artificial immune systems: an emerging technology dr. jonathan timmis computing laboratory...

Artificial Immune Systems: An Emerging Technology

Dr. Jonathan Timmis

Computing Laboratory

University of Kent at Canterbury

England. UK.

[email protected]

http:/www.cs.ukc.ac.uk/people/staff/jt6

Congress on Evolutionary Computation 2001. Seoul, Korea.

mailto:[email protected]

CEC 2001 Artificial Immune Systems

Tutorial Overview

What are Artificial Immune Systems?

Background immunologyWhy use the immune system as a metaphor

Immune Metaphors employed

Review of AIS workApplications

More blue sky research


Immune metaphors

Immune System

Idea! Idea ‘

Other areas

Artificial Immune Systems


Artificial Immune SystemsRelatively new branch of computer science

Some history

Using natural immune system as a metaphor for solving computational problems

Not modelling the immune system

Variety of applications so far …Fault diagnosis (Ishida)Computer security (Forrest, Kim)Novelty detection (Dasgupta)Robot behaviour (Lee)Machine learning (Hunt, Timmis, de Castro)


Why the Immune System?Recognition

Anomaly detectionNoise tolerance

RobustnessFeature extractionDiversityReinforcement learningMemoryDistributedMulti-layeredAdaptive


Part I – Basic Immunology


Role of the Immune System

Protect our bodies from infection

Primary immune responseLaunch a response to invading pathogens

Secondary immune responseRemember past encounters

Faster response the second time around


How does it work?


Where is it?


Multiple layers of the immune system

Phagocyte

Adaptive immune

response

Lymphocytes

Innate immune

response

Biochemical barriers

Skin

Pathogens


Immune Pattern Recognition

The immune recognition is based on the complementarity between the binding region of the receptor and a portion of the antigen called epitope.

Antibodies present a single type of receptor, antigens might present several epitopes.

This means that different antibodies can recognize a single antigen


Antibodies

Antigen binding sites

VH

VL

CH CH

VL

CL

CH

VH

CH

CL

Fc

FabFab

Antibody Molecule Antibody Production


Clonal Selection


T-cells

Regulation of other cells

Active in the immune responseHelper T-cells

Killer T-cells


Main Properties of Clonal Selection (Burnet, 1978)

Elimination of self antigens

Proliferation and differentiation on contact of mature lymphocytes with antigen

Restriction of one pattern to one differentiated cell and retention of that pattern by clonal descendants;

Generation of new random genetic changes, subsequently expressed as diverse antibody patterns by a form of accelerated somatic mutation


Reinforcement Learning and Immune Memory

Repeated exposure to an antigen throughout a lifetime

Primary, secondary immune responses

Remembers encountersNo need to start from scratch

Memory cells

Associative memory


Learning (2)

Antigen Ag1 Antigens Ag1, Ag2

Primary Response Secondary Response

Lag

Response to Ag1

Ant

ibod

y C

once

ntra

tion

Time

Lag

Response to Ag2

Response to Ag1

...

...

Cross-Reactive Response

...

...

Antigen Ag1 + Ag3

Response to Ag1 + Ag3

Lag


Immune Network Theory

Idiotypic network (Jerne, 1974)

B cells co-stimulate each otherTreat each other a bit like antigens

Creates an immunological memory


Immune Network Theory(2)


Shape Space Formalism

Repertoire of the immune system is complete (Perelson, 1989)

Extensive regions of complementarity

Some threshold of recognition

V

V

V

V


Self/Non-Self Recognition

Immune system needs to be able to differentiate between self and non-self cells

Antigenic encounters may result in cell death, therefore

Some kind of positive selection

Some element of negative selection


Summary so far ….

Immune system has some remarkable properties

Pattern recognition

Learning

Memory

So, is it useful?


Some questions for you !


Part II – A Review of Artificial Immune Systems


Topics to Cover

A few disclaimers …I can not cover everything as there is a large amount of work out thereTo do so, would be silly Proposed general frameworksGive an overview of significant application areas and work thereinI am not an expert in all the problem domains

• I would earn more money if I was !


Shape Space

Describe interactions between molecules

Degree of binding between molecules

Complement threshold

Each paratope matches a certain region of space

Complete repertoire


Representation and Affinities

Representation affects affinity measureBinary

Integer

Affinity is related to distanceEuclidian

Hamming

Affinity threshold


Basic Immune Models and Algorithms

Bone Marrow Models

Negative Selection Algorithms

Clonal Selection Algorithm

Somatic Hypermutation

Immune Network Models


Bone Marrow ModelsGene libraries are used to create antibodies from the bone marrowAntibody production through a random concatenation from gene librariesSimple or complex libraries


Negative Selection AlgorithmsForrest 1994: Idea taken from the negative selection of T-cells in the thymusApplied initially to computer securitySplit into two parts:

CensoringMonitoring


Negative Selection AlgorithmEach copy of the algorithm is unique, so that each protected location is provided with a unique set of detectorsDetection is probabilistic, as a consequence of using different sets of detectors to protect each entityA robust system should detect any foreign activity rather than looking for specific known patterns of intrusion. No prior knowledge of anomaly (non-self) is requiredThe size of the detector set does not necessarily increase with the number of strings being protectedThe detection probability increases exponentially with the number of independent detection algorithmsThere is an exponential cost to generate detectors with relation to the number of strings being protected (self).

Solution to the above in D’haeseleer et al. (1996)


Somatic HypermutationMutation rate in proportion to affinityVery controlled mutation in the natural immune systemTrade-off between the normalized antibody affinity D* and its mutation rate ,



Timmis & Neal, 2000

Used immune network theory as a basis, proposed the AINE algorithmInitialize AINFor each antigen

Present antigen to each ARB in the AINCalculate ARB stimulation levelAllocate B cells to ARBs, based on stimulation levelRemove weakest ARBs (ones that do not hold any B cells)

If termination condition metexit

elseClone and mutate remaining ARBsIntegrate new ARBs into AIN



De Castro & Von Zuben (2000c)

aiNET, based in similar principlesAt each iteration step do

For each antigen doDetermine affinity to all network cellsSelect n highest affinity network cellsClone these n selected cells

Increase the affinity of the cells to antigen by reducing the distance between them (greedy search)

Calculate improved affinity of these n cellsRe-select a number of improved cells and place into matrix MRemove cells from M whose affinity is below a set thresholdCalculate cell-cell affinity within the networkRemove cells from network whose affinity is below

a certain thresholdConcatenate original network and M to form new network

Determine whole network inter-cell affinities and remove all those below the set threshold

Replace r% of worst individuals by novel randomly generated onesTest stopping criterion


Part III - Applications


Anomaly DetectionThe normal behavior of a system is often characterized by a series of observations over time. The problem of detecting novelties, or anomalies, can be viewed as finding deviations of a characteristic property in the system.For computer scientists, the identification of computational viruses and network intrusions is considered one of the most important anomaly detection tasks


Virus DetectionProtect the computer from unwanted virusesInitial work by Kephart 1994More of a computer immune system

Detect Anomaly

Scan for known viruses

Capture samples using decoys

Extract Signature(s)

Add signature(s) to databases

Add removal infoto database

Segregatecode/data

AlgorithmicVirus Analysis

Send signals toneighbor machines

Remove Virus


Virus Detection (2)Okamoto & Ishida (1999a,b) proposed a distributed approach Detected viruses by matching self-information

first few bytes of the head of a file the file size and path, etc. against the current host files.

Viruses were neutralized by overwriting the self-information on the infected filesRecovering was attained by copying the same file from other uninfected hosts through the computer network


Virus Detection (3)Other key works include:

A distributed self adaptive architecture for a computer virus immune system (Lamont, 200)Use a set of co-operating agents to detect non-self patterns

Immune System Computational System

Pathogens (antigens) Computer viruses

B-, T-cells and antibodies Detectors

Proteins Strings

Antibody/antigen binding Pattern matching


Security

Somayaji et al. (1997) outlined mappings between IS and computer systemsA security systems need

ConfidentialityIntegrityAvailabilityAccountability Correctness


IS to Security SystemsImmune System Network Environment

Static Data

Self Uncorrupted data

Non-self Any change to self

Active Processes on Single Host

Cell Active process in a computer

Multicellular organism Computer running multiple processes

Population of organisms Set of networked computers

Skin and innate immunity Security mechanisms, like passwords, groups, file permissions, etc.

Adaptive immunity Lymphocyte process able to query other processes to seek for abnormal behaviors

Autoimmune response False alarm

Self Normal behavior

Non-self Abnormal behavior

Network of Mutually Trusting Computers

Organ in an animal Each computer in a network environment


Network Security

Hofmeyr & Forrest (1999, 2000): developing an artificial immune system that is distributed, robust, dynamic, diverse and adaptive, with applications to computer network security.

Kim & Bentley (1999). New paper here at CEC so I won’t cover it, go see it for yourself!


Forrests Model

AIS for computer network security. (a) Architecture. (b) Life cycle of a detector.

Datapath triple

(20.20.15.7, 31.14.22.87, ftp)

Broadcast LAN

ip: 31.14.22.87port: 2000

Internal host

External host

ip: 20.20.15.7 port: 22

Host

Activationthreshold

Cytokinelevel

Permutationmask

Detectorset

immature memory activated matches

0100111010101000110......101010010

Detector

Randomly created

Immature

Mature & Naive

Death

Activated

Memory

No match duringtolerization

010011100010.....001101

Exceed

activationthreshold

Don’t exceed

activation threshold

No co stimulation

Co stimulation

Match

Match during

tolerization


Novelty DetectionImage Segmentation : McCoy & Devarajan (1997)

Detecting road contours in aerial imagesUsed a negative selection algorithm


Hardware Fault Tolerance

Immunotronics (Bradley & Tyrell, 2000)

Use negative selection algorithm for fault tolerance in hardware

Table 4.1.

Immune System Hardware Fault Tolerance

Recognition of self Recognition of valid state/state transition

Recognition of non-self Recognition of invalid state/state transition

Learning Learning correct states and transitions

Humoral immunity Error detection and recovery

Clonal deletion Isolation of self-recognizing tolerance conditions

Inactivation of antigen Return to normal operation

Life of an organism Operation lifetime of a hardware


Machine Learning

Early work on DNA Recognition Cooke and Hunt, 1995

Use immune network theory

Evolve a structure to use for prediction of DNA sequences

90% classification rate

Quite good at the time, but needed more corroboration of results


Unsupervised Learning

Timmis, 2000Based on Hunts work

Complete redesign of algorithm: AINE

Immune metadynamics

Shape space

Few initial parameters

Stabilises to find a core pattern within a network of B cells


Results (Timmis, 2000)


Another approach

de Castro and von Zuben, 2000aiNET cf. SOFMUse similar ideas to Timmis

• Immune network theory• Shape space

Suppression mechanism different• Eliminate self similar cells under a set threshold

Clone based on antigen match, network not taken into account


Results (de Castro & von Zuben, 2001)

Test Problem Result from aiNET


Supervised Approach

Carter, 2000Pattern recognition and classification system: Immunos-81

Use T-cells, B-cells, antibodies and amino-acid library

Builds a library of data types and classes

System can generalise

Good classification rates on sample data sets


RoboticsBehaviour Arbitration

Ishiguro et al. (1996, 1997) : Immune network theory to evolve a behaviour among a set of agents

Collective BehaviourEmerging collective behaviour through communicating robots (Jun et al, 1999)Immune network theory to suppress or encourage robots behaviour

Desirable Interacting antibodiescondition and degree of interaction

Action

Paratope Idiotope


SchedulingHart et al. (1998) and Hart & Ross (1999a)Proposed an AIS to produce robust schedules

for a dynamic job-shop scheduling problem in which jobs arrive continually, and the environment is subject to changes.

Investigated is an AIS could be evolved using a GA approach

then be used to produce sets of schedules which together cover a range of contingencies, predictable and unpredictable.

Model included evolution through gene libraries, affinity maturation of the immune response and the clonal selection principle.


DiagnosisIshida (1993) Immune network model applied to the process diagnosis problemLater was elaborated as a sensor network that could diagnose sensor faults by evaluating reliability of data from sensors, and process faults by evaluating reliability of constraints among data.Main immune features employed:

Recognition is performed by distributed agents which dynamically interact with each other;Each agent reacts based solely on its own knowledge; andMemory is realized as stable equilibrium points of the dynamical network.


SummaryCovered much, but there is much work not covered (so apologies to anyone for missing theirs)ImmunologyImmune metaphors

Antibodies and their interactionsImmune learning and memorySelf/non-self

• Negative selection

Application of immune metaphors


The Future

Rapidly growing field that I think is very exciting

Much work is very diverseNeed of a general framework

Wide possible application domains

Lots of work to do …. Keep me in a job for quite a while yet

artificial immune systems: an emerging technology dr. jonathan timmis computing laboratory...

Documents

immune system slide

immune recognition

artificial immune systems

natural immune system

metaphor immune metaphors

secondary immune responses

castro slide

single antigen slide