Artificial Immune Systems: An

Emerging Technology
Congress on Evolutionary Computation 2001.
Seoul, Korea.
Dr. Jonathan Timmis
Computing Laboratory
University of Kent at Canterbury
England. UK.
J.Timmis@ukc.ac.uk
http:/www.cs.ukc.ac.uk/people/staff/jt6

Tutorial Overview
What are Artificial Immune Systems?
Background immunology
Why use the immune system as a metaphor

Immune Metaphors employed

Review of AIS work
Applications
More blue sky research
CEC 2001

Artificial Immune

Immune metaphors
Other areas
Idea!

Idea

Immune System Artificial Immune

Systems
CEC 2001

Artificial Immune

Artificial Immune Systems

Relatively new branch of computer science
Some history

Using natural immune system as a metaphor for solving

computational problems
Not modelling the immune system

Variety of applications so far

Fault diagnosis (Ishida)
Computer security (Forrest, Kim)
Novelty detection (Dasgupta)
Robot behaviour (Lee)
Machine learning (Hunt, Timmis, de Castro)

CEC 2001

Artificial Immune

Why the Immune System?

Recognition
Anomaly detection
Noise tolerance

Robustness
Feature extraction
Diversity
Reinforcement learning
Memory
Distributed
Multi-layered
Adaptive

CEC 2001

Artificial Immune

Part I Basic Immunology

CEC 2001

Artificial Immune

Role of the Immune System

Protect our bodies from infection
Primary immune response
Launch a response to invading pathogens

Secondary immune response

Remember past encounters
Faster response the second time around

CEC 2001

Artificial Immune

How does it work?

CEC 2001

Artificial Immune

Where is it?

CEC 2001

Artificial Immune

Multiple layers of the immune

system
Pathogens

Skin
Biochemical
barriers
Phagocyte
Innate
immune
response

Lymphocytes

Adaptive
immune
response

CEC 2001

Artificial Immune

Immune Pattern Recognition

The immune recognition is based on the complementarity

between the binding region of the receptor and a portion of
the antigen called epitope.
Antibodies present a single type of receptor, antigens
might present several epitopes.
CEC

This means that different antibodies can recognize a single

antigen
2001
Artificial Immune

Antibodies
Antigen binding sites
VH

VH

VL

VL
CH
Fab

CH
Fab

CL

CL

CH

CH
Fc

Antibody Molecule
CEC 2001

Antibody Production

Artificial Immune

Clonal Selection

CEC 2001

Artificial Immune

T-cells
Regulation of other cells
Active in the immune response
Helper T-cells
Killer T-cells

CEC 2001

Artificial Immune

Main Properties of Clonal

Selection (Burnet, 1978)

Elimination of self antigens

Proliferation and differentiation on contact of matur
lymphocytes with antigen
Restriction of one pattern to one differentiated cell an
retention of that pattern by clonal descendants;
Generation of new random genetic change
subsequently expressed as diverse antibody patterns b
a form of accelerated somatic mutation

CEC 2001

Artificial Immune

Reinforcement Learning and

Immune Memory
Repeated exposure to an antigen throughout
a lifetime
Primary, secondary immune responses
Remembers encounters
No need to start from scratch
Memory cells

Associative memory
CEC 2001

Artificial Immune

Learning (2)

Antibody Concentration

Cross-Reactive
Response

Secondary Response

Primary Response

Lag
Lag

Response
to Ag1

Lag

Response
to Ag1

...
...

...

Response to
Ag1 + Ag3

Response
to Ag2

Antigen Ag1

Antigens
Ag1, Ag2

CEC 2001

Artificial Immune

...
Antigen
Ag1 + Ag3

Time

Immune Network Theory

Idiotypic network (Jerne, 1974)
B cells co-stimulate each other
Treat each other a bit like antigens

Creates an immunological memory

CEC 2001

Artificial Immune

Immune Network Theory(2)

CEC 2001

Artificial Immune

Shape Space Formalism

Repertoire of the
immune system is
complete (Perelson, 1989)
Extensive regions of
complementarity
Some threshold of
recognition

CEC 2001

Artificial Immune

Self/Non-Self Recognition
Immune system needs to be able to
differentiate between self and non-self cells
Antigenic encounters may result in cell
death, therefore
Some kind of positive selection
Some element of negative selection

CEC 2001

Artificial Immune

Summary so far .
Immune system has some remarkable
properties
Pattern recognition
Learning
Memory
So, is it useful?

CEC 2001

Artificial Immune

Some questions for you !

CEC 2001

Artificial Immune

Part II A Review of Artificial

Immune Systems

CEC 2001

Artificial Immune

Topics to Cover
A few disclaimers
I can not cover everything as there is a large amount
of work out there
To do so, would be silly
Proposed general frameworks
Give an overview of significant application areas
and work therein
I am not an expert in all the problem domains
I would earn more money if I was !

CEC 2001

Artificial Immune

Shape Space
Describe interactions between molecules
Degree of binding between molecules
Complement threshold
Each paratope matches a certain region of
space
Complete repertoire

CEC 2001

Artificial Immune

Representation and Affinities

Representation affects affinity measure
Binary
Integer

Affinity is related to distance

Euclidian
Hamming

Affinity threshold
CEC 2001

Artificial Immune

Basic Immune Models and

Algorithms
Bone Marrow Models
Negative Selection Algorithms
Clonal Selection Algorithm
Somatic Hypermutation
Immune Network Models

CEC 2001

Artificial Immune

Bone Marrow Models

Gene libraries are used to create antibodies from
the bone marrow
Antibody production through a random
concatenation from gene libraries
Simple or complex libraries

CEC 2001

Artificial Immune

Negative Selection Algorithms

Forrest 1994: Idea taken from the negative selection of T-cells in the
thymus
Applied initially to computer security
Split into two parts:
Censoring
Monitoring

CEC 2001

Artificial Immune

Negative Selection Algorithm

Each copy of the algorithm is unique, so that each protected location is
provided with a unique set of detectors
Detection is probabilistic, as a consequence of using different sets of
detectors to protect each entity
A robust system should detect any foreign activity rather than looking for
specific known patterns of intrusion.
No prior knowledge of anomaly (non-self) is required
The size of the detector set does not necessarily increase with the number of
strings being protected
The detection probability increases exponentially with the number of
independent detection algorithms
There is an exponential cost to generate detectors with relation to the
number of strings being protected (self).
Solution to the above in Dhaeseleer et al. (1996)

CEC 2001

Artificial Immune

Somatic Hypermutation
Mutation rate in proportion to affinity
Very controlled mutation in the natural immune system
Trade-off between the normalized antibody affinity D*
and its mutation rate ,

CEC 2001

Artificial Immune

Immune Network Models

Timmis & Neal, 2000
Used immune network theory as a basis,
proposed the AINE algorithm
Initialize AIN
For each antigen
Present antigen to each ARB in the AIN
Calculate ARB stimulation level
Allocate B cells to ARBs, based on stimulation level
Remove weakest ARBs (ones that do not hold any B cells)
If termination condition met
exit
else
Clone and mutate remaining ARBs
Integrate new ARBs into AIN

CEC 2001

Artificial Immune

Immune Network Models

De Castro & Von Zuben (2000c)
aiNET, based in similar principles

At each iteration step do

For each antigen do
Determine affinity to all network cells
Select n highest affinity network cells
Clone these n selected cells
Increase the affinity of the cells to antigen by reducing the
distance between them (greedy search)
Calculate improved affinity of these n cells
Re-select a number of improved cells and place into matrix M
Remove cells from M whose affinity is below a set threshold
Calculate cell-cell affinity within the network
Remove cells from network whose affinity is below
a certain threshold
Concatenate original network and M to form new network
Determine whole network inter-cell affinities and remove all those
below the set threshold
Replace r% of worst individuals by novel randomly generated ones
Test stopping criterion

CEC 2001

Artificial Immune

Part III - Applications

CEC 2001

Artificial Immune

Anomaly Detection
The normal behavior of a system is often
characterized by a series of observations over time.
The problem of detecting novelties, or anomalies,
can be viewed as finding deviations of a
characteristic property in the system.
For computer scientists, the identification of
computational viruses and network intrusions is
considered one of the most important anomaly
detection tasks

CEC 2001

Artificial Immune

Virus Detection
Protect the computer from unwanted viruses
Initial work by Kephart 1994
More of a computer immune system
Detect Anomaly

Scan for known viruses

Remove Virus
Capture samples using decoys

Segregate
code/data

Algorithmic
Virus Analysis

Extract Signature(s)

Add removal info

to database

Add signature(s) to databases

CEC 2001

Artificial Immune

Send signals to
neighbor machines

Virus Detection (2)

Okamoto & Ishida (1999a,b) proposed a distributed
approach
Detected viruses by matching self-information
first few bytes of the head of a file
the file size and path, etc.
against the current host files.

Viruses were neutralized by overwriting the selfinformation on the infected files

Recovering was attained by copying the same file from
other uninfected hosts through the computer network
CEC 2001

Artificial Immune

Virus Detection (3)

Other key works include:
A distributed self adaptive architecture for a computer
virus immune system (Lamont, 200)
Use a set of co-operating agents to detect non-self
patterns
Immune System

Computational System

Pathogens (antigens)

Computer viruses

B-, T-cells and antibodies

Detectors

Proteins

Strings

Antibody/antigen binding

Pattern matching

CEC 2001

Artificial Immune

Security
Somayaji et al. (1997) outlined mappings
between IS and computer systems
A security systems need
Confidentiality
Integrity
Availability
Accountability
Correctness
CEC 2001

Artificial Immune

IS to Security Systems
Immune System

Network Environment
Static Data

Self

Uncorrupted data

Non-self

Any change to self

Active Processes on Single Host

Cell

Active process in a computer

Multicellular organism

Computer running multiple processes

Population of organisms

Set of networked computers

Skin and innate immunity

Autoimmune response

Security mechanisms, like passwords, groups, file

permissions, etc.
Lymphocyte process able to query other processes to seek for
abnormal behaviors
False alarm

Self

Normal behavior

Non-self

Abnormal behavior

Adaptive immunity

Network of Mutually Trusting Computers

Organ in an animal

CEC 2001

Each computer in a network environment

Artificial Immune

Network Security
Hofmeyr
&
Forrest
(1999, 2000):
developing an artificial immune system that
is distributed, robust, dynamic, diverse and
adaptive, with applications to computer
network security.
Kim & Bentley (1999). New paper here at
CEC so I wont cover it, go see it for
yourself!
CEC 2001

Artificial Immune

Forrests Model
External
host
ip: 20.20.15.7
port: 22
Datapath triple
Internal
host

Randomly
created

Host
Activation Detector
threshold
set
Cytokine
level

010011100010.....001101
Immature
No match during
tolerization

(20.20.15.7, 31.14.22.87,
ftp)
Permutation
mask

Mature & Naive

ip: 31.14.22.87
port: 2000
Detector

Match
during
tolerization

0100111010101000110......101010010

Broadcast LAN

immaturememory

activated matches

Dont
exceed
activation
threshold
Death

Exceed
activation
threshold
Activated
No
co stimulation

Match

Co stimulation
Memory

AIS for computer network security. (a) Architecture. (b) Life cycle of a detec

CEC 2001

Artificial Immune

Novelty Detection
Image Segmentation : McCoy &
Devarajan (1997)
Detecting road contours in aerial
images
Used a negative selection algorithm

CEC 2001

Artificial Immune

Hardware Fault Tolerance

Immunotronics (Bradley & Tyrell, 2000)
Use negative selection algorithm for fault
tolerance in hardware
Immune System

Hardware Fault Tolerance

Recognition of self

Recognition of valid state/state transition

Recognition of non-self

Recognition of invalid state/state transition

Learning

Learning correct states and transitions

Humoral immunity

Error detection and recovery

Clonal deletion

Isolation of self-recognizing tolerance conditions

Inactivation of antigen

Return to normal operation

Life of an organism

Operation lifetime of a hardware

CEC 2001

Artificial Immune

Machine Learning
Early work on DNA Recognition
Cooke and Hunt, 1995
Use immune network theory
Evolve a structure to use for prediction of DNA
sequences
90% classification rate
Quite good at the time, but needed more
corroboration of results
CEC 2001

Artificial Immune

Unsupervised Learning
Timmis, 2000
Based on Hunts work
Complete redesign of algorithm: AINE
Immune metadynamics
Shape space
Few initial parameters
Stabilises to find a core pattern within a
network of B cells
CEC 2001

Artificial Immune

Results (Timmis, 2000)

CEC 2001

Artificial Immune

Another approach
de Castro and von Zuben, 2000
aiNET cf. SOFM
Use similar ideas to Timmis
Immune network theory
Shape space

Suppression mechanism different

Eliminate self similar cells under a set threshold

Clone based on antigen match, network not

taken into account
CEC 2001

Artificial Immune

Results (de Castro & von Zuben,

2001)

Test Problem

CEC 2001

Result from aiNET

Artificial Immune

Supervised Approach
Carter, 2000
Pattern recognition and classification system:
Immunos-81
Use T-cells, B-cells, antibodies and amino-acid
library
Builds a library of data types and classes
System can generalise
Good classification rates on sample data sets
CEC 2001

Artificial Immune

Robotics
Behaviour Arbitration
Ishiguro et al. (1996, 1997) : Immune network theory to
evolve a behaviour among a set of agents

Collective Behaviour
Emerging collective behaviour through communicating
robots (Jun et al, 1999)
Immune network theory to suppress or encourage robots
behaviour
Paratope
Desirable
condition

CEC 2001

Artificial Immune

Action

Idiotope
Interacting antibodies
and degree of interaction

Scheduling
Hart et al. (1998) and Hart & Ross (1999a)
Proposed an AIS to produce robust schedules
for a dynamic job-shop scheduling problem in which jobs arrive
continually, and the environment is subject to changes.

Investigated is an AIS could be evolved using a GA

approach
then be used to produce sets of schedules which together cover a
range of contingencies, predictable and unpredictable.

Model included evolution through gene libraries, affinity

maturation of the immune response and the clonal
selection principle.

CEC 2001

Artificial Immune

Diagnosis
Ishida (1993)
Immune network model applied to the process diagnosis problem
Later was elaborated as a sensor network that could diagnose
sensor faults by evaluating reliability of data from sensors, and
process faults by evaluating reliability of constraints among data.
Main immune features employed:
Recognition is performed by distributed agents which dynamically interact
with each other;
Each agent reacts based solely on its own knowledge; and
Memory is realized as stable equilibrium points of the dynamical network.

CEC 2001

Artificial Immune

Summary
Covered much, but there is much work not covered
(so apologies to anyone for missing theirs)
Immunology
Immune metaphors
Antibodies and their interactions
Immune learning and memory
Self/non-self
Negative selection

Application of immune metaphors

CEC 2001

Artificial Immune

The Future
Rapidly growing field that I think is very
exciting
Much work is very diverse
Need of a general framework

Wide possible application domains

Lots of work to do . Keep me in a job for
quite a while yet
CEC 2001

Artificial Immune