Artificial Immune System against Viral Attack

Slides:

Advertisements

Similar presentations

Code-Red : a case study on the spread and victims of an Internet worm David Moore, Colleen Shannon, Jeffery Brown Jonghyun Kim.

Advertisements

Reporter: Jing Chiu Advisor: Yuh-Jye Lee /7/181Data Mining & Machine Learning Lab.

By Hiranmayi Pai Neeraj Jain

Characterizing Non- Gaussianities or How to tell a Dog from an Elephant Jesús Pando DePaul University.

Day anti-virus anti-virus 1 detecting a malicious file malware, detection, hiding, removing.

Optimal Analyses for 3  n AB Games in the Worst Case Li-Te Huang and Shun-Shii Lin Dept. of Computer Science & Information Engineering, National Taiwan.

1 Detection of Injected, Dynamically Generated, and Obfuscated Malicious Code (DOME) Subha Ramanathan & Arun Krishnamurthy Nov 15, 2005.

Anomaly Detection Steven M. Bellovin Matsuzaki ‘maz’ Yoshinobu 1.

Linear Obfuscation to Combat Symbolic Execution Zhi Wang 1, Jiang Ming 2, Chunfu Jia 1 and Debin Gao 3 1 Nankai University 2 Pennsylvania State University.

Polymorphic blending attacks Prahlad Fogla et al USENIX 2006 Presented By Himanshu Pagey.

Software Security Threats Threats have been an issue since computers began to be used widely by the general public.

5/1/2006Sireesha/IDS1 Intrusion Detection Systems (A preliminary study) Sireesha Dasaraju CS526 - Advanced Internet Systems UCCS.

Expectation Maximization Method Effective Image Retrieval Based on Hidden Concept Discovery in Image Database By Sanket Korgaonkar Masters Computer Science.

Ragib Hasan Johns Hopkins University en Spring 2011 Lecture 10 04/18/2011 Security and Privacy in Cloud Computing.

An Authentication Service Against Dishonest Users in Mobile Ad Hoc Networks Edith Ngai, Michael R. Lyu, and Roland T. Chin IEEE Aerospace Conference, Big.

Artificial Immune Systems Our body’s immune system is a perfect example of a learning system. It is able to distinguish between good cells and potentially.

Cmpt-225 Simulation. Application: Simulation Simulation  A technique for modeling the behavior of both natural and human-made systems  Goal Generate.

What is it, how does it work, and why is it important?

Jarhead Analysis and Detection of Malicious Java Applets Johannes Schlumberger, Christopher Kruegel, Giovanni Vigna University of California Annual Computer.

Automated malware classification based on network behavior

Over the last years, the amount of malicious code (Viruses, worms, Trojans, etc.) sent through the internet is highly increasing. Due to this significant.

A Statistical Anomaly Detection Technique based on Three Different Network Features Yuji Waizumi Tohoku Univ.

Computer Viruses Preetha Annamalai Niranjan Potnis.

Hacker Zombie Computer Reflectors Target.

Behavior-based Spyware Detection By Engin Kirda and Christopher Kruegel Secure Systems Lab Technical University Vienna Greg Banks, Giovanni Vigna, and.

WHAT IS VIRUS? NAE GRAND CHALLENGE SECURE CYBERSPACE.

nd Joint Workshop between Security Research Labs in JAPAN and KOREA Profile-based Web Application Security System Kyungtae Kim High Performance.

 Two types of malware propagating through social networks, Cross Site Scripting (XSS) and Koobface worm.  How these two types of malware are propagated.

A virus is software that spreads from program to program, or from disk to disk, and uses each infected program or disk to make copies of itself. Basically.

CHAPTER 14 Viruses, Trojan Horses and Worms. INTRODUCTION Viruses, Trojan Horses and worm are malicious programs that can cause damage to information.

1 A Feature Selection and Evaluation Scheme for Computer Virus Detection Olivier Henchiri and Nathalie Japkowicz School of Information Technology and Engineering.

Operating system Security By Murtaza K. Madraswala.

HIPS Host-Based Intrusion Prevention System By Ali Adlavaran & Mahdi Mohamad Pour (M.A. Team) Life’s Live in Code Life.

IEEE Communications Surveys & Tutorials 1st Quarter 2008.

Biologically Inspired Defenses against Computer Viruses International Joint Conference on Artificial Intelligence 95’ J.O. Kephart et al.

Intelligent Database Systems Lab 國立雲林科技大學 National Yunlin University of Science and Technology 1 Virus Pattern Recognition Using Self-Organization Map.

CISC Machine Learning for Solving Systems Problems Presented by: Ashwani Rao Dept of Computer & Information Sciences University of Delaware Learning.

Wireless communications and mobile computing conference, p.p , July 2011.

Speaker : Yu-Hui Chen Authors : Dinuka A. Soysa, Denis Guangyin Chen, Oscar C. Au, and Amine Bermak From : 2013 IEEE Symposium on Computational Intelligence.

CISC Machine Learning for Solving Systems Problems Presented by: Satyajeet Dept of Computer & Information Sciences University of Delaware Automatic.

Search Worms, ACM Workshop on Recurring Malcode (WORM) 2006 N Provos, J McClain, K Wang Dhruv Sharma

nd Joint Workshop between Security Research Labs in JAPAN and KOREA Polymorphic Worm Detection by Instruction Distribution Kihun Lee HPC Lab., Postech.

Intrusion Detection Systems Paper written detailing importance of audit data in detecting misuse + user behavior 1984-SRI int’l develop method of.

Introduction Program File Authorization Security Theorem Active Code Authorization Authorization Logic Implementation considerations Conclusion.

Advanced Anti-Virus Techniques

I NTRUSION P REVENTION S YSTEM (IPS). O UTLINE Introduction Objectives IPS’s Detection methods Classifications IPS vs. IDS IPS vs. Firewall.

Speaker : Yu-Hui Chen Authors : Dinuka A. Soysa, Denis Guangyin Chen, Oscar C. Au, and Amine Bermak From : 2013 IEEE Symposium on Computational Intelligence.

Network-based and Attack-resilient Length Signature Generation for Zero-day Polymorphic Worms Zhichun Li 1, Lanjia Wang 2, Yan Chen 1 and Judy Fu 3 1 Lab.

Intelligent Database Systems Lab 國立雲林科技大學 National Yunlin University of Science and Technology 2005.ACM GECCO.8.Discriminating and visualizing anomalies.

Active Learning for Network Intrusion Detection ACM CCS 2009 Nico Görnitz, Technische Universität Berlin Marius Kloft, Technische Universität Berlin Konrad.

Some Great Open Source Intrusion Detection Systems (IDSs)

SELF-DEFENDING NETWORK. CONTENTS Introduction What is Self Defending Network? Types of Network Attacks Structure of Self Defending Network Conclusion.

Learning to Detect and Classify Malicious Executables in the Wild by J

A Multi-gigabit Rate Deep Packet Inspection Algorithm using TCAM

V. A. Memos and K. E. Psannis*

SEMINAR ON PC SECURITY FROM VIRUSES

Techniques, Tools, and Research Issues

Cyber Security By: Pratik Gandhi.

Operating system Security

Research on Immunizing Embedded Linux Core Against Viruses and Software Faults Tao Gong1, 2, 3, Changxing Du1 1 College of Information S. & T., Donghua.

With so many major corporations and people falling victim to cybercrimes and with viruses and malware infecting several computers and networks around.

Roland Kwitt & Tobias Strohmeier

12: Security The Security Problem Authentication Program Threats

Effective Social Network Quarantine with Minimal Isolation Costs

Malware and how to defend against it

Operating System Concepts

Autonomous Network Alerting Systems and Programmable Networks

IASP 470 PROJECT PROPOSAL MALWARE DETECTION

Parallel Feature Identification and Elimination from a CFD Dataset

An overview over Botnets

Presentation transcript:

Artificial Immune System against Viral Attack ICCS 2004 2018-11-27 Artificial Immune System against Viral Attack Hyung Joon Lee Wonil Kim Manpyo Hong 2018-11-27 Wonil Kim, Sejong University Wonil Kim, Sejong University

Wonil Kim, Sejong University ICCS 2004 2018-11-27 Contents Introduction Artificial immune system Proposed Virus Detection System (VDS) Simulation Conclusion 2018-11-27 Wonil Kim, Sejong University Wonil Kim, Sejong University

Wonil Kim, Sejong University Introduction Computer virus detection system Scanning detection has been used as a primary method in virus detection system No longer able to detect various forms of viruses and worms effectively This paper proposes artificial immune based virus detection system that can detect unknown viruses 2018-11-27 Wonil Kim, Sejong University

Artificial Immune System Human Immune System Distinguishing self from dangerous non-self and eliminating the non-self Artificial Immune System for Computer Security Distinguishing benign program from malicious program 2018-11-27 Wonil Kim, Sejong University

Wonil Kim, Sejong University The proposed VDS Signature learning system to detect unknown viruses Anomaly detection Use the ideas of negative selection and decoy program Ignore common part with self Select similar part among non self 2018-11-27 Wonil Kim, Sejong University

Wonil Kim, Sejong University 3 steps 1st step : VDS assumes that all existing programs are legitimate 2nd step : All the incoming and changed programs are classified into suspicious program 3rd step : VDS selects virus programs using detection method based on virus behavior 2018-11-27 Wonil Kim, Sejong University

Wonil Kim, Sejong University 3 components Signature representation Signature extractor Signature selector 2018-11-27 Wonil Kim, Sejong University

Proposed Virus Detection System Self signatures 2018-11-27 Wonil Kim, Sejong University

Signature Representation 2018-11-27 Wonil Kim, Sejong University

Wonil Kim, Sejong University Signature Extractor 2018-11-27 Wonil Kim, Sejong University

Wonil Kim, Sejong University Signature Selector Calculates the similarity values of non-self signatures 2018-11-27 Wonil Kim, Sejong University

Wonil Kim, Sejong University Similarity values between signatures of the same program code are higher than the others. Therefore, the proposed VDS can distinguish signatures of the same program codes from signatures of other distinct program codes The threshold value for classifying signatures of the same and different programs are determined by analyzing similarity values of the entire non-self programs 2018-11-27 Wonil Kim, Sejong University

Simulation Parameters Variables # of self programs 1385 execution files # of non-self programs 160 execution files ( 3 virus infected files ) SER size 500Byte, 1Kbyte, 5Kbyte, 10Kbyte Comparison unit size 1Byte, 2Byte, 3Byte 2018-11-27 Wonil Kim, Sejong University

Simulation (Signature Extractor) 2018-11-27 Wonil Kim, Sejong University

Wonil Kim, Sejong University Signature size and similarity values are important factors in VDS Larger extraction regions and comparison unit  larger signature Larger than 1K byte is not feasible % of zero signature is independent(8.75%) 1K byte and 500byte are chosen (SER) 2018-11-27 Wonil Kim, Sejong University

Wonil Kim, Sejong University Signature selector (1) 2018-11-27 Wonil Kim, Sejong University

Wonil Kim, Sejong University Signature selector (2) 2018-11-27 Wonil Kim, Sejong University

Wonil Kim, Sejong University Since the % of the actual virus infected file is 1.875% (3 of 160), the ideal % of signatures that the similarity value is zero should be 98.125% Need to determine threshold value for similarity value SER 1 K byte with 3 byte comparison unit, and 1.e+08 of similarity value selects three signatures 2018-11-27 Wonil Kim, Sejong University

Wonil Kim, Sejong University Conclusion Proposed VDS can classify suspicious non-self programs into normal programs and viral programs 94% of extracted signature were completely different. Remaining 6% signatures including virus signatures had distinguished similarity values. Especially, 2% virus signatures had relatively high similarity values. 2018-11-27 Wonil Kim, Sejong University