Journal of Robotics, Networking and Artificial Life, Vol. 4, No. 4 (March 2018) 303-307___________________________________________________________________________________________________________Artificial Immune Ecosystems: the role of expert-based learning in artificial cognition
Pierre Parrend

ICube laboratory, University of Strasbourg, UMR CNRS 7357, Strasbourg, France, ECAM Strasbourg-Europe,
Schiltigheim France, pierre.parrend@unistra.fr
Fabio Guigou, Julio Navarro, Aline Deruyver, Pierre Collet

ICube laboratory, University of Strasbourg, UMR CNRS 7357, Strasbourg, FranceAbstract
The rapid evolution of IT ecosystems significantly challenges the security models our infrastructures rely on. Beyondthe old dichotomy between open and closed systems, it is now necessary to handle securely the interaction between
heterogeneous devices building dynamic ecosystems. To this regard, bio-inspired approaches provide a rich set ofconceptual tools, but they have failed to lay the basis for robust and efficient solutions. Our research effort intends torevisit the contribution of artificial immune system research to bring immune properties: security, resilience,distribution, memory, into IT infrastructures. Artificial immune ecosystems support a comprehensive model for
anomaly detection and characterization, but their cognitive capacity are limited by the state of the art in machinelearning and the rapid evolution of cybersecurity threats so far. We therefore propose to enrich the cognitive processwith expert-based learning for reinforcement, classification and investigation. Application to system supervisionusing system logs and supervision time series confirms the relevance and performance of this model.
Keywords: Artificial Immune Systems, Cybersecurity, Immunity, Computational Ecosystem, Anomaly detection

the properties of natural immune systems: security,resilience, distribution, memory. To this aim, theircognition capacity for anomaly identification andcharacterization in a context of dynamic systems andrapidly evolving threats is a key requirement. We areconvinced that cognition, i.e. the support of search,
adaptability, memory and learning [4] in such
heterogeneous environments will not be achieved in ashort time span through fully automated solution, andthat the contribution of human creativity in the analysis
process is a major enabler for adaptation and learning.
We therefore propose in this paper to extend the AIE withexpert-based learning for reinforcement, classificationand investigation. We apply this model to systemsupervision using system logs and supervision time series
to confirm its relevance and performance.
Section 2 introduces related works. Section 3 defines therole of cognition in the Artificial Immune Ecosystem(AIE). Section 4 formalizes the expert-aided learning in
the AIE. Section 5 presents the experiments and theevaluation of this model. Section 6 concludes this work.

1. Introduction
Old closed IT infrastructures increasingly turn into open
interconnected ecosystems of heterogeneous devices:
this shift is put to light in particular by the numerous
challenges posed by IoT Security [1]. In this context, thedetection of anomalies caused by cyberattacks becomesan ever more tedious task to identify known anomalies,
new ‘zero-day’ anomalies or signs of system instability
following these anomalies. Bio-inspired architectures
and algorithms provide to this regard a promising set ofconcepts and solutions for multi-scale dynamicecosystems. However, no robust and efficient solution
exists to solve the issue of generic anomaly detection sofar. We therefore work on a new generation ArtificialImmune Systems (AIS) called Artificial Immune
Ecosystem (AIE): it encompasses not only the analysis
layer as classical AIS do, but also a basis layer for robust
and resilient data management, an immune
communication protocol [2] as well as a supervision andknowledge management layer [3]. The AIE shall embed

Copyright © 2018, the Authors. Published by Atlantis Press.
This is an open access article under the CC BY-NC license (http://creativecommons.org/licenses/by-nc/4.0/).
303

Journal of Robotics, Networking and Artificial Life, Vol. 4, No. 4 (March 2018) 303-307___________________________________________________________________________________________________________

2. Related Work

Although these properties have been devised in atheoretical context, they prove to be key to theconstruction of an efficient Artificial Immune Ecosystem
for multi-scale IT infrastructures.

2.1. Mechanisms of natural immunity
It is possible to summarize natural immunity as theperception of three types of signals by the immune
system [5]:1-signal: the affinity between antigens and antibodies
enable these latter to identify known pathogens. This
process typically occurs through B-cells and T-cells inacquired immunity.
2-signals: the affinity between immune receptors andPAMPs (Pathogen-Associated Molecular Patterns, suchas endotoxin from certain bacteria) triggers infectious
inflammation and multiplies the immune reaction. Thisprocess typically occurs through Pattern Recognition
Receptors (PRR) in innate immunity.
3-signals: the affinity between immune receptors andDAMPs (Danger Associated Molecular Patterns, such as
signs of necrosis or intracellular proteins like DNA whenreleased in the intercellular milieu) triggers noninfectious inflammation. This process typically occurs
through TLR (Toll-Like Receptors, a specific kind ofPRR) in innate immunity.

3. Cognition and the Artificial Immune
Ecosystem
3.1. The artificial immune process
A major difference exists between natural immunity andartificial immune processes: In natural systems, theperception of the three (3) signal types occurs through thevarious immune cell types in parallel. In artificialsystems, detection mechanisms are best defined as aprocess involving several analysis approaches so far, asdefined in the artificial immune detection process inFigure 1. 1) The first step for anomaly detection isdeterministic memory-based recognition of pathogens. It
typically uses explicit rules with a tightly define scope,such as in antiviruses. 2) The second step consists instochastic immune detection: 2.1) detection based on
known antigens, for instance using fuzzy detectors,
similar to the 1-signal model of natural immunity, 2.2)
recognition of a generic model similar to the 2-signals
model and 2.3) detection of danger signal similar to the3-signals models. 3) The third step consists in thecharacterization of the anomaly. It can be automated or
assisted by the expert as specified in Section 4. 4) Next,
the system memory is updated to leverage the knowledge
gained through the characterization step. 5) A reaction is
performed – which is beyond the scope of thiscontribution. One should note the difference between
step 1) which is deterministic and well understood andstep 2.1) which leverages stochastic technologies and isan active research field.

2.2. Cognition and immunity
Natural immunity is a reference model of learning andcognition where a fully decentralized and autonomous
system supports a comprehensive loop of information
input, processing and subsequent reaction [6]. This loop
is known since Varella as the enactment principle [7].
The cognitive domain covers the range of search,adaptability, memory and learning [4] capabilities.
Search is the capability of processing input information
for partially hidden signals. Adaptability is the capabilityof letting information processing evolve over time tocope with environment evolution. Memory enables toretain raw or processed information about passed events.
Learning occurs when memory content trigger theadaptation of search capability. It can concern both facts
and behaviours.
Bourgine and Steward propose a more global definitionof cognition: “A system is cognitive if and only if sensory
inputs serve to trigger actions in a specific way, so as tosatisfy a viability constraint” [8], i.e. if it is capable ofreaction in a context where its viability is at risk.

Figure 1 : The artificial immune detection process

304

Journal of Robotics, Networking and Artificial Life, Vol. 4, No. 4 (March 2018) 303-307___________________________________________________________________________________________________________On can note several radical differences between thenatural immune system (IS) and the artificial immune
system process:1) Artificial immunity greatly benefits of integrating
deterministic detectors since such technologies are
already available and mature, whereas natural systems
rely on probabilistic affinities only.
2) In natural IS, no notion of process flow exists, immune
mechanisms occur in parallel, whereas an artificial
process embeds expert knowledge in its own design.

complex knowledge in latter analyses such as new
detectors, new algorithms or new algorithm parameters.
4. The role of the Expert in the Artificial
Immune Ecosystem
The expert intervenes in anomaly characterization forreinforcement, classification of investigation.
4.1. Expert-based reinforcement (step 3.2.1)
In expert-based reinforcement, the expert approves orinvalidates the classification into a given category.

3.2. Anomaly characterization
The step 2.2) of anomaly characterization entails anautomated step and a manual-driven step, as shown in
Figure 2. We share the vision of D. Engelbart that in
highly evolutive environments, interactive systems
which “increas[e] the capability of a man to approach acomplex problem situation, to gain comprehension to suithis particular needs, and to derive solutions to problems”[9] are a necessity to overcome the intrinsic limitationsof bottom-up fully automated systems. Step 3.1) consists
in automated detection, typically using statistical ormachine learning approaches. If the analysis processprovides a satisfactory output here, anomaly
characterization is completed. Otherwise, the output of
this automated step is presented to the expert for furtheranalysis. If analysis requires a manual confirmation ofautomated classification for reinforcement, the expert
validates or invalidates the system proposal (step 3.2.1).
If the analysis requires a manual classification, the expert
allocates the anomaly to a category (1 dimension),
potentially creating a new one (step 3.2.2). If thecharacterization is more complex (2 or more dimensions),
the expert performs a deeper investigation (step 3.2.3).

As stated in Equation 1, a classification proposal propthat a signal SU pertains to a given category Ci is made by
the system. If the expert labels this classification ascorrect, the membership of SU to Ci is confirmed, as given
in Equation 2. If the expert labels this classification asincorrect, the membership of SU to Ci is invalidated, asgiven in Equation 3.
4.2. Expert-aided classification (step 3.2.2)
In expert-aided classification, the expert provides thecategory of unknown items, when the system does not
manage to find a satisfactory category itself.

Equation 5 states that system knowledge K is compoundof a set of known anomaly categories { Ci }. Equation 6states that this set of known anomaly categories entails aset of n traces of Anomalies {Ai} [2], a set of m traces ofAnomaly Accompanying Pattern {AAPi} [3], a set of otraces of danger {Di} [2]. Equation 7 states that when thissignal SU is affected by the expert ( ) to an existing
anomaly category Ci which can be either a known
anomalous event Ai, a known pattern AAPi or a known
danger signal Di symptom of abnormal system use, thisexisting category Ci is extended with anomaly U. This
process occurs when Ci does not contain U yet. Equation
8 states that when this signal SU is affected by the expert
to a new category Cn, which is either an anomalous event
A, a pattern AAP or a danger signal D, the set C ofFigure 2 : Anomaly characterisation
The output of steps 3.1, 3.2.1 and 3.2.2 enables thecontinuous adaptation of the learning artificial immune
process. Step 3.2.3 requires that the process can embed305

Journal of Robotics, Networking and Artificial Life, Vol. 4, No. 4 (March 2018) 303-307___________________________________________________________________________________________________________anomaly categories is extended with Cn, that entails asingle anomaly U at this point.

learning. The expert-augmented AIE is thus a cognitive
system in the sense of Bourgine’s definition [8], butimmense research questions are open before thecommunity can transform the proposed process into afully autonomous one.

4.3. Expert investigation (step 3.2.3)
In expert investigation, the experts performs thecharacterization of the properties of an unknown item.
This characterization can typically lead to the definitionof new detectors.

5.2. Expert-based reinforcement
We studied the efficiency of expert-based reinforcementwith the Morwilog tool [10], which exploits expert
feedback to validate the identification of sequences ofsystem logs as occurrences of multi-step attacks.
Although these results are theoretical, they provide
highly promising insights wrt. the capability of handling
rapidly evolving complex signals in the context ofcybersecurity.

As stated in Equation 9, expert investigation EI leads tothe analysis of an unknown signal SU as a set of anomaly
properties {pi}, which then becomes a known signal Sk.
As stated in Equation 10, the intervention of expert
design process ED can lead to the creation of a detector
DK for the signal Sk. As stated in Equation 11, theknowledge base K is then extended with signal Sk, and thedetector base D with detector DK. Note that in the case ofinvestigation, the knowledge is compound of thesubproperties Sk = {pi} of each anomaly, rather than outof anomaly categories as in the previous cases ofclassification. Expert-aided classification is thus a special
case of the investigation where |Sk = 1| and Sk {Ci}, i.e.
the properties can be assigned to an explicit, well-knowncategory.
5. Evaluation

Figure 3 : Evaluation of expert-based reinforcement
in Morwilog

5.1. A cognitive Artificial Immune Ecosystem

5.3. Expert-aided classification

In the frame of Bersini’s definition of cognition domains[4], the proposed artificial immune process is actually acognitive process: it supports search, adaptability,memory and learning, and does so for ensuring theviability of the system. Steps 1) deterministic memorybased recognition of pathogens and 2) stochastic
recognition of pathogens embed the search facility. Step
3) Anomaly characterization embeds adaptability. Step
4) Memory update ensures the memory property together
with its exploitation in steps 1), 2), 3). The combinationof search, adaptability and memory ensures the capabilityof learning facts; step 3.2.3) investigation ensures thecapability of learning behaviours. In our current model,
the human expert supports the reaction process, theviability constraints of IT systems equipped with an AIE
and does most of the adaptability capability and behavior

We studied the efficiency of expert-aided classificationin the application of the Artificial Immune Ecosystem tonetwork supervision [10], in the particular case of theanalysis of time series information. Again, the theoreticalresults show that the involvement of an expert in thelearning process, here for classification, greatly quickens
the analysis capability. On a dataset of 10.000 entries, 30
requests on expert feedback, i.e. 0,3%, enables to achieve
89,7% of precision as given by classification F-score. 500
expert feedbacks, i.e. 5%, provides 99% precision.
Maximum
expertfeedback
F-score

2030

50

100

500

Unlimited.36.70

.72

.72

.78

.78

Table 1: Impact of expert-based classification

306

Journal of Robotics, Networking and Artificial Life, Vol. 4, No. 4 (March 2018) 303-307___________________________________________________________________________________________________________5.4. Expert investigation

model for artificial immune ecosystems. In IEEE
Congress on Evolutionary Computation 2017, Special
Session on Artificial Immune Systems: Algorithms,Simulation, Modelling & Theory, June 2017.
3. F. Guigou, P. Parrend, and P. Collet. An artificial immune
ecosystem model for hybrid cloud supervision. In
Complex System Digital Campus’15, Sep 2015.
4. H. Bersini and F. J. Varela. Hints for adaptive problem
solving gleaned from immune networks. In International
Conference on Parallel Problem Solving from Nature,pages 343–354. Springer, 1990.
5. J. Greensmith, U. Aickelin, and S. Cayzer. Detecting
danger: The dendritic cell algorithm. In Robust Intelligent
Systems, pages 89–112. Springer, 2008.
6. J. E. Hunt and D. E. Cooke. Learning using an artificial
immune system. Journal of network and computer
applications, 19(2):189–212, 1996.
7. F. Varela. Invitation aux sciences cognitives, 1988.
8. P. Bourgine and J. Stewart. Autopoiesis and cognition.
Artificial life, 10(3):327–345, 2004.
9. D. C. Engelbart. Augmenting human intellect: A
conceptual framework. Summary report afosr-3223 undercontract af 49 (638)-1024, SRI project 3578 for air force
office of scientific research. Stanford Research Institute.
Retrieved March, 1:2007, 1962.
10. J. Navarro Lara, A. Deruyver, and P. Parrend. Morwilog:
an ACO-based system for outlining multi-step attacks. InIEEE Symposium Series on Computational Intelligence(IEEE SSCI 2016). IEE, Dec 2016.
11. F. Guigou, P. Collet, and P. Parrend. The artificial immuneecosystem: a bioinspired meta-algorithm for boosting timeseries anomaly detection with expert input. In
EvoApplications, 20th European Conference on theApplications of Evolutionary Computation, Apr 2017.

We studied the efficiency of expert investigation in thecontext of Morwilog tool: before the reinforcement phasecan start, the AIE provides suspicious traces as input tothe expert to enable him to characterize prototypicalmulti-step attacks. Based on a list of suspicious traces,
the expert thus identifies the actual threat and confirmsthat a given event sequence builds a single attack.

Figure 4 : Attack steps identified through Morwilog
investigation
6. Conclusions and perspectives
In this contribution, we propose a process for enforcing
artificial immunity, i.e. a bio-inspired model supporting
the search for three immune signals: pathogens,pathogen-associated patterns and danger. The artificial
immune process entails rich detection capabilities, aswell as anomaly characterization, which is key to ensure
adaptability and memory, and thus learning. In thecontext of a rapidly evolving environment, we show thatinvolving the expert in this process for reinforcement,
classification or investigation provides significant
improvements in the learning process, which can then beconsidered a cognitive one.
Acknowledgements
We express our thanks to the colleagues who havecontributed to projects in which we developed theArtificial Immune Ecosystem: Véronique ThomasVaslin, Véronique Legrand. This work was founded byICube Laboratory (SENSAI project), French BanquePublique d’Investissement (BPI) under AAP-19 HuMaproject, Agence Nationale de la Recherche
Technologique (ANRT) and the enterprise IPLine.
References
1. S. M. Hashemi and J. He. La-based approach for iot
security. Journal of Robotics Networking and Artificial
Life, 3(4):240–248, 2017.
2. P. Parrend, P. David, F. Guigou, C. Pupka, and P. Collet.
The AWA artificial emergent awareness architecture307