Immune Memory in the Dynamic Clonal Selection Algorithm

TLDR: This paper describes an extension to the original DynamiCS algorithm, involving the deletion of memory detectors that are no longer valid, and investigates a further extension of Dyna miCS, so that it can reduce FP rates increased by memory detectors.

Abstract: The dynamic clonal selection algorithm (DynamiCS) was created to tackle the difficulties of anomaly detection in continuously changing environments (Kim and Bentley, 2002). This paper describes an extension to the original algorithm, involving the deletion of memory detectors that are no longer valid. Experiments are performed on the extended system and results are analysed. The results show a marked decrease in false positive errors produced by the system. A real computer network produces new network traffi c continuously in real-time. Thus, normal behaviours of network traffic on one day can be different from no rmal behaviours of network traffic on another day. Prev ious work (Kim and Bentley, 2002), introduced the concep t of an artificial immune system (AIS) based on a dynamic clonal selection algorithm (DynamiCS) to tackle this type of problem. This system is capable of learning norm al behaviours by experiencing only a small subset of s elf antigens at one time. Its detectors were designed t o be replaced whenever previously observed normal behavioursnolongerrepresentedcurrentnormal behaviours. The results from experiments on this system (Kim an d Bentley, 2002) showed that DynamiCS could incrementally learn the globally converged distribu tions even though only one subset distribution was given at each generation. This feature was achieved by emplo ying three important parameters: tolerisation period ,activation threshold and life span. However, DynamiCS could not learn new self-antigens when learned self and non-s elf behaviours suddenly altered due to legal self chang e. This resulted in high false positive (FP) rates when new antigens were monitored by DynamiCS, although it produced high true positive (TP) rates. The proposed explanation of this outcome was that the generated memory detectors had never been exposed to certain antigen clusters within their tolerisation periods. Thus they could not have tolerance against a complete se lf set. This paper investigates a further extension of Dyna miCS, so that it can reduce FP rates increased by memory detectors. As one way to decrease the FP rates caus ed by memory detectors, the extended DynamiCS handles generated memory detectors based on their detection results. DynamiCS preserved memory detectors for an infinite lifespan. In contrast, the extended Dynami CS presented here kills memory detectors if they show poor self-tolerance to new antigens. This extended syste m is tested to see whether surviving memory detectors no longer cause seriously high FP error rates or not. From this test, an analysis …