Immunology as a Metaphor for Computational ... - Napier University

Chapter 2. Background 18system. The basic principles behind all of these models are as follows (modified fromDasgupta [Dasgupta and Forrest, 1999])Define self as a multiset S of strings of length l over a finite alphabet, a collection¢which we wish to process or monitorGenerate a set R of detectors, each of which fails to match any string in S. (A¢partial matching rule may be applied)Monitor S for changes by continually matching the detectors against S. If any¢detector ever matches, a change or deviation must have occurred.This basic algorithm has been employed extensively in computer security applications.[Forrest et al., 1994] applied the analogy to computer virus detection, to hostbasedintrusion detection[Forrest et al., 1997a], and to making computers robust towide-spread attacks, [Forrest et al., 1997b]. [Hofmeyr and Forrest, 2000] describe afurther system for protecting local area networks (LANs) from network-based attacks.The key to each of these applications clearly lies in defining ’self’ in each case. Forexample, in Hofmeyr’s work on LAN security, self is defined as a set of datapath triplesdefining TCP connections logged to the network. These were collected over a periodof 50 days, which after filtering out noisy traffic sources such as web-servers, resultedin a set of 1.5 million datapaths.The negative detection algorithm has also been applied by Dasgupta in[Dasgupta and Forrest, 1996, Dasgupta, 1996] to detecting anomalies in time seriesdata. In this case, the aim is to detect temporal changes in the cutting force patternsobtained from machine tool data, and thus predict when a machine is likely to break. Inthis case, self is defined by first collecting raw sensory data from machines in normaloperation over a moving time window and mapping this real-valued data into a binaryform (essentially by normalising each analog value with respect to a defined range anddiscretising it into bins — each data point is assigned the integer corresponding to thebin within which it falls).In [Hofmeyr and Forrest, 2000], Hofmeyr describes a general immune frameworkcalled ARTIS, based on the principle of negative selection, which embodies many ofthe characteristics of the biological immune system. In this system, a set of detectors is