Towards an Immune-inspired Temporal Anomaly Detection Algorithm based on Tunable Activation Thresholds

The detection of anomalies in computer environments, like n etwork intrusion detection, computer virus or spam classification, are usually based on some form of patter n searchon a database of pre-computed “signatures” for known anomalies. Although very successful and widely de ployed, these approaches are only able to cope with anomalous events that have already been seen and classified or, with the more robust systems, anomalies that are similar to some previously seen event. To cope with these weaknesses there is a new emerging type of anomaly detection system that is “behaviour” bas ed. Although conceptually more appealing, the deployment of behaviour based systems has resulted in an imp ractical high rate of false alarms. The vertebrate Immune System is an emergent and appealing me taphor for new ideas on anomaly detection. There are some theories already adopted in particular fields , such as network intrusion detection. In this paper we present a temporal anomaly detection archit ecture based on the Grossman’s Tunable Activation Threshold (TAT) hypothesis. The basic idea is that th e repertoire of immune cells is constantly tuned according to the cells temporal interactions with the envir onment and yet retains responsiveness to an openended set of abnormal events. We describe some preliminary w ork on the development of an anomaly detection algorithm derived from TAT and present the results obta ined thus far with training and testing using some synthetic data-sets.