This paper proposes for watching the artificial immune system. The definitions the basic element and the element with the memory like the part of artificial immune system in intrusion detection systems are described. The metric between elements with the limit measure is set. This metric is called affinity and the limit measure is called affinity threshold. The definitions of clone and mutation operations are set. Besides, the behavior between basic elements and elements with the memory on using clone and mutation operations in artificial immune system is researched.
Today there is important task of classifying the data and messages transmitted from the sender to the recipient through different systems in modern information infrastructure (mail, web, irq и т.д.). This problem solved by using either non-adaptive (methods of attack graphs scenarios, methods of analysis of the state systems, expert systems, methods on specifications, signature-based methods, etc.) or adaptive (artificial neural networks, artificial immune algorithms, genetic algorithms, etc.) methods [115].
As a part of information system the problem of classification the messages is reduced to task of classifying incoming data to definite class (for example, by relevance, by sender, by content and volume).
Today, in analyzing and classifying messages problem the most actual solution is using the classification data by it content. If we have no any information about data source it’s possible to determine the class which this data can be applied with a cer1. Reliable (actual, legitimate, and so on) class of data information; 2. Non-reliable (irrelevant, illegitimate, etc.) class of data information. The reliable (legitimate) information is a set of data which doesn’t include any threat in terms of availability, integrity and confidentiality for information system. Otherwise, the information is called non-reliable (illegitimate). Any anti-spam system or software and hardware anti-virus protection is classic example of such classification, because the information is classified by its content for two classes: reliable and non-reliable.
As said before, there are a large number of both adaptive and non-adaptive algorithms can classify the data blocks (emails) by its content. In [19] there is proposition which solves the problem by using two-classification artificial immune system.
Two-classification artificial immune system (2CAIS) is an adaptive algorithm with the teacher, which allows to classify the data blocks (emails) for two classes: reliable class of messages and the non-reliable class of messages.
The algorithm of two-classification artificial immune system was produced as an analogue of the biological immune system. The β-element (base element) and a βmelement (element with memory) are the basic definitions of 2CAIS. This elements are analogs of B-lymphocyte and B-lymphocyte with the memory in biological systems. B-lymphocyte and B-lymphocyte with memory, from a biological point of view, are "security flag". If this flag is changed the signal about it is created and the lymphocytes are generated by the body. The lymphocytes are deal with the (antigens). If the lymphocyte destroys a particular threat successfully or responds it with the higher probability, immune system transfers this B-lymphocyte to B-lymphocyte with the memory. Immune system transforms B-lymphocytes to B-lymphocyte with the memory using the presence of a weighting parameter. The more effective lymphocyte makes its functions the higher its "weight" and vice versa. If the lymphocyte does not provide effective kind of threat detection the immune system reduces the value of weight parameter until it reaches the point where it can be removed from the system finally.
Similarly, B-lymphocyte is a β-element and B-lymphocyte with the memory is βmelement in two-classification artificial immune system.
Also, similarly, the age (power, weight) is the main parameter of β-element. The age is a non-zero value, which characterizes the element weight. It fulfills the "death" condition of elements. If its value becomes equal zero the element is removed from the system. Another words, the age parameter shows the efficiency of elements. Also there are mutation and cloning operations in 2CAIS.
The mutation operation is a process of changing the β-element structure randomly.
The age of the β-element is finite and the process of mutation affects only a certain
number of entities. The measure of mutation is set on initializing stage 2CAIS
algorithm. The mutating operation (Mutating) is equivalent to write:
Mutating() i j , j , | | | |, i m j ,
m [0,1]
(
The cloning operation (Cloning (β)) is used for creating new β-elements in artificial immune system. This operation is applied when the mutation operation is finished. The cloning copies new mutate β-elements to current β-element set. The cloning coefficient is an important parameter of cloning operation. It shows how much elements will be created relative to the original.
Thus, the mutation operation creates new β-elements which potential to identify new threats. The cloning operation clones these elements to system.
These operations provide the variability between βm-elements and a simple βelements. The variability is the process which considers βm-element like the element with the memory. The βm-element is the most well-established "cast" the threat that it is able to effectively detect. Simple β-element is produced by a combination of a random selection of words from the emails or datasets with the applying of cloning and mutation operations. The βm-element is derived from iterative measure of effectiveness β-element working in a set of emails.
The distance (metrics) between the β-elements is calculated by using the affinity definition.
In 2CAIS the affinity of the elements defined as the ratio between the number of common entities, which are composed of these elements to norm. The norm of two elements is the minimum number of entities that make up each of the elements. Therefore, the affinity (Affinity or α) may be expressed as the following equation: Affinity(1,2 ) (1,2 )
Count(1i 2 )
j , i j min(| 1i |, | 2j |) where i, j – the order of the entities in the element; Count – a function of the number of intersections of the elements; |βj| – element capacity (the number of entities in the elements).
If the value of the affinity between the antigen (threat or potential message from the class of non-reliable information) and any β-element is above some threshold value (threshold affinity), then it means that the β-element recognizes the threat. After that, the system mark this data block (email) as a non-reliable, otherwise the data block is marked as reliable.
On the one hand, the affinity allows to detect the threat and thus carry out the process of the primary classification. On the other hand, there is a question to research the relationship between the processes of creating of β-elements and βm-elements. In other words, there is a task that requires to explore the relationship between basic (simple) β-elements and βm-elements with the memory which have the affinity metrics cloning and mutation operations through the problem of classification data block (emails) into two classes: reliable information class and non-reliable information class of messages. To solve the task of finding the relationship between β-elements and βm-elements prove Proposition 1.
For each ε > 0 exists [0,1] such that |β| = λ|βm |.
Let introduce some notation.
Consider the initial set of messages (emails, data blocks) S. β-elements initialized from S, |S| = s, s>0 and sN . Let k – the age if β-element, and n – the threshold when m (affinity threshold), and r = n-k, r>0, the difference between them. There are is1(k ) – elements (words in email) when the system is initialized. Let α – the value of the affinity function Affinity() for two elements. Pα – probability of appearing two β-elements which have the affinity distance greater than or equal to α, pi – its corresponding value. Let l the cloning coefficient in function Cloning(β) (hereinafter briefly denoted by C(β) function). Let m the mutation coefficient which corresponds the probability characteristics of new β-elements in Mutating(β) (hereinafter briefly denoted as a function of M(β)).
General algorithm of producing β-element and βm-elements consists of several steps: Step 1. Initialization β-element set from the S set; Step 2. Application the mutation and cloning functions to β-element set; Step 3. Calculate the probability Pα for getting β-element set; Step 4. Go to Step 2.
Consider the process iteratively. In Steps 1 and 2 the set of β-elements applied the cloning and mutation operation:
s
C (M ( (k ))) (
s b11s1 b12 s1b11
M1 C(M (i1(k ))) | P i11i1 (k 1) i21i2 (k 1) (
For the r-th iteration, the set of Mr becomes: M 2 L(M (M r 1)) | P br 2 b(r1)1 br1 i2 i2 1 br1 b(r1)1 i1 (k r) i1 1
r1 br 2r b(r1)1 brj
j1 i2r i2r 1 (k r 1) ...
(k r) On this stage the βm-elements are appeared because there are β-elements which have age equals n = k+r. The value of this age equals the threshold when m . The dimension Mr is finite and equals: | M r | prlr mr | (k r) || (k r 1) |... | (k r 1) || (k r) | prlr mr | || m | where |β| – number of all β-elements; |βm| – number of all βm-elements.
The relationship between the count of β-elements and βm-elements is a value (coefficient) depending on cloning coefficient, mutation coefficient and affinity distance greater than or equal to a predetermined value. Thus, the proposition that for each ε>0 exists [0,1] such that |β| = λ|βm| is proofed.
Now, we need to establish the relation between the number of simple β- elements and βm-elements with the memory from the sets it’s created. Another words, there is the task to determine the dependence of count β-elements and βm-elements for the two finite sets which have nesting ratio. To do this, let state Proposition 2.
For any two finite sets S1 и S2, where S1 S2 , | S1 | | S2 | , |β1| ≤ |β2| and |βm1|≤ |βm
2|.
(
The proof is reduced to a repetition of the iterations of the Proposition 1, but this time for two sets S1 and S2 with a comparison of the results.
Thus, there is a direct dependency between simple β-elements from βm-elements which allows to estimate the amount of generated β-elements and βm-elements. Besides, if we have finite sets we can predict the number of β-elements and βm-elements. It helps us to design the information systems for classifying.
Thus, there is a dependency between the simple β-elements from βm-elements within a finite set of emails or data blocks. It can help to predict the amount of memory allocated for the creation and storage the β-elements from βm-elements in 2CAIS. The information systems which can be built using this approach can classify emails or data blocks on two classes: reliable class and non-reliable class. It can be very necessary for creating the intrusion detection systems based on its content.