There are many old works by Schneier and some not so old like this one http://pdf.aminer.org/000/340/924/agent_based_cooperative_anomaly_detection_for_wireless_ad_hoc_networks.pdf In general, you should represent intrusions as patterns that can be recognized by inmune systems (or, for that matter, any other algorithm)

Thank you Dr Merelo for your consideration and your helpful tips. As you said, I should recognize intrusion patterns. I'm trying to use Danger Theory(A new approach to implement AIS) in order to anomaly detection. But I'm in the Beginning of my thesis and I'm a little confused.

Good luck, then. These other papers by old mate Estévez Tapiador might also be of help http://scholar.google.com/scholar?q=est%C3%A9vez+tapiador+intrusion+detection&hl=es&as_sdt=0&as_vis=1&oi=scholart&sa=X&ei=ZW6SUMDeM6a_0QWg1oCADA&ved=0CB4QgQMwAA

Of course they will be advantageous.

Thanks a million Dr Merelo.

its important to pay attention on the convergence time of any real-time artificial intelligence algorithm such as AIS, or the intruder may escape not by being smarter but merely faster

Definitely you are right Dr Fornari. I should deal this issue too in order to get reasonable results.

Thanks a lot for your helpful and practical tips.

Some early immune systems, were based on the "Major Histocompatibility Complex" where authorized code carried with it a validity marker that changed with the code, so that changed code was detectable, however this was ineffective for cases where the code was not changed so much as broken, and code substituted for data.

Dear Dr. Graeme Smith thanks a lot and I appreciate your helpful comment.

Dear Suresh P thanks to your helpful comments and that essay.

I was wondering whether there is any open-access tool-box available for AIS, which can be freely used for tutorial as well as its enhanced development.

It's necessary to pay attention about differences between 1st generation and 2nd genreation of AIS. In the first, the approach is self-non-self. In that case, we can apply over an IDS/IPS but we will have a scalability problem. Remember, we need to define what is self and what is not. In this case, it's difficult to us define what is self or no in a big network. This is the problem of the first generation of AIS. In the 2nd generation inspired by MAtzinger theory, the scalability problem is mitigated. This generation uses a signal concepts and dendritic cells have an important value in the immune system. This approach uses a DCA algorithm (by Greensmith) as motor of theory. I recommend you observe the Uwe Aickelin research group that works with this new concepts of AIS.

Sorry for responding so late.

Moisés Danziger

Thanks a million Moises,I've seen their page and I've read Greensmith's papers and Gu's papers and some other essays but I wanna work with KDDdataset and it seems that DCA algorithm does not mach with this static dataset properly.Do you agree?

Dr Feng Gu use DCA and KDD99 dataset and I've read it even I've read his thesis but it is a little ambiguous for me.

Hi Sajjad, I didn't read Gu thesis (I don't think so), but I believe that you need to understand as the KDDdataset was developed and then, you need to map to DCA algorithm use. When we want to apply any computational intelligence tool (e.g. ANN, AIS, GA, PSO, ACO etc) on a specific problem, the biggest problem is the mapping. It is necessary a deep study and knowledge about the problem. If I remember, in the DCA algorithm there are various cells used to process signals found in the system. These signals are: danger signal, normal signal and attack signal. According to processing, Dendritic cells capture these signals and process them.

Each cell has a threshold and, if it captured more danger signals, for example, some flag can be dispatched to warn someone.

You must observe the database to define what data you can use and format them is inevitable. You need to think about how to normalize the data and also how to divide the database for training and testing. Anyway, these are some activities that you need to think before applying AIS. As a suggestion, I would use intelligent agents embedded with DCA.

Hello Moises

I think you are right I need to read more about KDDdataset and DCA algorithm and I'll do that. The only reason that I said DCA should't work with KDDdataset is that in KDDdataset we don't have time stamps and there isn't any dependence(temporal relation) between samples.

I'm also trying to support AIS algorithms with some statistical Machine Learning algorithms.

I appreciate your answers and your ideas.

An Episodal Memory system grafted onto the KDD dataset might be the answer if the dataset has no temporal dependencies, the episodal memory system would supply them for it.

Thanks a lot Dear Smith

Unfortunately I don't have any idea about Memory system. Would you mind giving me a clue for example introducing a helpful paper.

An Episodal Memory System, is a system of memory that stores before-after relationships which allows you to bind temporal dependence to events. An episode can be thought of as a series of before-after relationships that form a chain or sequence. Think of it as a dually linked list where the Before link links to what came just before the recorded state and the after link links to what came just after the recorded state. When you update the KDD data, you write the state vector into the state part of the new record, and point the before link to the previous state, and the after link of the previous state to the state vector you just wrote. a null after link represents the present where there is no after because that state has yet to happen. A null before link represents the original state where there was no previous states. I am not sure how that would impact DCA but it would give you temporal binding.

The negative selection algorithm (NSA) belongs to the area of Artificial Immume Systems and was introduced as a computational model of biological immune systems’ way of producing a protection mechanism against unknown pathogens. We have recently used the NSA as a central component of a general method that uses the first-order statistics of character strings to implement a compact negative representation of text documents. The method can be used in detecting suspicious changes in the documents and could potentially also be adapted to be used in intrusion detection.

Polla, M. and Honkela, T. Negative selection of written language using character multiset statistics. Journal of Computer Science and Technology 25(6): 1256-1266, Nov. 2010.

http://link.springer.com/article/10.1007/s11390-010-9403-4

If this hasn't been said before, have you looked at the work by Stephanie Forrest?

Here is an old classic that might be of interest. http://www.cs.unm.edu/~forrest/publications/ieee-sp-96-unix.pdf

Hi William

Thank you dear. Yes I've read Forrest's papers and they were pretty useful.

Hello Dear Timo

Thanks for your consideration. I'm intrigued about your paper it seems interesting. But unfortunately I haven't access to your article in Springer for some reasons.

Thanks you so much

Hello Dear Smith

Thanks for your helpful tips. I'll give it some Thoughts. I'll try to read more about your idea.

Thanks again

We used multiagent system as a population of members o society, Then we used mechanism of negative selection and voting i society. It makes a system that was enable to reconize unusual situation that arise in the process of the society functionning. It is described in our papers...

Thank you for your consideration Dear Krzysztof. I'll give it some thoughts

I work on Danger theory to classification problems. I suggest a book by Jason Brownlee (http://www.cleveralgorithms.com/) to start !

In my opinion, a lot of the Social Network Analysis that had a hype in recent years, can be applied to immuization systems.

hi am implementing DCA but my problem is when calculating the CSM values how will you  know which CSm value is related to a particular antigen

Salam Sajjad Fouladvand,

Well, my master thesis was on using DCA algorithm for detecting SYN-Flooding attaks.

Here some recommendations:

1- Understand DC cell well:

https://www.youtube.com/watch?v=pSc7Ae1ZUqc

2- Figure out how to map the DC working mechanism to solve your problem

such as:

> having agent based system?

> which signals in DCA to represent what in your working problem?

(PAMP Signal, Danger Signal (DS), Safe Signal (SS))

3- Implement your idea and do experiments

I have followed this methodology, I proposed my system to detect on real-time the SYN-Flooding attacks.

https://scholar.google.com/citations?view_op=view_citation&hl=en&user=1VZC4jkAAAAJ&authuser=1&citation_for_view=1VZC4jkAAAAJ:u5HHmVD_uO8C

I suggest you to read the sections below in my paper, after understanding the DC cells:

> 5. THE PROPOSED AISD SYSTEM

> 6. IMPLEMENTING AISD SYSTEM

All the best,

Ismael Ali

I'm sorry I did not quite understand something:

I'm going to use DCA for detecting spam SMS.(As in the following article) So, I generate signals from the output of two ML algorithms (Naive Bayes and SVM) with confidence for each SMS. After that, run DCA for select DC that migrate. (Training phase)

Well, now, how do I determine the type of new SMS? (Test phase) Suppose the new SMS is not like any previous one.

http://www.sciencedirect.com/science/article/pii/S1877050915008674