1. Architecture For An Artificial Immune System S. A. Hofmeyr and S. Forrest

2. What Do They Do? Mimic Immunse System functionality and method Apply method to Intrusion Detection

3. How Do They Do It? They detail the ARTIS system Adapt and apply it, to create LISYS

4. Analogy

5. ARTIS Detector –Detector Trainer –Activation Threshold –Lifespan Memory Detector Costimulation

6. Detector Lifecycle

7. Why Is It Good? Robust –Diverse, Distributed, Dynamic Adaptable Autonomous

8. LISYS Detector –Datapath triple (src_ip,dest_ip,port) Detection Nodes on each internal machine

9. LISYS in action

10. Does It Work? Claimed: –Robust –Controlled (Tunable) –Scalable –Accurate –Adaptable –Lightweight

11. What Doesn’t It Do? Pass around memory detectors Respond to a detected “nonself”

12. How Can We Apply It To A.C.? Architecture? Methods? Inspiration?