1. Immune-inspired Network Intrusion Detection System (i-NIDS)
GECCO HUMIES
Immune-inspired Network Intrusion Detection System (i-NIDS)
M. Zubair Shafiq1, Syed Ali Khayam2, Muddassar Farooq1
1 Next Generation Intelligent Networks Research Center
National University of Computer & Emerging Sciences
Islamabad, Pakistan
2 School of Electrical Engineering & Computer Sciences
National University of Sciences & Technology
Rawalpindi, Pakistan

2. Human^ machine competitive
Introduction
Simple Human
competitive
Human^ machine competitive

3. Unfortunately, most computer viruses are not so courteous!

4. Threat numbers show the story of what’s happening?

5. These are Commercial Software…
Norton AV
Command AV
McAfee AV
Chernobyl-1.4
Not detected
F0sf0r0
Hare
Z0mbie-6.b
468% increase in malware attacks from
Signature matching!
Size of signature database cannot scale!
Inability to detect zero-day (novel) attacks!

6. Motivation for current work
A self-healing, self-defending and living artificial immune system
Proactive defense against zero-day attacks
Mapping concepts from A-life and evolution

7. Immune inspired Network Intrusion Detection System
Alarm Output
Adaptive Immune System/
Innate Immune System
Negative Selection
Dendritic Cell Algorithm
Intelligent Statistical Features
Memory of Markov Chain
Multi resolution session rate
Entropy of IP address
Divergence of port distribution
Network
Traffic Stream

8. Human^machine Competitive Results
Detector
TP rate (%)
FP rate (%)
[Classical Bio-inspired Detector]
Naïve RVNS
53.5
7.9
Naïve DCA
61.6
5.8
[State-of-the-art Statistical Detector]
Rate Limiting
84.4
1.4
Maximum Entropy
83.1
4.2
[Immune inspired NIDS]
i-RVNS
94.9
0.2
i-DCA
94.6
0.1

9. Engineered System Patent pending
Complete version will be ready in 1 year time; free download
US$200,000 grant to develop the final product from the National ICT R&D fund, Government of Pakistan

10. Why the best? In a nutshell…
1. Hard problem in hard domain; impossible for a human to solve
2. Evolved system better than human developed, commercial anti-virus software
3. Evolved system better than state-of-the-art statistical malware detectors
4. Hybrid of statistical-immune detectors; best of both worlds
5. Engineered product; open-source initiative

11. Publications (BEST PAPER NOMINATION)
A Comparative Study of Fuzzy Inference Systems, Neural Networks and Adaptive Neuro Fuzzy Inference Systems for Portscan Detection
M. Zubair Shafiq, Muddassar Farooq and Syed Ali Khayam
In M. Giacobini et al.(Eds.), Proceedings of Applications of Evolutionary Computing, EvoWorkshops 2007 (EuroGP-EvoCoMnet), Volume 4974 of Lecture Notes in Computer Science, pp. 48–57, Springer Verlag, Napoli, Italy, March,2008.
(BEST PAPER NOMINATION)
Improving the Accuracy of Immune-inspired Malware Detectors by using Intelligent Features
M. Zubair Shafiq, Syed Ali Khayam and Muddassar Farooq
In Genetic and Evolutionary Conference (GECCO), July, 2008, Atlanta, USA.

12. Unt ze Dream vill finally kome True!