Toward an artificial immune server against cyber attacks

Abstract

This paper proposes a novel framework for an artificial immune server with both innate and adaptive immune functions. The innate immune function detects cyber attacks on a known or unknown vulnerability. Upon detecting a cyber attack, the innate immune function creates a new process of the server application and terminates the compromised process. The adaptive immune function learns the requests with exploit code detected by the innate immune function. The adaptive immune function enables the server application to maintain its own service without terminating the server application after the innate immune function recognizes the attack. Performance tests of a prototype system implemented on a vulnerable web server showed that this prototype system was able to maintain the web service during all attacks except the first.