Malicious code detection architecture inspired by human immune system

Malicious code is a threat to computer systems globally. In this paper, we outline the evolution of malicious code attacks. The threat is evolving, leaving challenges for attackers to improve attack techniques and for researchers and security specialists to improve detection accuracy. We present a novel architecture for an effective defense against malicious code attack, inspired by the human immune system. We introduce two phases of program execution: Adolescent and Mature Phase. The first phase uses a malware profile matching mechanism, whereas the second phase uses a program profile matching mechanism. Both mechanisms are analogous to the innate immune system

A malware detection system inspired on the human immune system

Malicious programs (malware) can cause severe damage on computer systems and data. The mechanism that the human immune system uses to detect and protect from organisms that threaten the human body is efficient and can be adapted to detect malware attacks. In this paper we propose a system to perform malware distributed collection, analysis and detection, this last inspired by the human immune system. After collecting malware samples from Internet, they are dynamically analyzed so as to provide execution traces at the operating system level and network flows that are used to create a behavioral model and to generate a detection signature. Those signatures serve as input to a malware detector, acting as the antibodies in the antigen detection process. This allows us to understand the malware attack and aids in the infection removal procedures. © 2012 Springer-Verlag.

The human immune system: Part 1

The immune system protects the human body against infectious and maligant disease. The concept of an immune system arose because of the observation that an attack of measles or mumps, two common childhood diseases, conferred an immunity on the individual, the immunity being specific to the disease. It was only much later that it was discovered that a system in the body conferred this immunity.

The human immune system Part 2: auto-immune disorders

For the immune system to function effectively, the body must be able to distinguish foreign antigens from self-antigens. However, the mechanisms which maintain this distinction may break down and result in auto-immune disease in which self-reacting antibodies and T-cells are produced. This article discusses first, the evidence for the existence of human auto-immune disease and second, the auto-immune diseases which have characteristic ocular symptoms.

The human immune system: Part 1

The immune system protects the human body against infectious and malignant disease. The concept of an immune system arose because of the observation that an attack of measles or mumps, two common childhood disease, conferred an immunity on the individual, the immunity being specific to the disease. It was only much later that it was discovered that a system in the body conferred this immunity. This article discusses the various components of the immune system, how they develop and their action in conferring immunity.

The human immune system: Part 2

For the immune system to function effectively, the body must be able to distinguish foreign antigens from self antigens. However, the mechanisms which maintain this distinction may break down and result in an auto-immune disease in which self-reacting antibodies and T-cells are produced. This article discusses first, the evidence for the existence of human auto-immune disease and second, the auto-immune diseases which have characteristic ocular symptoms.

An investigation of the molecular interactions between statins and bacterial pathogens, and their combined impact on the human immune system

Statins are a class of drug that inhibits cholesterol biosynthesis, and are used to treat patients with high serum cholesterol levels. They exert this function by competitively binding to the enzyme 3-hydroxy-3-methylglutaryl-CoenzymeA reductase (HMGR), which catalyses the formation of mevalonate, a rate-limiting step in cholesterol biosynthesis. In addition, statins have what are called “pleiotropic effects”, which include the reduction of inflammation, immunomodulation, and antimicrobial effects. Statins can also improve survival of patients with sepsis and pneumonia. Cystic fibrosis (CF) is the most common recessive inherited disease in the Caucasian population, which is characterised by factors including, but not limited to, excessive lung inflammation and increased susceptibility to infection. Therefore, the overall objective of this study was to examine the effects of statins on CFassociated bacterial pathogens and the host response. In this work, the prevalence of HMGR was examined in respiratory pathogens, and several CF-associated pathogens were found to possess homologues of this enzyme. HMGR homology was analysed in Staphylococcus aureus, Burkholderia cenocepacia and Streptococcus pneumoniae, and the HMGR of B. cenocepacia was found to have significant conservation to that of Pseudomonas mevalonii, which is the most widely-characterised bacterial HMGR. However, in silico analysis revealed that, unlike S. aureus and S. pneumoniae, B. cenocepacia did not possess homologues of other mevalonate pathway proteins, and that the HMGR of B. cenocepacia appeared to be involved in an alternative metabolic pathway. The effect of simvastatin was subsequently tested on the growth and virulence of S. aureus, B. cenocepacia and S. pneumoniae. Simvastatin inhibited the growth of all 3 species in a dose-dependent manner. In addition, statin treatment also attenuated biofilm formation of all 3 species, and reduced in vitro motility of S. aureus. Interestingly, simvastatin also increased the potency of the aminoglycoside antibiotic gentamicin against B. cenocepacia. The impact of statins was subsequently tested on the predominant CF-associated pathogen Pseudomonas aeruginosa, which does not possess a HMGR homologue. Mevastatin, lovastatin and simvastatin did not influence the growth of this species. However, sub-inhibitory statin concentrations reduced the swarming motility and biofilm formation of P. aeruginosa. The influence of statins was also examined on Type 3 toxin secretion, quorum sensing and chemotaxis, and no statin effect was observed on any of these phenotypes. Statins did not appear to have a characteristic effect on the P. aeruginosa transcriptome. However, a mutant library screen revealed that the effect of statins on P. aeruginosa biofilm was mediated through the PvrR regulator and the Cup fimbrial biosynthesis genes. Furthermore, proteomic analysis demonstrated that 6 proteins were reproducibly induced by simvastatin in the P. aeruginosa swarming cells. The effect of statins on the regulation of the host-P. aeruginosa immune response was also investigated. Statin treatment increased expression of the pro-inflammatory cytokines IL-8 and CCL20 in lung epithelial cells, but did not attenuate P. aeruginosa-mediated inflammatory gene induction. In fact, simvastatin and P. aeruginosa caused a synergistic effect on CCL20 expression. The expression of the transcriptional regulators KLF2 and KLF6 was also increased by statins and P. aeruginosa, with the induction of KLF6 by simvastatin proving to be a novel effect. Interestingly, both statins and P. aeruginosa were capable of inducing alternative splicing of KLF6. P. aeruginosa was found to induce KLF6 alternative splicing by way of the type 3 secreted toxin ExoS. In addition, a mechanistic role was elucidated for KLF6 in the lung, as it was determined that statin-mediated induction of this protein was responsible for the induction of the host response genes CCL20 and iNOS. Moreover, statin treatment caused a slight increase in infection-related cytotoxicity, and increased bacterial adhesion to cells. Taken together, these data demonstrate that statins can reduce the virulence of CFassociated bacterial pathogens and alter host response effectors. Furthermore, novel statin effectors were identified in both bacterial and host cells.

An artificial immune system for data analysis

Timmis J and Neal M J. An artificial immune system for data analysis. In Proceedings of 3rd international workshop on information processing in cells and tissues (IPCAT), Indianapolis, U.S.A., 1999.

The immune system as drug target

The immune system is perhaps the largest yet most diffuse and distributed somatic system in vertebrates. It plays vital roles in fighting infection and in the homeostatic control of chronic disease. As such, the immune system in both pathological and healthy states is a prime target for therapeutic interventions by drugs-both small-molecule and biologic. Comprising both the innate and adaptive immune systems, human immunity is awash with potential unexploited molecular targets. Key examples include the pattern recognition receptors of the innate immune system and the major histocompatibility complex of the adaptive immune system. Moreover, the immune system is also the source of many current and, hopefully, future drugs, of which the prime example is the monoclonal antibody, the most exciting and profitable type of present-day drug moiety. This brief review explores the identity and synergies of the hierarchy of drug targets represented by the human immune system, with particular emphasis on the emerging paradigm of systems pharmacology. © the authors, publisher and licensee Libertas Academica Limited.

'Immune System Approaches to Intrusion Detection - A Review'

Abstract. The use of artificial immune systems in intrusion detection is an appealing concept for two reasons. Firstly, the human immune system provides the human body with a high level of protection from invading pathogens, in a robust, self-organised and distributed manner. Secondly, current techniques used in computer security are not able to cope with the dynamic and increasingly complex nature of computer systems and their security. It is hoped that biologically inspired approaches in this area, including the use of immune-based systems will be able to meet this challenge. Here we collate the algorithms used, the development of the systems and the outcome of their implementation. It provides an introduction and review of the key developments within this field, in addition to making suggestions for future research.

'Malicious Code Execution Detection and Response Immune System inspired by the Danger Theory'

The analysis of system calls is one method employed by anomaly detection systems to recognise malicious code execution. Similarities can be drawn between this process and the behaviour of certain cells belonging to the human immune system, and can be applied to construct an artificial immune system. A recently developed hypothesis in immunology, the Danger Theory, states that our immune system responds to the presence of intruders through sensing molecules belonging to those invaders, plus signals generated by the host indicating danger and damage. We propose the incorporation of this concept into a responsive intrusion detection system, where behavioural information of the system and running processes is combined with information regarding individual system calls.

Immune System Approaches to Intrusion Detection - A Review

The use of artificial immune systems in intrusion detection is an appealing concept for two reasons. Firstly, the human immune system provides the human body with a high level of protection from invading pathogens, in a robust, self-organised and distributed manner. Secondly, current techniques used in computer security are not able to cope with the dynamic and increasingly complex nature of computer systems and their security. It is hoped that biologically inspired approaches in this area, including the use of immune-based systems will be able to meet this challenge. Here we review the algorithms used, the development of the systems and the outcome of their implementation. We provide an introduction and analysis of the key developments within this field, in addition to making suggestions for future research.

'Immune System Approaches to Intrusion Detection - A Review'

Abstract. The use of artificial immune systems in intrusion detection is an appealing concept for two reasons. Firstly, the human immune system provides the human body with a high level of protection from invading pathogens, in a robust, self-organised and distributed manner. Secondly, current techniques used in computer security are not able to cope with the dynamic and increasingly complex nature of computer systems and their security. It is hoped that biologically inspired approaches in this area, including the use of immune-based systems will be able to meet this challenge. Here we collate the algorithms used, the development of the systems and the outcome of their implementation. It provides an introduction and review of the key developments within this field, in addition to making suggestions for future research.

'Malicious Code Execution Detection and Response Immune System inspired by the Danger Theory'

The analysis of system calls is one method employed by anomaly detection systems to recognise malicious code execution. Similarities can be drawn between this process and the behaviour of certain cells belonging to the human immune system, and can be applied to construct an artificial immune system. A recently developed hypothesis in immunology, the Danger Theory, states that our immune system responds to the presence of intruders through sensing molecules belonging to those invaders, plus signals generated by the host indicating danger and damage. We propose the incorporation of this concept into a responsive intrusion detection system, where behavioural information of the system and running processes is combined with information regarding individual system calls.

Immune System Approaches to Intrusion Detection - A Review

The use of artificial immune systems in intrusion detection is an appealing concept for two reasons. Firstly, the human immune system provides the human body with a high level of protection from invading pathogens, in a robust, self-organised and distributed manner. Secondly, current techniques used in computer security are not able to cope with the dynamic and increasingly complex nature of computer systems and their security. It is hoped that biologically inspired approaches in this area, including the use of immune-based systems will be able to meet this challenge. Here we review the algorithms used, the development of the systems and the outcome of their implementation. We provide an introduction and analysis of the key developments within this field, in addition to making suggestions for future research.