Advertisement

On Permutation Masks in Hamming Negative Selection

  • Thomas Stibor
  • Jonathan Timmis
  • Claudia Eckert
Part of the Lecture Notes in Computer Science book series (LNCS, volume 4163)

Abstract

Permutation masks were proposed for reducing the number of holes in Hamming negative selection when applying the r-contiguous or r-chunk matching rule. Here, we show that (randomly determined) permutation masks re-arrange the semantic representation of the underlying data and therefore shatter self-regions. As a consequence, detectors do not cover areas around self regions, instead they cover randomly distributed elements across the space. In addition, we observe that the resulting holes occur in regions where actually no self regions should occur.

Keywords

Negative Selection Anomaly Detection Network Intrusion Detection Generalization Region Grey Shade Area 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

Preview

Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.

References

  1. 1.
    Forrest, S., Perelson, A.S., Allen, L., Cherukuri, R.: Self-nonself discrimination in a computer. In: Proceedings of the 1994 IEEE Symposium on Research in Security and Privacy. IEEE Computer Society Press, Los Alamitos (1994)Google Scholar
  2. 2.
    Dasgupta, D., Forrest, S.: Novelty detection in time series data using ideas from immunology. In: Proceedings of the 5th International Conference on Intelligent Systems (1996)Google Scholar
  3. 3.
    Hofmeyr, S.A.: An Immunological Model of Distributed Detection and its Application to Computer Security. Ph.D thesis, University of New Mexico (1999)Google Scholar
  4. 4.
    Singh, S.: Anomaly detection using negative selection based on the r-contiguous matching rule. In: Proceedings of the 1st International Conference on Artificial Immune Systems (ICARIS), pp. 99–106. Unversity of Kent at Canterbury Printing Unit (2002)Google Scholar
  5. 5.
    Kim, J., Bentley, P.J.: An evaluating of negative selection in an artificial immune system for network intrusion detection. In: Proceedings of the Genetic and Evolutionary Computation Conference, GECCO 2001, pp. 1330–1337 (2001)Google Scholar
  6. 6.
    Stibor, T., Timmis, J., Eckert, C.: On the appropriateness of negative selection defined over hamming shape-space as a network intrusion detection system. In: Congress On Evolutionary Computation – CEC 2005, pp. 995–1002. IEEE Press, Los Alamitos (2005)CrossRefGoogle Scholar
  7. 7.
    Stibor, T., Timmis, J., Eckert, C.: The link between r-contiguous detectors and k-cnf satisfiability. In: Congress On Evolutionary Computation – CEC 2006. IEEE Press, Los Alamitos (to appear, 2006)Google Scholar
  8. 8.
    Stibor, T., Timmis, J., Eckert, C.: Generalization regions in hamming negative selection. In: Intelligent Information Processing and Web Mining. Advances in Soft Computing, pp. 447–456. Springer, Heidelberg (2006)CrossRefGoogle Scholar
  9. 9.
    Hofmeyr, S., Forrest, S.: Architecture for an artificial immune system. Evolutionary Computation 8, 443–473 (2000)CrossRefGoogle Scholar
  10. 10.
    de Castro, L.N., Timmis, J.: Artificial Immune Systems: A New Computational Intelligence Approach. Springer, Heidelberg (2002)MATHGoogle Scholar
  11. 11.
    Perelson, A.S., Oster, G.F.: Theoretical studies of clonal selection: minimal antibody repertoire size and reliability of self-nonself discrimination. J. Theor. Biol. 81, 645–670 (1980)CrossRefMathSciNetGoogle Scholar
  12. 12.
    Percus, J.K., Percus, O.E., Perelson, A.S.: Predicting the size of the T-cell receptor and antibody combining region from consideration of efficient self-nonself discrimination. Proceedings of National Academy of Sciences USA 90, 1691–1695 (1993)CrossRefGoogle Scholar
  13. 13.
    Balthrop, J., Esponda, F., Forrest, S., Glickman, M.: Coverage and generalization in an artificial immune system. In: GECCO 2002: Proceedings of the Genetic and Evolutionary Computation Conference, New York, pp. 3–10. Morgan Kaufmann, San Francisco (2002)Google Scholar
  14. 14.
    Esponda, F., Forrest, S., Helman, P.: A formal framework for positive and negative detection schemes. IEEE Transactions on Systems, Man and Cybernetics Part B: Cybernetics 34, 357–373 (2004)CrossRefGoogle Scholar
  15. 15.
    D’haeseleer, P., Forrest, S., Helman, P.: An immunological approach to change detection: algorithms, analysis, and implications. In: Proceedings of the 1996 IEEE Symposium on Research in Security and Privacy, pp. 110–119. IEEE Computer Society Press, Los Alamitos (1996)Google Scholar
  16. 16.
    González, F., Dasgupta, D., Niño, L.F.: A randomized real-valued negative selection algorithm. In: Timmis, J., Bentley, P.J., Hart, E. (eds.) ICARIS 2003. LNCS, vol. 2787, pp. 261–272. Springer, Heidelberg (2003)CrossRefGoogle Scholar
  17. 17.
    Knuth, D.E.: The Art of Computer Programming, 3rd edn., vol. 1. Addison-Wesley, Reading (2002)Google Scholar
  18. 18.
    González, F., Dasgupta, D., Gómez, J.: The effect of binary matching rules in negative selection. In: Cantú-Paz, E., Foster, J.A., Deb, K., Davis, L., Roy, R., O’Reilly, U.-M., Beyer, H.-G., Kendall, G., Wilson, S.W., Harman, M., Wegener, J., Dasgupta, D., Potter, M.A., Schultz, A., Dowsland, K.A., Jonoska, N., Miller, J., Standish, R.K. (eds.) GECCO 2003. LNCS, vol. 2723, pp. 195–206. Springer, Heidelberg (2003)CrossRefGoogle Scholar
  19. 19.
    Tax, D.M.J.: One-class classification. Ph.D thesis, Technische Universiteit Delft (2001)Google Scholar
  20. 20.
    Rätsch, G.: Benchmark repository (1998), http://ida.first.fraunhofer.de/projects/bench/benchmarks.htm

Copyright information

© Springer-Verlag Berlin Heidelberg 2006

Authors and Affiliations

  • Thomas Stibor
    • 1
  • Jonathan Timmis
    • 2
  • Claudia Eckert
    • 1
  1. 1.Department of Computer ScienceDarmstadt University of Technology 
  2. 2.Departments of Electronics and Computer ScienceUniversity of YorkHeslington

Personalised recommendations