Artificial Immune System Algorithm based on Danger Theory Gon¸calo Pereira INESC-ID and Instituto Superior T´ecnico Porto Salvo, Portugal
[email protected]
April 22, 2011
1
What is it?
An artificial immune system algorithm, based on the Danger Theory, is an algorithm which emulates, in a computational context, the defense mechanism of the human immune system when presented with a danger to its wellbeing. Over its evolution the human immune system has developed a complex defense mechanism against entities which are harmful to the human body. This system is divided into two sub-systems that provide different types of defense, the innate immune system that is activated by generic (learned through evolution) harmful entities to the human body, and the adaptive immune system which is activated by specific antigens (molecules which are recognized as dangerous by the immune system). The capacity of the human immune system to flexibly and efficiently respond to threats in the human body is the main inspiration for its artificial intelligence conceptualizations. The study of this system has led researchers to formulate several theories regarding how the immune system works. However, the one we are addressing is the Danger Theory, which was introduced by Matzinger [11, 12] and offered a new perspective to the conceptualization and understanding of the immune system. This model is controversial but it provides answers to several of the problems faced by the previous ones, such as transplant rejections, no immune responses to the body in puberty or spontaneous tumor rejection. The main difference to previous models is that the immune system adapts to a changing self and is activated when it detects danger and not just when in the presence of non-self antigens as previous models proposed. Based on these concepts there are two main ideas behind algorithms using this model: • The algorithm will be based on responses to danger signals from a conceptual body.
1
Figure 1: Self-Nonself Model immune response activation diagram. • The algorithm will be able to cope with a changing body.
2
How does it work?
Many of the works using Danger Theory inspired algorithms are very domain dependent due to the different definitions needed to implement it, for example “what is danger?” or “what is self or non-self?”[4, 1]. Therefore, there is not a widespread basic version of the algorithm but several improved/modified versions or simply guidelines on how to build such a system[1]. In order to be able to proper understand these algorithms we then have to introduce the conceptual model of the Danger Theory as the groundwork for these computational models. The Danger Model even though controversial due to its major conceptual change, builds upon the previous (Self-Nonself) models which try to explain how our adaptive immune system is activated. To explain how this model works we will briefly explain the conceptual evolutions which lead to the danger model since they are part of it. A) Self-Nonself Model (SNS) (see figure 1) - The first model pinpointed the immune system response activation in B-Cells (a type of lymphocytes). B-Cells would have antigen specific receptors which recognized foreign entities upon contact and initiate an immune system response (by signaling for activation both B-Cells and T-Cells[another type of lymphocytes]).[3] The problem of this model is that activated B-Cells hypermutate (create new cells with mutations in order to better adapt immune response) and in this process could also create self-reacting cells which would mean that autoimunity would be common. In reality it is not.[11] B) 1st Modified SNS Model (see figure 2) - To solve the problem of the previous model, a modified one was created where a Helper T-Cell was added. In this version, the B-Cell would recognize the antigen and express it on its surface. If a Helper T-Cell bound to the B-Cell’s expressed antigen then an immune response would be initiated (signaling help for the B-Cell) otherwise the B-Cell would simply die.[2] However, later on it was discovered that T-Cells responded more strongly against foreign cells of their own species (trials with cells of different species) than against those of other species.[11]
2
Figure 2: 1st Modified SNS Model immune response activation diagram.
Figure 3: 2nd Modified SNS Model immune response activation diagram. C) 2nd Modified SNS Model (see figure 3) - To solve this new problem, a new cell with species specific signals was added to the model, the Antigen Presenting Cell (APC). Now the B and Helper T cells would not be enough to start an immune response, it would only start if the T cell was costimulated by an APC cell with a species specific signal[10]. This model solved the problem of species specificity but reintroduced the problem of self-reactivity since APC cells capture and express both self and non-self cells meaning that they could easily stimulate an autoimmune response.[11] D) Infectious-Nonself Model (INS) (see figure 4) - Given the limitation of the previous model, it was proposed that the APC cells would be able to discriminate between self and non-self by having a set of receptors (pattern recognition receptors, PRRs) capable of recognizing pathogen-associated molecular patterns (PAMPs) patterns. Only when in the presence of such patterns would the APC cells be activated and costimulate the Helper cells to finally start the immune response[8]. Again the solution to a problem raised others, like the lack of explanation of immune responses to viruses or why non-bacterial
3
Figure 4: Infectious Nonself Model immune response activation diagram. adjuvants1 work.[11] E) Danger Model (see figure 5) - This model is proposed as an attempt to solve the previous model’s problems. It introduces a major conceptual change by modifying the trigger of immune response activation from self/non-self discrimination to danger/alarm signaling. This is done by including all body tissue cells and adding a new signal to the model. It is proposed that a healthy cell in the human body does not emit any kind of distress or alarm signal (even when a cell goes through apoptosis, natural cell death) and that when a cell is injured it emits a distress signal (this can be any substance released or produced by such a cell when in distress or danger). This signal then activates the local APCs which consequently costimulate Helper T Cells, and these in turn help B Cells that finally activate the immune response. This model offers explanations to many of the problems faced by previous models, such as how can we have non-self organisms inside our body without them triggering an immune response or why we have an immune response to viruses. The difference of immunological reaction between the main models described along this evolution can be observed in figure 6. [11] Regarding danger model inspired computational algorithms there is not a single basic version, but several considerations to such a system have been presented in “The Danger Theory and Its Applications to Artificial Immune System” [1]. However, in the last few years one algorithm has been applied to several different domains with good results[13, 5, 9, 7]: Dendritic Cell Algorithm (DCA). Given the increasing application of this algorithm and its performance, it seems the most generic solution available and we will focus on it for a detailed description of how could a Danger Theory inspired artificial immune system al1 “An adjuvant is a pharmacological or immunological agent that modifies the effect of other agents (e.g., drugs, vaccines) while having few if any direct effects when given by itself. They are often included in vaccines to enhance the recipient’s immune response to a supplied antigen while keeping the injected foreign material at a minimum.” retrieved on 21st April 2011 from http://en.wikipedia.org/wiki/Adjuvant
4
Figure 5: Danger Model immune response activation diagram.
Figure 6: The activation of the immune system by different types of immune system models. Diagram retrieved from [12]
5
gorithm work.
2.1
DCA - Dendritic Cells Algorithm
The DCA is especially suited to be applied on problems analogous to those presented to the human immune system, but in a computational context. Examples of these are intrusion or anomaly detection in computer security for networked environments or medical data classification. The algorithm is a “multi-sensor data fusion and correlation algorithm that can perform anomaly detection on ordered data sets, including real-time and time-series” [6]. In other words, the algorithm correlates a set of signals (dangerous or safe) existing in an environment with the entities in that environment at any given time, resulting in a decision of whether those entities are dangerous or not without having an explicit classification. Based on this definition we can already expect that the algorithm is mostly centered on the detection of danger rather than the response to the danger. The DCA name is derived from a specific type of immune system cells called dendritic cells which play a central part in the algorithm. The focus on this cells enables an abstraction from some details in the danger theory and the creation of a concrete algorithm applicable to several computational domains. The algorithm itself specifies how data is processed and flows but several details are domain dependent, such as the specification of the danger signals. Dendritic Cells (DC) are white blood cells which can perform the task of antigen presenting cell (a crucial function for danger detection) by monitoring human tissues and migrating to local lymph nodes2 to activate an appropriate immune response when needed. To properly explain the algorithm several immunology terms are used, but adapted in terms of their meaning regarding a computational context. Some important definitions are: tissue the computational “area” which needs to be monitored by the algorithm (example: a storage area); antigen an entity which exists or is related with the tissue being monitored (example: a process); lymph node the algorithm’s part where the DCs and its information are used to decide on the danger of the associated antigens; signal a property of the tissue which influences the decision regarding the safety or danger of a tissue at a given time (example: amount of network traffic) In this context an antigen is defined as an entity which can be associated (presented) by a DC (the APC cell) and does not have a direct correlation to an immune system response as it would in its original definition with previous models. It can be either a dangerous or non-dangerous entity. Generically the DCA is composed by three main processes: 2 In
the human body lymph nodes “store” B and T cells ready for immunological action.
6
• Creation of DCs; • Exposition of DCs to the environment(tissue); • Evaluation of the data collected by DCs;
2.2
Creation of DCs
In a computational context the creation of a parameterizable number of DC cells is summarized as the simple creation of a structure which contains all the relevant data in a way that it can be manipulated by the algorithm. Especially relevant in this step is to understand what information does a DC contain. Each DC has the following information: Maturation Stage expresses one of three maturation stages. Each of these represents, in a simplified way, a different type of impact on danger detection. The stages of the DCs and what they represent are the following: immature DCs which are still monitoring the tissue and will not participate in any danger evaluation; semi-mature DCs which are on the lymph node (no longer sampling the environment) and will increase the relationship of the antigens they carry with tolerance (non danger); mature DCs which are on the lymph node (no longer sampling the environment) and will increase the relationship of the antigens they carry with danger. Antigen Storage the place where the DC can record all the antigens to which it was exposed while sampling the environment (not in the lymph node); Cumulative Output Signals the cumulative DC signals are used to decide when the DC migrates to the lymph node (stops sampling the environment) and whether it will signal for danger or not when it arrives at the lymph node; Migration Threshold a value that essentially represents the amount of time a DC will sample the environment.
2.3
Exposition of DCs to the environment
After the DC cells have been created they must be exposed to the environment in order to store data which will enable them, upon migration to the lymph node, to decide on whether they sensed danger or not. The process of exposition and data collection of a DC is shown in the pseudo code from algorithm 1. Before explaining in detail how the DC life cycle evolves it is important to understand that there are two types of signals: input signals and output signals. The input signals, as described in [6] and sensed by the DC from the environment are presented in table 1. 7
Algorithm 1 DC life cycle 1: 2: 3: 4: 5: 6: 7: 8: 9: 10: 11: 12: 13: 14: 15: 16:
InitializeDC //The DC is in the tissue while CSM output signal < Migration Threshold do get antigen; store antigen; get current values for input signals; update cumulative output signals; end while //The DC enters the lymph node if semi-mature output signal > mature output signal then set cell state as semi-mature; else set cell state as mature; end if //The DC dies and communicates the information collected kill cell
The mapping of the input signals’ abstract properties to their computational representation is domain specific. Regarding the DC output signals which are used to decide on DC state and danger are presented in table 2.
The pseudo-code presented in algorithm 1 represents the several phases of a DC life cycle. In the initialization phase (line 1) all the DC structures are initialized, especially relevant is the assignment of the migration threshold. This value is parameterizable, but in the actual assignment to the DC some variability should be introduced so that antigens will have different lifetimes and provide a broader evaluation (evaluating different time frames). After this step, the DC is placed on the tissue for environment sampling (lines 3-8). Here it starts by collecting and storing an antigen from the environment. Next, the current values of the input signals are retrieved from the environment and each output signal is updated according to equation 1. In this equation we incorporate the contribution of all input signals, P for PAMPs, D for danger signals, S for safe Signals and I for the inflammation signal. The index w represents specific weights for the calculation of each output signal and i the index of a given input signal of that type. The actual values depend on domain specific adjustments, but the relationship between weights should follow the one presented in table 3. This update process has been derived from empirical immunological data. This tissue sampling process repeats until the Migration threshold is met.
8
Signal PAMP Danger Signals Safe Signals
Biological Property Indicator of microbial presence Indicator of tissue damage Indicator healthy tissue
Abstract Property Signature of likely anomaly High levels indicate “potential” anomaly High levels indicate normally functioning system Multiplies all other input signals
of
Inflammation Indicating general tissue distress
Computational Example Error messages per second Netowrk packets per second size of packets
network
User physically absent
Table 1: DCA input signals.
Signal Costimulatory signal (CSM) Semi-mature signal Mature signal
Importance of the signal represents the signal that decided on DC migration to the lymph node represents the tendency of the DC to represent safety represents the tendency of the DC to represent danger
Table 2: DCA output signals.
9
Outputi+1 = Outputi + (Pw ∗
X
Pi + Dw ∗
i
Signal CSM Semi-mature Mature
PAMP W1 0 W2
Danger W 1/2 0 W 2/2
X
Di + Sw ∗
i
X
Si ) ∗ (1 + I) (1)
i
Safe W 1 ∗ 1.5 1 −W 2 ∗ 1.5
Table 3: DCA input signals.
When the value of the CSM output signal is greater or equal to the Migration Threshold the DC migrates to the lymph node. In this part of the algorithm a simple choice is made to decide if the DC presents signals of danger or not. If the semi-mature output signal accumulated value is higher than the accumulated mature output signal then the cell’s state is set to semi-mature otherwise it is set to mature. After this step the cell is set to be eliminated. However, before being eliminated the data it collected must be registered for posterior algorithm analysis. The antigens that the DC cell collected from the environment are then marked as either associated with a mature or semi-mature according to the nature of the cell. This marking should be done in a cumulative way (for example counters) so that the information from several cells can be stored at the same time. When a cell is finally eliminated a new one is created so the algorithm can continue to run.
2.4
Evaluation of the data collected by DCs
The collected information by the various DC cells is evaluated based on the “mature context antigen value” (MCAV) which determines the anomaly coefficient for a given antigen type. The MCAV value is calculated by equation 2, where the MCAV of a given antigen type is given by the average of DC cells that registered that antigen type as associated with a mature context. M CAV (antigen type) = mature count/antigen count
(2)
The closer the value of MCAV is to 1, the highest the probability of that antigen type being associated with the danger signals, and therefore, representing danger itself. The threshold of MCAV can be parameterized, but the action taken when a dangerous antigen type is detected is domain dependent. This action is the analogous to the previously called immunological response.
10
3
Applications
Some of the known applications of artificial immune algorithms based on a danger theory model are: • Computer Intrusion Detection - based on DCA applied to anomaly detection on port scanning[7]; • Web Mining - a mailbox filter example is given, not based on DCA[14]; • Two-class On-line Classification - a general framework and experiments are presented, not based on DCA[15]; • Breast Cancer Classification - based on DCA, used on a dataset containing information regarding people with and without breast cancer to classify the information[5];
References [1] U. Aickelin and S. Cayzer. The danger theory and its application to artificial immune systems. In Proceedings of the First International Conference on Artificial Immune Systems, pages 141–148. Citeseer, 2002. [2] P. Bretscher and M. Cohn. A theory of self-nonself discrimination. Science, 169(950):1042–1049, 1970. [3] S.F.M. Burnet. The clonal selection theory of acquired immunity. Vanderbilt University Press, 1959. [4] A.P. Engelbrecht. Computational intelligence: An introduction. Wiley, 2007. [5] J. Greensmith, U. Aickelin, and S. Cayzer. Introducing dendritic cells as a novel immune-inspired algorithm for anomaly detection. Artificial Immune Systems, pages 153–167, 2005. [6] J. Greensmith, U. Aickelin, and S. Cayzer. Detecting Danger: The Dendritic Cell Algorithm. Robust Intelligent Systems, pages 89–112, 2009. [7] J. Greensmith, U. Aickelin, and G. Tedesco. Information fusion for anomaly detection with the dendritic cell algorithm. Information Fusion, 11(1):21– 34, 2010. [8] C.A. Janeway Jr. The immune system evolved to discriminate infectious nonself from noninfectious self. Immunology Today, 13(1):11–16, 1992. [9] J. Kim, P. Bentley, C. Wallenta, M. Ahmed, and S. Hailes. Danger is ubiquitous: Detecting malicious activities in sensor networks using the dendritic cell algorithm. Artificial Immune Systems, pages 390–403, 2006.
11
[10] KJ Lafferty and AJ Cunningham. A new analysis of allogeneic interactions. Immunology and Cell Biology, 53(1):27–42, 1975. [11] P. Matzinger. Essay 1: the Danger model in its historical context. Scandinavian Journal of Immunology, 54(1-2):4–9, 2001. [12] P. Matzinger. The danger model: a renewed sense of self. Science’s STKE, 296(5566):301, 2002. [13] R. Oates, J. Greensmith, U. Aickelin, J. Garibaldi, and G. Kendall. The application of a dendritic cell algorithm to a robotic classifier. Artificial Immune Systems, pages 204–215, 2007. [14] A. Secker, A. Freitas, and J. Timmis. A danger theory inspired approach to web mining. Artificial Immune Systems, pages 156–167, 2003. [15] Chenggong Zhang and Zhang Yi. A danger theory inspired artificial immune algorithm for on-line supervised two-class classification problem. Neurocomput., 73:1244–1255, March 2010.
12
