  We propose an artificial immune model for intrusion detection in distributed
systems based on a relatively recent theory in immunology called Danger theory.
Based on Danger theory, immune response in natural systems is a result of
sensing corruption as well as sensing unknown substances. In contrast,
traditional self-nonself discrimination theory states that immune response is
only initiated by sensing nonself (unknown) patterns. Danger theory solves many
problems that could only be partially explained by the traditional model.
Although the traditional model is simpler, such problems result in high false
positive rates in immune-inspired intrusion detection systems. We believe using
danger theory in a multi-agent environment that computationally emulates the
behavior of natural immune systems is effective in reducing false positive
rates. We first describe a simplified scenario of immune response in natural
systems based on danger theory and then, convert it to a computational model as
a network protocol. In our protocol, we define several immune signals and model
cell signaling via message passing between agents that emulate cells. Most
messages include application-specific patterns that must be meaningfully
extracted from various system properties. We show how to model these messages
in practice by performing a case study on the problem of detecting distributed
denial-of-service attacks in wireless sensor networks. We conduct a set of
systematic experiments to find a set of performance metrics that can accurately
distinguish malicious patterns. The results indicate that the system can be
efficiently used to detect malicious patterns with a high level of accuracy.
