Artificial Immune Systems: An Emerging Technology

1. Artificial Immune Systems: An Emerging Technology Congress on Evolutionary Computation 2001. Seoul, Korea. Dr. Jonathan Timmis Computing Laboratory University of Kent at Canterbury England. UK. J.Timmis@ukc.ac.uk http:/www.cs.ukc.ac.uk/people/staff/jt6

2. Tutorial Overview • What are Artificial Immune Systems? • Background immunology • Why use the immune system as a metaphor • Immune Metaphors employed • Review of AIS work • Applications • More blue sky research Artificial Immune Systems

3. Immune metaphors Other areas Idea! Idea ‘ Artificial Immune Systems Immune System Artificial Immune Systems

4. Artificial Immune Systems • Relatively new branch of computer science • Some history • Using natural immune system as a metaphor for solving computational problems • Not modelling the immune system • Variety of applications so far … • Fault diagnosis (Ishida) • Computer security (Forrest, Kim) • Novelty detection (Dasgupta) • Robot behaviour (Lee) • Machine learning (Hunt, Timmis, de Castro) Artificial Immune Systems

5. Why the Immune System? • Recognition • Anomaly detection • Noise tolerance • Robustness • Feature extraction • Diversity • Reinforcement learning • Memory • Distributed • Multi-layered • Adaptive Artificial Immune Systems

6. Part I – Basic Immunology Artificial Immune Systems

7. Role of the Immune System • Protect our bodies from infection • Primary immune response • Launch a response to invading pathogens • Secondary immune response • Remember past encounters • Faster response the second time around Artificial Immune Systems

8. How does it work? Artificial Immune Systems

9. Where is it? Artificial Immune Systems

10. Multiple layers of the immune system Artificial Immune Systems

11. Immune Pattern Recognition • The immune recognition is based on the complementarity between the binding region of the receptor and a portion of the antigen called epitope. • Antibodies present a single type of receptor, antigens might present several epitopes. • This means that different antibodies can recognize a single antigen Artificial Immune Systems

12. Antibodies Antibody Molecule Antibody Production Artificial Immune Systems

13. Clonal Selection Artificial Immune Systems

14. T-cells • Regulation of other cells • Active in the immune response • Helper T-cells • Killer T-cells Artificial Immune Systems

15. Main Properties of Clonal Selection (Burnet, 1978) • Elimination of self antigens • Proliferation and differentiation on contact of mature lymphocytes with antigen • Restriction of one pattern to one differentiated cell and retention of that pattern by clonal descendants; • Generation of new random genetic changes, subsequently expressed as diverse antibody patterns by a form of accelerated somatic mutation Artificial Immune Systems

16. Reinforcement Learning and Immune Memory • Repeated exposure to an antigen throughout a lifetime • Primary, secondary immune responses • Remembers encounters • No need to start from scratch • Memory cells • Associative memory Artificial Immune Systems

17. Learning (2) Artificial Immune Systems

18. Immune Network Theory • Idiotypic network (Jerne, 1974) • B cells co-stimulate each other • Treat each other a bit like antigens • Creates an immunological memory Artificial Immune Systems

19. Immune Network Theory(2) Artificial Immune Systems

20. Shape Space Formalism • Repertoire of the immune system is complete (Perelson, 1989) • Extensive regions of complementarity • Some threshold of recognition V ´ V e e V e e ´ ´ ´ ´ V e e ´ ´ Artificial Immune Systems

21. Self/Non-Self Recognition • Immune system needs to be able to differentiate between self and non-self cells • Antigenic encounters may result in cell death, therefore • Some kind of positive selection • Some element of negative selection Artificial Immune Systems

22. Summary so far …. • Immune system has some remarkable properties • Pattern recognition • Learning • Memory • So, is it useful? Artificial Immune Systems

23. Some questions for you ! Artificial Immune Systems

24. Part II – A Review of Artificial Immune Systems Artificial Immune Systems

25. Topics to Cover • A few disclaimers … • I can not cover everything as there is a large amount of work out there • To do so, would be silly  • Proposed general frameworks • Give an overview of significant application areas and work therein • I am not an expert in all the problem domains • I would earn more money if I was ! Artificial Immune Systems

26. Shape Space • Describe interactions between molecules • Degree of binding between molecules • Complement threshold • Each paratope matches a certain region of space • Complete repertoire Artificial Immune Systems

27. Representation and Affinities • Representation affects affinity measure • Binary • Integer • Affinity is related to distance • Euclidian • Hamming • Affinity threshold Artificial Immune Systems

28. Basic Immune Models and Algorithms • Bone Marrow Models • Negative Selection Algorithms • Clonal Selection Algorithm • Somatic Hypermutation • Immune Network Models Artificial Immune Systems

29. Bone Marrow Models • Gene libraries are used to create antibodies from the bone marrow • Antibody production through a random concatenation from gene libraries • Simple or complex libraries Artificial Immune Systems

30. Negative Selection Algorithms • Forrest 1994: Idea taken from the negative selection of T-cells in the thymus • Applied initially to computer security • Split into two parts: • Censoring • Monitoring Artificial Immune Systems

31. Negative Selection Algorithm • Each copy of the algorithm is unique, so that each protected location is provided with a unique set of detectors • Detection is probabilistic, as a consequence of using different sets of detectors to protect each entity • A robust system should detect any foreign activity rather than looking for specific known patterns of intrusion. • No prior knowledge of anomaly (non-self) is required • The size of the detector set does not necessarily increase with the number of strings being protected • The detection probability increases exponentially with the number of independent detection algorithms • There is an exponential cost to generate detectors with relation to the number of strings being protected (self). • Solution to the above in D’haeseleer et al. (1996) Artificial Immune Systems

32. Somatic Hypermutation • Mutation rate in proportion to affinity • Very controlled mutation in the natural immune system • Trade-off between the normalized antibody affinity D* and its mutation rate , Artificial Immune Systems

33. Immune Network Models • Timmis & Neal, 2000 • Used immune network theory as a basis, proposed the AINE algorithm Initialize AIN For each antigen Present antigen to each ARB in the AIN Calculate ARB stimulation level Allocate B cells to ARBs, based on stimulation level Remove weakest ARBs (ones that do not hold any B cells) If termination condition met exit else Clone and mutate remaining ARBs Integrate new ARBs into AIN Artificial Immune Systems

34. Immune Network Models • De Castro & Von Zuben (2000c) • aiNET, based in similar principles At each iteration step do For each antigen do Determine affinity to all network cells Select n highest affinity network cells Clone these n selected cells Increase the affinity of the cells to antigen by reducing the distance between them (greedy search) Calculate improved affinity of these n cells Re-select a number of improved cells and place into matrix M Remove cells from M whose affinity is below a set threshold Calculate cell-cell affinity within the network Remove cells from network whose affinity is below a certain threshold Concatenate original network and M to form new network Determine whole network inter-cell affinities and remove all those below the set threshold Replace r% of worst individuals by novel randomly generated ones Test stopping criterion Artificial Immune Systems

35. Part III - Applications Artificial Immune Systems

36. Anomaly Detection • The normal behavior of a system is often characterized by a series of observations over time. • The problem of detecting novelties, or anomalies, can be viewed as finding deviations of a characteristic property in the system. • For computer scientists, the identification of computational viruses and network intrusions is considered one of the most important anomaly detection tasks Artificial Immune Systems

37. Virus Detection • Protect the computer from unwanted viruses • Initial work by Kephart 1994 • More of a computer immune system Artificial Immune Systems

38. Virus Detection (2) • Okamoto & Ishida (1999a,b) proposed a distributed approach • Detected viruses by matching self-information • first few bytes of the head of a file • the file size and path, etc. • against the current host files. • Viruses were neutralized by overwriting the self-information on the infected files • Recovering was attained by copying the same file from other uninfected hosts through the computer network Artificial Immune Systems

39. Immune System Computational System Pathogens (antigens) Computer viruses B-, T-cells and antibodies Detectors Proteins Strings Antibody/antigen binding Pattern matching Virus Detection (3) • Other key works include: • A distributed self adaptive architecture for a computer virus immune system (Lamont, 200) • Use a set of co-operating agents to detect non-self patterns Artificial Immune Systems

40. Security • Somayaji et al. (1997) outlined mappings between IS and computer systems • A security systems need • Confidentiality • Integrity • Availability • Accountability • Correctness Artificial Immune Systems

41. Immune System Network Environment Static Data Self Uncorrupted data Non-self Any change to self Active Processes on Single Host Cell Active process in a computer Multicellular organism Computer running multiple processes Population of organisms Set of networked computers Skin and innate immunity Security mechanisms, like passwords, groups, file permissions, etc. Adaptive immunity Lymphocyte process able to query other processes to seek for abnormal behaviors Autoimmune response False alarm Self Normal behavior Non-self Abnormal behavior Network of Mutually Trusting Computers Organ in an animal Each computer in a network environment IS to Security Systems Artificial Immune Systems

42. Network Security • Hofmeyr & Forrest (1999, 2000): developing an artificial immune system that is distributed, robust, dynamic, diverse and adaptive, with applications to computer network security. • Kim & Bentley (1999). New paper here at CEC so I won’t cover it, go see it for yourself! Artificial Immune Systems

43. Forrests Model External host Randomly created Host ip: 20.20.15.7 010011100010.....001101 Activation port: 22 Detector threshold set Immature Datapath triple Cytokine level match during No (20.20.15.7, 31.14.22.87, Internal tolerization host ftp) Permutation mask Exceed Mature & Naive activation ip: 31.14.22.87 threshold Match port: 2000 during Don’t Match tolerization exceed Detector Activated activation threshold 0100111010101000110......101010010 No Co stimulation co stimulation memory immature activated matches Death Memory Broadcast LAN AIS for computer network security. (a) Architecture. (b) Life cycle of a detector. Artificial Immune Systems

44. Novelty Detection • Image Segmentation : McCoy & Devarajan (1997) • Detecting road contours in aerial images • Used a negative selection algorithm Artificial Immune Systems

45. Table 4.1. Immune System Hardware Fault Tolerance Recognition of self Recognition of valid state/state transition Recognition of non-self Recognition of invalid state/state transition Learning Learning correct states and transitions Humoral immunity Error detection and recovery Clonal deletion Isolation of self-recognizing tolerance conditions Inactivation of antigen Return to normal operation Life of an organism Operation lifetime of a hardware Hardware Fault Tolerance • Immunotronics (Bradley & Tyrell, 2000) • Use negative selection algorithm for fault tolerance in hardware Artificial Immune Systems

46. Machine Learning • Early work on DNA Recognition • Cooke and Hunt, 1995 • Use immune network theory • Evolve a structure to use for prediction of DNA sequences • 90% classification rate • Quite good at the time, but needed more corroboration of results Artificial Immune Systems

47. Unsupervised Learning • Timmis, 2000 • Based on Hunts work • Complete redesign of algorithm: AINE • Immune metadynamics • Shape space • Few initial parameters • Stabilises to find a core pattern within a network of B cells Artificial Immune Systems

48. Results (Timmis, 2000) Artificial Immune Systems

49. Another approach • de Castro and von Zuben, 2000 • aiNET cf. SOFM • Use similar ideas to Timmis • Immune network theory • Shape space • Suppression mechanism different • Eliminate self similar cells under a set threshold • Clone based on antigen match, network not taken into account Artificial Immune Systems

50. Results (de Castro & von Zuben, 2001) Test Problem Result from aiNET Artificial Immune Systems