Immunocomputing Model of Intrusion Detection - Computer Network Security - page 454

Spatial FIN (sFIN) is proposed as an extension of FIN intended for pattern recogni-
tion applications. Define sFIN as a set:
SFIN = < R N , m, w, ∆ h, B-cells > , B-cell = <S, P> ,

where
R N is N -dimensional Euclidean space considered as the shape space of sFIN;
P ∈ R N is N -dimensional vector (point of the shape space) considered as the formal
protein (FP), as well as the receptor of the B-cell;
m is the number of nearest neighbors of any B-cell;
w is the Euclidean distance considered as the binding energy between FPs:

w: R N × R N → R 1 , w ij = |P i − P j | ;

∆ h is real value “mutation step”: ∆ h ∈ R 1 ;
S is the state indicator of B-cell: S = {ltm, stm, del} , where ltm is long-term (mem-
ory) cell, stm is short-term (memory) cell, and del is deleted cell.
Rules of behavior of sFIN are as follows.
All B-cells update their states simultaneously in a discrete time t = 0,1,2, … .
Any B-cell B k has no more than m nearest neighbors, which correspond to m near-
est points in the shape space (rule B_neibor). B-cell updates its state as follows.
Short-term cell becomes deleted if it is close to any long-term cell (rule B_delete).
In case of deletion rule (B_delete), consider that long-term cell B i recognizes short-
term cell B k .
Short-term cell makes m copies ( proliferates to the direction of the nearest
neighbors) if it isn't close to any cell (rule B_prolif).
Short-term cell becomes long-term cell if it is close to any short-term cell but isn't
close to any long-term cell (rule B_interf).
Long-term cell drifts to the direction of the nearest long-term cell if the cells are
close (rule B_drift).
Two long-term cells B i , B j fuse if they are identical (rule B_fusion).
If any new FP ( antigen ) P A intrudes to the SFIN, then new short-term cell ( antigen
presenting cell ) appears, which expose the intruder as the receptor (rule A_pres).
Note essential difference between SFIN and cellular automata. Namely, any cell of
cellular automaton has fixed nearest neighbors, while any cell of SFIN determines
such neighbors dynamically on any time step.
Note also essential difference between SFIN and immune network algorithms pro-
posed by [4]. The algorithms represent special case of genetic algorithms, because
immune cells are coded by bit strings and “mutate” by random rules. Unlike these
features, cells of SFIN are coded by real vectors and their behavior is deterministic.
Actually, SFIN represents special modification of so-called hybrid cellular auto-
mata, which applied successfully for the modeling of rather complex dynamical proc-
esses [9].
Consider numerical experiment with a fragment of a database of network connec-
tion records. This database utilizes a model of a typical local area network of US Air
Force [1].
The database fragment contains 106 records of 15 types of intrusions and normal
behavior. The fragment utilizes 33 characteristics of the network connection records,