Method for evolving detectors to detect malign behavior in an artificial immune system

A method for detecting an unauthorized client software activity, comprising:

• generating a plurality of detectors, wherein each detector is a different sequence of computer system calls, and wherein each detector is assigned an initial matching value and expectation value;
• comparing each detector to at least one fragment of sequences of computer system calls associated with a computing process, and based on the comparison revising the matching value for each of the detectors;
• if a revised matching value for one of the detectors is equal to or greater than that detector's expectation value, evolving at least one child detector based in part on that detector, modifying that detector's expectation value, and modifying at least one child detector's expectation value and matching value based on a comparison to the at least one fragment of sequences;
• and
• if an expectation value for a detector in the plurality of detectors or the at least one child detector exceeds a threshold value, evaluating that detector or child detector to determine if an unauthorized activity is detected.

A system for detecting an unauthorized computing activity, comprising:

• a server that is operative to perform actions, including:
• generating a plurality of detectors, wherein each detector is a different sequence of computer system calls, and wherein each detector is assigned an initial matching value and expectation value;
• and
• sending the plurality of detectors over a network;
• a client device that is operative to perform actions, including:
• receiving the plurality of detectors;
• comparing each detector to at least one fragment of sequences of computer system calls associated with the computing activity, and based on the comparison revising the matching value for each of the detectors;
• if a revised matching value for one of the detectors is equal to or greater than that detector's expectation value, evolving at least one child detector based in part on that detector, modifying that detector's expectation value, and modifying at least one child detector's expectation value and matching value based on a comparison to the at least one fragment of sequences;
• and
• if an expectation value for a detector in the plurality of detectors or the at least one child detector exceeds a threshold value, sending that detector or child detector to the server, wherein that detector or child detector is evaluated to determine if an unauthorized activity is detected on the client device.

An apparatus for detecting an unauthorized process activity, comprising:

• means for generating a detector having an initial matching value and initial expectation value, and wherein the detector is a sequence of computer system calls;
• means for revising the matching value and expectation value for the detector based on a characteristic of a client process;
• means for generating another detector based on the detector and the detector's matching value and expectation value, wherein a matching value and expectation value is associated with the other detector;
• and
• means for performing a hill-climb of the detector's and the other detector's matching values, until one of the matching values satisfy a threshold value, then means for determining from the detector or the other detector if an unauthorized activity is detected by the client process.