The idea of using the defense mechanism observed in some bird species such as starlings has not yet been exploited in the development of Intrusion Prevention Systems (IPS). Starlings are self-organized with a characteristic of collective response. Starlings as prey have a way of detecting single or multiple predatory attacks and responding to danger that may be visible to only a small fraction of individuals in the ock [1]. The ability of starlings to evade predators is associated with several factors, including murmuration, collective response and confusion e ect. These factors are detailed as follows: (1) Murmuration: this is a phenomenon that hampers predation success [2]. It follows three simple rules, namely cohesion, alignment, and separation; other rules include predator avoidance and ee behaviour [3]. (2) Collective response: this is the way the whole group responds to its environment. For gregarious animals under strong predatory pressure collective response is vital and in fact it is the hallmark of self-organized order as opposed to centralized order [4]. (3) Confusion E ect: this is a phenomenon describing that decreasing predator attack success is associated with increasing prey group size in the eye of the predator. Benedict et al [5] used a computer game style experiment to investigate the confusion e ect in threedimensions, but the authors used human predators to track and capture a target starling. In this research we conducted a similar experiment in two-dimensions with both prey and predator simulated instead of (human) predator to further investigate the confusion e ect and collective response.
{ What are the essential features of starlings that reduce success rate of predators on them? { Can these features be adapted to develop a framework for Software De ned
Network Security?
{ Can the starlings attack evasion feature inform an algorithm for intrusion
prevention in Software De ned Networks?
{ How best can this algorithm be implemented and evaluated?
Bio-inspired approaches have proved e ective as arti cial alternatives in
mitigating the de ciencies of conventional models in areas such as robotics, optimization
problems, classi cation, computer security and prediction [
Predator-prey systems (PPS) demonstrate complex relationships and
interactions between entities in which one depends on the other for food and
protection [
Simulation was carried out in 2D, by means of processing jar library 1,
Version 3.2 with Java NetBeans Integrated Development Environment (IDE).
Experiments were conducted with 100 starlings and one predator (peregrine
falcon). Collective response was simulated following [
the normalized speed of the starlings population and n represents a factor that increase the starlingsM eanSpeed and murmuration speed = starlingsM eanSpeed. The conf usion speed is an incentive through which the starlings acquire a certain speed due to predator attack. Once the danger is eliminated or contained the starlings revert to murmuration speed. 5
First question: What is the extent to which confusion e ect reduces predator
attack success rate?
Ten di erent experiments were carried out using di erent parameters in ten
trials, each of which has twenty attacks (F igure 1) and we tuned the parameters
of starlings interaction and adaptation to an attack situation (confusion-e ect)
to optimal values. These are: global scale, neighbourhood radius, crowd radius,
avoidance radius, cohesion radius, separation radius, predator radius, eat
radius, catch radius, starlings speed, predator speed and we ran ten experiments,
as shown in F igure 1. Also, we set our starlings speed to follow a log-normal
distribution with 2 standard deviation of their mean speed. The decision to use
log normal distribution is based on the study by Eastwood et al [
The error bars de ne variability in the experiments which we attribute to: physical tness of the individual bird, daily form of the bird and current wind speed.
From F igure 1, we infer that there is a strong evidence that the results of our simulation is consistent because, the error bars of the ten experiments overlap and almost all the overlap includes the mean of the error bars, which is a strong evidence that the results of our experiment (i.e. success rate due to confusion e ect) is consistent. Therefore, we compute predator attack success rate as: m a S = 100%; (1) where S denotes success in predator attack, m denotes the mean number of attacks from the average values of ten di erent trials, and a denotes the average number of attacks.
Based on the results, we identi ed that confusion e ect reduced the success rate of predation by about 85% in starlings simulation with Standard Error of the Mean (SEM) = 0:297. In comparison, if a predator has 17% success rate in twenty attempts, a predator (i.e. peregrine falcon) will have a 0.85% success rate in a single attempt to capture a starling in a swarm, in a ratio of one to twenty. Second question: is there an optimal neighbourhood radius at which the confusion e ect is more e ective in reducing predator success rate and starlings conserve energy? Five di erent experiments were carried out using di erent parameters in ten trials, each of which last for ve minutes as shown in F igure 2 using di erent radii to set the topological range of the swarm. We used connectivity (graph theory) to know the average group size within the starlings at each draw during the experiment, and this enabled us to nd the number of successful predator attacks and the corresponding neighbourhood size. See F igure 2 for more details. The result shows the average predator success rate with corresponding neighbourhood size at each radius. The error bars on the average predator success shows the variability in the average success (SD) while those on the neighbourhood size shows the precision of the group size (SEM). Results in F igure 2 shows that there is an optimal neighbourhood size through which starlings can e ectively confuse the predator without dissipating much energy (F igure 2). This size is observed to be between seven and fourteen, which is the number that starlings use in keeping update with the entire swarm. Therefore, we conclude that there is a positive correlation between the optimal neighbourhood size and the confusion e ect and that this relationship contributes to reducing predation success rate. 6
In conclusion, this research presents an in depth investigation of the starlings murmuration and defence mechanisms particularly the confusion e ect through computer simulation. We have discovered novel underlying information such as the positive correlation between group size and neighbourhood radii, the rate at which confusion e ect contribute to reduced predator success rate. Further to this research, we will develop a meta-heuristic algorithm and set up an experiment using virtual environment to identify the network attacks that can best be mitigated using the algorithm to validate the performance of our intrusion prevention framework for Software De ned Networks.
Software-De ned Network (SDN) is a new and emerging area that promises to change the way networks are designed, build and operated. It is a paradigm shift from the traditional network architecture that is proprietary to a non proprietary, simple and programmable network architecture. 2