Plant and Salamander Inspired Network Attack Detection and Data Recovery Model

Abstract

The number of users of the Internet has been continuously rising, with an estimated 5.1 billion users in 2023, which comprises around 64.7% of the total world population. This indicates the rise of more connected devices to the network. On average, 30,000 websites are hacked daily, and nearly 64% of companies worldwide experience at least one type of cyberattack. As per IDC's 2022 Ransomware study, two-thirds of global organizations were hit by a ransomware attack that year. This creates the desire for a more robust and evolutionary attack detection and recovery model. One aspect of the study is the bio-inspiration models. This is because of the natural ability of living organisms to withstand various odd circumstances and overcome them with an optimization strategy. In contrast to the limitations of machine learning models with the need for quality datasets and computational availability, bio-inspired models can perform in low computational environments, and their performances are designed to evolve naturally with time. This study concentrates on exploring the evolutionary defence mechanism in plants and understanding how plants react to any known external attacks and how the response mechanism changes to unknown attacks. This study also explores how regenerative models, such as salamander limb regeneration, could build a network recovery system where services could be automatically activated after a network attack, and data could be recovered automatically by the network after a ransomware-like attack. The performance of the proposed model is compared to open-source IDS Snort and data recovery systems such as Burp and Casandra.

Keywords: bio-inspired algorithm; evolutionary computing; intrusion detection; network security; ransomware.

Figure 1

Taxonomy of Evolutionary Computation used in IDS.

Figure 2

Real time feature extraction for IDS [31].

Figure 3

Comparative bar chart for different implemented methods.

Figure 4

The zig-zag plant defense model [31].

Figure 5

Guard model in plants.

Figure 6

Elements in salamander limb regeneration.

Figure 7

Molecular metabolism for wound recovery and limb regeneration in the salamander.

Figure 8

Taxonomy of different Machine Learning algorithms used in IDS.

Figure 9

Transmission of malicious program flow in a network.

Figure 10

LAN topology.

Figure 11

Experimental results [49]: (a) SSH worm infection spread; (b) Slowloris detection; (c) TCP-Syn flood attack; (d) File deletion comparison under Ransomware like attack.

Figure 12

Packet drop comparison between Snort and PIRIDS.

Figure 13

File recovery: (a) Multicast Hello Packet; (b) Database of critical node peers; (c) File distribution to peers for backup-script; (d) File distribution to peers for backup-database; (e) Backup request from peers and recovery initialization; (f) ECM formation after fragments of files received from peers. Note: The ‘star’ symbol in all the figures is the Linux terminal prompt symbol and * is for comments.

Figure 14

Backup time comparison.

Figure 15

Restore time comparison.

Figure 16

Different time complexity order for different detector agents.

Figure 17

Different space complexity order for different detector agents.