A Change-Detection Algorithm Inspired by the Immune System

The problem of protecting computer systems can be viewed in part as the problem of distinguishing self from other. We describe a method for accomplishing this which is based on the way natural immune systems generate T-cells. The two-phase algorithm rst generates a set of detectors that do not match self. In the second phase, these detectors are used to monitor self and if a match is ever found, a change is reported. Mathematical analysis reveals the conditions under which the system is feasible, and preliminary experiments illustrate how the method could be applied to the problem of computer virus detection.