An Analysis of the Performance of an Artificial Immune Approach to Detecting Infections in Computer Programs

P. Widulinski, K. Wawryn (Koszalin Univ. of Techn., Poland)

In this paper, an analysis of theoretical and experimental performance of an intrusion detection system (IDS) in terms of detection rates (true positive ratios) is presented. The IDS is based on an artificial immune system (AIS) approach, inspired by the human immune system. Using both known and modified negative-selection-based methods, the IDS monitors a directory for possible program infections, and reports anomalies to the user. A probabilistic approach is utilized to determine the system's theoretical true positive ratios for a wide range of testing parameters. Experimental tests are conducted for comparison with the theoretical outcome and presented. The results are then compared, analyzed and concluded.