Multi-Agent Artificial Immune Systems (MAAIS) for Intrusion Detection: Abstraction from Danger Theory

摘要

Danger theory-inspired Multi-agent artificial immune system (MAAIS) is applied to intrusion detection systems (IDS). Antigens are profiles of system calls while corresponding behaviors are regarded as signals. The intelligence behind such system is based on the danger theory while dentricit cells agents (DC agent) are emulated for innate immune subsystem and artificial T-cell agents (TC agent) are for adaptive immune subsystem. This IDS is based on the dual detections of DC agent for signals and TC agent for antigen, where each agent coordinates with other to calculate danger value (DV). According to DV, immune response for malicious behaviors is activated by either computer host or Security Operating Center (SOC).