Can IT defenses work like the body's? The model IT system of the future will learn independently and react autonomously--like the human immune system.

As information technology (IT) systems increase in scale and complexity, they become more difficult to secure. We can see this in the growing number of successful attacks. If networks are to be made more secure, the IT community must move away from traditional approaches to security, which are knowledge-intensive, requiring human expertise and control at every stage of the process.

What is the alternative? We need fully automated systems that can learn independently and react rapidly and autonomously to deal with attacks. The problem is that these are much harder to design and build. But a model for this approach already exists: the biological immune system. This system secures an enormously complex environment--the human body--against a vast array of ever-changing threats. And the immune system is very successful. Most of us are healthy most of the time, and failures are rare. Most importantly, the immune system does this all autonomously, with no centralized control and no human input. The immune system is the reverse of the top-down, knowledge-intensive approach.

[ILLUSTRATION OMITTED]

What lessons should we draw from the immune system? One of the key differentiators is that the system is self-learning and adaptive. We call such systems autodidactic. The immune system is an autodidactic system that learns to distinguish self (the body) from nonself (everything else). Likewise, we want an IT security system that can learn to distinguish between acceptable (legitimate) behavior and unacceptable (illegitimate) behavior.

The trick is determining how to define what constitutes acceptable behavior. In the immune system, self is implicitly defined as everything that is both frequent and harmless. If we use a similar definition in an IT system, we need to understand what it means to be harmless. We know that we want the system to operate efficiently and without interruptions. Therefore, we can say at a minimum that any behavior that results in a loss of efficiency or that brings the system down is harmful. But beyond that simple definition, defining harmful behavior can be more complicated. For example, reading confidential data is harmful, but only if you are not authorized to do so, which is a policy decision that may be open to interpretation.

Adapting the immune system's approach to a network and defining the equivalent of self--which is essentially acceptable behavior--as everything frequent can also be problematic in a dynamic environment, where various aspects of the environment are changing rapidly and continually. The key is to define self in terms of characteristics of the environment that are largely invariant, but are nonetheless perturbed by attacks. The characteristics used by the immune system are peptides, or short protein fragments. These are good characteristics because they are ubiquitous and essential to the functioning of all parts of the body, and they provide a relatively stable basis for the definition of self.

Any IT security system needs the equivalent of peptides--characteristics that are largely invariant. These characteristics must lead to a stable definition of normal. But it may be unreasonable to expect that any single type of characteristic will be ubiquitous. For example, sequences of system calls emitted by running programs result in stable profiles of normal behavior for certain applications, such as servers, and other programs that exhibit repetitive programmatic behavior. However, sequences of system calls may not be effective for the highly varied and intermittent behavior of some direct-user applications such as word processors; a different way of identifying normal characteristics will be needed.

In addition to being autodidactic, the immune system has a number of other key properties that we need to emulate if we are to build effective, large-scale security systems. For example, the immune system is highly distributed, and all interaction and communication is localized. This structure enables the immune system to adapt its response level to protect every aspect of the body without needing a disproportionate increase in resources. Furthermore, the lack of a central point of failure makes the immune system very robust. Although the immune system can be evaded or overwhelmed, it is not generally subject to sudden, catastrophic failure.

To achieve scalability for IT security, we will need the autodidactic security system to be distributed across all locations in the enterprise, and we will need fine-grained protection at the level of applications running on computers. We cannot rely on network-level defenses alone, just as the body cannot rely on the skin alone for protection. The immune system protects beyond the skin, and we need a security system to likewise protect the core, beyond the firewall, and beyond network monitoring tools.

In addition, although there is a need for centralized reporting and control, we will have to surrender most if not all of that centralized power if we want systems to scale and be robust. If a single operator has the power to turn off the security system, any attacker that steals that power will be able to cause a catastrophic failure. Clearly, we will not get to this point until we have sufficient faith in our defenses to let them run autonomously. Such a step will mark the true beginning of a new paradigm in security.

To establish the new paradigm, security designers must work toward autodidactic systems that can be deployed throughout the IT infrastructure, onto every node, including desktops, laptops, servers, PDAs, and next-generation cellphones. These autodidactic systems must be largely autonomous, automatically learning normal behavior and regulating responses to minimize harm, all without human control.

We are currently some distance from realizing this dream. But if we look to our own biological systems for inspiration, we will get there.

BY STEVEN HOFMEYR, PH.D.

Steven Hofmeyr, Ph.D., is founder and chief scientist of Sana Security. San Mateo, California. He has authored numerous papers and served on the committee for the Artificial Immune Systems workshop at the IEEE World Congress on Computational Intelligence.