US 2017/0374091 A1 · DIGITAL IMMUNE SYSTEM FOR INTRUSION DETECTION ON DATA PROCESSING SYSTEMS AND NETWORKS

Abstract

A method for detecting intrusion is provided using a combination of two AIS algorithms: Negative Selection Algorithm (NSA) and Dendritic Cell Algorithm (DCA). The method includes the following steps, or some functional subset of these steps: periodic monitoring of a data processing system for anomalous behavior that may indicate the presence of an intruder or an undesirable software; using the NSA for the generation of a population of detectors that are used for detecting anomalies in the monitored system via a matching criterion; using the DCA (which runs in parallel to the NSA) to sample traffic and signals coming in or out of the data processing system; using an aggregation system to combine the individual decisions of the NSA and the DCA to form a single final decision.

Claims28

Dependent claims

A system for detecting insider or outsider attacks/intrusions, comprising:

a local node;
one or more computing nodes connected to the local node;
and
a detection module in the local node that is operative to perform actions, including:
using a plurality of sensors to measure data indicative of the state of the environment of the sensor;
using a data fusion module to combine all the different data obtained from the various sensors to form a single chunk of data;
passing the combined data to a data preprocessing module for processing, wherein the data pre-processing module extracts an input signal vector from the combined data chunk;
using the dendritic cell module (DCA) to analyze the input signal vector to produce a single signal;
using the negative selection (NSA) module to analyze the input signal vector to produce a single signal;
using an aggregator module to combine the single signals generated by the NSA and DCA module respectively to produce an anomaly signal value;
and
using a decision module to decide if an unauthorized activity/traffic is detected using the anomaly signal value.

9 more elements

A method of operating a computer network comprising a plurality of computing nodes and a server, the method comprising:

running the detection module on each of the computing nodes and the server;
generating a result for detecting insider/outsider threat at any of the computing nodes by analyzing the data from activities/traffic gathered by a plurality of sensors linked to the computing nodes based on predefined criteria established by the detector module running on the computing nodes;
comparing the confidence value of the results generated by each detector module running on computing nodes to their individual predefined confidence value;
each computing node sending a result request/query signal to the server if any of their new result confidence value is less than their individual predefined confidence values;
the server responding to any result request/query with a new result having a new confidence value;
each computing node that made a request selecting either the old result or the new result whichever has a greater confidence value than the predefined confidence value;
and
for a result accepted by any computing node, if the anomaly value of the result is greater than a predetermined threshold, the activities/traffic under test are/is classified as an intrusion/attack, else, it is classified as normal or benign.

5 more elements

A method of operating a distributed computer network comprising a plurality of computing nodes, the method comprising:

running the detection module on each of the computing nodes;
generating a result for detecting insider/outsider threat at any of the computing nodes by analyzing the data from activities/traffic gathered by a plurality of sensors linked to the computing nodes based on predefined criteria established by the detector module running on the computing nodes;
comparing the confidence value of the results generated by each detector module running on computing nodes to their individual predefined confidence value;
each computing node sending a result request/query signal to a neighboring computing node if any of their new result confidence value is less than their individual predefined confidence values;
the neighboring computing node responding to any result request/query with a new result having a new confidence value;
each computing node that made a request selecting either the old result or the new result whichever has a greater confidence value than the predefined confidence value;
and
for a result accepted by any computing node, if the anomaly value of the result is greater than a predetermined threshold, the activities/traffic under test are/is classified as an intrusion/attack, else, it is classified as normal or benign.

5 more elements

Dependencies are inferred from the claim text.

Digital immune system for intrusion detection on data processing systems and networks

Life of this patent

Digital immune system for intrusion detection on data processing systems and networks

Life of this patent

Abstract

Claims28