
448 19. Artificial Immune Models
The number of unread emails in the inbox determines the degree of the danger signal,
θ. If the degree of the danger signal reaches a limit, θ
max
, the unread emails, U,are
presented to the set of antibodies, B, for classification as uninteresting. An email,
z
p
∈U, is classified as uninteresting if the highest calculated affinity, a
h
,ishigher
than an affinity threshold, a
max
.Theuninteresting classified email is then moved to
a temporary folder or deleted. The degree of the danger signal needs to be calculated
for each new email received.
19.5.3 Intrusion Detection
The basic function of an intrusion detection system (IDS) is to monitor incoming traffic
at a specific host connected to a network. The IDS creates a profile of normal user
traffic and signals an alarm of intrusion for any detected abnormal traffic, i.e. traffic
not forming part of the normal profile. A problem to this solution of profile creation,
is that the normal traffic changes through time. Thus, the profile gets outdated.
The danger signal used in danger theory inspired the modeling of an adaptable IDS.
The danger signal can be defined as a signal generated by the host if any incoming traf-
fic resulted in abnormal CPU usage, memory usage or security attacks. The adaptable
IDS will only signal an alarm of abnormal traffic if the IDS receives a danger signal
from the host. If no danger signal is received from the host, the profile is adapted to
accommodate the new detected normal traffic. Danger theory inspired AISs applied
to intrusion/anomaly detection can be found in [13, 30].
19.6 Applications and Other AIS models
Artificial immune systems have been successfully applied to many problem do-
mains. Some of these domains range from network intrusion and anomaly detection
[13, 30, 176, 279, 280, 327, 373, 374, 457, 458, 803, 804] to data classification models
[692, 890], virus detection [281], concept learning [689], data clustering [184], robotics
[431, 892], pattern recognition and data mining [107, 398, 845, 847]. The AIS has
also been applied to the initialization of feed-forward neural network weights [189],
the initialization of centers of a radial basis function neural network [188] and the
optimization of multi-modal functions [181, 294]. The interested reader is referred to
[175, 183, 185] for more information on AIS applications.
19.7 Assignments
1. With reference to negative selection as described in Section 19.2.1, discuss the
consequences of having small values for r. Also discuss the consequences for
large values.
2. A drawback of negative selection is that the training set needs to have a good
representation of self patterns. Why is this the case?