An immunological approach to change detection: algorithms, analysis and implications

Published 23 December 2002

Patrik D’haeseleer, Stephanie Forrest, Paul Helman

DOI10.1109/secpri.1996.502674

Citations163

TL;DR

Two detector-generating algorithms are introduced which run in linear time and heuristics are given for setting parameters based on the analysis, and the presence of holes in detector space is examined.

Abstract

We present new results on a distributable changedetection method inspired by the natural immune system. A weakness in the original algorithm was the exponential cost of generating detectors. Two detector-generating algorithms are introduced which run in linear time. The algorithms are analyzed, heuristics are given for setting parameters based on the analysis, and the presence of holes in detector space is examined. The analysis provides a basis for assessing the practicality of the algorithms in specific settings, and some of the implications are discussed. 1.

Keywords

Immunology and MicrobiologyBiochemistry, Genetics and Molecular BiologyEngineering

CellT cell tolerance by clonal elimination in the thymus

2,214 Citations1987John W. Kappler, Neal W. Roehm +1 more

The results show that in normal animals tolerance to self-MHC is due to clonal elimination rather than suppression, and indicate that tolerance induction may occur in the thymus at the time immature thymocytes are selected to move into the mature thymocyte pool.

Self-nonself discrimination in a computer

1,325 Citations2002Stephanie Forrest, Alan S. Perelson +2 more

A method for change detection which is based on the generation of T cells in the immune system is described, which reveals computational costs of the system and preliminary experiments illustrate how the method might be applied to the problem of computer viruses.

A sense of self for Unix processes

838 Citations2002Stephanie Forrest, Steven Hofmeyr +2 more

A method for anomaly detection is introduced in which "normal" is defined by short-range correlations in a process' system calls, and initial experiments suggest that the definition is stable during normal behaviour for standard UNIX programs.

Journal of Theoretical BiologyTheoretical studies of clonal selection: Minimal antibody repertoire size and reliability of self-non-self discrimination

652 Citations1979Alan S. Perelson, George Oster

It is argued that multisite recognition is a more reliable method of distinguishing between molecules than single site recognition, which may have been an important evolutionary consideration in the selection of weak non-covalent interactions as the basis of antigen-antibody bonds.

NatureIntroduction to Mathematical Probability

540 Citations1938J. V. Uspensky

View PDF

Purdue e-Pubs (Purdue University System)Defending a Computer System Using Autonomous Agents

152 Citations1995Mark Crosbie, Eugene H. Spafford

This report presents a prototype architecture of a defense mechanism for computer systems where TILcse agents are taught how to recognise intrusive behaviour, and the learning mechanism in the agents is built using Genetic Programming.

View PDF

Proceedings of the Royal Society B Biological SciencesHow diverse should the immune system be?

129 Citations1993Rob J. de Boer, Alan S. Perelson

A probability-based model suggests that the diversity of the lymphocyte repertoire reflects the number of self antigens the immune system needs to avoid reactivity with, and that for PE to be low the diversity should be large.

View PDF

An immunological approach to change detection: theoretical results

78 Citations2002Patrik D’haeseleer

The principle of holes (undetectable nonself strings) is illustrated, along with a proof of their existence for a large class of matching rules, and a lower bound on the size of the detector set is derived, based on information-theoretic grounds.

Probability of Self-Nonself Discrimination

16 Citations1992J. K. Percus, Ora E. Percus +1 more

In order to estimate the size of an optimal receptor combining region, the mammalian immune system over evolutionary time has been presented with a large random set of foreign antigens that occur on common pathogens, which it must recognize, and a smallerrandom set of self-antigens which a mature organism must not recognize.