Immune Computation of Anti-Worm Static Web System

Abstract:

A normal model and an immune computation model were modelled to detect recognize and eliminate worms in a static Web system. Immune computation included detecting, recognizing, learning and eliminating non-selfs. The self/non-self detection was based on querying in the self database and the self database was built on the normal model of the static Web system. After the detection, the recognition of known non-self was based on querying in the non-self database and the recognition of unknown non-self was based on learning unknown non-self. The learning algorithm was designed on the neural network or the learning mechanism from examples. The last step was elimination of all the non-self and failover of the damaged Web system. The immunization of the static Web system was programmed with Java to test effectiveness of the approach. Some worms infected the static Web system, and caused the abnormity. The results of the immunization simulations show that, the immune program can detect all worms, recognize known worms and most unknown worms, and eliminate the worms. The damaged files of the static Web system can all be repaired through the normal model and immunization. The normal model & immune computation model are effective in some anti-worm applications.

• Periodical: Applied Mechanics and Materials (Volumes 48-49)
• Pages: 603-606
• DOI: https://doi.org/10.4028/www.scientific.net/AMM.48-49.603
• Online since: February 2011
• Authors: Tao Gong, Song Wang, Lei Yao
• Keywords: Artificial Immune System, Normal Model, Static Web System, Worm

References

[1] Orman H, in: The Morris Worm: A Fifteen-Year Perspective [J]. IEEE SECURITY & PRIVACY, 2003, 1(5): 35-43.

DOI: 10.1109/msecp.2003.1236233

[2] Staniford S, Paxson V, Weaver N, in: How to Own the Internet in Your Spare Time. Proceedings of the 11th USENIX Security Symposium, Berkeley: USENIX, 2002. 149-167.

[3] Balthrop J, Forrest S, Newman M E J, et al, in: Technological Networks and the Spread of Computer Viruses [J]. Science, 2004, 304(5670): 527-529.

DOI: 10.1126/science.1095845

[4] Levy E, in: Worm Propagation and Generic Attacks [J]. IEEE Security and Privacy, 2005, 3(2): 63-65.

DOI: 10.1109/msp.2005.57

[5] Gray R S, Berk V H, in: Rapid Detection of Worms Using ICMP-T3 Analysis. Proceedings of SPIE, Bellingham: SPIE Press, 2004, 89-101.

[6] Dasgupta D, González F, in: An immunity-based technique to characterize intrusions in computer networks [J]. IEEE Transactions on Evolutionary Computation, 2002, 6(3): 281-291.

DOI: 10.1109/tevc.2002.1011541

[7] Zou Chang-chun, Gong Wei-bo, Towsley D, in: Code Red Worm Propagation Modeling and Analysis. Proceedings of the 9th ACM Conference on Computer and Communications Security, New York: ACM Press, 2002, 138-147.

DOI: 10.1145/586110.586130

[8] Madhusudan B, Lockwood J W, in: A hardware- accelerated system for real-time worm detection [J]. IEEE Micro, 2005, 25(1): 60-69.

DOI: 10.1109/mm.2005.1

[9] Gong Tao, Cai Zi-xing, in: Immune modeling and programming of a mobile robot demo [J]. J. Cent. South Univ. Technol., 2006, 13(6): 694-698.

DOI: 10.1007/s11771-006-0015-7

[10] Gong Tao, Cai Zi-xing, in: Parallel evolutionary computing and 3-tier load balance of remote mining robot [J]. Trans Nonferrous Met Soc China, 2003, 13(4): 948-952.

[11] Gong Tao, Cai Zi-xing, in: Anti-Worm immunization of Web system based on normal model and BP neural network [J]. Lecture Notes in Computer Science, 2006, 3973: 267-272.

DOI: 10.1007/11760191_39

[12] De Castro L N, Timmis J, in: Artificial immune systems: a new computational intelligence approach [M]. London: Springer-Verlag, (2002).