  The analysis of system calls is one method employed by anomaly detection
systems to recognise malicious code execution. Similarities can be drawn
between this process and the behaviour of certain cells belonging to the human
immune system, and can be applied to construct an artificial immune system. A
recently developed hypothesis in immunology, the Danger Theory, states that our
immune system responds to the presence of intruders through sensing molecules
belonging to those invaders, plus signals generated by the host indicating
danger and damage. We propose the incorporation of this concept into a
responsive intrusion detection system, where behavioural information of the
system and running processes is combined with information regarding individual
system calls.
