![](bg3.png)
3.1.1 Example Detector in Anomaly Extraction
System
The example detector (APC cell) is responsible for
monitoring system calls made by process. Analysis
of conditional entropy of the sequences suggests that
it is reasonable to choose one of the statistical model
which incorporates conditional probability to build a
profile of system calls sequences. Markov chain with
variable order is the choice here. This model provides
a probability of the next system call having seen pre-
vious n. In this case n is a length of history and de-
pends on the actual context — hence variable order.
The profile is created during the training phase from
the sequences of system calls representing normal be-
haviour according to the algorithm presented in (Ron
et al., 1996). An overview of Markov models can
be found in (Bengio, 1999). The detector provides
a probability of the next system call.
3.2 Lymphocytes Mobile Agents
Mobile agents Md
1
, ..., Md
n
forms the second layer of
the system architecture. They use signals from detec-
tors as a trigger for further processing of events. Ini-
tial mobile agent population is empty. The first agent
is born after first signal from a detector. A newly
born agent captures all processed information from all
APC detectors in a given time slot T
s
- it can be sus-
pected that these events are correlated and a system
wide information could be captured. The captured
pattern becomes the system output. Because of the
possibility of wrong information corellation - a false
alarm - this newly created agent needs a second signal
to become fully functional. For now this signal comes
from external source - usually an administrator. After
the administrator’s decision the agent is turned into
one of the two types:
• pattern specific — in case when valuable pattern
has been found and in the same time it becomes
an immune memory agent.
• anergic — in case it was a false alarm. This
agent’s aim is to remember false alarm pattern and
prevent future appearances of this pattern in sys-
tem output.
3.2.1 Life Energy
To maintain a stable in number population of mobile
agents and also to build a population which can dy-
namically adapt to the most current information main-
tained by the environment an idea of life energy is
used. At the beginning an agent receives some fixed
amount of life energy E
p
. In each step the energy is
decreased by 1. A certain probability of death of the
agent is also determined, which depends on the ac-
tual level of the agent’s life energy. The probability is
given by the following function:
p(x) =
−
1
E
s
+ 1 forx < E
s
0 forx ≥ E
s
(1)
where E
s
is an arbitrarily chosen value. When the
agent happens to detect something its life energy in-
creases also by arbitrarily chosen value E
a
. This
mechanism makes it possible to delete agents which
detect obsolete patterns. It also keeps alive those
agents responsible for detection of frequently occur-
ring patterns.
3.2.2 Example of a Lymphocyte Agent
The probability output of APC detector agent is
mapped to some amount of penalty points. It is done
through a penalty function ξ : [0, 1] → R. To be use-
ful this function should give a large amount of penalty
points for probability equal to 0 and small amount if
the probability is close to 1. In my research the fol-
lowing function was used:
ξ(x) =
a
x + b
+ c . (2)
The a parameter controls how convex the function is,
b and c parameters modifies the amount of points the
function returns for a given probability. All three pa-
rameters must be carefully chosen. In each step the
computed penalty points are added to a penalty ac-
count Ξ. To limit aggregation of history the penalty
account is also multiplied by dumping factor ζ < 1
(4).
Ξ
0
= 0 (3)
Ξ
i+1
= ζ(Ξ
i
+ ξ
i,i+1
) (4)
where ξ
i,i+1
is the amount of the penalty points com-
puted when going from i-th step to (i + 1)-th step. If
the penalty account exceeds a certain threshold τ a
pattern is stored. Figure 2 presents example plot of
the penalty account and the threshold. From observa-
tions it can be concluded that each process has its own
characteristic plot of behaviour that is a very impor-
tant feature.
Subsequent values of the penalty account form a
signal which is unique for a particular process and is
also unique for an information pattern. It is reason-
able though to remember and analyse this signal and
through this recognise patterns. For this purpose a
very simple neural network is used. Since the agent
is (in this version) responsible only for detection of
one particular pattern, and with the assumption that it
is in linearly separable set, its neural network consists
ARTIFICIAL IMMUNE SYSTEM FRAMEWORK FOR PATTERN EXTRACTION IN DISTRIBUTED
ENVIRONMENT
181