AI Challenge to Computer Intruders
AI Challenge to Computer Intruders
Dateline: 08/29/00
Network espionage, hacker attacks, widespread promulgation of computer viruses and other security issues are becoming a real nightmare not only for computer professionals but also for ordinary users. In the good old days, you typically used floppy disks for file transfers, slowing down the primary mechanism viruses use to spread and replicate themselves. Explosive growth of Internet and the protocols for quick file transfer has provided an extremely fertile environment for virus replication. Day after day, various security incidents are creating immense problems for users that have to spend enormous amounts of money for protection. Virus protection proved to be an extremely complex, difficult and expensive task that constantly occupies thousands of researchers. Various Artificial Intelligence technologies have been used to detect virus-like behaviors, such as trapping certain interrupt services or attempting unlikely actions such as reformatting the hard disk. This brief review of AI-related, commercially available antivirus products and research projects is by no means complete, but it can give you a glimpse of what's to come. About guide to antivirus software will provide you with more information on other antivirus packages and practical methods for protection.
IBM scientists and technologists and their colleagues from Symantec are using some of the world's most advanced technology for dealing with viruses automatically. Drawing on analogies with biological immune systems, they developed an immune system for computers and computer networks. They use pattern-matching techniques developed by computational biologists, using vertebrate immune system as a primary source of inspiration. An older article from Scientific American gives an excellent overview of the technology used at IBM. Results from this research are used for the Symantec's Bloodhound system (used in popular Norton AntiVirus package), an artificially intelligent web-spider that crawls through the World Wide Web searching for new and unknown viruses. The primary goal of this and similar systems is to automatically capture the virus and send it to an automated analysis center that should be able to find the cure and send it back to the infected PC. This process can occur within minutes of a new virus' arrival, finding a cure for a newborn virus before it can spread around the world.
Researchers at IBM Thomas J. Watson Research Centre also developed a neural network for generic detection of boot-sector viruses. It has been reported that this type of neural network learned to recognize viruses better than expert systems hand-tuned by virus researchers. More technical details are available at the Antivirus online home page, particulary in a paper titled "Neural Networks for Computer Virus Recognition".
The Department of Energy's Sandia National Laboratories has recently developed Cyberagent, an intelligent agent software for virus protection. This system, still in the laboratory stage, actually functions as a multiagent collective - a distributed, decentralized program that runs on multiple computers in a network. An agent's entire structure is described by a program "genome", which can be downloaded and used to "grow" an agent from scratch. Fully developed agent immediately connects to other agents and becomes a member of a security community, trained to protect its computers against viruses, trojan horses, denial-of-service attacks and other malicious attempts. The key fact in this story is that no single point of attack can bring down the whole agent community.
Cyberagent earned its reputation this March, when it protected five networked computes against concetrated attacks of an expert hacker group called the Red Team, whose purpose is to test the defense systems of government and corporate networks. Formally known as the Information Design Assurance Red Team or IDART, this group either successfully invaded or devised successful mock attacks on 35 out of 35 information systems at various sites over the past two years. These good guys playing bad guys sometimes explained to clients in advance exactly how and when they will attack. System defenders have time to prepare specific strategies, yet their defenses were breached in 100% of cases. Now the Red Team acknowledges that it is challenged only by a new style of defense employed by the Cyberagent.
Want to try it? Unfortunately, the commercial release is about three years away. Watch this space for more technical details on Cyberagent and similar systems as they become available.