An articial immune system (ARTIS) is described which incorporates many properties of natural immune systems, including diversity, distributed computation, error tolerance, dynamic learning and adaptation and self-monitoring. ARTIS is a general framework for a distributed adaptive system and could, in principle, be applied to many domains. In this paper, ARTIS is applied to computer security, in the form of a network intrusion detection system called LISYS. LISYS is described and shown to be eective at detecting intrusions, while maintaining low false positive rates. Finally, similarities and dierences between ARTIS and Holland's classier systems are discussed. 1 INTRODUCTION The biological immune system (IS) is highly complicated and appears to be precisely tuned to the problem of detecting and eliminating infections. We believe that the IS provides a compelling example of a massively-parallel adaptive information-processing system, one which we can study for the purpose o...

This dissertation explores an immunological model of distributed detection, called negative detection, and studies its performance in the domain of intrusion detection on computer networks. The goal of the detection system is to distinguish between illegitimate behaviour (nonself ), and legitimate behaviour (self ). The detection system consists of sets of negative detectors that detect instances of nonself; these detectors are distributed across multiple locations. The negative detection model was developed previously; this research extends that previous work in several ways. Firstly, analyses are derived for the negative detection model. In particular, a framework for explicitly incorporating distribution is developed, and is used to demonstrate that negative detection is both scalable and robust. Furthermore, it is shown that any scalable distributed detection system that requires communication (memory sharing) is always less robust than a system that does not require communication...

Present day computer systems are fragile and unreliable. Human beings are involved in the care and repair of computer systems at every stage in their operation. This level of human involvement will be impossible to maintain in future. Biological and social systems of comparable and greater complexity have self-healing processes which are crucial to their survival. It will be necessary to mimic such systems if our future computer systems are to prosper in a complex and hostile environment. This paper describes strategies for future research and summarizes concrete measures for the present, building upon existing software systems.

Abstract. Dendritic cells are antigen presenting cells that provide a vital link between the innate and adaptive immune system. Research into this family of cells has revealed that they perform the role of coordinating T-cell based immune responses, both reactive and for generating tolerance. We have derived an algorithm based on the functionality of these cells, and have used the signals and differentiation pathways to build a control mechanism for an artificial immune system. We present our algorithmic details in addition to some preliminary results, where the algorithm was applied for the purpose of anomaly detection. We hope that this algorithm will eventually become the key component within a large, distributed immune system, based on sound immunological concepts.

Abstract. The Dendritic Cell algorithm (DCA) is inspired by recent work in innate immunity. In this paper a formal description of the DCA is given. The DCA is described in detail, and its use as an anomaly detector is illustrated within the context of computer security. A port scan detection task is performed to substantiate the influence of signal selection on the behaviour of the algorithm. Experimental results provide a comparison of differing input signal mappings.

Abstract. An immune system without tissue is like evolution without genes. Something very important is missing. Here we present the novel concept of tissue for artificial immune systems. Much like the genetic representation of genetic algorithms, tissue provides an interface between problem and immune algorithm. Two tissue-growing algorithms are presented with experimental results illustrating their abilities to dynamically cluster data and provide useful signals. The use of tissue to provide an innate immune response driving the adaptive response of conventional immune algorithms is then discussed. 1

Abstract not found

A form of distributed, lazy evaluation is presented for anomaly detection in computers. Using a two dimensional time parameterization, and a geometric Markovian memory, we discuss a three tiered probabilistic method of classifying anomalous behaviour in periodic time. This leads to a computationally cheap means of finding probable faults amongst the symptoms of network and system behaviour. Keywords: Machine learning, anomaly detection 1.

Artificial immune systems have previously been applied to the problem of intrusion detection. The aim of this research is to develop an intrusion detection system based on the function of Dendritic Cells (DCs). DCs are antigen presenting cells and key to the activation of the human immune system, behaviour which has been abstracted to form the Dendritic Cell Algorithm (DCA). In algorithmic terms, individual DCs perform multi-sensor data fusion, asynchronously correlating the fused data signals with a secondary data stream. Aggregate output of a population of cells is analysed and forms the basis of an anomaly detection system. In this paper the DCA is applied to the detection of outgoing port scans using TCP SYN packets. Results show that detection can be achieved with the DCA, yet some false positives can be encountered when simultaneously scanning and using other network services. Suggestions are made for using adaptive signals to alleviate this uncovered problem.

this paper we present a brief review of the main properties and interactions of such tumour-associated macrophages, leading to a description of a mathematical model for the spatial interactions of macrophages, tumour cells and normal tissue cells, focusing on the ability of macrophages to kill mutant cells. Analysis of the homogeneous steady states shows that, for this model, normal tissue is unstable to the introduction of mutant cells despite such an immune response, but that the composition of the resulting tumour can be significantly altered. Including random cell movement and chemical di#usion, we demonstrate the existence of travelling wave solutions connecting the normal tissue and tumour steady states, corresponding to a growing tumour, and of the development of a spatial instability behind the wave front. Numerical solutions are illustrated in one and two dimensions. We go on to estimate macrophage motility parameters using data from Boyden chamber experiments. We then extend our model to include macrophage chemotaxis, that is, their directed movement in response to gradients of chemicals secreted by tumours. Solutions in one dimension indicate the possibility of spatiotemporal irregularities within the growing tumour, which are deduced to be the result of a series of bifurcations as the e#ective domain length increases, leading to a permanently transient solution