• The lymphocyte’s state.
• The specificity of the lymphocyte’s receptor: a representation of the ran-domly generated receptors that we are going to match the infectious agents with.
• A value representing the numbers of receptors currently bound or a value representing the accumulated signal send to the core of the lymphocyte from the currently bound receptors.
• A value representing the threshold before getting activated.
The two main functionalities of the lymphocyte is to either travel or interact.
The travelling is rather simple, but when interacting the lymphocyte should at least be able to carry out the following functionalities:
• Receive stimulation, this could for instance be commands like:
– die when being exposed to part of self to simulate negative selection, – or die because we need to keep a constant rate of lymphocytes in the
system.
• Go through different states.
• Recognise infectious agents.
• Divide itself to simulate clonal expansion.
• Lower activation threshold to simulate a possible faster activation when being a memory cell.
• Carry out some kind of affinity maturation.
• Release signals to attract others to the site of infection.
• Travel in a specific direction due to the receiving of signals from other cells.
• Carry out some kind of action when being activated.
5.9 Stimulation
To keep alive the lymphocytes repeatedly need stimulation from the local en-vironment. This enables the immune system to have a kind distributed local control and enables it to keep the numbers of lymphocytes in the body at a constant rate. Furthermore, the lymphocytes can be stimulated by chemical signals like cytokines and chemokines to attract them to the site of infection.
But how should we model the stimulation from the local environment in our system?
The stimulation could be modelled in a number of ways. One approach is to stimulate the lymphocytes from the environment they reside in. If a graph is used to represent the location of the lymphocytes, vertices in the graph could contain information on how many lymphocytes there were allowed to stay in the vertex, and for how long time they were allowed to stay. Furthermore, the vertex could contain a probability measure indicating how likely it would be for the lymphocyte to survive in that particular vertex, thereby enabling the system to keep a constant rate of lymphocytes in each vertex. A second
approach is to model some kind ofstimulation cells also circulating the system together with the lymphocytes. These cells would be able to interact with the lymphocytes and could keep a constant rate of them by neglecting stimulation to those which had been inactive for a long time and not doing any good. To attract lymphocytes to the site of infection the cells could also carry information on which direction the lymphocytes should travel to help in fighting an intrusion.
A third approach is to try to let the lymphocytes handle all the stimulation themselves. The lymphocytes would have a probability measure of how likely it would be for them to survive when being in a specific state. As an example newly matured lymphocytes often have a high frequency of dying, whereas the memory lymphocytes often lives forever to support the immune system with the feature known as immunological memory.
63
Chapter 6
Computer Immune System for Virus Detection
With reference in the computer immune systems designed and implemented by IBM and UNM, we will in this chapter discuss how a system for virus detection could be designed. Components and mechanisms from the immune system, as discussed in the previous chapter, will be used to the extent that we see fit; we will not try to make a complete model of the immune system, but only use the parts that we find useful.
We start out by explaining how we have chosen to represent self instead of nonself in our computer immune system. As explained in the previous chapters we regard self as the elements which are not harmful to our system whereas nonself is regarded as elements which are harmful. Then we describe what kind of matching approach we have chosen to detect nonself and finally we discuss a static and a dynamic method for detecting nonself.
6.1 Representing Self instead of Nonself
The main purpose of the system is to distinguish between self and nonself. The immune system handles this job by randomly generating millions of cells and afterwards killing those cells reacting to self. In this way the cells of the immune system hold a complete set of nonself, and all substances which match this set are regarded as nonself and are therefore harmful. The following list shows the steps in the biological immune system for detecting nonself:
1. Randomly generate receptors.
2. Kill those receptors reacting to self.
3. Anything that match the receptors must be nonself.
In a computer system the set of nonself might be so large that we are not able to represent it within a computer, and the only possibility is therefore to try to represent the set of self instead. In such a system we do not randomly generate anything, but simply match with the set of self. The system then detects nonself by any substances which do not match self and in this way the system is able to tell what is right from wrong without having to represent the complete set of nonself. The list below shows the steps for detecting nonself in our system:
1. Match with self.
2. If it does not match with self it must be nonself.
But what is self and nonself in our system? Well, we have chosen to detect viruses from their patterns of behaviour. This means that self represents the normal behaviour which is not harmful and that nonself represents the abnormal behaviour which is harmful. Generally the computer immune system will hold a representation of normal behaviour and anything that deviates from this will be regarded as nonself.