Artificial immunity using constraint-based detectors

In this paper, an artificial immune system (AIS) is used to detect abnormality in a computer network in an effort to provide protection from illegal intrusion and unauthorized use. The problem of anomaly detection can be addressed as the problem of distinguishing self patterns from non-self patterns. The self patterns could be any variety of characteristics of a system or its users. Detectors of an AIS recognize non-self patterns and invoke an alarm. In this work, an AIS was used to monitor simulated TCP/IP traffic on a simulated broadcast local area network. Detectors, in the form of interval constraints, were used to develop a simple and effective AIS.