COMBINING NEGATIVE SELECTION AND POSITIVE SELECTION IN ARTIFICIAL IMMUNE SYSTEMS

Size: px

Start display at page:

Download "COMBINING NEGATIVE SELECTION AND POSITIVE SELECTION IN ARTIFICIAL IMMUNE SYSTEMS"

Arlene Mosley
5 years ago
Views:

1 COMBINING NEGATIVE SELECTION AND POSITIVE SELECTION IN ARTIFICIAL IMMUNE SYSTEMS Nguyen Van Truong 1*, Vu Thi Nguyet Thu 1, Trinh Van Ha 2 1 College of Education TNU 2 College of Information and Communication Technology - TNU SUMMARY Artificial Immune System (AIS) is a diverse research area that combines the disciplines of immunology and computation. Negative Selection Algorithm (NSA) and Positive selection algorithm (PSA) are two famous models of AIS designed for anomaly detection. They all contain two stages: generating a set D of detectors from a given set S of self; detecting if a given cell is self or non-self using generated detectors. In this paper, we propose an improvement of r-chunk type detector-based NSA by combining negative selection and positive selection to reduce runtime complexity and memory complexity. Key words: Artificial immune system, negative selection algorithm, positive selection algorithm, computer security, r-chunk detector. INTRODUCTION * The biological immune system is able to recognize which cells are its own (self) and which are foreign (non-self, such as bacteria or viruses). The representative immune cell is the T cell, which has a self-recognition component and an antigen receptor for locating and eliminating infected cells. By modeling the characteristics of the biological immune system, the system that protects from damage by external attacks and eliminates intruders in the case of computer perspectives is called the artificial immune system [3]. Biological immune system is a complex, self organizing and highly distributed system. It has no centralized control and uses learning and memorizing when solving particular tasks [11]. The learning process does not require negative examples and acquired knowledge is represented in an explicit form: T cells are generated randomly and in a large number, in the hope that every pathogen that infects the host is detected by at least some of these cells. However, the host must ensure that no cell generated would turn against itself - many severe diseases are caused by such autoimmune reactions. Hence, newborn T * Tel: ; nvtruongtn@gmail.com cells undergo the process of negative selection. In a special organ, the thymus, they are shown self proteins, which belong to the host. If a T cell detects any self protein, it is destroyed.in contrast with negative selection, in positive selection, the T cells are tested for recognition of Major Histocompatibility Complex molecules expressed on the cortical epithelial cells. If a T cell fails to recognize any of the Major Histocompatibility Complex molecules, it is discarded; otherwise, it is kept. Forrest et al. [2, 3] analyzed the biological immune system and they found that the problem faced by the immune system is similar to one that today's computer systems face: It is difficult to defend a system against a various unknown danger, such as an exploit of a new security hole. The only reliable knowledge we have is the normal behavior of the system - the equivalent of self. The idea of the negative selection classification scheme is to mimic the T cells in the biologicalimmune system: Generate a set of detectors that do not match anything in self, thenuse these detectors to monitor the system for unusual behavior. An algorithmic abstraction of this biological process called NSA is found interesting implementations: computer virus detection, monitoring UNIX processes, anomaly detection in time series, fault analysis, process 41

2 diagnosis, numerical optimization,recognizing promoters in DNA sequences or Scheduling Problem [4, 8, 9, 11, 12]. The outline of a typical NSA contains two stages: generation and detection [2]. In the generation stage (Fig. 1.a), the detectors are generated by some random processes and censored by trying to match given self samples taken from set S. Those candidates that match are eliminated and the rest are kept Begin as detectors in set D. In the detection stage (Fig. 2.a), the collection of detectors (or detector set) is used to verify whether an incoming data instance is self or non-self. If it matches any detector, it is claimed as non-self or anomaly. Each negative detector will match a subset of the non-self set. By generating a sufficient number of independent detectors, good coverage of the non-self set could be obtained. Begin Generate random candidates Generate random candidates Match self samples? Match self samples? Accept as new detector Accept as new detector Enough detectors? End Enough detectors? End a. Negative detector generation b. Positive detector generation Figure 1. Models of detector generation Begin Begin Input new samples Input new samples Match any detector? Match any detector? nself Self nself Self End End a. Negative detection b. Positive detection Figure 2. Detections of new instances 42

3 In positive selection, positive detectors are those that match some samples; and an instance is clamed as self if it matches any detector. The generation and detection stages are illustrated in Fig. 1.b and Fig. 2.b, respectively. Each positive detector will cover a subset of the self set. Several studies have used the concept of positive selection to model their systems [1, 4, 8, 13]. The considered negative r-chunk and r- contiguous detectors are among the most common ones in the AIS literature. Many authors originally research the negative r- contiguous detectors, and negative r-chunk detectors were later introduced to achieve better results on data where adjacent regions of the input strings are not necessarily semantically correlated, such as network data packets [8, 13, 14]. Zhou Ji et al. (2007) [14] showed that there are atleast 16 representations of NSAs. All existing NSAs suffer from a worst-case exponential size of D in the total size of the input, and therefore, limit their practical applicability [7]. Our contribution is to develop an r-chunk type detector-based selection algorithm by combining negative selection and positive selection, that reduces both runtime and memory complexities effectively. The remaining of the paper is organized as follows: In the next section, we present r- chunk detector types. Some modifications of positive detection to have a false negative rate adequate to that of negative selection are discussed. The subsequent section, shows our efficient approach in detail. In the last section, we summarize our approach and discuss the future work. NEGATIVE AND POSITIVE STRING- BASED DETECTORS In this paper, we consider NSA and PSA as a classifier operating on a binary string space Σ l, where Σ= {0, 1}. The limited alphabet Σ here is just for easy understanding the approach; our algorithm can be feasibly adjusted to real world datasets on arbitrary alphabets. We also use the following notation: Let s Σ l be a binary string. Then l = s is the length of s and s[i,,j] is the substring of s that starts at position i with length j i + 1. Definition 1 (Chunk detectors). An r-chunk detector (d,i) is a tuple of astring d Σ r and an integer i {1,, l - r +1}.It matches another string s Σ l if s[i,, i+r - 1] = d and we also call s match detector (d, i) at the position i. Definition 2 (Positive chunk detectors). Given a self set S, an r-chunk detector (d, i) is a positive chunk detector if it matches a substring s[i,, i + r - 1] of s, s S. Definition 3 (Negative chunk detectors). Given a self set S, an r-chunk detector (d, i) is a negative chunk detector if it does not matches any substring s[i,, i + r - 1] of s, s S. Example 1.Given a self set S having 6 binary strings, with l = 5 and r = 3: S = {s 1 = 00000; s 2 = 00010; s 3 = 10110; s 4 = 10111; s 5 = 11000; s 6 = 11010}. The set Dn of all negative 3-chunk detectors that includes (l - r + 1) subsetsis Dn = Dn 1 Dn 2 Dn 3 where Dn 1 = {(001,1); (010,1); (011,1); (100,1); (111,1)}, Dn 2 = {(010,2); (110,2); (111,2)} and Dn 3 = {(001,3); (011,3); (100,3); (101,3)}; The non-self space covered by Dn, callednn, contains 26 elements in {0, 1} 5 are{00001; 00011; 00100; 00101; 00110; 00111; 01000; 01001; 01010; 01011; 01100; 01101; 01110; 01111; 10000; 10001; 10010; 10011; 10100; 10101; 11001; 11011; 11100; 11101; 11110; 11111}. The set Dp of all positive 3-chunkdetectors is Dp =Dp 1 Dp 2 Dp 3 wheredp 1 = {(000,1); (101,1); (110,1)}, Dp 2 = {(000,2); (001,2); (011,2); (100,2); (101,2)} and Dp 3 = {(000,3); (010,3); (110,3); (111,3)}. It can be seen that Dn i and Dp i is the complement of each other in space {0,1} 3, i = 1, 2, 3. The self space detected by Dp, called Sp, contains 26 elements in {0, 1} 5 which are {00000; 00001; 00010; 00011; 00110; 00111; 01000; 01001; 01010; 01011; 01110; 01111; 10000; 10001; 10010; 10011; 10100; 10101; 10110; 10111; 43

4 11000; 11001; 11010; 11011; 11110; 11111}. This example shows that the conjunction of two sets Dn and Dp is not empty. In other words, the spaces detected by two types of 3- chunk detectors are not the complement of each other. The solution of this ambiguity can be found in NSA literature: if a given cell s matches any r-chunk negative detector, it is non-self. Our approach may originate to dual method of NSA: if a given cell s does not match a r-chunk positive detector at all position i, i = 1, 2,, l - r +1, it is non-self. Using this dual selection method, the set Sp now contains only 6elements of S that match l - r +1 3-chunk positive detector at all position i, i = 1, 2,, l - r +1. We have now two disjoint set Sp and Nn that Sp Nn = {0, 1} 5. It means that NSA and PSA have the same false negative rate. This simple modifications of positive detection leads to our interesting approach as described in the following section. COMBINING NEGATIVE SELECTION AND POSITIVE SELECTION Our approach is derived from Truong et al. s work[8], in which onlynegative selection algorithms only are used. In our approach, binary tree is used as data structure for combining positive selection and negative selection to reduce memory complexity, and therefore to reduce time complexity of detection phase. Our algorithm is first construct l - r + 1 binary self trees corresponding to l - r + 1 Dp i sets. Then all complete sub-trees of these trees are deleted to achieve a compact representation of the positive r-chunk detector set. Finally, for every self tree, if the i th tree is optimal in memory, it is selected, otherwise it will be replaced by constructing non-self tree corresponding to Dn i and is denoted as T i, i = 1,, l - r + 1.Therefore,there are two type of binary tree: self tree and non-self tree. The detection phase can be processed by traveling the optimal trees iteratively one by one. In Example 1, the binary trees T 1, T 2, T 3 built from Dp 1, Dp 2, and Dp 3, respectively, are illustrated in Figure 3a, 3b, 3c. In these figures, the dash arrows representing subtrees will be deleted. Moreover, the left child is labeled with 0 and the right one labeled with 1 implicitly. a. Self tree of Dp 1 b. n-self tree of Dn 1 c. Self tree of Dp 2 d. n-self tree of Dn 2 e. Self tree of Dp f. n-self tree of Dn 3 Figure 3. Binary treesconstructed from Dn i and Dp i, i = 1, 2, 3 44

5 The number of nodes of the tree in figure 3.a- 3.f (after deletingredundant nodes) is 9, 10, 7, 6, 8 and 8, respectively. The three selected optimal trees are in the figure 3.a (9 nodes), 3.d (6 nodes) and 3.e or 3.f (8 nodes). Our efficient algorithm, called PNSA (Positive-Negative Selection Algorithm),on r- chunk detectors is presented as follows. ProcedurePNSA; Input: a self set S, an integer r {1,,l}and a cell string s* to be detected. Output: detection of s* as self or non-self. begin for i = 1 to l- r + 1 do begin initialize an empty binary self tree T i ; for each s S do insert s[i,,r+i-1] into T i ; for every non-leaf node n T i do if n is root of complete binary sub-tree then delete this sub-tree; if this self tree is not optimal then create nonself tree. end; flag = true; while (i<= l - r + 1) and flag do Beginif (T i is self tree) and (s*does not match any concatenation of labels from root of T i to a leaf) thenflag = false; if (T i is non-self tree) and (s*matches any concatenation of labels from root of T i to a leaf) then flag = false; end; if flag = false then output s* is non-self else output s* is self ; end; The procedure of generating a compact representation of a complete r-chunk detector is conducted in the outer for loop. The binary tree T i is constructed in the first inner loop, and the deletion of T i is completedby the second one, i = 1,, l - r + 1. The procedure of detecting if a given cell string s* is self or non-self, is done by the last if then else statement. For example, given S, r(as mentioned in Example 1), and s* = are the inputs of the algorithm. Then three binary trees are constructed as in Figure 3. The output of the algorithm is the declaration s* is non-self because the all paths of T 2 do not contain substring of labels s*[2...4] = 010 of s*. Figure 4. Detection time of NSA and PNSA on r We use binary tree as main data structure constructed from self set S that impacts on time complexity. It is easy to proof that it takes time S (l - r + 1).r to generate all necessarytrees and (l - r + 1).r to verify a cell string as self or as non-self in worst case. The following table compares our results with run times of the NSAspublished in 2009 [7] and 2012 [10] on some inputs. Table 1. Comparison of time detection S l r Reduced memory Detection time (mini second) NSA PNSA Reduced memory is the ratio of nodes in binary tree developed by NSA reduced by using our PNSA. The training data, S, is created randomly. This table shows that when l and r are big enough, the time to detect is reduced almost half. 45

6 We have conducted another experiment by choosing l = 40, S = and variable r (from 15 to 40). The Fig. 4 illustrates that the detection time of PNSA is reduced very impressively. For example, when r vary from 20 to 34, its reduction is4.46 times lower than detection time of NSA. CONCLUSIONS Our efficientapproach can reduce time complexity of the detection phase and memory needed for the detector. This provides AISs with the ability to cope with harmful intrusions more quickly. In the future, we plan to report more detail experimental data about the algorithm on virus, spam [7] [10] and standard database of network attacks, i.e. KDD CUP 99 data set. ACKNOWLEDGMENT This work was funded by the Vietnam's National Foundation for Science and Technology Development (NAFOSTED) via a research grant for fundamental sciences, grant number: , by the Thai Nguyen University for university s research, code number DH , and by Ha i University s research. We would like to thank the Management Boards of these projects. REFERENCES [1] Fernando Esponda, Fernando Esponda, Stephanie Forrest, and Paul Helman, A Formal Framework for Positive and Negative Detection Schemes, IEEE transactions on systems, man, and cybernetics, 34 (2004), [2] Forrest et al., Self-nself Discrimination in a Computer, Proceedings of IEEE Symposium on Research in Security and Privacy, Oakland, CA, [3] Forrest, S., Hofmeyr, S. and Somayaji, A., Computer Immunology, Communications of the ACM, 40 (1997), [4] Fuyong Zhang, Deyu Qi, A Positive Selection Algorithm for Classifcation, Journal of Computational Information Systems, 8 (2012), [5] Jamie Twycross et al., Detecting Anomalous Process Behavior usingsecond Generation Artificial Immune Systems, Journal of Unconventional Computing, 1 (2010), [6] L. N de Castro and J. Timmis, Artificial Immune Systems: A New Computational Intlligence Approach, Springer-Verlag, [7] M.Elberfeld, J.Textor, Efficient algorithms for string-based negative selection, Proceedings of the 8 th International Conferenceon Artificial Immune Systems, York, UK, [8] Nguyen Van Truong, Vu Duc Quang, Trinh Van Ha, A fast r-chunk detector-based negative selection algorithm,journal of Science and Technology, Thai Nguyen University, 2(90), 2012, [9] R. Murugesan et al., A Fast Algorithm for Solving JSSP, European Journal of Scientific Research, 64 (2011), [10] Somayaji, A. and Forrest, S., Automated Response Using System-Call Delays, Proceedings of the 9 th USENIX Security Symposium, Berkeley, CA, [11] Slawomir T.Wierzchoń, Generating optimal repertoire of antibody strings in an artificial immune system, Advanced in Soft Computing, Springer-Verlag Company, [12] T. Pourhabibi and R. Azmi, Anomaly Based IDS Using Variable Size Detector Generation in AIS: A Hybrid Approach, International Journal of Machine Learning and Computing, 2 (2012), [13] T.Stibor et al., An investigation of r-chunk detector generation on higher alphabets, Proceedings of Genetic and Evolutionary Computation Conference, Seattle, WA, USA, [14] Zhou Ji et al., Revisiting Negative Selection Algorithms, Evolutionary Computation, 15(2007),

7 TÓM TẮT KẾT HỢP CHỌN LỌC DƯƠNG TÍNH VÀ CHỌN LỌC ÂM TÍNH TRONG HỆ MIỄN DỊCH NHÂN TẠO Nguyễn Văn Trường 1*, Vũ Thị Nguyệt Thu 1, Trịnh Văn Hà 2 1 Trường Đại học Sư phạm - ĐH Thái Nguyên 2 Trường Đại học Công nghệ thông tin và Truyền thông - ĐH Thái Nguyên Hệ miễn dịch nhân tạo là một lĩnh vực nghiên cứu phong phú kết hợp các nguyên lý miễn dịch học và tính toán. Thuật toán chọn lọc âm tính và thuật toán chọn lọc dương tính là hai mô hình tính toán nổi tiếng của hệ miễn dịch nhân tạo được thiết kế cho phát hiện bất thường. Chúng bao gồm hai giai đoạn: sinh ra một tập D các bộ dò từ một tập tế bào S cho trước, tiếp đó sử dụng những bộ dò này để phát hiện một tế bào cho trước là self hay non-self. Chúng tôi đề xuất một cải tiến thuật của toán chọn lọc âm tính dựa trên bộ dò loại r-chunk, bằng cách kết hợp chọn lọc dương tính và chọn lọc âm tính để làm giảm độ phức tạp thời gian và độ phức tạp bộ nhớ. Từ khóa: Hệ miễn dịch nhân tạo, thuật toán chọn lọc âm tính, thuật toán chọn lọc dương tính, an ninh máy tính, bộ dò r-chunk. Ngày nhận bài: 10/4/2013; Ngày phản biện: 22/4/2013; Ngày duyệt đăng: 26/7/2013 * Tel: ; nvtruongtn@gmail.com 47

8 48

Why does the motion of the Pioneer Satellite differ from theory?

Why does the motion of the Pioneer Satellite differ from theory? Le Van Cuong cuong_le_van@yahoo.com Information from Science journal shows that the motion of the Pioneer satellite, which was launched