Network security has always been an area of priority and extensive research. Recent years have seen a considerable growth in experimentation with biologically inspired techniques. This is a consequence of our increased understanding of living systems and the application of that understanding to machines and software. The mounting complexity of telecommunications networks and the need for increasing levels of security have been the driving factor. The human body can act as a great role model for its unique abilities in protecting itself from external, foreign entities. Many abnormalities in the human body are similar to that of the attacks in wireless sensor networks (WSN). This paper presents basic ideas drawn from human immune system analogies that can help modelling a system to counter the attacks on a WSN by monitoring parameters such as energy, frequency of data transfer, data sent and received. This is implemented by exploiting two immune concepts, namely danger theory and negative selection. Danger theory aggregates the anomalies based on the weights of the anomalous parameters. The objective is to design a cooperative intrusion detection system (IDS) based on danger theory. Negative selection differentiates between normal and anomalous strings and counters the impact of malicious nodes faster than danger theory. We also explore other human immune system concepts and their adaptability to Wireless Sensor Network Security.

Orientador: Fernando Jose Von Zuben / Dissertação (mestrado) - Universidade Estadual de Campinas, Faculdade de Engenharia Eletrica e de Computação / Made available in DSpace on 2018-08-11T02:37:26Z (GMT). No. of bitstreams: 1 Pinto_JoseCarlosLima_M.pdf: 2121571 bytes, checksum: 9c655f127eb2b45c71b750509a43c3a1 (MD5) Previous issue date: 2006 / Resumo: Essa dissertação apresenta um algoritmo de detecção de falhas composto de múltiplos módulos interconectados e operando de acordo com o paradigma suportado pela Teoria do Perigo em imunologia. Esse algoritmo busca atingir características significativas que um sistema de detecção de falhas deve expressar ao monitorar um sistema telefônico. Essas características seriam basicamente a adaptabilidade, devido à forte variação que esse sistema pode ter em seus parâmetros ao longo do tempo, e a diminuição no número de falsos positivos que podem ser gerados ao se classificar como falha toda anormalidade encontrada. Cenários simulados foram concebidos para validar a proposta, sendo que os resultados obtidos foram analisados e comparados com propostas alternativas / Abstract: Abstract This thesis presents a fault detection algorithm composed of multiple interconnected modules, and operating according to the paradigm supported by the Danger Theory in immunology. This algorithm attempts to achieve significant features that a fault detection system is supposed to express when monitoring a telephone system. These features would basically be adaptability, due to the strong variation that operational conditions may exhibit over time, and the decrease in the number of false positives, which can be generated when any abnormal behavior is erroneously classified as being a fault. Simulated scenarios have been conceived to validate the proposal, and the obtained results are then analyzed and compared with alternative proposals / Mestrado / Engenharia de Computação / Mestre em Engenharia Elétrica

This research created a new theoretical Soft Computing (SC) hybridized network intrusion detection diagnostic system including complex hybridization of a 3D full color Self-Organizing Map (SOM), Artificial Immune System Danger Theory (AISDT), and a Fuzzy Inference System (FIS). This SOM+ diagnostic archetype includes newly defined intrusion types to facilitate diagnostic analysis, a descriptive computational model, and an Invisible Mobile Network Bridge (IMNB) to collect data, while maintaining compatibility with traditional packet analysis. This system is modular, multitaskable, scalable, intuitive, adaptable to quickly changing scenarios, and uses relatively few resources.

The growth in the number of connected devices, in the volume of data traffic and of applications used has shown a significant increase in the complexity of today's networks, leaving the activity of management increasingly difficult for network and system administrators. Management aspects, such as the security of these systems has been a major challenge faced by the researchers, especially considering that, in parallel, there has been also a significant increase in the degree of sophistication of malicious activities. This scenario requires the development of sophisticated security systems also, in order to prevent or contain attacks increasingly destructive to systems, such as worm attacks. And the biological inspiration has been a main ally in this endeavor, bringing several concepts and new ways of thinking and solving these problems. This work used the bio-inspired concepts of Autonomic Networks (self-managing networks inspired by the functioning of the human nervous system)and Artificial Immune Systems (computer security systems inspired by the functioning of the human immune system), to define a management architecture for network self-protection, through the prediction of security attacks. This architecture incorporates the Danger Theory immune-inspired model and uses its Dendritic Cells algorithm to correlate events and detect anomalies. The architecture analysis was performed on an Early Warning System, which uses notifications received from worm already infected machines as additional information to identify the imminence of an infection in still vulnerable machines. In the experiments the gain in time obtained with this early identification was used in the Conficker worm propagation model and the results showed a reduction in the number of infected machines and, consequently, in the worm propagation across a network / O crescimento do número de dispositivos conectados, do volume de dados trafegados e das aplicações utilizadas tem evidenciado um aumento importante na complexidade das redes atuais, deixando a atividade de gerência cada vez mais difícil para os administradores de redes e sistemas. Aspectos de gerência, como a segurança desses sistemas tem sido um dos principais desafios enfrentados pelos pesquisadores, principalmente, considerando que, em paralelo, observa-se um também importante aumento no grau de sofisticação das atividades maliciosas. Tal cenário exige o desenvolvimento de sistemas de segurança igualmente sofisticados, com o intuito de impedir ou conter ataques cada vez mais destrutivos aos sistemas, como os ataques de worms. E a inspiração biológica tem sido uma das grandes aliadas nesta empreitada, trazendo diversos conceitos e novas formas de pensar e resolver esses problemas. Este trabalho utilizou os conceitos bio-inspirados das Redes Autonômicas (redes autogerenciáveis inspiradas nos funcionamento do sistema nervoso humano) e dos Sistemas Imunes Artificiais (sistemas de segurança computacional inspirados no funcionamento do sistema imunológico humano), para definir uma arquitetura de gerência para autoproteção de redes, através da predição de ataques de segurança. Tal arquitetura incorpora o modelo imuno-inspirado da Teoria do Perigo e utiliza o seu Algoritmo das Células Dendríticas para correlacionar eventos e detectar anomalias. A análise da arquitetura foi realizada em um Sistema de Alerta Antecipado, que usa notificações recebidas de máquinas já infectadas por worm como informação adicional para identificar a iminência de uma infecção em máquinas ainda vulneráveis. Nos experimentos o ganho de tempo obtido com essa identificação precoce foi utilizado no modelo de propagação do worm Conficker e os resultados apontaram uma redução no número de máquinas infectadas e, consequentemente, na propagação deste worm em uma rede