Intrusion Detection in Multicore Embedded Systems based on Artificial Immune Systems

In this paper, we address the problem of intrusion detection in multicore embedded systems through a self-nonself discrimination scheme based on Artificial Immune Systems. We collect runtime data to build a model in which the T-cells work as detectors for the system’s sane behavior. The T-cells are represented by N-dimensional data points composed of samples of the N variables monitored during model building. A pre-established binding threshold is used for the T-cells generation. The difference between data points is measured as the distance between them. While training, whenever a collected sample fails to bind to an existing T-cell, it becomes a new one. After training, the threshold is adjusted to the maximum distance observed in the model. Therefore, the model definition follows an iterative clustering algorithm where each T-cell is a cluster centroid with threshold as the radius. Nonself detection consists of comparing collected samples to the T-cells in the model through a cluster membership verification. Whenever the incoming sample is not a member of any of the clusters, the sample is classified as nonself. A time complexity analysis indicates the suitability of the proposed technique for runtime operation, and offline experiments show this approach achieved a 97.17% nonself detection rate.