Abstract
Edge computing solves such questions as the massive multisource data and resource consuming computing tasks in edge devices. Some new security problems especially the data security and privacy issues have been introduced into the edge computing scenario. Through analyzing the biological immune principles, a novel idea for the problem of intrusion detection in edge computing is provided. Specifically, an edge intrusion detection system (Edge IDS) with a distributed structure, which has the characteristics of an imprecise model, self-learning, and strong interactivity, is constructed in a systematic way inspired by the biological immune principles. Moreover, a newly proposed gene immune detection algorithm (GIDA) is designed. In order that Edge IDS can deal with the dynamic data problem efficiently, the key functional components such as the remaining gene, niching strategy, and extracting vaccine are embedded into the GIDA algorithm. Furthermore, extensive simulation experiments are conducted, and the results show that the proposed Edge IDS can be adapted to the domain of edge computing with comparative performance advantages.
1. Introduction
Nowadays, the Internet is dramatically growing with the proliferation of a wide variety of network-connected devices everywhere. As increasing numbers of applications are continuously migrated from these devices to the cloud [1], current cloud infrastructure has become too overwhelmed to provide guaranteed services. For instance, the massive multisource data and resource-consuming computing tasks generated from these devices go far beyond the ability of cloud computing technologies [2]. To address these challenges, the edge computing paradigm (e.g., cloud-aware mobile fog computing [3]) is emerging and attracting increasing attentions, which enables the use of networked resources from remote cloud datacenters to the edge closer to the data source [4].
In edge computing, such special features as real-time computation and parallel processing [5] have also brought new security problems which can be summarized as follows [6]. (1)Due to the need for computing at the edge, privacy data needs to be transmitted to third parties (e.g., the edge servers operated by certain commercial companies). In this case, it is easy to lose data, have data leakage, or operate illegal data. Thus, it is difficult to guarantee data confidentiality and integrity [7](2)Users’ data shows characteristics like multiple trust domains and variety structure, which increase the uncertainty and difficulty of data detection(3)The edge and cloud services can be accessed by all the authorized parties at any situation as per users’ requirements, which increases the risk of malicious exploitation on certain data(4)It will be relatively easy to lose protection and control of all the privacy information, for example, personal identification or location information, due to some outsourced or external computing issues
As an original barrier, the intrusion detection system (IDS) plays a critical role in the problem of security protection. In this paper, the IDS that is implemented in the traditional cloud servers is classified as Cloud IDS and the one implemented in the edge servers is classified as Edge IDS.
Compared with the Cloud IDS relying on remote servers, the Edge IDS can perform nearly real-time computing tasks exactly at the edge of the network and thus can effectively protect the security of the edge computing scene. However, the concepts and methods of traditional intrusion detection are difficult to be directly applied to the security protection scenarios of edge computing architecture. For example, it is difficult for the Edge IDS to establish a precise detection model as the Cloud IDS, since the amount of data that can be obtained by the edge networks is much smaller than that of the cloud central servers. Furthermore, the variety of data sources and mobile devices existing in the edge also increases the difficulty of edge intrusion detection. In addition, traditional intrusion detection mechanisms work independently in each edge domain without cooperation or lack of interactivity; thus, they cannot be entirely and directly applied as the Edge IDS without modification. Thus, it is necessary to design an Edge IDS to solve the above problems timely and effectively.
Although edge computing reduces the scale of data in cloud computing, it is difficult to solve the problem of multisource data in edge computing in many IDSs. Traditional IDSs often establish a detection mechanism by extracting data characteristics, where an exact model is often required. Fortunately, biological immune principles provide a new way for designing a more dynamic and effective Edge IDS without the help of such exact models. The biological immune system can identify foreign invasions primarily by distinguishing self and nonself. In addition, the immune response is carried out individually and does not require a central controller.
Obviously, in the edge computing environment, the problem of multisource data can effectively be solved through nonspecific immunity in biological immune principles. The distributed structure makes the Edge IDS not only facilitate the operation and reduce the amount of data but also increase the real-time interaction with the Cloud IDS. At the same time, an immune system also has a self-learning function and can adapt to dynamic detection.
In this paper, the basic idea of building Edge IDS based on biological immune principles is presented. The characteristics of Edge IDS and an artificial immune system (AIS) inspired by biological immune principles are analyzed. And the theory of AIS is used to construct a dynamic Edge IDS from the system’s point of view. This system is placed in the distributed system associated with the Cloud IDS. Because of the distributed structure, there is an interaction between Edge IDS and Cloud IDS. The Edge IDS in the control layer transmits the detection information to the Cloud IDS in the monitoring layer. Cloud IDS generates cloud vaccine libraries that give feedback to Edge IDS. Edge IDS inspired by the principle of biological immunity does not need to have an exact model and has excellent self-learning function.
The main contribution of this paper can be concluded as follows: (1)The characteristics and types of intrusion detection in edge computing are analyzed and described in detail. An Edge IDS is constructed with the idea of AIS(2)The Edge IDS lies in the second layer of the whole system which has a distributed system structure with three layers. The first one is the monitor layer (e.g., Cloud IDS), the second one is the control layer (e.g., Edge IDS), and the third one is the device layer (e.g., host firewall). It also has dynamic detection and adaptive functions because of the use of a distributed structure. For example, Edge IDS can dynamically determine whether to distribute some tasks to Cloud IDS based on the self-assessed network load. On the other hand, Edge IDS can adaptively improve its security ability by acquiring security knowledge from Cloud IDS with continuous convergence of fragmented security data scattered throughout the network(3)An algorithm named GIDA is proposed. It proposes the way of the remaining gene, niching strategy, and abstracting vaccine, so as to deal with dynamic data efficiently and own the function of self-learning
The rest of this article is organized as follows. Section 2 introduces the background knowledge of biological immune system and briefly summarizes related works on IDS in edge/fog/cloud computing. Section 3 illustrates the theoretical preliminaries of the immune process. Section 4 presents the design of the proposed Edge IDS as well as the details of the GIDA algorithm. In Section 5, experiments are conducted to verify and evaluate the system. Finally, Section 6 concludes our work.
2. Background and Related Work
2.1. Security Threats for Edge Computing
One of the important problems for edge computing is how to ensure the security of the data transmission process [8]. During message transmission, some attacks may be generated to disable some certain network connections by congesting the network bandwidth resources or could monitor some details of the targeted network data flow. The threats for the edge computing, including Forgery Attack, Tampering Attack, Spam Attack, Sybil Attack, Jamming Attack, Eavesdropping Attack, Denial of Service Attack, and Collusion Attack, are shown in Figure 1 [9–11]. In a network or a system, intrusions mean any unauthorized or unapproved activities. Thus, any attacks are intrusions from the outside.
2.2. Overview of Biological Immune System
In a biological immune system, for an organism, antigens are external invasions. When antigens appear, immune function begins to work. The process of the body’s identification and exclusion of antigens is called immunity [12].
Lymphocytes are the main line of defense for the body’s immunity. Lymphocytes are divided into B-cells and T-cells. B-cells can be activated by invading pathogens. It has two functions: one is to activate innate immune function and the other is to produce antibodies. B-cells can clone themselves, and their function of negative selection can prevent the resulting antibodies from responding to themselves. On the other hand, positive selection is done through T-cells. After a series of stimulation processes, B-cells, suppressor T-cells, and killer T-cells form antibodies [13]. Helper T-cells are used to help suppressor T-cells for an immune response.
During the process of producing antibodies, the vaccine is extracted and entered into the antibody library. Thus, a closed-loop immune system is produced. The scheme of the whole immune circle is shown in Figure 2.
A biological system is actually a complex information processing and interaction system. An AIS is based on the inspiration of biological principles applied to the field of engineering [14].
During the process of studying the intrusion detection mechanism, it is shown that both the AIS and IDS have high similarity in Table 1. The former protects body recognition and excludes antigens (virus or pathogen), and the latter protects the computer to avoid damage in the case of intrusion. Both of them keep the stability of the system in a continually changing environment.
2.3. Brief Summary of IDS in Edge/Fog/Cloud Computing
In different network environments, there are different requirements for the detection algorithm and application deployment of IDS. Intrusion detection is mainly used to monitor and detect abnormal behaviors on the host side or network side, and many studies in cloud computing environment are also instructive and valuable to the design of the Edge IDS.
In 2010, Zhou et al. [15] suggested a collaborative IDS for cloud environments. Mazzariello et al. [16] present a network-based IDS that determines intrusion behavior by defining a series of intrusion rules with a high detection rate. To handle access to large-scale network data and applications that manage control traffic in the cloud, Gul and Hussain [17] introduced a multithreaded IDS model in 2011. In this model, the Cloud IDS can process and analyze the data packets of high traffic, generate reports effectively, and automatically send security reports to users through third-party IDS detection services.
Internet of Things (IoT), wireless sensing networks (WSN), and other networks are typical applications for edge computing. IDS for these scenarios also has a reference value for the design of a specific IDS for edge computing. In 2013, Raza et al. [18] proposed an IDS, SVELTE, for the IoT environment, primarily for the detection of routed attacks. In 2014, Shamshirband et al. [19] applied the three-person cooperative strategy game model to the intrusion detection of WSN, focusing on flooding attacks in WSN and verifying that the model’s attack detection and defense accuracy as well as the energy consumption are superior to machine learning methods. In 2015, Xiao et al. [20] introduced the concept of friend mechanism and proposed a lightweight IDS model for mobile networks, which has comparative advantages in detection accuracy when detecting black hole attacks in routing. But they are only simulated for attacks at the network routing level.
In 2016, Hosseinpour et al. [21] proposed an IDS with distributed lightweight character based on AIS for fog computing. IDS is distributed across a three-tier IoT structure. However, an in-depth analysis of the detection rate and FP rate (false positive rate) is lacking. In 2017, Wang et al. [22] discussed a privacy shield for a collaboration network based on fog devices, which can improve detection efficiency with the protection of private data and information security of network resources. The study focused on privacy data protection but did not study and analyze the characteristics of limited resources for fog nodes.
In 2018, An et al. [23] introduced a common fog computing IDS framework, provided a classifier model, and proposed an intrusion detection scheme of a cloud and fog hybrid collaboration. Lin et al. [24] discussed the problem of system defense resource allocation under this framework and put forward a single-level advantage and distributed strategy. The performance of IDS is improved by allocating resources.
3. Theoretical Preliminaries and Notation
3.1. Abbreviation Representation
Ab:Antibody,
Ag:The number of antigen,
Tkill:Killer T-cell,
Tsup:Suppressor T-cell,
TH:Helper T-cell,
APC:A presenting cell for antigens,
MHC:Major and histocompatibility complex,
TCR:A receptor for T-cell,
S: The overall number of APC conjoining with helper T-cells,
:The threshold which is the concentration into the blood from the marrow,
Bp: The plasma B-cells,
B:Number of B-cells.
3.2. Modeling of Immune Process
TCR can recognize antigens after they enter into the body of a creature. The function of APC is to transmit the information of the antigen to helper T-cells. By APC, these stimulations will activate helper T-cells. According to the dynamic equations from Qi and Du [25], the following differential equation set is described.
where is a constant that presents the number of macrophages selected as APC and is a proportional coefficient. is very small, so we can neglect it in computation.
Solve the equation set (1). Neglecting the item including , we can gain where and are constants.
In equation set (2), the number of helper T-cells can be considered as a nonline relation linking antigens.
According to the proportion relation between helper T-cells and killer T-cells, the number of killer T-cells at time can be calculated. Here, is a coefficient decided by the immune response.
Through the function of APCs, helper T-cells will promptly be activated. Then, they will stimulate the resting B-cells and become plasma B-cells (). We use differential equations to represent the speed at which B-cells transform and the collection of . The model is as follows:
Set Hill function , which represents the MHC’s effects in the process of B-cell activation. where and are constants of the duplicating velocity of B-cell and and are the usual killed rate of and .
Through solving, the number of will be obtained. Setting the number of antibodies at time is .
In equation (5), is the proportion coefficient of antibody production by .
The can show the action of all other cells. The relation between and the number of antigens at time is as follows:
where is a positive factor, is the beginning time when it is revealed. In equation (6), the middle term demonstrates the progressive relation between killer T-cells and antigens.
Thus, the overall number of attacking cells at time is as follows:
According to equations (1)–(7), the generation procedure of antibodies in biological immunity is shown as a schematic module in Figure 3. It illustrates the function of suppressor T-cells and helper T-cells in the process of antibody generation. Killer T-cells and antibodies are taken as detectors defending external invasion in the biological immune system.
4. A System View of the Proposed Edge IDS
4.1. The Basic Idea
The main characteristics in edge computing are high discreteness, real-time, and interaction, which can be considered as a distributed interactive computing system. In Table 2, the basic thought of an intrusion detection mechanism with an uncertain model is suggested, whose features is suitable for edge computing.
Everything with certain functions and multiple elements can be considered as a system. If cloud computing is a great system, edge computing can also be looked at as a tiny system (Figure 4).
Viewing from the holistic perspective, Internet IDS can be regarded as a distributed IDS. The Cloud IDS can be equal to a monitor layer and the Edge IDS corresponds to a control layer. Every edge device has its own data security system, for example, a firewall. The layer of edge devices is considered as the device layer.
In the three-layer distributed structure, IDSs in the device layer protects only the information in their respective devices. They perform the lowest level of security. Edge IDS is located at the control layer. They protect the data generated during edge computation. At the same time, in the network state, the security system in the equipment can be controlled by the communication protocol. Cloud IDS is located at the monitor layer. Edge IDS in the control layer can selectively upload a part of the data to the cloud and is processed by the Cloud IDS. The monitoring layer publishes data processed to the control layer as needed to enable monitoring of the control layer. So each Edge IDS performs its own function and only interacts with Cloud IDS, which is independent of each other.
In edge computing, the amount of data is small, but the data is real time and interactive. This requires that the Edge IDS must have dynamic real-time detection function. In addition, multisourced data caused by the heterogeneous edge devices exists. As a result, it is difficult to model the IDS. Based on the above analysis, there is no exact model required for the system design of the proposed Edge IDS. Fortunately, the AIS inspired by the principles of a biological immune mechanism meets the requirements of the Edge IDS, which provides a feasible way for the design of an effective and efficient Edge IDS. The reasons are as follows: (1)Nonspecific immunity and specific immunity are divided into the basic principles of immunity. Nonspecific immunity is taken as the general immune effect of organisms, i.e., the use of “self” and “nonself” identification to detect all foreign invasion. It does not require modeling. Specific immunity is the targeted training of antibodies. This results in a vaccine that allows for dynamic detection in advance(2)The use of nonspecific immune function can avoid the requirement of precise modeling. The problem of the multisource data does not need to be considered. Dynamic and rapid detection can be achieved with specific immune function. With the help of the process of generating and updating antibodies, the ability of self-learning in the IDS can be achieved(3)The current disadvantages of the AIS are the algorithm’s complexity and storm data. Edge computing effectively avoids them because the amount of data is greatly reduced, so it is feasible to use AIS to construct the Edge IDS.(4)The interaction between edge computing and cloud computing has formed a distributed IDS structure. Edge IDSs are independent of each other and interact with Cloud IDS for information sharing and data fusion. In this way, conflicts between Edge IDSs are better avoided. At the same time, by constantly learning new knowledge from the Cloud IDS, the Edge IDS can update and upgrade its detection rules as the network security situation changes.
4.2. Details for the Architecture
Based on the characteristics of Edge IDS and the basic principle of AIS, a model of an Edge IDS embedded with AIS advantages is constructed, as shown in Figure 5.
The system model takes a distributed structure. The Edge IDS is the control layer. The main function of the system contains two major parts: a generating detector and detection. The generating detector is a key part with a dynamic process. The structure of the AIS is used in the part of the generating detector. The model is based on negative selection algorithms that identify self and nonself. The clone selection module and the compensation operator are used as forward channels in the system. The positive selection module is used as a feedforward module. The vaccine module serves as feedback. This forms a feedback system with feedforward control. Feedforward control can quickly generate “genes.” Feedback control ensures the diversity and stability of the system. The system can generate multigeneration detectors through feedforward and feedback control, which can detect foreign intrusions in real time. Detection is a process of matching between detectors and external data. In the part of detection, the system can output the result on whether a behavior is malicious or not.
Obviously, the algorithm combines the two outstanding characteristics of nonspecificity and specificity in immunity. Through nonspecificity immunity, an original detector is generated.
Vaccine and gene detection algorithms are included in the specific immunity which are emphasized on the basis of self and nonself algorithms. Vaccines can be obtained through self-learning and interaction with Cloud IDS. And system updates are made through constant updates of the vaccine. Thus, the system becomes a dynamic system with adaptive capability. The niching strategy is used to optimize the search by dividing the weight coefficient. It guarantees the diversity of detectors, so that the generation of the detector does not become partially optimal.
The distributed system is reflected in the interaction between the Edge IDS and the Cloud IDS. The Edge IDS uploads alarm information to the Cloud IDS. The Cloud IDS collects and compares information about multiple Edge IDSs. Key information is then passed on to the Edge IDS in the form of a vaccine. This ensures the diversity and effectiveness of Edge IDS.
4.2.1. Nonspecific Immunity
Nonspecific immunity is a kind of innate immune function of the immune system, which includes negative selection, cloning selection, and compensating operators.
Forrest et al. [26] first proposed the negative selection algorithm. It is initialized by producing a detector from the protected data. Then, the detector can be used to recognize self and nonself. Clone selection can effectively detect unknown intrusions by copying the data fragments. A complement operator can help immune response.
(1) Negative Selection. The negative selection algorithm produces plenty of random patterns that are compared with each self. If any random pattern does not match the self, it becomes a “detector” that is able to monitor profiled patterns of the protected files. In the process, if a detector matches any new pattern, it is then taken as a novel abnormal one named the nonself.
The method of negative selection can be described with a set of mathematical models. (i)U: a whole set which is limited(ii)S: a subset indicating self(iii)N: a subset indicating nonself
Then, .
The problem of intrusion detection can be described as follows: in the case that some limited information is given, an element in the whole set is determined while it is included in the or . In the process, two metrics can be used to evaluate the intrusion detection ability of the IDS: true positive () and false positive (). indicates that a malicious external access behavior is correctly identified by the IDS. On the other hand, means that a self is considered as a nonself, that is, an external legitimate behavior is erroneously classified as abnormal. According to these, and are available to assess the detection ability of IDS [25].
The formal definition of the intrusion detection model based on biological immune principles is a classification that is made up of the following two components. , where is a bivariate function of classification and is a detector set that is gained by learning access data constantly in the mechanism of the immune system. means immune intrusion detection system. shows a process in that a detector detects intrusions.
If is set to a conventional value, that is, . Then,
(2) Clone Selection. Clone selection is used to reproduce valid antibodies [27]. In the process, clone selection can evolve antibodies by random methods.
In Table 3, the computing steps of the negative selection and clone selection are provided.
(3) Complement Operator. After the first match, the function of a complement operator is to exclude those antibodies with high similarity so as to obtain the qualified detectors. These antibodies need to be mutated randomly. The aim is to increase the diversity of antibodies. Data is updated quickly and frequently in edge computing. Compensation operators can increase detection efficiency and reduce detection time by mutation. This is suitable for data processing in edge computing.
4.2.2. Specific Immunity
Specific immunity is the immune function produced against a particular virus. It includes positive selection and vaccine operators. In the process of antibody evolution, the niche strategy is formally adopted as well.
(1) Positive Selection Operator and Gene Detection. Positive selection is a method that a detector is directly extracted from viruses.
The computing process of positive selection operator is also called as the gene detection. In edge computing, genes can be defined as features representing the unique information. Genes cannot be altered under the legal action.
(2) Vaccine Operator. The vaccines can be considered as a kind of memory cell. The immune system can usually generate vaccines after a detector responds the first time. The effect of vaccines is that the system is able to respond rapidly when the antigen is encountered again.
The generating idea of vaccines is as follows: (1) generate the nonself set, (2) detect the nonself, and (3) select vaccines from the antigens detected and join them into the antibody library.
The rule of extracting vaccines is to select antigens detected with a high match level and affirm that the detector that may be repeated into a vaccine. Vaccines are updated as needed in time. The diagram of vaccine generation is shown in Figure 6, where system information needed for detection can generate an initial population in a random way. Through negative selection, an original nonself set is produced. After executing detection, some antibodies with high weight will be selected as vaccines. In another way, by clone selection, matured antibodies will also become vaccines. These vaccines will join in the antibody library so as to detect external attacks.
(3) Niching Strategy. Niche is mentioned as a certain special circumstance in biology. During the period of antibody generation, strings in a population have different affinities. Depending on the size of the affinity, these strings can be divided into some subpopulation. Then, in every subpopulation, duplication, cross and mutation will be executed individually. Finally, those strings with high affinity are eliminated. Thus, the covering rate of antibodies is added.
Obviously, the niching strategy can avoid the high similarity of antibodies, change the diversity of antibodies, and increase detection efficiency. This improves the convergence of the algorithm.
4.2.3. Step Description of GIDA
The algorithm combining with those operators mentioned above is called GIDA in Edge IDS, and the flow diagram of GIDA is illustrated in Figure 7.
In GIDA, the system information which needs to be protected will be acquired in real time. The extracted information is converted to binary code. The process is called initialization. Then, values of some parameters will be given in the algorithm. In the beginning of the algorithm, the positive selection operator will extract the key information as the “gene.” They will be a part of the first generation of detectors. The other part of the first generation of detectors can be provided by negative selection and clone selection operator. After the 1st detection is generated, it will be used to detect intrusion. If the match is yes, the system will alert and generate a vaccine operator. If no, a complement operator will be added to the algorithm. Thus, the 2nd generation of detectors appears. As a result, continuous detection has been produced with the Nth generation detector. The system will finally approach the performance of real-time detection.
5. Performance Evaluation
As mentioned above, a novel Edge IDS using immunity is set up. In this section, the performance of the proposed Edge IDS as well as the GIDA will be evaluated in detail, with comparative simulation experiments.
5.1. Simulation Background
As a part of a distribution system, the proposed Edge IDS is mainly simulated. In order to establish a trustworthy experimental environment and verify the effect of the system, we completed the experiments on the KDDCup99 dataset. The recall rate, accuracy rate, precision, false negative rate, and -score were used for assessing the performance of the proposed system. At the same time, for the aim of proving the effect of our algorithm, we compare it with the LISYS [26] and DynamiCS [28].
In the KDDCup99 dataset, there are four usual types of attacks considered, and the ways of attack are described in detail as follows:
5.2. Establishment and Security Advantages of the Edge IDS
Based on the abovementioned, we build a proposed Edge IDS model based on the principle of immunity.
An experiment is reported in intrusion detection.
The setting parameters are as follows: is the amount of alphabet symbols, ; is the size of a random string, ; is the threshold of matches, ; .
In order to be convenience for the experiment, the KDDCup99 dataset provides 10% exercising set and detection set. Its partial samples are shown in Table 4.
The original data type is not uniform. Binary coding is the only encoding form that the computer can recognize. And a dynamic -proximity bit matching algorithm based on the weight in the paper is used. For the convenience of the experiment, we need to convert the KDDCup99 dataset into a binary form. Therefore, it is necessary to preprocess the dataset. The standardized method of data is shown in Table 5, where standardization of protocol type data, service type data, and property data are realized. The numbers in parentheses represent the amount of data of various types.
By classifying the data shown in Table 5, we need to convert these files to binary and take 32 characters as the antibody length. This makes it easy for the program to extract self and nonself. The process is called the standardization of data formats. Standardized data format is shown in Figure 8.
In order to inhibit the state of the experiment clearly, the item content, step, and result are shown in Table 6. The test is divided into six items. The detection of vulnerable attacks in edge calculations is shown. At the same time, the operating steps and the results that need to be presented accordingly are introduced in Table 6.
The concrete step of the experimental algorithm is shown in Table 7. From these steps, the basic idea of the algorithm is information extraction and detector generation. The detector is updated from generation to generation. In this way, the intrusion detection system dynamically adapts to the data modification in edge computing.
In Table 8, the experimental result is reported. Here, is the size of the source file, is the size of the file after intrusion, is the number of detectors, is the time spent for detection, and is the failure rate of detection.
In Table 8, we set six types of experiments. Firstly, we find that after a file is attacked, its length may change. While a file is short, the whole file needs to be detected. If a file is long enough, it is unnecessary to detect the whole one. The way of sampling the file is adopted in our experiment. We take out samples from the head, tail, and midst of the file. Due to the characteristics of edge computing data files, we use dynamic sampling methods. We selected the same length of data files from the test library to test the two attacks mentioned. Obviously, the system responds to attack quite quickly. The failure rate is also low. From the experimental data, the effect is credible.
Secondly, the detection failure rate in the experiment is within a reasonable range. The number of detectors is related to a positive proportion of detection efficiency, but the results are not clear enough.
In row , the data in every line shows different populations of detectors. For example, in the item of changing password, 67, 90, and 103 represent the number of the 1st, 3th, and 5th generations of detectors, respectively. Every population of detectors is generated dynamically. we find that the value of of the latter is less than that of the former. It illustrates that the system achieves better dynamic adaptability and improves the detection efficiency.
Finally, the performance of Edge IDS against attacks is evaluated. Two types of attacks are tested. Under the various attacks, the effect of the experiment is shown in Table 8. It can be observed that our IDS is effective in facing different types of attacks.
At the same time, the execution time is mainly shown. Obviously, the time is not ideal.
5.3. Detection Accuracy of the GIDA
In order to evaluate the accuracy of detection, we compare GIDA, DynamiCS, and LISYS. Though DynamiCS and LISYS are not applied for the area of intrusion detection, as classic immune algorithms, they are the basis of immune computing. The whole accuracy lies in and . It describes correct extent of an IDS’s job. The experimental result is shown in Figure 9. The aim of the contrast is that immune algorithms can be applied for the area firstly. The essence of immunity is that it can resist any attacks from foreign damage, regardless of the attack style or model. Secondly, the data security in edge computing scenario has its special requirements. Therefore, the classic immune algorithms should be improved accordingly. As shown in Figure 9, the proposed system with GIDA has the highest rate and the lowest rate. For example, after less than 15 generations of iterative upgrades, the GIDA can achieve a larger than 0.9 and a less than 0.1, which has obvious performance advantages over other algorithms. In fact, not all the attacks sometimes can cause an abnormal state. So the real-time performance of the Edge IDS should be evaluated. In Figure 9, the 1st-20th generations of detectors are generated. Obviously, the curves of and are growing. It shows that the system has better dynamic performance against attacks.
(a) Contrast of TP
(b) Contrast of FP
6. Conclusion
In this paper, an Edge IDS based on AIS is designed to adaptively detect threats in edge computing scenarios.
The basic idea of constructing an IDS inspired by biological immune principles is that there are such immune functions as resisting viruses and their variations in the biological immune system. A biological immune system can respond to unfamiliar viruses and their variants. It can have a self-adapting immune ability for unknown threats through the immune process. If the immune idea is incorporated into the design of IDS, it is possible to construct an intrusion detection system that adaptively detects novel attacks under the premise of less data requirement. Thus, the security of the edge computing scenario will be improved.
The contribution of this paper is in two aspects: (1)The design of the system structure(2)The introduction of an immune algorithm embedded into the Edge IDS
6.1. About the System Structure
Edge IDS is designed under the framework of a distributed system, which is connected with the Cloud IDS and the edge device security system. The Edge IDS mimics the structure of the AIS. It utilizes nonspecific immunity and specific immunity in biological immunity to respond to a variety of unknown and known invasion behaviors.
The Edge IDS is set up at the control layer. It is a feedback control system with feedforward control. Such a system structure has not only the stability and anti-jamming performance of the feedback system but also the timeliness of the feedforward control.
6.2. About the Algorithm
In this system, we have introduced an intrusion detection algorithm—GIDA. Shown in experiments, it is very valid for anomaly detection.
The algorithm is characterized by the rational use of genes, vaccines, and compensation operators, so that the effectiveness of the algorithm has been further improved. The application of niching strategy has also improved the algorithm. (1)Self-learning
Vaccination presents an important advantage, that is, self-learning ability.
Being not similar to the other algorithms, our algorithm is not asked to forecast the number of initial antibodies. The original number may be less. Subsequently, the antibody library would be renewed by self-learning in real time.
However, the key condition of the algorithm implementation is that an antigen can be detected during initial detection at least. Therefore, whether or not the vaccine is produced, the testing effect can be guaranteed through learning experience. In addition, the algorithm will undoubtedly become more complex due to the presence of vaccines. (2)Detection time
One of the effects of the complement operator is to avoid the shortcomings of the classic immune algorithms. Meanwhile, it is one of the reasons that the detection time can be decreased largely.
The complement operator is able to stimulate antibodies and make the antigens detect death. Therefore, in essence, the operator can help to decrease the number of antibodies and hold the diversity of the detectors.
Niching strategy is another effective way to reduce detection time. This strategy can obtain the diversity of antibodies according to thresholds, thereby increasing the coverage of the detectors, to shorten the detection time. (3)Convergence of the algorithm
Because of the niching strategy, the similar individual can be limited to duplicate overmuch. Therefore, the variety of detectors is guaranteed.
Vaccines are not produced from all the matched antigens. Vaccines with low similarities are retained. Highly similar vaccines will be discarded. Thus, computational delays due to the large number of vaccines can be avoided.
Vaccines, niching strategy, and complement operator are able to add to the diversity of the population. The diversity will make the algorithm not fall into local optimization. Thus, the convergence of the algorithm is ensured.
6.3. About the Attacks
The ability of self-learning in the Edge IDS can avoid some specific attacks from those attackers who can get IDS for free. Similar to immune function, Edge IDS starts from random strings and it will detect intrusion through dynamic, constant self-learning. Thus, the detectors of Edge IDS will be renewed in time. If some attackers may get them for free, it is impossible to attack some nodes effectively.
There is varying behavior in the Internet, and the data source is limited for immune algorithms although there may be a huge amount of data scattered in the Internet. The malicious behavior of the Internet can be defined as abnormal. Innate immunity can detect any abnormal state. These states will be reported to the Cloud IDS, to perform some necessary security operations in case of malicious behaviors (perhaps not to be attacked).
6.4. About the Edge IDS, Next Steps to Be Done
(1)The convergence of the algorithm needs to be demonstrated via in-depth study(2)The system stability and anti-jamming performance will be further evaluated(3)There are many uncertainties in the system model, which require further qualitative analysis(4)A diverse attack sample is needed to ensure the reliability and practical feasibility of the system
Data Availability
We used the KDDCup99, which is a famous and publicly accessed dataset (http://kdd.ics.uci.edu/databases/kddcup99/kddcup99.html), for the evaluation of new algorithms in the proposed Edge IDS.
Conflicts of Interest
The authors declare that there are no conflicts of interest regarding the publication of this paper.
Acknowledgments
This research is supported by the National Natural Science Foundation of China (NSFC) (No. 61702439).