Artificial Immune System: Applications in Computer Security

205 Pages·2016·7.37 MB·English

by  Ying Tan

fi
Arti cial Immune System
IEEEPressEditorialBoard
TariqSamad,EditorinChief
GeorgeW.Arnold Pui-InMak
GiancarloFortino JeffreyNanzer
DmitryGoldgof RayPerez
EkramHossain LindaShafer
XiaoouLi ZidongWang
VladimirLumelsky MengChuZhou
KennethMoore,DirectorofIEEEBookandInformationServices(BIS)
TechnicalReviewers
GuoyinWang,CollegeofComputerScienceandTechnology
ChongqingUniversityofPostsandTelecommunications
YanPei,UniversityofAizu,Japan
SuichenGu,Google,Inc.
AboutIEEEComputerSociety
IEEEComputerSocietyistheworld’sleadingcomputingmembershiporganizationandthe
trustedinformationandcareer-developmentsourceforaglobalworkforceoftechnologylead­
ersincluding:professors,researchers,softwareengineers,ITprofessionals,employers,andstu­
dents.Theunmatchedsourcefortechnologyinformation,inspiration,andcollaboration,the
IEEEComputerSocietyisthesourcethatcomputingprofessionalstrusttoprovidehigh-quality,
state-of-the-artinformationonanon-demandbasis.TheComputerSocietyprovidesawide
rangeofforumsfortopmindstocometogether,includingtechnicalconferences,publications,
andacomprehensivedigitallibrary,uniquetrainingwebinars,professionaltraining,andthe
TechLeaderTraining Partner Program to help organizations increase their staff’s technical
knowledgeandexpertise,aswellasthepersonalizedinformationtoolmyComputer.Tofind
outmoreaboutthecommunityfortechnologyleaders,visithttp://www.computer.org.
IEEE/WileyPartnership
TheIEEEComputerSocietyandWileypartnershipallowstheCSPressauthoredbookprogram
toproduceanumberofexcitingnewtitlesinareasofcomputerscience,computing,andnetwork­
ingwithaspecialfocusonsoftwareengineering.IEEEComputerSocietymemberscontinueto
receivea15%discountonthesetitleswhenpurchasedthroughWileyoratwiley.com/ieeecs.
Tosubmitquestionsabouttheprogramorsendproposals,pleasecontactMaryHatcher,
Editor,Wiley-IEEEPress:Email:[email protected],Telephone:[phone],John
Wiley&Sons,Inc.,111RiverStreet,MS8-01,Hoboken,NJ07030-5774.
fi
Arti cial Immune System
Applications in Computer
Security
Ying Tan
Copyright2016bytheIEEEComputerSociety,Inc.Allrightsreserved.
PublishedbyJohnWiley&Sons,Inc.,Hoboken,NewJersey.
PublishedsimultaneouslyinCanada.
Nopartofthispublicationmaybereproduced,storedinaretrievalsystem,ortransmittedinanyformor
byanymeans,electronic,mechanical,photocopying,recording,scanning,orotherwise,exceptas
permittedunderSection107or108ofthe1976UnitedStatesCopyrightAct,withouteithertheprior
writtenpermissionofthePublisher,orauthorizationthroughpaymentoftheappropriateper-copyfeeto
theCopyrightClearanceCenter,Inc.,222RosewoodDrive,Danvers,MA01923,[phone],fax
[phone],oronthewebatwww.copyright.com.RequeststothePublisherforpermissionshouldbe
addressedtothePermissionsDepartment,JohnWiley&Sons,Inc.,111RiverStreet,Hoboken,NJ07030,
[phone],fax[phone],oronlineathttp://www.wiley.com/go/permission.
LimitofLiability/DisclaimerofWarranty:Whilethepublisherandauthorhaveusedtheirbesteffortsin
preparingthisbook,theymakenorepresentationsorwarrantieswithrespecttotheaccuracyor
completenessofthecontentsofthisbookandspecificallydisclaimanyimpliedwarrantiesof
merchantabilityorfitnessforaparticularpurpose.Nowarrantymaybecreatedorextendedbysales
representativesorwrittensalesmaterials.Theadviceandstrategiescontainedhereinmaynotbesuitable
foryoursituation.Youshouldconsultwithaprofessionalwhereappropriate.Neitherthepublishernor
authorshallbeliableforanylossofprofitoranyothercommercialdamages,includingbutnotlimitedto
special,incidental,consequential,orotherdamages.
Forgeneralinformationonourotherproductsandservicesorfortechnicalsupport,pleasecontactour
CustomerCareDepartmentwithintheUnitedStatesat(800)762-2974,outsidetheUnitedStatesat(317)
572-3993orfax(317)572-4002.
Wileyalsopublishesitsbooksinavarietyofelectronicformats.Somecontentthatappearsinprintmay
notbeavailableinelectronicformats.FormoreinformationaboutWileyproducts,visitourwebsiteat
www.wiley.com.
LibraryofCongressCataloging-in-PublicationDataisavailable.
ISBN:978-1-119-07628-5
PrintedintheUnitedStatesofAmerica.
10 9 8 7 6 5 4 3 2 1
Thisbookisdedicatedtomywife,ChaoDeng
andmydaughter,FeiTan

Contents
ListofFigures xiii
ListofTables xvii
Preface xix
Acknowledgments xxv
AbouttheAuthor xxvii
1. ArtificialImmuneSystem 1
1.1 Introduction 1
1.2 BiologicalImmuneSystem 2
1.2.1 Overview 2
1.2.2 AdaptiveImmuneProcess 2
1.3 CharacteristicsofaBiologicalImmuneSystem 4
1.4 ArtificialImmuneSystem 5
1.5 ArtificialImmuneSystemModelsandAlgorithms 7
1.5.1 NegativeSelectionAlgorithm 7
1.5.2 ClonalSelectionAlgorithm 9
1.5.3 ImmuneNetworkModel 11
1.5.4 DangerTheory 11
1.5.5 ImmuneConcentration 12
1.5.6 OtherMethods 14
1.6 CharacteristicsoftheArtificialImmuneSystem 14
1.6.1 DistributedDetection 15
1.6.2 DetectionofAbnormality 15
1.6.3 LearningandMemory 15
1.6.4 Diversity 15
1.6.5 IncompleteDetection 15
1.7 ApplicationsofArtificialImmuneSystem 16
1.7.1 VirusDetection 16
1.7.2 SpamFiltering 16
1.7.3 Robots 20
1.7.4 ControlEngineering 21
vii
viii Contents
1.7.5 FaultDiagnosis 21
1.7.6 OptimizedDesign 21
1.7.7 DataAnalysis 21
1.8 Summary 22
References 22
2. MalwareDetection 26
2.1 Introduction 26
2.2 Malware 27
2.2.1 DefinitionandFeatures 27
2.2.2 TheDevelopmentPhasesofMalware 28
2.3 ClassicMalwareDetectionApproaches 29
2.3.1 StaticTechniques 30
2.3.2 DynamicTechniques 30
2.3.3 Heuristics 31
2.4 Immune-basedMalwareDetectionApproaches 32
2.4.1 AnOverviewofArtificialImmuneSystem 32
2.4.2 AnOverviewofArtificialImmuneSystemforMalware
Detection 34
2.4.3 AnImmune-BasedVirusDetectionSystemUsingAffinity
Vectors 35
2.4.4 AHierarchicalArtificialImmuneModelforVirusDetection 36
2.4.5 AMalwareDetectionModelBasedonaNegativeSelectionAlgorithm
withaPenaltyFactor 38
2.5 Summary 42
References 42
3. ImmunePrincipleandNeuralNetworks-BasedMalwareDetection 46
3.1 Introduction 46
3.2 ImmuneSystemforMaliciousExecutableDetection 47
3.2.1 NonselfDetectionPrinciples 47
3.2.2 AnomalyDetectionBasedonThickness 47
3.2.3 RelationshipBetweenDiversityofDetectorRepresentationand
AnomalyDetectionHole 47
3.3 ExperimentalDataset 47
3.4 MalwareDetectionAlgorithm 48
3.4.1 DefinitionofDataStructures 48
3.4.2 DetectionPrincipleandAlgorithm 48
3.4.3 GenerationofDetectorSet 49
3.4.4 ExtractionofAnomalyCharacteristics 49
3.4.5 Classifier 51