Aickelin, Uwe (2003) Artificial Immune System and Intrusion Detection Tutorial. In: Introduction Tutorials in Optimization, Search and Decision Support Methodologies, Nottingham, UK. Access from the University of Nottingham repository: http://eprints.nottingham.ac.uk/653//03intros_ais_tutorial.pdf Copyright and reuse: The Nottingham eprints service makes this work by researchers of the University of Nottingham available open access under the following conditions. This article is made available under the University of Nottingham End User licence and may be reused according to the conditions of the licence. For more details see: http://eprints.nottingham.ac.uk/end_user_agreement.pdf A note on versions: The version presented here may differ from the published version or from the version of record. If you wish to cite this item you are advised to consult the publisher s version. Please see the repository url above for details on accessing the published version and note that access may require a subscription. For more information, please contact eprints@nottingham.ac.uk
Artificial Immune Systems Tutorial By Dr Uwe Aickelin http://www.aickelin.com
Overview Biological Immune System. Artificial Immune System (AIS). Comparison to other Algorithms. Applications of AIS: Data Mining. Security (Build Your Own). Others. The Future.
Antigens Substances capable of starting a specific immune response are referred to as antigens. This includes some pathogens such as viruses, bacteria, fungi etc.
Why the Immune System? Robust. Autonomous. Effective Memory. Distributed. Adaptive. Very Successful.
Biological Immune System Protect our bodies from pathogens. Primary immune response: Launch a response against invaders. Secondary immune response: Remember past encounters. Faster response the second time.
Biological Immune System Innate vs Acquired Cell Mediated vs Humoral T Cell (Killer) T Cell (Helper) B Cell Secretes Antibody
Immune System Overview M H C p r o t e i n A n t i g e n A P C ( I ) P e p t i d e ( I I ) T - c e l l ( I I I ) B - c e l l ( V ) ( I V ) A c t i v a t e d T - c e l l L y m p h o k i n e s ( V I ) A c t i v a t e d B - c e l l ( p l a s m a c e l l ) ( V I I )
Self-Nonself Discrimination Immune system differentiates between self and nonself cells. Antigenic encounters may result in cell death. Therefore: Some kind of positive selection. Some element of negative selection.
Immune Network Theory Idiotypic network (Jerne, 974): B cells stimulate each other. Creates an immunological memory. Ag Suppression (Negative Response) 2 3 Stimulation (Positive Response)
Overview Biological Immune System. Artificial Immune System (AIS). Comparison to other Algorithms. Applications of AIS: Data Mining. Security (Build Your Own). Others. The Future.
Film Recommender Prediction: What rating would I give a specific film? Recommendation: Give me a top 0 list of films I might like.
Film Recommender EachMovie database (70k users). User Profile: set of tuples {movie, rating}. Me: My user profile. Neighbour: User profile of others. Similarity metric: Correlation score. Neighbourhood: Group of similar users. Recommendations: From neighbourhood.
Film Recommender User Profile: set of tuples {movie, rating} Antigen Antibody Stimulation Me: My user profile. Neighbour: User profile of others. Affinity metric: Correlation score. Antibody Antigen Binding Antibody Antibody Binding Neighbourhood: Group of similar users. Suppression Group of antibodies similar to antigen and dissimilar to other antibodies Recommendations: From neighbourhood Weighted Score based on Similarities.
Film Recommender Start with empty AIS. Encode target user as an antigen Ag. WHILE (AIS not full) && (More Users): Add next user as antibody Ab. IF (AIS at full size) Iterate AIS. Generate recommendations from AIS.
Film Recommender Suppose we have 5 users and 4 movies: u={(m,v),(m2,v2),(m3,v3)}. u2={(m,v2),(m2,v22),(m3,v23),(m4,v24)}. u3={(m,v3),(m2,v32),(m4,v34)}. u4={(m,v4),(m4,v44)}. u5={(m,v5),(m2,v52),(m3,v53), (m4,v54)}. We do not have users votes for every film. We want to predict the vote of user u4 on movie m3.
Algorithm walkthrough () Start with empty AIS: AIS DATABASE u, u 2, u 3, u 4, u 5 User for whom to predict becomes antigen: DATABASE u, u 2, u 3, u 5 u 4 AIS Ag
Algorithm walkthrough (2) Add antibodies until AIS is full DATABASE u Ag AIS u 2, u 3, u 5 Ab DATABASE u 2,u 3 Ag AIS u 4 Ab Ab 2 Ab 3
Algorithm walkthrough (3) Ab 2 Ag Ab 3 Ab Table of Correlation between Ab and Ag: MS4, MS24, MS34. Table of Correlation between Antibodies: MS2 = CorrelCoef(Ab, Ab2) MS3 = CorrelCoef(Ab, Ab3) MS23 = CorrelCoef(Ab2, Ab3)
Algorithm walkthrough (4) Calculate Concentration of each Ab: Interaction with Ag (Stimulation). Interaction with other Ab (Suppression). AIS Ag Ab Ab 2 Ab 3 Ag Ab Ab 2 Ab 2 Ab 2 Ab Ab Ab 2 2 AIS
Algorithm walkthrough (5) Generate Recommendation based on Antibody Concentration. AIS Ag Ab Ab2 Ab 2 Ab Ab 2 Ab Ab 2 2 Recommendation for user u 4 on movie m 3 will be highly based on vote on m 3 of user u 2
Film Recommender Results Tested against standard method (Pearson k-nearest neighbours). Prediction: Results of same quality. Recommendation: 4 out of 5 films correct (AIS). 3 out of 5 films correct (Pearson).
Evaluation AIS is good for Collaborative Filtering: Idiotypic effect for more varied population. Potential for distribution. Smaller neighbourhoods. General recommendation tool: Webmining (URL Recommender).
Overview Biological Immune System. Artificial Immune System (AIS). Comparison to other Algorithms. Applications of AIS: Data Mining. Security (Build Your Own). Others. The Future.
Comparison of Algorithms GA (Optimisation) NN (Classification) AIS Components Location of Components Structure Chromosome Strings Dynamic Discrete Components Artificial Neurons Pre-Defined Networked Components Knowledge Storage Chromosome Strings Connection Strengths Dynamics Meta-Dynamics Interaction between Components Interaction with Environment Threshold Activity Evolution Recruitment / Elimination of Components Crossover Fitness Function Crowding / Sharing Learning Construction / Pruning of Connections Network Connections External Stimuli Neuron Activation
Comparison of Algorithms GA (Optimisation) NN (Classification) AIS Components Chromosome Strings Artificial Neurons Attribute Strings Location of Components Dynamic Pre-Defined Dynamic Structure Discrete Components Networked Components Discrete components / Networked Components Knowledge Storage Chromosome Strings Connection Strengths Component Concentration / Network Connections Dynamics Evolution Learning Evolution / Learning Meta-Dynamics Recruitment / Elimination of Components Construction / Pruning of Connections Recruitment / Elimination of Components Interaction between Components Crossover Network Connections Recognition / Network Connections Interaction with Environment Fitness Function External Stimuli Recognition / Objective Function Threshold Activity Crowding / Sharing Neuron Activation Component Affinity
Overview Biological Immune System. Artificial Immune System (AIS). Comparison to other Algorithms. Applications of AIS: Data Mining. Security (Build Your Own). Others. The Future.
Clustering (ainet) Immune System Antibody Antigen Affinity Cell cloning Somatic hypermutation Immune network Metadynamics ainet Internal data vector Training data vector Euclidean distance Duplication of internal data vectors Affinity proportional mutation Network of internal data vectors Removal / creation of internal data vectors
Clustering (ainet) Initialization (Create a random population of antibodies). For each antigen do: Clonal selection and Hypermutation. Metadynamics (Removal). Network interactions (Suppression). Cycle (Repeat for a number of iterations).
Clustering (ainet) Training Patterns 0.8 0.6 0.4 0.2 0 4 4 44 4 4 44 44 44 4 44 4 4 4 4 4 44 4 4 4 4 4 4 34 3 3 3 33 333 3 3 4 3 3 3 33 3 33 3 3 3 3 3 3 3 22 22 22 22 2 22 22 2 5 5 2 2 2 2 2 2 2 55 5 55 5 66 666 5 5 5 5 5 55 55 5 55 5 5 5 7 777 7777777 77 7 777 7 7777 77 7 7 77 7 7 7 777 8 8 88 88 8 8 888 8 8 8 8 8888 88 8 88 8 8 8 88 8 8 88888888888 0 0.2 0.4 0.6 0.8 Training Pattern Immune network
AIS for Security Self : files, network traffic, system calls. Antibody creation: positive vs. negative. Change detection (Checksums). Advanced Features: Binary strings or symbolic rules. Activation thresholds (vs false positives). Co-stimulation (vs false positives). Memory detectors (secondary response).
Design a Simple AIS IDS Feature Positive or Negative Selection? AIS IDS Antibody Antigen Affinity Measure Cloning Somatic Hypermutation Immune Network Metadynamics
Forrest s Censoring Self strings (S) Generate random strings (R 0) Match No Detector Set (R) Yes Reject
Forrest s Monitoring Detector Set (R) Protected Strings (S) Match Yes No Non-self Detected
AIS Security Evaluation Applied to network intrusion, virus detection Good results on test systems. BUT Definition of Self ambiguous. Inefficient to map entire nonself universe. Self / Nonself changes over time.
AIS for Optimisation Applied to TSP (of course), job shop scheduling, time series prediction Some good results on test problems. BUT Often little added value to GA. AIS metaphor somewhat strained?
Overview Biological Immune System. Artificial Immune System (AIS). Comparison to other Algorithms. Applications of AIS: Data Mining. Security (Build Your Own). Others. The Future.
Traditional Self-Nonself Traditional Self-Nonself Problems: No reaction to foreign bacteria in gut. No reaction to food / air / etc. The human body changes over its life. Auto-immune diseases. Tumours / Transplants.
Danger Theory Need for discrimination: What should be responded to? Self-Nonself discrimination useful. Respond to Danger not to foreignness. Danger is measured by damage / distress signals. What would be danger signals?
Danger Zone Antibodies Antigens Cells Damaged Cell Danger Zone Stimulation Match, but too far No match away Danger Signal
The Future Much work is very diverse: More formal approach required? Wide possible application domains. What makes the immune system unique? More work with immunologists: Danger theory. Idiotypic Networks. Self-Assertion.
The Future (2) Use Latest Immunological Danger Theory for Intrusion Detetcion. Investigate the Correlation between Good and Bad Cell Deaths. Overcome Self-Nonself Limitations. Supported by 659k EPSRC Adventure Grant (+ 33k Industry).
The Future (3) ARTIST: A Network for Artificial Immune Systems (EPSRC funded network). Work towards: A theoretical foundation for AIS. Extraction of accurate metaphors. Application of AIS. Train PhD students. Fund workshops/meetings. Coordinate and Disseminate UK based AIS research.
AIS Resources Artificial Immune Systems and Their Applications by D Dasgupta (Editor), Springer Verlag, 999. Artificial Immune Systems: A New Computational Intelligence Approach by L de Castro, J Timmis, Springer Verlag, 2002. Immunocomputing: Principles and Applications by A Tarakanov et al, Springer Verlag, 2003. Second International Conference on Artificial Immune Systems (ICARIS), September -3, 2003, Napier University, Edinburgh, UK.