THE way the body鈥檚 immune system responds when its cells are under attack has inspired a new way of protecting computer networks from viruses and hackers.
An intrusion detection system for networks that listens for distress signals from besieged computers is being developed by a team led by computer scientist Uwe Aickelin at the University of Nottingham in the UK. It is designed to offer networks better protection from the ravages of email viruses and denial of service attacks, and in tests has already defended a network against simulated hacker attacks.
Researchers have been trying to develop artificial immune systems for computer networks for more than a decade, says Steve Cayzer, a computational neuroscientist at HP Labs in Bristol, UK. The way our immune system detects attacks from unknown pathogens makes it an ideal model, he says.
Advertisement
Most such approaches so far have tended to mimic the way the white blood cells of the immune system watch out for molecules that are not 鈥渟elf鈥�, such as proteins made by viruses, bacteria and parasites. These approaches used software to police the network in a similar way. However, in computer systems this tactic means dangerous activity can be overlooked if it appears legitimate, such as a virus disguised as an ordinary email.
The Nottingham team鈥檚 approach is instead based on an alternative model of how the immune system works, called danger theory. According to this, the immune system does not attack foreign molecules whenever it detects them, but only if they start to cause trouble, says Julie McLeod, an immunologist at the University of the West of England in Bristol.
This may help explain anomalies in the self/non-self explanation of immunity, such as why our immune system does not attack proteins ingested as food, or why a pregnant mother鈥檚 immune system does not turn on her fetus. 鈥淲e don鈥檛 recognise these as dangerous or foreign,鈥� she says.
Working with Aickelin and Cayzer, McLeod and colleagues have been studying dendritic cells, the front-line soldiers of the immune system, which pick up distress signals given off when other cells in the body die. The team鈥檚 research suggests that dendritic cells only respond to this alarm call from cells when the 鈥渧olume鈥� exceeds a certain threshold.
鈥淭he system cuts out false alarms caused by unusual but legitimate activity鈥�
Aickelin has now mimicked this approach in the new security system. Its software behaves like the dendritic cells, scouring the network looking for danger signals such as sudden increases in network traffic or unusually high numbers of error messages. If these signals increase above a preset threshold, the alarm is sounded. 鈥淭he system works by detecting stress,鈥� he says.
This helps to cut out false alarms caused by unusual but perfectly legitimate activity, says Cayzer. For example, there is nothing wrong with a computer being 鈥減inged鈥� by a PC from outside the network seeking to verify its IP address and check whether it is online. 鈥淏ut if you have millions of them, that is a denial of service attack,鈥� he says.
