Method for evolving detectors to detect malign behavior in an artificial immune system

A method for detecting an unauthorized activity at a network device, comprising the actions of enabling a processor to execute instructions that enable further actions, including:

• generating a plurality of detectors, wherein each detector includes a plurality of system calls;
• determining an initial matching value and an expectation value for each detector;
• comparing each detector to logged fragments of system calls that are associated with a computing process, and employing at least in part the comparison to determine a new matching value for each detector;
• when the new matching value for at least one detector is equal to or greater than the at least one detector's expectation value, evolving a child detector from the at least one parent detector;
• generating a value for the child detector that is based on a combination of common values from a plurality of detectors that are employed to evolve the child detector;
• associating a rate of mutation for each detector that corresponds to mutations in its evolved child detectors;
• and
• enabling a mutation in at least one child detector, wherein the mutation includes a change from a corresponding parent detector for at least one of a fragment length for each system call and a type of each system call.

A non-transitive processor readable storage media that includes data and instructions, wherein execution of the instructions by a processor enables actions for detecting an unauthorized activity at a network device, the actions include:

• generating a plurality of detectors, wherein each detector includes a plurality of system calls;
• determining an initial matching value and an expectation value for each detector;
• comparing each detector to logged fragments of system calls that are associated with a computing process, and employing at least in part the comparison to determine a new matching value for each detector;
• when the new matching value for at least one detector is equal to or greater than the at least one detector's expectation value, evolving a child detector from the at least one parent detector;
• generating a value for the child detector that is based on a combination of common values from a plurality of detectors that are employed to evolve the child detector associating a rate of mutation for each detector that corresponds to mutations in its evolved child detectors;
• and
• enabling a mutation in at least one child detector, wherein the mutation includes a change from a corresponding parent detector for at least one of a fragment length for each system call and a type of each system call.

A system for detecting an unauthorized computing activity, comprising:

• a server device that is configured to perform actions, including:
• generating a plurality of detectors, wherein each detector includes a plurality of system calls;
• determining an initial matching value and an expectation value for each detector;
• sending the plurality of detectors over a network to at least one client device;
• generating a value for the child detector that is based on a combination of common values from a plurality of detectors that are employed to evolve the child detector;
• associating a rate of mutation for each detector that corresponds to mutations in its evolved child detectors;
• and
• enabling a mutation in at least one child detector, wherein the mutation includes a change from a corresponding parent detector for at least one of a fragment length for each system call and a type of each system call;
• and
• a client device that is configured to perform actions, including:
• receiving the plurality of detectors;
• comparing each detector to logged fragments of system calls that are associated with a computing process, and employing at least in part the comparison to determine a new matching value for each detector;
• and
• when the new matching value for at least one detector is equal to or greater than the at least one detector's expectation value, evolving a child detector from the at least one parent detector.