A distributed surveillance model for network security inspired by immunology

Abstract

In the interest of surveying global attacks distributing in the networks, a distributed surveillance model for network security inspired by human immunity is proposed. The proposed model consists of attack detection agent, forensics sub-model, alarm sub-model and risk assessment sub-model. Through simulating immune mechanisms, a detection agent performs self-adaptation and self-learning to generate excellent detection elements and reach the target of attacks recognition. Local agents detect attacks independently and share the learning achievement with the other agents through communication. The sub-models realize the surveying process of evidence extraction, alarms configuration and quantitative risk assessment. Theoretical analysis shows that the proposed model effectively adapts the local network environment and globally improves the surveillance ability of network security. © 2011 Springer-Verlag.