A Review of Artificial Immune System Based Security Frameworks for MANET <s> Negative Selection <s> Biology gives us numerous examples of self-assertional systems whose essence does not precede their existence but is rather revealed through it. Immune system is one of them. The fact of behaving in order not only to satisfy external constraints as a pre-fixed set of possible environments and objectives, but also to satisfy internal "viability" constraints justifies a sharper focus. Adaptability, creativity and memory are certainly interesting "side-effects" of such a tendency for self-consistency. However in this paper, we adopted a largely pragmatic attitude attempting to find the best hybridizing between the biological lessons and the engineering needs. The great difficulty, also shared by neural net and GA users, remains the precise localisation of the frontier where the biological reality must give way to a directed design. <s> BIB001 </s> A Review of Artificial Immune System Based Security Frameworks for MANET <s> Negative Selection <s> With increased global interconnectivity and reliance on e-commerce, network services and Internet communication, computer security has become a necessity. Organizations must protect their systems from intrusion and computer virus attacks. Such protection must detect anomalous patterns by exploiting known signatures while monitoring normal computer programs and network usage for abnormalities. Current anti-virus and network intrusion detection (ID) solutions can become overwhelmed by the burden of capturing and classifying new viral strains and intrusion patterns. To overcome this problem, a self-adaptive distributed agent-based defense immune system based on biological strategies is developed within a hierarchical layered architecture. A prototype interactive system is designed, implemented in Java and tested. The results validate the use of a distributed-agent biological system approach toward the computer security problems of virus elimination and ID. <s> BIB002 </s> A Review of Artificial Immune System Based Security Frameworks for MANET <s> Negative Selection <s> This paper proposes a Genetic Algorithms (GA)-based detector optimization scheme in the Negative Selection Algorithm (NSA). The NSA is a natural immune response inspired pattern discrimination method. In our scheme, the NSA detectors are optimized by the GA to occupy the maximal coverage of the nonself space so that they can achieve the best anomaly detection performance. Two numerical examples including the discriminant analysis of Fisher's iris data are demonstrated to compare our new approach with a conventional detector generation method. Simulation results show that the former is more efficient than the latter for generating the NSA detectors. <s> BIB003 </s> A Review of Artificial Immune System Based Security Frameworks for MANET <s> Negative Selection <s> The natural immune system (NIS) protects the body against unwanted foreign material (non-self cells) that could damage the body (self cells). The NIS can be modeled into an artificial immune system (AIS) to detect any non-self patterns in a non-biological environment. Detectors in the NIS can change from their initial mature status to memory status detectors or to annihilated status. A memory detector is a detector that fre- quently detects non-self cells and is a general detector for a sub- set of non-self cells. The NIS uses these memory detectors in a faster response to non-self cells. The purpose of this paper is to present the genetic artificial immune system (GAIS) which evolves these non-self detectors and determine their state using a life counter function. Only detectors with mature or memory status are used to detect non-self. Thus, the number of detectors is dynamically determined by the life counter function. In the paper GAIS is applied to different classification problems. <s> BIB004 </s> A Review of Artificial Immune System Based Security Frameworks for MANET <s> Negative Selection <s> This paper presents a new selection algorithm based on artificial immunologic systems (AIS) and decision theory. The objective of the algorithm it to increase the performance of executive decisions by identifying more carefully what can be considered an appropriate executive decision to a given specific context. The main idea is to mimic the immunologic system, specifically the self & non-self detection mechanism. According to our proposition, 'decision cells' (analogous to immune-cells) are responsible for selection of the appropriate executive decisions. In this paper we present the motivation, theoretical approach (i.e. the analogy between biological and business models), the proposed algorithm and some simulated experiments aiming at real situations. <s> BIB005 </s> A Review of Artificial Immune System Based Security Frameworks for MANET <s> Negative Selection <s> A new scheme for detector generation for the Real-Valued Negative Selection Algorithm (RNSA) is presented. The proposed method makes use of genetic algorithms and Quasi-Monte Carlo Integration to automatically generate a small number of very efficient detectors. Results have demonstrated that a fault detection system with detectors generated by the proposed scheme is able to detect faults in analog circuits and in a ball bearing dataset. <s> BIB006 </s> A Review of Artificial Immune System Based Security Frameworks for MANET <s> Negative Selection <s> One of the major challenges for negative selection is to efficiently generate effective detectors. The experiment in the past shows that random generation fails to generate useful detectors within acceptable time duration. In this paper, we propose an antigen feedback mechanism for generating the detectors. For an unmatched antigen, we make a copy of the antigen and treat it the same as a newly randomly generated antibody: it goes through the same maturing process and is subject to elimination due to self matching. If it survives and is then activated by more antigens, it becomes a legitimate detector. Our experiment demonstrates that the antigen feedback mechanism provides an efficient way to generate enough effective detectors within a very short period of time. With the antigen feedback mechanism, we achieved 95.21% detection rate on attack strings, with 4.79% false negative rate, and 99.21% detection rate on normal strings, 0.79% false positive. In this paper, we also introduce Arisytis --- Ar tificial I mmune Sy stem T ool K i t s --- a project we are undertaking for not only our own experiment, but also the research communities in the same area to avoid the waste on repeatedly developing similar software. Arisytis is available on the public domain. Finally, we also discuss the effectiveness of the r-continuous bits match and its impact on data presentation. <s> BIB007 </s> A Review of Artificial Immune System Based Security Frameworks for MANET <s> Negative Selection <s> Over the last decade, a new idea challenging the classical self-non-self viewpoint has become popular amongst immunologists. It is called the Danger Theory. In this conceptual paper, we look at this theory from the perspective of Artificial Immune System practitioners. An overview of the Danger Theory is presented with particular emphasis on analogies in the Artificial Immune Systems world. A number of potential application areas are then used to provide a framing for a critical assessment of the concept, and its relevance for Artificial Immune Systems. <s> BIB008
In the biotic or biological immune system T-cells are initially formed in the bone marrow and on maturation they move to the thymus. The phase of T-cell evolution is characterized by expressions provided by T-cell receptors. Whenever the Pre-T-cells and thymus cells interact this leads to Pre-T-cell multiplication and divergence. Then these T-cells undergo negative selection to eliminate T-cells that are activated by self in the thymus. Although variations of negative selection have been proposed, the process described in  [18] still remains in use. Gao et al. BIB003 proposed enlarging non overlapping detectors to obtain non-self coverage. Let the detector center be O j , then detector j will have a maximum radius of r j . The detectors with large radii have higher fitness. Ma et al. BIB007 describe a mechanism to produce useful detectors that are randomly produced and the unmatched antigen is placed into a detector space called the feedback detector. The feedback detector will be eliminated in case it matches self strings. Once the feedback detector becomes mature it will be used to match antigens. When the feedback detector acquires a match on further antigens, it becomes a legitimate detector. Simple Evolutionary NSA (ENSA) and basic ENSA BIB007 are Negative Selection Algorithm (NSA) variations and the functionality of Simple ENSA is to generate detectors capable of identifying corrupted data. When a detector is to match correct data it can lead to wayward or abnormal changes in the detector and this detector will be discarded. The evolution of the next generation detectors takes place through mutation, positive selection and negative selection. Such evolutionary inception loops to generate detectors continue until a wayward change is detected. In Basic ENSA, in addition to the next generation detector set, a randomly generated detector is also added. By including the additional detector searches can take place in the global space as well. ENSA finds its use in hardware/ software segregation in embedded systems. The proposed system BIB002 uses numerous layers to account for fault detection. The negative selection algorithm is implemented in the top most layer in order to identify abnormal situations at the system level. The sys-tem identifies non-self states and upon identification of a non-self the cause must be contained. This can only be achieved upon reconfiguration of the device and performing test patterns at a low level. The process used hand selection in order to pick a detector set. In BIB001 they have used negative selection to detect anomalies in network traffic. The detectors containing non-self patterns are generated. The TCP packet headers that passed within the intra-LAN as well as between the intra-LAN and external networks were captured and chosen for data sets. The collection of the first data set occurred when there were no intrusions and the remaining data was collected during the simulation of different intrusions such as an IP spoofing attack, guessing rlogin, network hopping attack and a scanning attack. The simulations obtained data that was classified into two categories such as "inter-connection" and "intra-connection". Inter-connection denoted the connection between internal and external hosts while intra-connection denoted the connection between internal hosts. The result of the experiment resulted in the generation of five different sets of detectors after the negative selection incorporated AIS was run five times. The authors came to a conclusion wherein AIS incorporating negative selection can be used as a filter or screening mechanism for invalid detectors instead of generating competent detectors. Caldas et al. BIB005 proposed a variant of the negative selection algorithm where a repository database is used to store perceptible indexes of performance for an enterprise. There will be a set of cells known as decision cells which will be responsible for extracting decisions from the repository database and provide feedback about the decision to the repository database. Each decision issue is represented by a decision cell which in turn is composed of x decision receptors. The approach proposed consists of two stages: learning and operation. In the learning stage the decision maker selects the decision cells based on the information in the repository database. These cells constitute the initial reservoir of self-cells, that is a decision cache to be stored in the repository database for later use. In the operation stage the decision creator requests decision cells from the repository database and presents decision related problems to the decision cells for resolution. The identification of unauthorised access to an organization's computing resource is known as intrusion detection  . There can be abuse carried out by authorized users on enterprise resources. The most common detection approach employed is to match a received pattern/signature against a library of patterns/signatures. Each time a match is obtained an alert is generated. There can be high false positive rates with this approach due to the following reasons: i) the speed of data can cause the IDS to miss out on key information; and ii) high noise level on networks due to user accidents, damaged or lost data packets. Although alerts are generated by the IDS, enormous time and resources are consumed. Just like a physician who does not make a diagnosis based on a single symptom of disease, correlation and analysis of multiple alerts are required. The steps carried out are: i) a non-self detector string is created by the generator which tests this string against all known self; and ii) if a match on self occurs, a new string is generated thereby destroying the old string. The new string, after going through the same process if successful, is set to memory type. This interactive system designed and implemented in Java validate the use of a biological system approach towards network problems such as virus elimination and intrusion detection Graaff et al. BIB004 proposed the Genetic Artificial Immune System (GAIS). Here the counterpart of lymphocyte is known as an artificial lymphocyte. The four states in which an artificial lymphocyte exists are: immature (no priority), mature (medium priority), memory (high priority) and annihilated (low priority). The bit string of an artificial lymphocyte is randomly generated and is made to undergo either positive selection or negative selection. Based on the Hamming distance of the nearest self-pattern to the artificial lymphocyte, it will be assigned a distance threshold value. Whenever a match occurs with a non-self-pattern the Hit counter of the artificial lymphocyte is incremented in order to determine its matching ratio. GAIS also uses Genetic Algorithms (GA) to evolve artificial lymphocytes. Each artificial lymphocyte is related to a chromosome and the randomly generated artificial lymphocytes will constitute an existing population of a GA. Amaral et al. BIB006 uses GA to generate a detector in a real valued negative selection algorithm. Every possible detector set is linked to a chromosome. Each gene is considered to be a pointer to a y dimensional detector set. The radius for each detector set is computed by using a decoding function and Monte Carlo integration BIB008 [27] is used to calculate the volume of the detector set.