# US 9,438,621 B2 · Dendritic cell algorithm module with inflammatory inter-node signaling > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 9,438,621 B2 - Document ID: US9438621B2 - Status: Granted - Kind: B2 - Application number: 14/333,875 - Filed: 2014-07-17 - Published: 2016-01-21 - Granted: 2016-09-06 - Earliest claimed: 2014-07-17 - Assignees: The Boeing Company - Applicants: The Boeing Company - Inventors: Mark Jonathan Handel; Douglas Alan Stuart - Web page: https://patentgrep.com/patent/US9438621B2 ## CPC - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - G06F 21/564: {by virus signature recognition} - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 67/12: specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Artificial Immune Systems (AIS) including the Dendritic Cell Algorithm (DCA) are an emerging method to detect malware in computer systems. An implementation of the DCA may detect anomalous behavior in various embedded network systems. Unlike previous approaches, the DCA implementation may use an inflammation signal to communicate information among the nodes of a distributed or centralized network, where the inflammatory signal indicates a likelihood to the connected nodes that a local node has been attacked by malicious software. ## Claims ### Claim 1 A system comprising: a local node; one or more connected nodes linked to the local node; and a Dendritic Cell Algorithm (DCA) module in the local node, the DCA module comprising an inflammatory signal indicating a likelihood to the connected nodes that the local node has been attacked by malicious software. ### Claim 2 (depends on 1) The system of claim 1, wherein the local node and connected node(s) comprise: (a) a collection of discrete computing devices, (b) a collection of logical nodes within a single computing device, or (c) a combination of discrete computing devices and logical nodes. ### Claim 3 (depends on 1) The system of claim 1, wherein the system comprises a distributed network. ### Claim 4 (depends on 1) The system of claim 1, wherein the system comprises a centralized network having a central server and a plurality of client nodes. ### Claim 5 (depends on 1) The system of claim 1, wherein the local node comprises a plurality of processes operating in parallel with the DCA module. ### Claim 6 (depends on 1) The system of claim 1, wherein the inflammatory signal comprises a continuous variable having a value within a range of −1 to 1. ### Claim 7 (depends on 1) The system of claim 1, wherein the inflammatory signal has a strength proportional to a degree of certainty that the local node has been attacked by malicious software. ### Claim 8 (depends on 1) The system of claim 1, wherein the DCA module comprises: a plurality of sensors configured to measure raw sensor data; a plurality of indicators created based on raw sensor data measured by the sensors; a signal combiner; a tissue module; and a plurality of individual dendritic cell (DC) instances. ### Claim 9 (depends on 8) The system of claim 8, wherein the raw sensor data comprises computer network information or individual processor information. ### Claim 10 (depends on 8) The system of claim 8, wherein the indicators comprise one or more signals representative of a heartbeat, packet size, network address, bandwidth, or processor load. ### Claim 11 (depends on 8) The system of claim 8, wherein the signal combiner sums the indicators. ### Claim 12 (depends on 8) The system of claim 8, wherein the signal combiner averages the indicators. ### Claim 13 (depends on 8) The system of claim 8, wherein the signal combiner determines the median value of the indicators. ### Claim 14 (depends on 8) The system of claim 8, wherein the tissue module manages a store of indicator signal and antigen signal, and provides data to the plurality of DC instances. ### Claim 15 A method of operating a computer network comprising a plurality of computing nodes, the method comprising: running a Dendritic Cell Algorithm (DCA) module on each of the computing nodes; identifying a harmful antigen at a first computing node by observing abnormal activity based on predetermined criteria established by the DCA module running on the first computing node; and transmitting an inflammatory signal from the DCA module of the first computing node to one or more additional computing nodes on the computer network, wherein the inflammatory signal indicates a likelihood to the one or more additional computing nodes that the first computing node has been attacked by malicious software. ### Claim 16 (depends on 15) The method of claim 15, wherein the computer network comprises a distributed network. ### Claim 17 (depends on 15) The method of claim 15, wherein the computer network comprises a centralized network. ### Claim 18 (depends on 15) The method of claim 15, further comprising modulating the response to local signal changes at the one or more additional computing nodes. ### Claim 19 (depends on 15) The method of claim 15, wherein running the DCA module on each computing node comprises: initializing an individual Dendritic Cell (DC) instance within the DCA module; receiving raw sensor data from sensors of the DCA module; creating an antigen signal in a data processing event; processing the raw sensor data to create an indicator signal comprising a vector of the following signals: (a) pathogenic associated molecular patterns (PAMP), (b) Danger, (c) Safe, and (d) Inflammation signal; passing the indicator signal to a signal transformation event; passing the antigen signal to an antigen sampling event; correlating the indicator signal and sampled antigen signals based on their time stamps; and determining whether a maturation threshold has been reached and, if so, changing the DC instance from a correlating state to an information presenting state. ### Claim 20 (depends on 19) The method of claim 19, wherein the antigen signal represents a program name, a file name, or a network address of a node. ### Claim 21 A method of operating a Dendritic Cell Algorithm (DCA) module on a first computing node linked to a computer network, the method comprising: monitoring an indicator signal comprising a vector of PAMP, Danger, and Safe signals, collected locally at the first computing node; receiving an inflammation signal from a second computing node linked to the computer network, wherein the inflammation signal indicates a likelihood that the second computing node has been attacked by malicious software; creating and aging out a plurality of individual Dendritic Cell (DC) instances; calculating an overall mature context antigen value (MCAV) of the first computing node as individual DC instances age out; and transmitting a current node status signal to one or more additional nodes linked to the computer network. ### Claim 22 (depends on 21) The method of claim 21, further comprising determining whether the MCAV of the first computing node is above a selected threshold before transmitting the current node status signal to one or more additional nodes linked to the computer network.