| It has been an important issue to detect malware on embedded system. Due to the limit of computing power and consumption, it is not suitable to use traditional way of computer virus defense in the embedded system. Intrusion detection technology based on the theory of artificial immune system has imitate the mechanism of biological immune system by randomly generating detectors and then using the Negative Selection Algorithm to sifting them. It can use a small amount of detectors to detect large number of non-self elements which can make up the limit resource the embedded system can use in virus defense. However, there isn’t mature implementation scheme of the intrusion detection model of embedded system based on artificial immune system which confined its application in embedded system.In this paper, through the study of the principle of biological immune system and the negative selection algorithm of artificial immune system, we have summarized three key issues oftraditional negative selection algorithm:low detector generating efficiency, the overlap of the coverage space of detectors and the black holes of the coverage space of detectors. Through analysis we found that the key factor is we usuallyuse fixed threshold in traditional negative selection algorithm which lead to the fixed cover space of a single detector. Moreover, there isn’t effective screening rules for storage of self set which lead to redundancy and inhomogeneous distribution of the self elements. We proposed an negative selection algorithm with variable threshold to improve those deficiencies. In that algorithm we introduce the matching threshold of self elements, detectors with variable threshold and a new approach of terminating the detector generating process which through compute the coverage rate, which lead to remarkable advance of the detector generating efficiency and the smaller black-hole space in the same number of detectors. Finally, the variable threshold computing rule has completely solve the issue of overlap of the coverage space.In this end, we have demonstrated the effectiveness of the algorithm we have proposed and implement the algorithm with on hardware layer on embedded systems after optimized it. Through integrated into the embedded processor, the hardware immune system we designed can run synchronously with the processor to perform anomaly detection. |
