Nature-Inspired Cyber Security and Resiliency: Fundamentals, techniques and applications

Cover
Contents
Preface
About the editors
1 Nature-inspired analogies and metaphors for cyber security
	1.1 Historical examples of the nature-inspired inventions
	1.2 Classification of the nature-inspired inventions
	1.3 Nature-inspired analogies and metaphors for cyber security: needed or not?
		1.3.1 Adaptability as a key factor in nature
			1.3.1.1 Communication networks and adaptability
			1.3.1.2 Cyber security and adaptability
	1.4 Cyber security ecology
		1.4.1 Cyber ecosystem
		1.4.2 Cyber-ecology and its subtypes
		1.4.3 Cyber ecosystem interactions
	1.5 Early nature-inspired terminology in cyber security
	1.6 Recent nature-inspired analogies and metaphors for cyber security
		1.6.1 Nature-inspired cyber security inspired by an organism\'s characteristic feature/defence mechanism
		1.6.2 Nature-inspired cyber security inspired by organisms\' interactions
		1.6.3 Generalised attack scenario analogy
			1.6.3.1 Three lines of defence in nature
			1.6.3.2 Mapping nature lines of defence to cyber security – main findings
	1.7 Conclusion and outlook
	References
2 When to turn to nature-inspired solutions for cyber systems
	2.1 Why natural systems are tempting
		Promising characteristics of natural systems
		2.1.1 Analogous qualities in engineered cyber systems
	2.2 How biological systems develop solutions
		2.2.1 Darwinian evolution
			2.2.1.1 Fitness
			2.2.1.2 Competition
			Important note
		2.2.2 Avoiding a common trap: best may not be good
			2.2.2.1 An illustrative example of evolution failing to converge on a single \"best\" solution
		2.2.3 Does this make natural systems poor sources of inspiration?
			Important note
	2.3 Evidence of success from nature-inspired efforts
		2.3.1 A standard pattern in nature-inspired design research
	2.4 A few of nature\'s tools
		2.4.1 Proximate cues
		2.4.2 Distributed decisions
		2.4.3 Error convergence
	2.5 Synergy among nature\'s tools
	2.6 Potential pitfalls in nature-inspired algorithms specific to cyber security and resilience
		2.6.1 Coevolutionary arms races
		2.6.2 Designed threats versus evolved threats
		2.6.3 Trade-offs between security and privacy may be different for each design component
			2.6.3.1 Proximate cues must be relatively \"leak-proof\"
			2.6.3.2 Distributed decision-making
			2.6.3.3 Error convergence
	2.7 When NOT to use nature-inspired algorithms
	2.8 Conclusions
	Acknowledgments
	References
3 Bioinspired collaboration and cyber security
	3.1 Collaboration
		3.1.1 Computer-supported cooperative work
		3.1.2 Service-oriented architecture
		3.1.3 Online social networks
		3.1.4 Multi-agent systems
	3.2 Bioinspired cooperation
		3.2.1 Cooperation in swarm intelligence
		3.2.2 Coordination in chemistry
	3.3 Access control for bioinspired cooperation
		3.3.1 Traditional access control models
		3.3.2 Access control models for bioinspired collaboration
			3.3.2.1 Existing access control models for cooperation
			3.3.2.2 Role-interaction-based access control
			3.3.2.3 Dynamic role-interaction based access control
			3.3.2.4 Community-centric role-interaction-based access control
			3.3.2.5 CPBAC
	3.4 Conclusions and future work
	References
4 Immune-based defence and resiliency
	4.1 Introduction
	4.2 Definitions
	4.3 Core contributions
		4.3.1 Immunity basics
			4.3.1.1 Innate and acquired immunity
			4.3.1.2 Self and non-self
			4.3.1.3 Selection, cloning and deletion
			4.3.1.4 Danger
			4.3.1.5 The three-signal model
		4.3.2 Complexity aspects of the immune system
			4.3.2.1 The idiotypic network
			4.3.2.2 Modelling self-assertion and immune tolerance
			4.3.2.3 Empirical validation of immune affinities
			4.3.2.4 Multi-scale mechanisms
			4.3.2.5 The contributions of idiotypic networks
		4.3.3 Immune properties of natural organisms
	4.4 Applications
		4.4.1 Immuno-engineering
		4.4.2 Artificial immune systems
			4.4.2.1 Research efforts on AIS
			4.4.2.2 First-generation artificial immune systems
			4.4.2.3 Second-generation artificial immune systems
		4.4.3 AIS for intrusion detection
		4.4.4 Immune properties of artificial systems
		4.4.5 Limitations and perspectives of AIS applications
	4.5 Conclusions and perspectives
	References
5 Bio-inspired approaches for security and resiliency of network traffic
	5.1 Introduction
		5.1.1 Biological approaches
		5.1.2 Network regimes
	5.2 Biological methods as models for network traffic analysis
		5.2.1 Information flow
		5.2.2 Multi-organism coordination: flocking, swarming and social insects
		5.2.3 Collective decision-making: thresholds, consensus and feedback
		5.2.4 Autonomy and autonomic control
		5.2.5 Redundancy, diversity and programmed death
		5.2.6 Learning and cognition
		5.2.7 A few notes of caution when applying biological concepts to computer networks
			5.2.7.1 Equilibrium vs.homeostasis
			5.2.7.2 Trade-off between optimality and robustness
			5.2.7.3 Latent vs. expressed properties
	5.3 Applying biological methods to network traffic
		5.3.1 Identifying normal and anomalous network traffic
			5.3.1.1 Machine learning
			5.3.1.2 Swarm intelligence
			5.3.1.3 Sequence analysis and other methods
		5.3.2 Network design and management
			5.3.2.1 Automaticity and autonomic control
			5.3.2.2 Information exchange
			5.3.2.3 Other methods
		5.3.3 Routing
			5.3.3.1 Autonomic control
			5.3.3.2 Machine learning
			5.3.3.3 Coordination without centralized control: swarms and social insects
	5.4 Conclusions and future directions
	References
6 Security and resilience for network traffic through nature-inspired approaches
	6.1 Introduction
	6.2 Service delivery vehicle—Moving-target Defense (MtD) technique
		6.2.1 Diversity concept
		6.2.2 Diversity as a fundamental concept for moving-target defense (MtD)
		6.2.3 MtD techniques and applications in the OSI layer
			6.2.3.1 MtD in the cloud layer
			6.2.3.2 MtD in the network layer
			6.2.3.3 MtD in the signals and communication layers
	6.3 The driver—artificial intelligence (AI) fundamentals
		6.3.1 Natural-inspired AI fundamentals and techniques
			6.3.1.1 Ant colony algorithms
			6.3.1.2 Genetic algorithms
			6.3.1.3 Artificial neural network
			6.3.1.4 Others
		6.3.2 Artificial intelligence applications across some OSI layers
	References
7 Towards nature-inspired machine-learning approach for cyber security
	7.1 Introduction
	7.2 Review of nature-inspired solutions for pattern extraction and machine learning
	7.3 From data to knowledge
		7.3.1 Raw-requests and hidden structure
		7.3.2 Time-series of traffic statistics
	7.4 Nature-inspired feature extraction algorithms
		7.4.1 Using genetic algorithm to identify structure in HTTP requests
		7.4.2 Evolutionary approach for content validation
		7.4.3 Results
	7.5 The concept of lifelong and nature-inspired machine learning
		7.5.1 The LML in cyber security
		7.5.2 Mathematical background behind LML
		7.5.3 Data imbalance
		7.5.4 Practical application of LML concept
		7.5.5 Remarks on effectiveness
	7.6 Conclusions
	References
8 Artificial intelligence and data analytics for encrypted traffic classification on anonymity networks
	8.1 Introduction
	8.2 Background
		8.2.1 Anonymity networks
			8.2.1.1 I2P
			8.2.1.2 JonDonym
			8.2.1.3 The onion router
		8.2.2 Measuring anonymity
		8.2.3 Identification of anonymity networks by infrastructure
		8.2.4 Identification of applications and services on the anonymity network
	8.3 Data analytics for encrypted network traffic
		8.3.1 Datasets
		8.3.2 Artificial intelligence and data analytics
			8.3.2.1 Decision tree—C4.5
			8.3.2.2 Random forests
			8.3.2.3 Naive Bayes
			8.3.2.4 Bayesian network
			8.3.2.5 Self-organizing map
		8.3.3 Flow exporters
	8.4 Empirical evaluations
		8.4.1 Using circuit level information
		8.4.2 Using flow level information
			8.4.2.1 Experiments with I2P traffic
			8.4.2.2 Experiments with JonDonym traffic
			8.4.2.3 Experiments with Tor traffic
		8.4.3 Using packet level information
		8.4.4 Nature-inspired learning for encrypted traffic analysis
	8.5 Conclusions and future work
	References
9 Bio/nature-inspired algorithms in A.I. for malicious activity detection
	9.1 Introduction
	9.2 Towards technology through nature
		9.2.1 Terminologies of bio/nature-inspired algorithms
			9.2.1.1 Populations
			9.2.1.2 Selection
			9.2.1.3 Crossover
			9.2.1.4 Mutation
		9.2.2 Review of bio/nature-inspired algorithms
			9.2.2.1 Artificial neural networks
			9.2.2.2 Evolutionary algorithms
			9.2.2.3 Swarm intelligence algorithms
			9.2.2.4 Artificial immune systems
			9.2.2.5 Fuzzy logic
			9.2.2.6 Chaos theory
			9.2.2.7 Game theory
	9.3 Cyberattacks and malware detection
		9.3.1 Distributed/Denial of service attacks
		9.3.2 Botnets
		9.3.3 Malware
			9.3.3.1 Viruses
			9.3.3.2 (Remote access) Trojan horses
			9.3.3.3 Rootkits
			9.3.3.4 Backdoors
			9.3.3.5 Spyware
			9.3.3.6 Worms
			9.3.3.7 Ransomware
		9.3.4 Probe attacks
		9.3.5 Buffer overflow
		9.3.6 Brute force attack
		9.3.7 Masquerading attacks
		9.3.8 Datasets used in intrusion detection
			9.3.8.1 DARPA dataset
			9.3.8.2 KDD99 dataset
			9.3.8.3 ISCX IDS 2012 dataset
			9.3.8.4 ISCX IDS 2017 dataset
			9.3.8.5 Botnet dataset
			9.3.8.6 CIC DoS dataset
			9.3.8.7 TheAWID dataset
			9.3.8.8 The UNSW-NB15 dataset
	9.4 Bio/Nature-inspired algorithm studies in intrusion detection
		9.4.1 Game theoretic studies
		9.4.2 Evolution strategies studies
		9.4.3 Genetic algorithms studies
		9.4.4 Fuzzy logic studies
		9.4.5 Swarm intelligence studies
		9.4.6 Artificial neural network studies
		9.4.7 Artificial immune systems studies
		9.4.8 Chaos theory studies
	9.5 Case study: application layer (D)DoS detection
		9.5.1 Evaluation environment
			9.5.1.1 Network simulator 3
			9.5.1.2 Simulation of (D)DoS attacks
		9.5.2 Feature selection
			9.5.2.1 Requests number
			9.5.2.2 Packets number
			9.5.2.3 Data rate
			9.5.2.4 Average packet size
			9.5.2.5 Average time between requests
			9.5.2.6 Average time between response and request
			9.5.2.7 Average time between responses
			9.5.2.8 Parallel requests
		9.5.3 Intrusion detection evaluation metrics
			9.5.3.1 True positive rate
			9.5.3.2 True negative rate
			9.5.3.3 False positive rate
			9.5.3.4 False negative rate
			9.5.3.5 Precision
		9.5.4 Experiments results analysis
		9.5.5 Results analysis and discussion
	9.6 Discussion
	9.7 Conclusion
	References
10 DNA-inspired characterization and detection of novel social Twitter spambots
	10.1 Introduction
		10.1.1 Contributions
	10.2 Datasets
		10.2.1 Social spambots
		10.2.2 Legitimate accounts
		10.2.3 Reproducibility
	10.3 Classification task and classification metrics
	10.4 Benchmarking current spambot detection techniques
		10.4.1 The BotOrNot? service
		10.4.2 Supervised spambot classification
		10.4.3 Unsupervised spambot detection via Twitter stream clustering
		10.4.4 Unsupervised spambot detection via graph clustering
	10.5 Toward an accurate detection of social spambots
		10.5.1 The digital DNA behavioral modeling technique
			10.5.1.1 Digital DNA sequences
			10.5.1.2 Definition of digital DNA
			10.5.1.3 Similarity between digital DNA sequences
	10.6 DNA-inspired detection of social spambots
		10.6.1 LCS curves of legitimate and malicious accounts
			10.6.1.1 LCS curves of a group of homogeneous accounts
			10.6.1.2 LCS curves of a group of heterogeneous accounts
		10.6.2 An unsupervised detection technique
		10.6.3 Comparison with state-of-the-art detection techniques
	10.7 Conclusions and future directions
	References
11 Nature-inspired approaches for social network security
	11.1 Introduction
		11.1.1 An overview of nature-inspired algorithms
			11.1.1.1 Evolutionary algorithms
			11.1.1.2 Swarm intelligence algorithms
	11.2 Social network: terms and terminologies
		11.2.1 The relevance of social network security and privacy
	11.3 The significance of nature-inspired approaches in social network security
	11.4 Nature-inspired techniques in social network paradigm
		11.4.1 Nature-inspired algorithms for influence maximisation in social networks
			11.4.1.1 Evolutionary algorithms for influence maximisation
			11.4.1.2 Swarm intelligence algorithms for influence maximisation
			11.4.1.3 Other nature-inspired approaches for influence maximisation
		11.4.2 Nature-inspired algorithms for community detection in social networks
			11.4.2.1 Evolutionary algorithms for community detection
			11.4.2.2 Swarm intelligence algorithms for community detection
		11.4.3 Nature-inspired algorithms for link prediction in social networks
			11.4.3.1 Evolutionary algorithm for link prediction
			11.4.3.2 Swarm intelligence algorithms for link prediction
		11.4.4 Nature-inspired algorithms for rumour detection in social networks
		11.4.5 Nature-inspired algorithms for trust management in social networks
		11.4.6 Nature-inspired algorithms for addressing other social network issues
	11.5 Security in emerging areas
		11.5.1 Decentralised social networks
		11.5.2 Mobile social networks
		11.5.3 Social Internet of Things
	11.6 Security challenges and future research directions
		11.6.1 Research challenges in social networks
		11.6.2 Future research directions
	11.7 Conclusion
	Acknowledgement
	References
12 Software diversity for cyber resilience: percolation theoretic approach
	12.1 Introduction
		12.1.1 Motivation
		12.1.2 Research goal
		12.1.3 Key contributions
		12.1.4 Structure of this chapter
	12.2 Background and related work
		12.2.1 Graph coloring
		12.2.2 Epidemic models
		12.2.3 Percolation theory
		12.2.4 Software diversity
	12.3 System model
		12.3.1 Network model
		12.3.2 Node model
		12.3.3 Attack model
		12.3.4 Defense model
	12.4 Software-diversity-based adaptation strategies
		12.4.1 Software diversity metric
		12.4.2 Adaptations based on software diversity
	12.5 Numerical results and analysis
		12.5.1 Metrics
		12.5.2 Comparing schemes
		12.5.3 Experimental setup
		12.5.4 Simulation results under a random network
		12.5.5 Simulation results under a scale-free network
	12.6 Conclusions and future work
	References
13 Hunting bugs with nature-inspired fuzzing
	13.1 Research challenge
	13.2 The stochastic process of fuzzing
		13.2.1 Fuzzing essentials
			13.2.1.1 Fuzzing origins
			13.2.1.2 Modern fuzzing
			13.2.1.3 Generic architecture and processes
		13.2.2 Markov decision processes
			13.2.2.1 Policies and behavior
			13.2.2.2 Value functions
		13.2.3 Fuzzing as a Markov decision process
			13.2.3.1 States
			13.2.3.2 Actions
			13.2.3.3 Rewards
	13.3 Fuzzing with predefined behavior
		13.3.1 Hunting bugs with Lévy flight foraging
			13.3.1.1 Optimal foraging
			13.3.1.2 Lévy flight hypothesis
			13.3.1.3 Swarm behavior
		13.3.2 Guiding a colony of Fuzzers with chemotaxis
			13.3.2.1 Colonies with explorers
			13.3.2.2 Chemotaxis
	13.4 Fuzzing with learning behavior
	13.5 Outlook
		13.5.1 Hierarchies of learning agents
		13.5.2 Alternative models
	13.6 Conclusion
	References
14 Bio-inspired cyber-security for the smart grid
	14.1 Smart grid security
		14.1.1 Smart grid architecture
		14.1.2 Smart grid cyber security requirements
		14.1.3 Smart grid cyber security threats
	14.2 Defence techniques
		14.2.1 Attack detection
		14.2.2 Attack prevention
		14.2.3 Attack mitigation
	14.3 Bio-inspired cyber security architectures
		14.3.1 Mapping between biological systems and cyber security systems
		14.3.2 Bio-inspired solutions for smart grid security
			14.3.2.1 Digital ants framework
			14.3.2.2 Multi-flock technique
			14.3.2.3 Multi-agent immunologically inspired model
			14.3.2.4 Smart grid immune system
		14.3.3 Future bio-inspired solutions for smart grid
			14.3.3.1 Genetic algorithm
			14.3.3.2 Artificial immune system
			14.3.3.3 Hive oversight for network intrusion early warning
			14.3.3.4 Digital epidemics: transmissive attacks
		14.3.4 Taxonomy
	14.4 Summary
	References
15 Nature-inspired cryptography and cryptanalysis
	15.1 Introduction
	15.2 Background and basics
		15.2.1 Cryptography and cryptanalysis
		15.2.2 Nature-inspired algorithms
	15.3 Application in cryptology
		15.3.1 Genetic cryptology
		15.3.2 Neural cryptology
		15.3.3 Artificial immune systems in cryptology
		15.3.4 Other biological approaches in cryptology
	15.4 Recent developments
		15.4.1 Evolutionary approaches
		15.4.2 Artificial neural networks
		15.4.3 Out-of-the-box thinking
		15.4.4 Conclusion and outlook
	References
16 Generation of access-control schemes in computer networks based on genetic algorithms
	16.1 State of the art
	16.2 Mathematical foundations
		16.2.1 RBAC scheme design
		16.2.2 VLAN scheme design
		16.2.3 Reconfiguring the access-control schemes
			16.2.3.1 Reconfiguring the RBAC scheme
			16.2.3.2 Reconfiguring the VLAN scheme
	16.3 Genetic algorithm development
		16.3.1 General provisions
		16.3.2 Generation of chromosomes
		16.3.3 Generation of initial population
		16.3.4 Fitness functions
		16.3.5 Crossover
		16.3.6 Mutation
	16.4 Evaluation test bed
	16.5 Experiments
		16.5.1 Evaluation of accuracy and speed
		16.5.2 Real-world case studies
			16.5.2.1 Generation of RBAC schemes
			16.5.2.2 VLAN design and reconfiguration
	16.6 Conclusions
	Acknowledgment
	References
Index
Back Cover