# Temporal Logic-Based Artificial Immune System for Intrusion Detection

Authors: Xiyue Chen; Jianmin Pang
Journal: Wireless Communications and Mobile Computing
 (2022)

---

## Abstract

Artificial immune system has made many contributions to network security areas, but there are still problems of insufficient detection range and high time cost. This paper presents a Hybrid Detector (HD) mechanism in which temporal logic antigens are proposed. The HD mechanism is constructed by using the advantage of temporal logic to describe time-varying behaviors in system. Finally, simulation experiments were carried out on KDD99 and NSL-KDD datasets. Experimental results show that the proposed method can extend the detection range and improve the detection rate. This work proves the possibility of applying temporal logic to AIS system.


---

## Body

## 1. Introduction

Intrusion Detection (ID) is an important network security technology and has achieved good results. However, there are still problems of insufficient detection range and low detection rate. Facing lots of increasingly complex attack patterns in the network, single intrusion detection technology falls short of detection ability seriously. In contrast, the human immune system generates new immune cells so that it is able to detect previously unknown and rapidly evolving harmful antigens [1].This paper uses the intrusion detection method based on artificial immunity system. The artificial immune system realizes recognition, learning, memory, and elimination by imitating the principle of the immune system. This method has good performance in intelligent network, intelligent robot, data mining, and so on.The semantics of common linear temporal logic formula are interpreted at points [2, 3]. The point represents a state and the relationship between points represents the temporal relationship between states. In a series of application fields including hardware circuits, this sequential relationship description ability cannot even describe the properties expressed by regular expressions. Different from point semantics-based LTL, Moszkowski proposed an interval temporal logic (ITL) based on interval semantics [4, 5]. The logic formula is interpreted and satisfied on an interval composed of discrete points with continuous positions. Therefore, compared with LTL, the former has stronger property description ability. At present, ITL logic has been applied to sequential circuit [6, 7], web service [8–10], multimedia [11], PLTL judgment algorithm and axiomatic completeness analysis [12], and other fields.We proposed a hybrid detector mechanism based on Interval Temporal Logic (ITL) to improve the detection rate on some certain attacks and expand the detection range. The hybrid detectors are acting as antigens in the artificial immune system for intrusion detection. This hybrid detector mechanism of R-L module is constructed by using the advantage of interval temporal logic to describe time-varying behaviors in the system.The contributions of this paper are as follows:(1)
We applied ITL into artificial immune system to expand the detection range(2)
The proposed AIS can gain a higher detection rate(3)
Comparisons on KDD dataset and NSL-KDD dataset is performedThis paper is arranged as a brief outline of related studies and the Interval Temporal Logic is covered in Section2; Section 3 gives details of the proposed system; Experiment and results are given in Section 4. Conclusions and future directions are provided in Section 5.


## 2. Related Work

### 2.1. Related Work

At present, intrusion detection systems can be roughly divided into five kinds: pattern-based, rule-based, statistics-based, status-based, and heuristic [13, 14]. Pattern-based methods can detect known attacks through pattern matching [15], Petri net [16, 17], keystroke monitoring, and file system inspection [18]. Rule-based detection system can be divided into rule-based [19], data mining [20], model-based/profile-based [21], and support vector machine (SVM) [22]. The system based on statistics is divided into statistics [23, 24], distance-based [25], Bayesian [26], and game theory. State-based systems include state transition analysis [27], user intent recognition [28], Markov process model [29], and stateful protocol analysis (SPA) [30]. Heuristic technologies are divided into neural network [31], fuzzy logic [32], genetic algorithm [33], immune system [34], and swarm intelligence [35–37].As for artificial immune system, Forrest et al. (on negative selection) and Kephart et al. [38] published their first papers on AIS in 1994, and Dasgupta conducted extensive studies on Negative Selection Algorithms. Hunt and Cooke (Hunt 1999) started the works on Immune Network models in 1995; Timmis and Neal [39] continued this work and made some improvements. De Castro and Von Zuben’s and Nicosia and Cutello’s [40, 41] work (on clonal selection) became notable in 2002.Hofmeyr proposed LISYS system which includes the use of negative selection algorithm to generate initial detector (immature detectors) populations. In order to achieve the adaptability, many mechanisms are put forward: mature detectors, memory detectors, tolerance period, activation threshold, and life span mechanisms. While the evolutionary idea of detector population is not proposed in LISYS model, Kim proposed a complete artificial immune model of network intrusion detection, which includes three different evolutionary stages: Negative Selection Algorithm (NSA), Clonal Selection Algorithm (CSA), and gene library evolution. But the model of negative selection, unlike LISYS system, uses the NSA to filter predetector which is produced by the gene expression and gene recombination. In the field of AIS-based network intrusion detection, Kim’s contribution is to propose the evolutionary idea of detector population using clonal selection algorithm (CSA).


### 2.2. Temporal Logic

Temporal Logic (TL) finds application in computer science, artificial intelligence, and linguistics. First-order interval temporal logic was initially developed in 1980s for the specification and verification of hardware protocols. Interval temporal logic (ITL) is a specific form of temporal logic, originally developed by Ben Moszkowski for his thesis at Stanford University. It is useful in the formal description of hardware and software for computer-based systems.ITL is a flexible notation for both propositional and first-order reasoning about periods of time found in descriptions of hardware and software systems. Unlike most other temporal logics, ITL can handle both sequential and parallel composition and offers powerful and extensible specification and proof techniques for reasoning about properties involving safety, liveness, and projected time [42]. Tempura provides an executable framework for developing and experimenting with suitable ITL specifications [43]. In addition, various researchers have applied Tempura to hardware simulation and other areas where timing is important.


## 2.1. Related Work

At present, intrusion detection systems can be roughly divided into five kinds: pattern-based, rule-based, statistics-based, status-based, and heuristic [13, 14]. Pattern-based methods can detect known attacks through pattern matching [15], Petri net [16, 17], keystroke monitoring, and file system inspection [18]. Rule-based detection system can be divided into rule-based [19], data mining [20], model-based/profile-based [21], and support vector machine (SVM) [22]. The system based on statistics is divided into statistics [23, 24], distance-based [25], Bayesian [26], and game theory. State-based systems include state transition analysis [27], user intent recognition [28], Markov process model [29], and stateful protocol analysis (SPA) [30]. Heuristic technologies are divided into neural network [31], fuzzy logic [32], genetic algorithm [33], immune system [34], and swarm intelligence [35–37].As for artificial immune system, Forrest et al. (on negative selection) and Kephart et al. [38] published their first papers on AIS in 1994, and Dasgupta conducted extensive studies on Negative Selection Algorithms. Hunt and Cooke (Hunt 1999) started the works on Immune Network models in 1995; Timmis and Neal [39] continued this work and made some improvements. De Castro and Von Zuben’s and Nicosia and Cutello’s [40, 41] work (on clonal selection) became notable in 2002.Hofmeyr proposed LISYS system which includes the use of negative selection algorithm to generate initial detector (immature detectors) populations. In order to achieve the adaptability, many mechanisms are put forward: mature detectors, memory detectors, tolerance period, activation threshold, and life span mechanisms. While the evolutionary idea of detector population is not proposed in LISYS model, Kim proposed a complete artificial immune model of network intrusion detection, which includes three different evolutionary stages: Negative Selection Algorithm (NSA), Clonal Selection Algorithm (CSA), and gene library evolution. But the model of negative selection, unlike LISYS system, uses the NSA to filter predetector which is produced by the gene expression and gene recombination. In the field of AIS-based network intrusion detection, Kim’s contribution is to propose the evolutionary idea of detector population using clonal selection algorithm (CSA).


## 2.2. Temporal Logic

Temporal Logic (TL) finds application in computer science, artificial intelligence, and linguistics. First-order interval temporal logic was initially developed in 1980s for the specification and verification of hardware protocols. Interval temporal logic (ITL) is a specific form of temporal logic, originally developed by Ben Moszkowski for his thesis at Stanford University. It is useful in the formal description of hardware and software for computer-based systems.ITL is a flexible notation for both propositional and first-order reasoning about periods of time found in descriptions of hardware and software systems. Unlike most other temporal logics, ITL can handle both sequential and parallel composition and offers powerful and extensible specification and proof techniques for reasoning about properties involving safety, liveness, and projected time [42]. Tempura provides an executable framework for developing and experimenting with suitable ITL specifications [43]. In addition, various researchers have applied Tempura to hardware simulation and other areas where timing is important.


## 3. Temporal Logic-Based Artificial Immune System

In the artificial immune system, any foreign object is considered an antigen. The AIS will produce antibodies to defend the antigen. When an antigen enters the body for the first time, the organism produces antibodies based on its strategy. When the antigen enters the body again, the organism immediately produces a large number of antibodies. This principle is similar to that of intrusion detection. In AIS-based intrusion detection system, abnormal behaviors are regarded as foreign objects, and AIS is used to determine whether the behavior is an attack. There are four categories of algorithms in AIS: Forrest et al. proposed negative selection algorithm in 1994. Castro and Zuben proposed clone selection algorithm. Chun [44] proposed genetic algorithm which is a combination of genetic algorithm and immune algorithm to increase chromosome diversity and dendritic cell algorithm.Firstly, we hypothesize that AIS has no antigens nor antibodies. Unknown samples are encoded as antigens, and all the other samples in the sample set may be antibodies. The antigen was added to AIS and then one candidate antibody was added at a time. At first, the size of the antibody collection will decrease slightly (to eliminate the antibodies with low matching degree); then, new antibodies will be produced. The way new antibodies are added depends on the clonal selection algorithm. Once the number of antibodies reaches its maximum, the system repeats the process of dying weak antibodies and producing new antibodies until AIS reaches a stabilized state.The pseudo of AIS is below:Pseudocode 1
Initialise artificial immune systemsPreprocessing antigens AGwhile (AIS not Full) & (More Antibodies)do{Add next sample as an antibody ABCalculate matching scores between AB and AGwhile (AIS is Full) & (AIS not stable)do{Reduce Concentration of all AB by a fixed amountMatch each AB against AG and stimulate as necessary}end while}end whileUse final set of antibodies to produce recommendation.


### 3.1. Signature Generation Module

#### 3.1.1. Preprocessing

The preprocessing process is as follows: Each record of the sample has 41 conditional attributes and 1 decision attribute, among which 34 attribute values are numeric types, 4 attribute values are binary variable types, and the remaining 4 attribute values are nominal types. By removing punctuation, converting nominal type to decimal, analyzing and orderly replacing nominal type, the record is turned into a regular format. For example, 3 102116216112 16699112 8170 239 486 0 0 0 0 0 1 0 0 1 0 2 0 0 0 0 0 8 8 0.00 0.00 0.00 0.00 1.00 0.00 0.00 19 19 1.00 0.00 0.05 0.00 0.00 0.00 0.00 0.00 1101221940180108.As we can see, the range of the record values is irregular. This will produce big values and small values and may lead to the missing of important feature after signature generation. The method of normalization can solve this problem. The normalization formula is as follows:(1)S∗=S−MINSMAXS−MINS,S represents the initial value of the sample and S∗ represents the normalized value.


#### 3.1.2. Signature Generation

In the signature generation component, we adopt Particle Swarm Optimization (PSO) algorithm. PSO algorithm is a swarm intelligence optimization algorithm proposed by Kennedy and Eberhart in 1995 [45]. It is a stochastic optimization algorithm based on the calculation theory of humanity. Its evolutionary retrieval process is based on fitness function rather than external information.The algorithm steps are as follows:(1)
Load training data and set initial parameters(2)
Randomly generate initial group, generate random initial velocity for each particle, and setPbest of the particle and Gbest of the group(3)
Evaluate the adaptive value of each particle according to the fitness function(4)
Compare each particle with the best position it has experienced, and if it is superior thanPbest, set it as the best place Pbest(5)
For each particle, the adaptive value is compared with the best position experienced by the groupGbest. If it is superior than Gbest, it is the optimal location of the group and the index number of Gbest is reset(6)
Update the velocity and position of the particle(7)
If the number of iterations reaches the maximum, turn to 8); otherwise, turn to 3);(8)
Convert the optimal location of the group into the corresponding feature subsetThe optimal subsetsPSO_Sub selected from the characteristic subset are like {0,1,0,0,1,1,0,1,0……, 1,0,0,1,1,0,0,1,1,1}, 1 represents the corresponding feature that has been selected.In this way, the AIS filters out the irrelevant and redundant features in the high-dimensional sample.


### 3.2. Negative Selection Algorithm

Basically, NSA can be divided into three stages: self-definition, detector generation, and nonself detection [46]. However, self-definition and detector generation are generally regarded as one stage, as shown in Figure 1. In the figure, the left side is the training stage and the right side is the detection stage. In the training stage, given a set of self-samples, the candidate detector is tested to see if it matches the self-samples. If matches, the candidate detector is deleted; otherwise, accept this candidate detector as a new detector. When the number of detectors reaches the preset value, the training stops. The generated detector is used to detect the new sample. If the new sample matches any detector, it will be judged as not me; otherwise, it will be identified as self.Figure 1
Negative selection algorithm.The pseudo of NSA [47] is below:Pseudocode 2
Define:fstim(i.j), fsupp(i,j), clone (i), mutation(i,j),mutation_rate(i), dynamics(i), update(i)generate Binit Lwhile (Not meet the stop criterion)do{for(i =0; i < |A|; i++)do{for(j =0; j < |B|; j++)do{fstim(agi, bj)}end for}end forfor(i =0; i < |A|; i++)do{for(j =0; j < |B|; j++)do{fstim(bi,agj)}end for}end forcalculate FBH = clone (B)BM= mutate (BH, mutation_rate ())dynamics (i)update (i)}end while


### 3.3. Clonal Selection Algorithm

The basic concept of CSA is as follows: only cells who can recognize antigens are selected and proliferated by the immune system, while those cannot be abandoned. The clone selection process is as follows: the immune cells who are selected by antigens will be cloned with large quantities. Each cloned cell expresses the same specific receptor. The higher the affinity is, the more number cloned antigens are.The pseudo of CSA [47] is below:Pseudocode 3
Define:fstimi,j, fsuppi,j, clone (i), mutation(i,j), mutation_rate(i), dynamics(i), update(i)generate Binit Lwhile (Not meet the stop criterion)do{for(i =0; i < |A|; i++)do{for(j =0; j < |B|; j++)do{fstim (agi,bj)}end for}end forfor(i =0; i < |A|; i++)do{for(j =0; j < |B|; j++)do{fstim (bi,agj)}end for}end forcalculate FBH = clone (B)BM= mutate (BH, mutation_rate ())dynamics (i)update (i)}end whileThe procedure of antigens is shown in Figure2.Figure 2
The procedure of antigens.


### 3.4. Hybrid Detector Mechanism

The AIS system presented in this paper uses a hybrid detector module. This module combines random detector and interval temporal logic detector. The two kinds of detectors work cooperatively to ensure the detection rate and expand the detection range.


#### 3.4.1. Random Detector (R-Detector)

Hamming distance is used in n-dimensional vector random detectors to judge the matching ability between the detector and unclassified antigen.LetDD1,⋯DN be the detector and R be the radius of detectors. The coverage area is a suprasphere, where D is the center and DR is the radius. If SS1,⋯SN is defined as an unknown antigen, then the hamming distance between D and S is the formula:
(2)EdD,S=∑i=1NDi−Si21/2,when the distance between D and S is less than RD, then unknown antigen S is within the detection range. In other words, the detector recognizes the antigen. Then, the antigen counter +1 and the detector counter +1. The operation until the antigen threshold exceeds the preset value which indicates an attack. If the detector counter exceeds the preset value, the detector becomes a memory detector.


#### 3.4.2. ITL Detector (I-Detector)

Syntax: The key notion of ITL is an interval. An intervalσ is considered to be a (in) finite sequence of states σ0σ1⋯, where each state σi is the union of the mapping from the set of integer variables IntVar to the set of integer values Z and the mapping from propositional variables PropVar to set of Boolean vales tt,ff [48]. Each interval has at least one state. The length σ of an interval σ0⋯σn is equal to n, one less than the number of states in the interval (this has always been a convention in ITL), i.e., a one state interval has length 0. The syntax of ITL is defined as follows:
(i)
z is an integer value,(ii)
a is a static integer variable (does not change within an interval),(iii)
A is a state integer variable (can change within an interval),(iv)
v is a static or state integer variable,(v)
g is an integer function symbol,(vi)
q is a static propositional variable (does not change within an interval),(vii)
Q is a state propositional variable (can change within an interval),(viii)
h is a predicate symbol.Semantics: The informal semantics of the most interesting constructs are as follows:Expressions:(3)e:≔zaAge1,⋯,enΟAfinA.Formula:(4)f:≔trueqQhe1,⋯,en¬ff1∧f2∀ν•fskipf1;f2f∗,where,OA: if interval is nonempty then the value of A in the next state of that interval else an arbitrary value.finA: if interval is finite then the value of A in the last state of that interval else an arbitrary value skipunit interval (length 1).f1;f2 holds if the interval can be decomposed (“chopped”) into a prefix and suffix interval, such thatf1holds over the prefix andf2over the suffix, or if the interval is infinite and f1 holds for that interval.f∗holds if the interval is decomposable into a finite number of intervals such that for each of themfholds, or the interval is infinite and can be decomposed into an infinite number of finite intervals for whichfholds [49].The method of describing ITL detectors is as follows:(i)
Analyze the meaning of each attribute in the sample(ii)
Analyze the attack principle(iii)
Construct temporal logic detector based on existing work and logic formulasITL detector formulae: According to the method mentioned above, we firstly analyzed 41 attributes in KDD and NSL-KDD dataset. Table1 shows the attributes’ meanings:Table 1
The attribute values in datasets.
1 Duration time2 Protocol type3 The network service type of the target host4 The state of a normal or incorrect connection5 The number of bytes of data from the source host to the target host6 The number of bytes of data from the target host to the source host7 If the connection is from/to the same host/port, it is 1; otherwise, it is 08 Number of error segments9 Number of urgent packets10 The number of times a system sensitive file or directory has been accessed11 Number of failed login attempts12 If successfully login, marked as 1, otherwise, 013 The number of essential capital occurs14 If the root shell is obtained, it is 1; otherwise, it is 015 The su root command is 1 if it appears, or 0 if it does not16 Number of root user visits17 Number of file creation operations18 The number of times you use shell commands19 The number of times you access control files, such as access to /etc/passwd or. rhosts files20 Number of outbound connections in an FTP session21 The frequency of occurrence of this feature in the dataset is 022 Whether the login belongs to the “hot” list is 1, otherwise 0.23 The number of connections to the target host as the current connection in the last two seconds.24 If guest logs in, it is 1; otherwise, it is 025 The number of connections in the last two seconds that have the same service as the current connection26 The percentage of connections that have “SYN” errors in the last two seconds that have the same target host as the current connection27 The percentage of connections that have “SYN” errors in the last two seconds that have the same service as the current connection28 The percentage of connections that have “REJ” errors in the last two seconds that have the same target host as the current connection29 The percentage of connections that have “SYN” errors in the last two seconds that have the same service as the current connection30 Over the past two seconds, the percentage of connections that have the same service as the current connection that have the same target host as the current connection31 Over the past two seconds, the percentage of connections with different services from the current connection that have the same target host as the current connection32 Over the past two seconds, the percentage of connections that have different target hosts from the current connection that have the same service as the current connection33 The first 100 connections have the same number of connections to the target host as the current connection34 Of the first 100 connections, the number of connections that have the same target host and service as the current connection35 The percentage of the first 100 connections that have the same service on the same target host as the current connection36 The percentage of the first 100 connections that have different services to the same target host as the current connection37 The percentage of the first 100 connections that have the same source port with the same target host as the current connection38 The percentage of the first 100 connections that have the same service as the current connection to the same target host that have a different source host from the current connection39 The percentage of the first 100 connections that have the same target host as the current connection that have SYN errors40 The percentage of the first 100 connections with SYN errors that have the same service on the same target host as the current connection41 The percentage of the first 100 connections that have the same target host as the current connection that have REJ errors42 The percentage of the first 100 connections that have the same target host and service as the current connection that have REJ errorsThe second step is analyzing the attack principle. We take port scan as an example.The principle of Port scan is as follows: When a source IP address sends an IP packet containing the TCPSYN fragment to 10 different ports at the same destination IP address at a specified interval of time (the default is 0.01 seconds), the network guard firewall determines that a port scan has been performed.The formula of PortScan is(5)f=Gp1∧⋄p2∧p3∧⋯∧⋄p9x<0.01⋄p10·f,AP=p1,⋯pi; pi is the time ordered TCP/SYN packet, and the ten record destination host fields are the same. T represents the time interval of the records.


#### 3.4.3. Hybrid Detector Mechanism

Randomly generated detectors can expand the detection rate. However, it also prolongs the execution time. R-detectors will be simplified and affected by I-detectors during GA. Then, we will get a smaller but stronger R-detector set. In this way, a hybrid detector set (HDset) is achieved. The mechanism of hybrid detectors is shown in Figure3.Figure 3
The mechanism of hybrid detectors.


## 3.1. Signature Generation Module

### 3.1.1. Preprocessing

The preprocessing process is as follows: Each record of the sample has 41 conditional attributes and 1 decision attribute, among which 34 attribute values are numeric types, 4 attribute values are binary variable types, and the remaining 4 attribute values are nominal types. By removing punctuation, converting nominal type to decimal, analyzing and orderly replacing nominal type, the record is turned into a regular format. For example, 3 102116216112 16699112 8170 239 486 0 0 0 0 0 1 0 0 1 0 2 0 0 0 0 0 8 8 0.00 0.00 0.00 0.00 1.00 0.00 0.00 19 19 1.00 0.00 0.05 0.00 0.00 0.00 0.00 0.00 1101221940180108.As we can see, the range of the record values is irregular. This will produce big values and small values and may lead to the missing of important feature after signature generation. The method of normalization can solve this problem. The normalization formula is as follows:(1)S∗=S−MINSMAXS−MINS,S represents the initial value of the sample and S∗ represents the normalized value.


### 3.1.2. Signature Generation

In the signature generation component, we adopt Particle Swarm Optimization (PSO) algorithm. PSO algorithm is a swarm intelligence optimization algorithm proposed by Kennedy and Eberhart in 1995 [45]. It is a stochastic optimization algorithm based on the calculation theory of humanity. Its evolutionary retrieval process is based on fitness function rather than external information.The algorithm steps are as follows:(1)
Load training data and set initial parameters(2)
Randomly generate initial group, generate random initial velocity for each particle, and setPbest of the particle and Gbest of the group(3)
Evaluate the adaptive value of each particle according to the fitness function(4)
Compare each particle with the best position it has experienced, and if it is superior thanPbest, set it as the best place Pbest(5)
For each particle, the adaptive value is compared with the best position experienced by the groupGbest. If it is superior than Gbest, it is the optimal location of the group and the index number of Gbest is reset(6)
Update the velocity and position of the particle(7)
If the number of iterations reaches the maximum, turn to 8); otherwise, turn to 3);(8)
Convert the optimal location of the group into the corresponding feature subsetThe optimal subsetsPSO_Sub selected from the characteristic subset are like {0,1,0,0,1,1,0,1,0……, 1,0,0,1,1,0,0,1,1,1}, 1 represents the corresponding feature that has been selected.In this way, the AIS filters out the irrelevant and redundant features in the high-dimensional sample.


## 3.1.1. Preprocessing

The preprocessing process is as follows: Each record of the sample has 41 conditional attributes and 1 decision attribute, among which 34 attribute values are numeric types, 4 attribute values are binary variable types, and the remaining 4 attribute values are nominal types. By removing punctuation, converting nominal type to decimal, analyzing and orderly replacing nominal type, the record is turned into a regular format. For example, 3 102116216112 16699112 8170 239 486 0 0 0 0 0 1 0 0 1 0 2 0 0 0 0 0 8 8 0.00 0.00 0.00 0.00 1.00 0.00 0.00 19 19 1.00 0.00 0.05 0.00 0.00 0.00 0.00 0.00 1101221940180108.As we can see, the range of the record values is irregular. This will produce big values and small values and may lead to the missing of important feature after signature generation. The method of normalization can solve this problem. The normalization formula is as follows:(1)S∗=S−MINSMAXS−MINS,S represents the initial value of the sample and S∗ represents the normalized value.


## 3.1.2. Signature Generation

In the signature generation component, we adopt Particle Swarm Optimization (PSO) algorithm. PSO algorithm is a swarm intelligence optimization algorithm proposed by Kennedy and Eberhart in 1995 [45]. It is a stochastic optimization algorithm based on the calculation theory of humanity. Its evolutionary retrieval process is based on fitness function rather than external information.The algorithm steps are as follows:(1)
Load training data and set initial parameters(2)
Randomly generate initial group, generate random initial velocity for each particle, and setPbest of the particle and Gbest of the group(3)
Evaluate the adaptive value of each particle according to the fitness function(4)
Compare each particle with the best position it has experienced, and if it is superior thanPbest, set it as the best place Pbest(5)
For each particle, the adaptive value is compared with the best position experienced by the groupGbest. If it is superior than Gbest, it is the optimal location of the group and the index number of Gbest is reset(6)
Update the velocity and position of the particle(7)
If the number of iterations reaches the maximum, turn to 8); otherwise, turn to 3);(8)
Convert the optimal location of the group into the corresponding feature subsetThe optimal subsetsPSO_Sub selected from the characteristic subset are like {0,1,0,0,1,1,0,1,0……, 1,0,0,1,1,0,0,1,1,1}, 1 represents the corresponding feature that has been selected.In this way, the AIS filters out the irrelevant and redundant features in the high-dimensional sample.


## 3.2. Negative Selection Algorithm

Basically, NSA can be divided into three stages: self-definition, detector generation, and nonself detection [46]. However, self-definition and detector generation are generally regarded as one stage, as shown in Figure 1. In the figure, the left side is the training stage and the right side is the detection stage. In the training stage, given a set of self-samples, the candidate detector is tested to see if it matches the self-samples. If matches, the candidate detector is deleted; otherwise, accept this candidate detector as a new detector. When the number of detectors reaches the preset value, the training stops. The generated detector is used to detect the new sample. If the new sample matches any detector, it will be judged as not me; otherwise, it will be identified as self.Figure 1
Negative selection algorithm.The pseudo of NSA [47] is below:Pseudocode 2
Define:fstim(i.j), fsupp(i,j), clone (i), mutation(i,j),mutation_rate(i), dynamics(i), update(i)generate Binit Lwhile (Not meet the stop criterion)do{for(i =0; i < |A|; i++)do{for(j =0; j < |B|; j++)do{fstim(agi, bj)}end for}end forfor(i =0; i < |A|; i++)do{for(j =0; j < |B|; j++)do{fstim(bi,agj)}end for}end forcalculate FBH = clone (B)BM= mutate (BH, mutation_rate ())dynamics (i)update (i)}end while


## 3.3. Clonal Selection Algorithm

The basic concept of CSA is as follows: only cells who can recognize antigens are selected and proliferated by the immune system, while those cannot be abandoned. The clone selection process is as follows: the immune cells who are selected by antigens will be cloned with large quantities. Each cloned cell expresses the same specific receptor. The higher the affinity is, the more number cloned antigens are.The pseudo of CSA [47] is below:Pseudocode 3
Define:fstimi,j, fsuppi,j, clone (i), mutation(i,j), mutation_rate(i), dynamics(i), update(i)generate Binit Lwhile (Not meet the stop criterion)do{for(i =0; i < |A|; i++)do{for(j =0; j < |B|; j++)do{fstim (agi,bj)}end for}end forfor(i =0; i < |A|; i++)do{for(j =0; j < |B|; j++)do{fstim (bi,agj)}end for}end forcalculate FBH = clone (B)BM= mutate (BH, mutation_rate ())dynamics (i)update (i)}end whileThe procedure of antigens is shown in Figure2.Figure 2
The procedure of antigens.


## 3.4. Hybrid Detector Mechanism

The AIS system presented in this paper uses a hybrid detector module. This module combines random detector and interval temporal logic detector. The two kinds of detectors work cooperatively to ensure the detection rate and expand the detection range.


### 3.4.1. Random Detector (R-Detector)

Hamming distance is used in n-dimensional vector random detectors to judge the matching ability between the detector and unclassified antigen.LetDD1,⋯DN be the detector and R be the radius of detectors. The coverage area is a suprasphere, where D is the center and DR is the radius. If SS1,⋯SN is defined as an unknown antigen, then the hamming distance between D and S is the formula:
(2)EdD,S=∑i=1NDi−Si21/2,when the distance between D and S is less than RD, then unknown antigen S is within the detection range. In other words, the detector recognizes the antigen. Then, the antigen counter +1 and the detector counter +1. The operation until the antigen threshold exceeds the preset value which indicates an attack. If the detector counter exceeds the preset value, the detector becomes a memory detector.


### 3.4.2. ITL Detector (I-Detector)

Syntax: The key notion of ITL is an interval. An intervalσ is considered to be a (in) finite sequence of states σ0σ1⋯, where each state σi is the union of the mapping from the set of integer variables IntVar to the set of integer values Z and the mapping from propositional variables PropVar to set of Boolean vales tt,ff [48]. Each interval has at least one state. The length σ of an interval σ0⋯σn is equal to n, one less than the number of states in the interval (this has always been a convention in ITL), i.e., a one state interval has length 0. The syntax of ITL is defined as follows:
(i)
z is an integer value,(ii)
a is a static integer variable (does not change within an interval),(iii)
A is a state integer variable (can change within an interval),(iv)
v is a static or state integer variable,(v)
g is an integer function symbol,(vi)
q is a static propositional variable (does not change within an interval),(vii)
Q is a state propositional variable (can change within an interval),(viii)
h is a predicate symbol.Semantics: The informal semantics of the most interesting constructs are as follows:Expressions:(3)e:≔zaAge1,⋯,enΟAfinA.Formula:(4)f:≔trueqQhe1,⋯,en¬ff1∧f2∀ν•fskipf1;f2f∗,where,OA: if interval is nonempty then the value of A in the next state of that interval else an arbitrary value.finA: if interval is finite then the value of A in the last state of that interval else an arbitrary value skipunit interval (length 1).f1;f2 holds if the interval can be decomposed (“chopped”) into a prefix and suffix interval, such thatf1holds over the prefix andf2over the suffix, or if the interval is infinite and f1 holds for that interval.f∗holds if the interval is decomposable into a finite number of intervals such that for each of themfholds, or the interval is infinite and can be decomposed into an infinite number of finite intervals for whichfholds [49].The method of describing ITL detectors is as follows:(i)
Analyze the meaning of each attribute in the sample(ii)
Analyze the attack principle(iii)
Construct temporal logic detector based on existing work and logic formulasITL detector formulae: According to the method mentioned above, we firstly analyzed 41 attributes in KDD and NSL-KDD dataset. Table1 shows the attributes’ meanings:Table 1
The attribute values in datasets.
1 Duration time2 Protocol type3 The network service type of the target host4 The state of a normal or incorrect connection5 The number of bytes of data from the source host to the target host6 The number of bytes of data from the target host to the source host7 If the connection is from/to the same host/port, it is 1; otherwise, it is 08 Number of error segments9 Number of urgent packets10 The number of times a system sensitive file or directory has been accessed11 Number of failed login attempts12 If successfully login, marked as 1, otherwise, 013 The number of essential capital occurs14 If the root shell is obtained, it is 1; otherwise, it is 015 The su root command is 1 if it appears, or 0 if it does not16 Number of root user visits17 Number of file creation operations18 The number of times you use shell commands19 The number of times you access control files, such as access to /etc/passwd or. rhosts files20 Number of outbound connections in an FTP session21 The frequency of occurrence of this feature in the dataset is 022 Whether the login belongs to the “hot” list is 1, otherwise 0.23 The number of connections to the target host as the current connection in the last two seconds.24 If guest logs in, it is 1; otherwise, it is 025 The number of connections in the last two seconds that have the same service as the current connection26 The percentage of connections that have “SYN” errors in the last two seconds that have the same target host as the current connection27 The percentage of connections that have “SYN” errors in the last two seconds that have the same service as the current connection28 The percentage of connections that have “REJ” errors in the last two seconds that have the same target host as the current connection29 The percentage of connections that have “SYN” errors in the last two seconds that have the same service as the current connection30 Over the past two seconds, the percentage of connections that have the same service as the current connection that have the same target host as the current connection31 Over the past two seconds, the percentage of connections with different services from the current connection that have the same target host as the current connection32 Over the past two seconds, the percentage of connections that have different target hosts from the current connection that have the same service as the current connection33 The first 100 connections have the same number of connections to the target host as the current connection34 Of the first 100 connections, the number of connections that have the same target host and service as the current connection35 The percentage of the first 100 connections that have the same service on the same target host as the current connection36 The percentage of the first 100 connections that have different services to the same target host as the current connection37 The percentage of the first 100 connections that have the same source port with the same target host as the current connection38 The percentage of the first 100 connections that have the same service as the current connection to the same target host that have a different source host from the current connection39 The percentage of the first 100 connections that have the same target host as the current connection that have SYN errors40 The percentage of the first 100 connections with SYN errors that have the same service on the same target host as the current connection41 The percentage of the first 100 connections that have the same target host as the current connection that have REJ errors42 The percentage of the first 100 connections that have the same target host and service as the current connection that have REJ errorsThe second step is analyzing the attack principle. We take port scan as an example.The principle of Port scan is as follows: When a source IP address sends an IP packet containing the TCPSYN fragment to 10 different ports at the same destination IP address at a specified interval of time (the default is 0.01 seconds), the network guard firewall determines that a port scan has been performed.The formula of PortScan is(5)f=Gp1∧⋄p2∧p3∧⋯∧⋄p9x<0.01⋄p10·f,AP=p1,⋯pi; pi is the time ordered TCP/SYN packet, and the ten record destination host fields are the same. T represents the time interval of the records.


### 3.4.3. Hybrid Detector Mechanism

Randomly generated detectors can expand the detection rate. However, it also prolongs the execution time. R-detectors will be simplified and affected by I-detectors during GA. Then, we will get a smaller but stronger R-detector set. In this way, a hybrid detector set (HDset) is achieved. The mechanism of hybrid detectors is shown in Figure3.Figure 3
The mechanism of hybrid detectors.


## 3.4.1. Random Detector (R-Detector)

Hamming distance is used in n-dimensional vector random detectors to judge the matching ability between the detector and unclassified antigen.LetDD1,⋯DN be the detector and R be the radius of detectors. The coverage area is a suprasphere, where D is the center and DR is the radius. If SS1,⋯SN is defined as an unknown antigen, then the hamming distance between D and S is the formula:
(2)EdD,S=∑i=1NDi−Si21/2,when the distance between D and S is less than RD, then unknown antigen S is within the detection range. In other words, the detector recognizes the antigen. Then, the antigen counter +1 and the detector counter +1. The operation until the antigen threshold exceeds the preset value which indicates an attack. If the detector counter exceeds the preset value, the detector becomes a memory detector.


## 3.4.2. ITL Detector (I-Detector)

Syntax: The key notion of ITL is an interval. An intervalσ is considered to be a (in) finite sequence of states σ0σ1⋯, where each state σi is the union of the mapping from the set of integer variables IntVar to the set of integer values Z and the mapping from propositional variables PropVar to set of Boolean vales tt,ff [48]. Each interval has at least one state. The length σ of an interval σ0⋯σn is equal to n, one less than the number of states in the interval (this has always been a convention in ITL), i.e., a one state interval has length 0. The syntax of ITL is defined as follows:
(i)
z is an integer value,(ii)
a is a static integer variable (does not change within an interval),(iii)
A is a state integer variable (can change within an interval),(iv)
v is a static or state integer variable,(v)
g is an integer function symbol,(vi)
q is a static propositional variable (does not change within an interval),(vii)
Q is a state propositional variable (can change within an interval),(viii)
h is a predicate symbol.Semantics: The informal semantics of the most interesting constructs are as follows:Expressions:(3)e:≔zaAge1,⋯,enΟAfinA.Formula:(4)f:≔trueqQhe1,⋯,en¬ff1∧f2∀ν•fskipf1;f2f∗,where,OA: if interval is nonempty then the value of A in the next state of that interval else an arbitrary value.finA: if interval is finite then the value of A in the last state of that interval else an arbitrary value skipunit interval (length 1).f1;f2 holds if the interval can be decomposed (“chopped”) into a prefix and suffix interval, such thatf1holds over the prefix andf2over the suffix, or if the interval is infinite and f1 holds for that interval.f∗holds if the interval is decomposable into a finite number of intervals such that for each of themfholds, or the interval is infinite and can be decomposed into an infinite number of finite intervals for whichfholds [49].The method of describing ITL detectors is as follows:(i)
Analyze the meaning of each attribute in the sample(ii)
Analyze the attack principle(iii)
Construct temporal logic detector based on existing work and logic formulasITL detector formulae: According to the method mentioned above, we firstly analyzed 41 attributes in KDD and NSL-KDD dataset. Table1 shows the attributes’ meanings:Table 1
The attribute values in datasets.
1 Duration time2 Protocol type3 The network service type of the target host4 The state of a normal or incorrect connection5 The number of bytes of data from the source host to the target host6 The number of bytes of data from the target host to the source host7 If the connection is from/to the same host/port, it is 1; otherwise, it is 08 Number of error segments9 Number of urgent packets10 The number of times a system sensitive file or directory has been accessed11 Number of failed login attempts12 If successfully login, marked as 1, otherwise, 013 The number of essential capital occurs14 If the root shell is obtained, it is 1; otherwise, it is 015 The su root command is 1 if it appears, or 0 if it does not16 Number of root user visits17 Number of file creation operations18 The number of times you use shell commands19 The number of times you access control files, such as access to /etc/passwd or. rhosts files20 Number of outbound connections in an FTP session21 The frequency of occurrence of this feature in the dataset is 022 Whether the login belongs to the “hot” list is 1, otherwise 0.23 The number of connections to the target host as the current connection in the last two seconds.24 If guest logs in, it is 1; otherwise, it is 025 The number of connections in the last two seconds that have the same service as the current connection26 The percentage of connections that have “SYN” errors in the last two seconds that have the same target host as the current connection27 The percentage of connections that have “SYN” errors in the last two seconds that have the same service as the current connection28 The percentage of connections that have “REJ” errors in the last two seconds that have the same target host as the current connection29 The percentage of connections that have “SYN” errors in the last two seconds that have the same service as the current connection30 Over the past two seconds, the percentage of connections that have the same service as the current connection that have the same target host as the current connection31 Over the past two seconds, the percentage of connections with different services from the current connection that have the same target host as the current connection32 Over the past two seconds, the percentage of connections that have different target hosts from the current connection that have the same service as the current connection33 The first 100 connections have the same number of connections to the target host as the current connection34 Of the first 100 connections, the number of connections that have the same target host and service as the current connection35 The percentage of the first 100 connections that have the same service on the same target host as the current connection36 The percentage of the first 100 connections that have different services to the same target host as the current connection37 The percentage of the first 100 connections that have the same source port with the same target host as the current connection38 The percentage of the first 100 connections that have the same service as the current connection to the same target host that have a different source host from the current connection39 The percentage of the first 100 connections that have the same target host as the current connection that have SYN errors40 The percentage of the first 100 connections with SYN errors that have the same service on the same target host as the current connection41 The percentage of the first 100 connections that have the same target host as the current connection that have REJ errors42 The percentage of the first 100 connections that have the same target host and service as the current connection that have REJ errorsThe second step is analyzing the attack principle. We take port scan as an example.The principle of Port scan is as follows: When a source IP address sends an IP packet containing the TCPSYN fragment to 10 different ports at the same destination IP address at a specified interval of time (the default is 0.01 seconds), the network guard firewall determines that a port scan has been performed.The formula of PortScan is(5)f=Gp1∧⋄p2∧p3∧⋯∧⋄p9x<0.01⋄p10·f,AP=p1,⋯pi; pi is the time ordered TCP/SYN packet, and the ten record destination host fields are the same. T represents the time interval of the records.


## 3.4.3. Hybrid Detector Mechanism

Randomly generated detectors can expand the detection rate. However, it also prolongs the execution time. R-detectors will be simplified and affected by I-detectors during GA. Then, we will get a smaller but stronger R-detector set. In this way, a hybrid detector set (HDset) is achieved. The mechanism of hybrid detectors is shown in Figure3.Figure 3
The mechanism of hybrid detectors.


## 4. Results and Discussion

### 4.1. Experiment

We use KDD and NSL-KDD as input of the system, respectively, to test the true detection rate (TR) and the detection range. Also, comparisons between the two datasets are made. KDD99 dataset is built by Lincoln LABS. Lincoln LABS built a network environment that simulated the air force’s LAN, collected nine weeks of TCP dump network connection and system audit data, and simulated various user types, network traffic, and attack methods to make it look like a real network environment. It is the benchmark for intrusion detection. But as we know, there is too much redundant data in KDD99, and NSL-KDD can overcome this shortcoming.The experiment in this paper is conducted on 10% of the dataset of KDD99 and NSL-KDD. The data of training set and test set are included in equal proportion.The experimental results are below: Table2 shows the TPR=NTP/NTP+NFNof detectors and proposed AIS in KDD and NLS-KDD, respectively.Table 2
The TPR of detectors and proposed AIS in KDD and NLS-KDD, respectively.
DetectorsKDDNLS-KDDTPRTPRRandom detector91.7%92%Interval temporal logic detector96.6%97.1%The AIS proposed94.9%95%Table3 gives out the TPR of KDD and NSL-KDD for each recognized attack by ITL detectors.Table 3
The TPR of KDD and NSL-KDD for each recognized attack by ITL detectors.
AttacksKDDNSL-KDDAttacksKDDNSL-KDDback91.6%92%nmap90.6%91.2%neptune100%100%portsweep97.7%97.9%Pod97%97.2%Satan99.2%99%smurf92%94%Buffer overflow93%93%teardrop99.5%99.4%rootkit98%98.2%ipsweep97.5%97%


### 4.2. Results

As we can see from the results, the ITL detectors gained a higher TR, and the detection range has expanded compared with existing work [50].This paper presents a HD mechanism in which temporal logic antigens are proposed and it is constructed by using the advantage of temporal logic to describe time-varying behaviors in system. This work gives a novelty method for intrusion detection and proves the possibility of applying temporal logic to AIS system.


## 4.1. Experiment

We use KDD and NSL-KDD as input of the system, respectively, to test the true detection rate (TR) and the detection range. Also, comparisons between the two datasets are made. KDD99 dataset is built by Lincoln LABS. Lincoln LABS built a network environment that simulated the air force’s LAN, collected nine weeks of TCP dump network connection and system audit data, and simulated various user types, network traffic, and attack methods to make it look like a real network environment. It is the benchmark for intrusion detection. But as we know, there is too much redundant data in KDD99, and NSL-KDD can overcome this shortcoming.The experiment in this paper is conducted on 10% of the dataset of KDD99 and NSL-KDD. The data of training set and test set are included in equal proportion.The experimental results are below: Table2 shows the TPR=NTP/NTP+NFNof detectors and proposed AIS in KDD and NLS-KDD, respectively.Table 2
The TPR of detectors and proposed AIS in KDD and NLS-KDD, respectively.
DetectorsKDDNLS-KDDTPRTPRRandom detector91.7%92%Interval temporal logic detector96.6%97.1%The AIS proposed94.9%95%Table3 gives out the TPR of KDD and NSL-KDD for each recognized attack by ITL detectors.Table 3
The TPR of KDD and NSL-KDD for each recognized attack by ITL detectors.
AttacksKDDNSL-KDDAttacksKDDNSL-KDDback91.6%92%nmap90.6%91.2%neptune100%100%portsweep97.7%97.9%Pod97%97.2%Satan99.2%99%smurf92%94%Buffer overflow93%93%teardrop99.5%99.4%rootkit98%98.2%ipsweep97.5%97%


## 4.2. Results

As we can see from the results, the ITL detectors gained a higher TR, and the detection range has expanded compared with existing work [50].This paper presents a HD mechanism in which temporal logic antigens are proposed and it is constructed by using the advantage of temporal logic to describe time-varying behaviors in system. This work gives a novelty method for intrusion detection and proves the possibility of applying temporal logic to AIS system.


## 5. Conclusion and Future Work

A method of using ITL detectors into AIS for intrusion detection is illustrated. The logic formula is interpreted and satisfied on an interval composed of discrete points with continuous positions. Therefore, ITL has stronger property description ability. Due to the strong describing ability of ITL, the AIS proposed in this article gained a good performance in detecting attacks with a higher accuracy. Experimental results show that the proposed method can extend the detection range and reduce the time complexity. Comparisons on KDD dataset and NSL-KDD dataset are performed.As for the future work, here is our arrangement: To further expand the detection range of ITL; search for more efficient detector mechanism; lower the time complexity; and search other novelty approaches to improve the detection performance.



---

*Source: 4685754-2022-03-09.xml*