We present ideas about creating a next generation Intrusion Detection System (IDS) based on the latest immunological theories. The central challenge with computer security is determining the difference between normal and potentially harmful activity. For half a century, developers have protected their systems by coding rules that identify and block specific events. However, the nature of current and future threats in conjunction with ever larger IT systems urgently requires the development of automated and adaptive defensive tools. A promising solution is emerging in the form of Artificial Immune Systems (AIS): The Human Immune System (HIS) can detect and defend against harmful and previously unseen invaders, so can we not build a similar Intrusion Detection System (IDS) for our computers? Presumably, those systems would then have the same beneficial properties as HIS like error tolerance, adaptation and self-monitoring. Current AIS have been successful on test systems, but the algorithms rely on self-nonself discrimination, as stipulated in classical immunology. However, immunologist are increasingly finding fault with traditional self-nonself thinking and a new `Danger Theory' (DT) is emerging. This new theory suggests that the immune system reacts to threats based on the correlation of various (danger) signals and it provides a method of `grounding' the immune response, i.e. linking it directly to the attacker. Little is currently understood of the precise nature and correlation of these signals and the theory is a topic of hot debate.

In order to maintain and promote a robust and dependable system it is required that agents, representing system services, are allowed some autonomy in their operations. It is also required that the system be as open as possible, without compromising security, to allow the introduction of novel procedures and performance improving changes or additions. This paper uses concepts from Artificial Immune Systems (AIS) engineering and the Stochastic Situation Calculus dialect of predicate logic, to formalise the detection of system novelty, based on danger signals as an immune (self-healing) and evolutionary (selfadaptive) reaction trigger. In this way any threat or potential enhancement to the system can be monitored for and the appropriate action taken to facilitate system selfgovernance, ensuring predictable and safe self-adaptation. 1.

Abstract-The dependability of distributed software is affected by issues of scalability and reliability that are commonly proposed to be solved by the use of autonomic software. However, usually the use of such software paradigms requires that the design of the formal operational model is implicitly linked with the end implementation. Such rigid reliance upon a static model thereby constrains the adaptability and flexibility of the software. This paper contends that for the aims of autonomic software to be fulfilled, namely the self-* abilities, a formal model should be specified and enacted independently from the runtime implementation. The paper shows by use of situation calculus and software representation techniques, how these issues can be addressed. In conclusion, by use of a representative example, the methodology proposed is evaluated to highlight the advantages discussed, and to identify problems still to be resolved. I.

This thesis investigates the application of principles inspired from the development of immune memory to the problem of unknown motif detection in time series data. Motifs represent repeating patterns in the underlying data. As human beings we naturally seek patterns or motifs in data in order to understand that information. Motifs indicate high level properties of the data, summarising the information in a compact, intuitive and meaningful manner. Motifs help identify relationships in the data and they can aid in the process of prediction and forecasting. The discovery of previously unknown motifs therefore has considerable value. Studying the evolution of naive immune cells in their path to becoming memory provides a valuable insight into the way the immune system learns and adapts to recognise and remember the information it encounters. Memory cells represent the solutions that the immune system has generated and wishes to remember. This biological system represents a mechanism capable of finding and storing a solution to a problem. By understanding the evolutionary process that leads to