基础上,SNS模式的优点在于简单和易于理解,且对于已知的自体或者非自体,具有很高的识别效率。但由于SNS模型本身的设计缺陷,它对于未知的自体或者非自体不能很好的识别,即具有很低的识别率和高误报率。因此,在本文中引入危险理论,该理论认为机体内部的危险信号才是引发免疫应答的关键,因而能很好的解决SNS模型的问题。
本文首先详细地介绍了一种生物体重要的抗原提呈细胞(APC),即树突细胞(DCs),以及树突细胞在人工免疫中的应用,然后分析了SNS模型和危险理论的优缺点,充分地利用SNS模型简单迅速的检测已知抗原的优点,以及危险理论能检测出未知抗原的优点,设计出一种基于两种模式相结合的人工免疫模型,新模型不仅具有传统SNS模型能高效识别已知抗原的优势,而且具有危险理论较高的检测率和低误报率的特点。最后的实验分析表明,新的模型高效快速,且具有高检测率和低误报率。
As human understanding of biological cells and the secret of organism defense virus, the organisms’ability of anti-virus has also been imitated and referenced in computer security. Currently, most of the artificial immune systems are built on the traditional self-nonself (SNS) discrimination model. The SNS model is simple and easy to understand, and it has high recognition efficiency in the known self or non-self. However, because of the design flaw of the SNS model, it's not well to distinguish unknown self or nonself. In other words, the SNS model has a very low recognition rate and high false alarm rate. So a new theory - danger theory has been introduced, the theory thought the danger signals within the body was the key to trigger the immune response, which can be a good model to solve the problem of SNS.
This paper describes an important organism antigen presenting cells - dendritic cells (DCs), and introduces dendritic cells in the application of artificial immune in detail. After considering the advantages and disadvantages of the SNS model and the danger theory, the paper analyses the advantages of the SNS model which is simple and fast for known antigen distinguishing, and the advantages of the danger theory which can distinguish unknown antigen. Then the artificial immunology model based on the fore-mentioned two models is proposed. The new model has both advantages of the SNS model and the danger theory. The experiment shows that the new model is not only effective and fast, but also has higher detection rate and lower false alarm rate.
本文首先详细地介绍了一种生物体重要的抗原提呈细胞(APC),即树突细胞(DCs),以及树突细胞在人工免疫中的应用,然后分析了SNS模型和危险理论的优缺点,充分地利用SNS模型简单迅速的检测已知抗原的优点,以及危险理论能检测出未知抗原的优点,设计出一种基于两种模式相结合的人工免疫模型,新模型不仅具有传统SNS模型能高效识别已知抗原的优势,而且具有危险理论较高的检测率和低误报率的特点。最后的实验分析表明,新的模型高效快速,且具有高检测率和低误报率。
As human understanding of biological cells and the secret of organism defense virus, the organisms’ability of anti-virus has also been imitated and referenced in computer security. Currently, most of the artificial immune systems are built on the traditional self-nonself (SNS) discrimination model. The SNS model is simple and easy to understand, and it has high recognition efficiency in the known self or non-self. However, because of the design flaw of the SNS model, it's not well to distinguish unknown self or nonself. In other words, the SNS model has a very low recognition rate and high false alarm rate. So a new theory - danger theory has been introduced, the theory thought the danger signals within the body was the key to trigger the immune response, which can be a good model to solve the problem of SNS.
This paper describes an important organism antigen presenting cells - dendritic cells (DCs), and introduces dendritic cells in the application of artificial immune in detail. After considering the advantages and disadvantages of the SNS model and the danger theory, the paper analyses the advantages of the SNS model which is simple and fast for known antigen distinguishing, and the advantages of the danger theory which can distinguish unknown antigen. Then the artificial immunology model based on the fore-mentioned two models is proposed. The new model has both advantages of the SNS model and the danger theory. The experiment shows that the new model is not only effective and fast, but also has higher detection rate and lower false alarm rate.
引文
[1] Krishna Kumar K, Neidhoefer J. Immunized adaptive critics for level 2 intelligent control [J]. 1997 IEEE International Conference on Computational Cybernetics and Simulation. Institute of Electrical and Electronics Engineers, Incorporated, 1997, 856~861.
[2] J H Carter. The Immune System as a model for Pattern Recognition and classification [J]. Journal of the American Medical Informatics Association. Vol.7 (3), 2000.
[3] Timmis J, Neal M, Hunt J. Data analysis using artificial immune systems, cluster analysis and Kohonen networks: some comparisons [J]. IEEE SMC’99 Conference Proceedings.1999 IEEE International Conference on System, Man, and Cybernetics. Institute of Electrical and Electronics Engineers, Incorporated, 1999, 922~927.
[4] L S Forrest, A S Perelson, L Allen, R cherukuri. Self-Nonself Discrimination in a Computer [J] Proceedings of IEEE Symposium on Research in Security and Privacy, Oakland, 1994.5.
[5] Uwe Aickelin, Steve Cayzer. The danger Theory and Its Application to Artificial Immune Systems [J]. Proceeding of the 1st internet conference on artificial immune system (ICARIS 2002), 141-148, Canterbury, UK, 2002.
[6]许春,李涛,刘孙俊,赵辉,张建华,刘念.基于免疫危险理论的新型网络入侵检测方法研究[J].南京邮电大学学报,2006,26 (5):80-85.
[7]梁可心,李涛.一种基于人工免疫理论的新型入侵检测模型[J].计算机工程与应用,129-131,2005.2.
[8]梁意文.网络信息安全的免疫模型[D].武汉:武汉大学,博士学位论文,2002,4.
[9]袁细国.基于危险理论的多Agent人工免疫模型的研究[D].武汉:武汉科技大学,硕士学位论文,2007,5.
[10]李雪.基于免疫危险模式的入侵检测研究[D].武汉:武汉科技大学,硕士学位论文,2009,5.
[11]李涛.计算机免疫学[M].北京:电子科技大学,2004,7.
[12] Matzinger P, Tolerance, Danger and the Extended Family [J]. Annual Review of Immunlogy, 12:991-1045, 1994.
[13] M.B. Lutz and G. Schuler. Immature, semi-mature and fully mature dendrites cells [J]: which signals induce 20 tolerance or immunity Trends in Immunology, 23(9): 991–1045, 2002.
[14] T R Mossman and AM Livingstone. Dendrites Cells [M]: the immune information management experts. Nature Immunology, 5(6):564-566, 2004.
[15] Ruslan medzhitov, Charles janeway. Innate Immunity [M]. The new England Journal of Medicine, 343:338-344.2000.
[16] Manfred B.Lutz, Gerold Schuler. Immature, Semi-mature and fully mature dendrites cells [M]: which signals induce tolerance or immunity Trend in immunology 23: 445-449, 2002 .
[17] Burnet FM. The colonel selection theory of acquired immunity [M]. London: Cambridge University Press, 1959.
[18] S A Hofmeyr. An Interpretative Introduction to the Immune System [J]. Design Principle for the Immune System and other Distributed Autonomous Systems (Oxford University Press), 2000.
[19] Polly Mat zinger. The danger model [M]: A renewed sense of self. Since, 296:301-304, 2002.
[20]黄悦.从克隆选择到危险模式[J].中国医学院学报,24:4(430-431),2002,8.
[21] Steven Hofmeyr. An immunological model of distributed detection and its application to Computer Security [J]. PhD thesis, University of New Mexico, 1999
[22] D Disrupter. Immune-based intrusion detection system: a general framework [J]. Proceedings of 22nd national information system security conference (NISSC), Virginia, USA, 1999.
[23] Tim R Mossman and Alexandra M Livingstone. Dendritic cells: the immune information management experts [J]. Nature Immunology, 5(6):564-566, 2004.
[24] Julie Greensmith, Uwe Aickelin and Steve Cayer. Introducing Dendritic Cells as a Novel Immune-Inspired Algorithm for Anomaly Detection [J]. In proc. of the fourth International Conference on Artificial Immune Systems (ICARIS-2005), pages, 2005.
[25] Julie Greensmith, Jamie Twycross and Uwe Aickelin. Dendritic Cells for Anomaly Detection [J]. CEC 2006 Congress on Evolutionary Computation, pages 664-671, 2006.
[26] Julie Green Smith. Uwe Aickelin. Dendritic Cells for SYN scan Detection [J]. GECCo’07, 7-11, London England UK, 2007. July.
[27] Julie Greensmith, Uwe Aickelin. Information Fusion for Anomaly Detection with the Dendritic Cell Algorithm [M], 2007.
[28] J. Twycross and U. Aickelin. Libtissue– implementing innate immunity [J]. In Congress on Evolutionary Computation (CEC-2006), pages 499–506, 2006.
[29] C.A. Williams, R.A. Harry, and J.D. McLeod. Mechanisms of apoptosis induced dc suppression [J]. Submitted to the Journal of Immunology, 2007.
[30] J.Twycross and U.Aickelin. Towards a conceptual framework for innate immunity [J]. In ICARIS-05, LNCS 3627, 2005.
[31] www.dangertheory.com.
[32] GONZALES F, DASGUPTA D. Anomaly Detection Using Real valued Negative Selection [J]. Journal of Genetic Programming and Evolvable Machines, 2003, 4 (4):383 - 403.
[33] Jeffrey O. Kephart, Gregory B. Sorkin. Morton Swimmer, and Steve R. White IBM ThomasJ. Watson Research Center,Blueprint for a Computer Immune System [M], the Virus Bulletin International Conference in San Francisco, California, October 1-3, 1997.
[34] http://kdd.ics.uci.edu/databases/kddcup99/kddcup99.html
[35]梁铁柱.入侵检测中数据挖掘方法的研究[D].中国人民解放军理工大学,博士学位论文,2002,5.
[36]赵林惠,戴亚平,付东梅,董芳艳.基于免疫危险理论的三级模块式入侵检测系统[J].计算机应用,2006,26 (10):2310-2314.
[37] U.Aickelin, P.Bentley, S.Cayzer, J.Kim, and J.McLeod. Danger theory: The link between AIS and IDS [J]. In Pron. of the 2nd International Conference on Artificial Immune Systems(ICARIS), LNCS 2787, pages 147-155, Spring-Verlag, 2003.
[38] K.Murphy, P.Travers, and M.Walport. Janeway’s Immunobiology [M]. Garland Seience, 7th edition, 2008.
[39] Greensmith J. Introducing the Dendritic Cell Algorithm [J]. International Conference on Artificial Immune Systems (ICARIS 2006), Lisbon Portugal September 2006.
[40] Julie Greensmith, Jan Feyereisl, Uwe Aickelin. The DCA: SoMe Comparison A comparative study between two biologically-inspired algorithms [M]. Evolutionary Intelligence 1 , 85-112, 2008.
[41] Uwe Aickelin, Julie Greensmith. Sensing Danger: Innate Immunology for Intrusion Detection [M]. Elsevier Information Security Technical Reports 12, 218-227, 2007.
[42] Julie Greensmith, Uwe Aicklin. The Deterministic Dendritic Cell Algorithm [J]. Processings of the 7th International conference on Aritifical Immune, 291-303, 2008.
[2] J H Carter. The Immune System as a model for Pattern Recognition and classification [J]. Journal of the American Medical Informatics Association. Vol.7 (3), 2000.
[3] Timmis J, Neal M, Hunt J. Data analysis using artificial immune systems, cluster analysis and Kohonen networks: some comparisons [J]. IEEE SMC’99 Conference Proceedings.1999 IEEE International Conference on System, Man, and Cybernetics. Institute of Electrical and Electronics Engineers, Incorporated, 1999, 922~927.
[4] L S Forrest, A S Perelson, L Allen, R cherukuri. Self-Nonself Discrimination in a Computer [J] Proceedings of IEEE Symposium on Research in Security and Privacy, Oakland, 1994.5.
[5] Uwe Aickelin, Steve Cayzer. The danger Theory and Its Application to Artificial Immune Systems [J]. Proceeding of the 1st internet conference on artificial immune system (ICARIS 2002), 141-148, Canterbury, UK, 2002.
[6]许春,李涛,刘孙俊,赵辉,张建华,刘念.基于免疫危险理论的新型网络入侵检测方法研究[J].南京邮电大学学报,2006,26 (5):80-85.
[7]梁可心,李涛.一种基于人工免疫理论的新型入侵检测模型[J].计算机工程与应用,129-131,2005.2.
[8]梁意文.网络信息安全的免疫模型[D].武汉:武汉大学,博士学位论文,2002,4.
[9]袁细国.基于危险理论的多Agent人工免疫模型的研究[D].武汉:武汉科技大学,硕士学位论文,2007,5.
[10]李雪.基于免疫危险模式的入侵检测研究[D].武汉:武汉科技大学,硕士学位论文,2009,5.
[11]李涛.计算机免疫学[M].北京:电子科技大学,2004,7.
[12] Matzinger P, Tolerance, Danger and the Extended Family [J]. Annual Review of Immunlogy, 12:991-1045, 1994.
[13] M.B. Lutz and G. Schuler. Immature, semi-mature and fully mature dendrites cells [J]: which signals induce 20 tolerance or immunity Trends in Immunology, 23(9): 991–1045, 2002.
[14] T R Mossman and AM Livingstone. Dendrites Cells [M]: the immune information management experts. Nature Immunology, 5(6):564-566, 2004.
[15] Ruslan medzhitov, Charles janeway. Innate Immunity [M]. The new England Journal of Medicine, 343:338-344.2000.
[16] Manfred B.Lutz, Gerold Schuler. Immature, Semi-mature and fully mature dendrites cells [M]: which signals induce tolerance or immunity Trend in immunology 23: 445-449, 2002 .
[17] Burnet FM. The colonel selection theory of acquired immunity [M]. London: Cambridge University Press, 1959.
[18] S A Hofmeyr. An Interpretative Introduction to the Immune System [J]. Design Principle for the Immune System and other Distributed Autonomous Systems (Oxford University Press), 2000.
[19] Polly Mat zinger. The danger model [M]: A renewed sense of self. Since, 296:301-304, 2002.
[20]黄悦.从克隆选择到危险模式[J].中国医学院学报,24:4(430-431),2002,8.
[21] Steven Hofmeyr. An immunological model of distributed detection and its application to Computer Security [J]. PhD thesis, University of New Mexico, 1999
[22] D Disrupter. Immune-based intrusion detection system: a general framework [J]. Proceedings of 22nd national information system security conference (NISSC), Virginia, USA, 1999.
[23] Tim R Mossman and Alexandra M Livingstone. Dendritic cells: the immune information management experts [J]. Nature Immunology, 5(6):564-566, 2004.
[24] Julie Greensmith, Uwe Aickelin and Steve Cayer. Introducing Dendritic Cells as a Novel Immune-Inspired Algorithm for Anomaly Detection [J]. In proc. of the fourth International Conference on Artificial Immune Systems (ICARIS-2005), pages, 2005.
[25] Julie Greensmith, Jamie Twycross and Uwe Aickelin. Dendritic Cells for Anomaly Detection [J]. CEC 2006 Congress on Evolutionary Computation, pages 664-671, 2006.
[26] Julie Green Smith. Uwe Aickelin. Dendritic Cells for SYN scan Detection [J]. GECCo’07, 7-11, London England UK, 2007. July.
[27] Julie Greensmith, Uwe Aickelin. Information Fusion for Anomaly Detection with the Dendritic Cell Algorithm [M], 2007.
[28] J. Twycross and U. Aickelin. Libtissue– implementing innate immunity [J]. In Congress on Evolutionary Computation (CEC-2006), pages 499–506, 2006.
[29] C.A. Williams, R.A. Harry, and J.D. McLeod. Mechanisms of apoptosis induced dc suppression [J]. Submitted to the Journal of Immunology, 2007.
[30] J.Twycross and U.Aickelin. Towards a conceptual framework for innate immunity [J]. In ICARIS-05, LNCS 3627, 2005.
[31] www.dangertheory.com.
[32] GONZALES F, DASGUPTA D. Anomaly Detection Using Real valued Negative Selection [J]. Journal of Genetic Programming and Evolvable Machines, 2003, 4 (4):383 - 403.
[33] Jeffrey O. Kephart, Gregory B. Sorkin. Morton Swimmer, and Steve R. White IBM ThomasJ. Watson Research Center,Blueprint for a Computer Immune System [M], the Virus Bulletin International Conference in San Francisco, California, October 1-3, 1997.
[34] http://kdd.ics.uci.edu/databases/kddcup99/kddcup99.html
[35]梁铁柱.入侵检测中数据挖掘方法的研究[D].中国人民解放军理工大学,博士学位论文,2002,5.
[36]赵林惠,戴亚平,付东梅,董芳艳.基于免疫危险理论的三级模块式入侵检测系统[J].计算机应用,2006,26 (10):2310-2314.
[37] U.Aickelin, P.Bentley, S.Cayzer, J.Kim, and J.McLeod. Danger theory: The link between AIS and IDS [J]. In Pron. of the 2nd International Conference on Artificial Immune Systems(ICARIS), LNCS 2787, pages 147-155, Spring-Verlag, 2003.
[38] K.Murphy, P.Travers, and M.Walport. Janeway’s Immunobiology [M]. Garland Seience, 7th edition, 2008.
[39] Greensmith J. Introducing the Dendritic Cell Algorithm [J]. International Conference on Artificial Immune Systems (ICARIS 2006), Lisbon Portugal September 2006.
[40] Julie Greensmith, Jan Feyereisl, Uwe Aickelin. The DCA: SoMe Comparison A comparative study between two biologically-inspired algorithms [M]. Evolutionary Intelligence 1 , 85-112, 2008.
[41] Uwe Aickelin, Julie Greensmith. Sensing Danger: Innate Immunology for Intrusion Detection [M]. Elsevier Information Security Technical Reports 12, 218-227, 2007.
[42] Julie Greensmith, Uwe Aicklin. The Deterministic Dendritic Cell Algorithm [J]. Processings of the 7th International conference on Aritifical Immune, 291-303, 2008.