Architecture For An Artificial Immune System S. A. Hofmeyr and S. Forrest
What Do They Do? Mimic Immunse System functionality and method Apply method to Intrusion Detection
How Do They Do It? They detail the ARTIS system Adapt and apply it, to create LISYS
Analogy
ARTIS Detector –Detector Trainer –Activation Threshold –Lifespan Memory Detector Costimulation
Detector Lifecycle
Why Is It Good? Robust –Diverse, Distributed, Dynamic Adaptable Autonomous
LISYS Detector –Datapath triple (src_ip,dest_ip,port) Detection Nodes on each internal machine
LISYS in action
Does It Work? Claimed: –Robust –Controlled (Tunable) –Scalable –Accurate –Adaptable –Lightweight
What Doesn’t It Do? Pass around memory detectors Respond to a detected “nonself”
How Can We Apply It To A.C.? Architecture? Methods? Inspiration?