In this work, we present a modification of the well-known negative selection algorithm (NSA), inspired by the process of T-cell generation in the immune system. The approach employs spherical detectors and was initial...
详细信息
In this work, we present a modification of the well-known negative selection algorithm (NSA), inspired by the process of T-cell generation in the immune system. The approach employs spherical detectors and was initially developed in the context of semi-supervised anomaly detection. The novelty of this work lies in proposing an adapted version of the NSA for unsupervised anomaly detection. The goal is to develop a method that can be applied to datasets that may not only represent self-data but also contain a small percentage of anomalies, which must be detected without prior knowledge of their locations. The proposed unsupervised algorithm leverages neighborhood sampling and ensemble methods to enhance its performance. We conducted comparative tests with 11 other algorithms across 17 datasets with varying characteristics. The results demonstrate that the proposed algorithm is competitive. The proposed algorithm performs well across multiple metrics, including accuracy, AUC, precision, recall, F1 score, Cohen's kappa, and Matthews correlation coefficient. It consistently ranks among the top algorithms for recall, indicating its effectiveness in scenarios where detecting all existing anomalies is critical, even at the expense of some increase in false positives. Further research is possible and may focus on exploring normalization procedures, improving threshold automation, and extending the method for more detailed anomaly confidence assessments.
The traditional negative selection algorithm with a randomly generated hypersphere detector is unable to satisfy the development needs of continuous learning due to the inherent defects of the detector. This paper pro...
详细信息
The traditional negative selection algorithm with a randomly generated hypersphere detector is unable to satisfy the development needs of continuous learning due to the inherent defects of the detector. This paper proposes a novel negative selection algorithm for hyper-rectangle detectors that overcomes the shortcomings of randomly generated hyper-sphere detectors and lays the foundation for a negative selection algorithm with continuous learning capability. It uses self-sample clusters of equal-sized hypercubes instead of self-samples for training. The hyper-rectangle detectors are generated by cutting the nonself-space along the boundary of the self-sample clusters. The state space is covered without overlapping each other by self-sample clusters and detectors. The anomaly detection performance of the proposed method was demonstrated using Iris data, vowel recognition data (Vowel), and Wisconsin Breast Cancer (BCW) data. The experimental results show that the proposed method outperforms other artificial immune algorithms and clustering algorithms under the same parameter conditions.
This paper proposes a self-adaptive mobile web service (MWS) discovery approach based on the modified negative selection algorithm (M-NSA) to improve the effectiveness and accuracy of MWS discovery in dynamic mobile e...
详细信息
This paper proposes a self-adaptive mobile web service (MWS) discovery approach based on the modified negative selection algorithm (M-NSA) to improve the effectiveness and accuracy of MWS discovery in dynamic mobile environment. The main contributions of this work are the service relevance learning model and a MWS matchmaking algorithm that it is capable of changing as soon as the discovery demonstrates the feasibility of attaining improved effectiveness or accuracy. This is achieved by transforming the two stages of modified negative selection algorithm (M-NSA) into service relevance and self-adaptive matchmaking, respectively. The proposed approach is evaluated in terms of both binary and graded relevance. After an experiment with the largest MWS dataset, the proposed approach records better results in comparison with the state-of-the-art approaches. This is owing to the self/nonself discrimination mechanism, in addition to the decent parameter analysis, and the use of more comprehensive information that covers the entire discovery space.
Botnet is a network and internet risk. It is necessary to detect botnet by analyzing and monitoring in order to quickly prevent them. Most approaches are proposed to detect bots using processing and preprocessing on a...
详细信息
Botnet is a network and internet risk. It is necessary to detect botnet by analyzing and monitoring in order to quickly prevent them. Most approaches are proposed to detect bots using processing and preprocessing on a large number of incoming information from network packets, structures, etc. The recent growth of Internet and network environments has caused a significant growth in botnet attack. Accordingly, the traditional approaches are not good for botnet detection. This paper presents a new approach for the detection of botnet within networks. The proposed detection model is used to compare four attacks, the IRC, HTTP, DNS and P2P, which are used by botnet. Additionally, this model evaluates the accuracy of botnet detection. We use network nerves and correlation and also NSA (negative selection algorithm) which is based on the artificial immune system to identify botnet and compare our results with random forest, K-neighbors, SVM, Gaussian NB, CNN, LSTM algorithms. Our method (CNN-LSTM) presents shorter training time and higher accuracy. In this experiment, we use ISOT and ISCX botnet dataset which are labeled as traffic data. In addition, we investigate various types of botnet attacks and the final evaluation is presented.
negative selection algorithm is the core algorithm of artificial immune system. It only uses the self for training and generates detectors to detect abnormalities. Holes are feature space areas that the detector fails...
详细信息
negative selection algorithm is the core algorithm of artificial immune system. It only uses the self for training and generates detectors to detect abnormalities. Holes are feature space areas that the detector fails to cover, it is the root cause of the performance degradation of the negative selection algorithm. The conventional method generates a large number of detectors randomly to repair the holes, which is time-consuming and not effective. To alleviate the problem, we propose a V-Detector-KN algorithm in this paper. V-Detector is the abbreviation of the real-valued negative selection algorithm with Variable-sized Detectors, KN represents Known Nonself. The V-Detector-KN algorithm uses the known nonself as the candidate detector to further generate the detector based on the V-Detector randomly generated detector, so as to realize the repair of holes. Compared with the conventional method to randomly generate detectors to repair holes, our proposed V-Detector-KN method uses known nonself to repair holes, reducing the randomness and blindness of hole repair. Theoretical analysis shows that the detection rate of our algorithm is not lower than that of the conventional V-Detector algorithm. The results of experiment comparing with other 6 algorithms on 7 UCI data sets show the superiority of our proposed algorithm.
The Artificial Immune System (AIS) is a powerful information processing system in adaptability, distribution, self-regulation, and decentralization control in computer networks inspired by the human immune system (HIS...
详细信息
The Artificial Immune System (AIS) is a powerful information processing system in adaptability, distribution, self-regulation, and decentralization control in computer networks inspired by the human immune system (HIS). NSA is the primary method used in AIS. It is based on self and non-self-discrimination observed in the HIS. This work introduces the recent improvements in the NSA in the field of Intrusion detection in computer networks, wireless sensor networks (WSN), Internet of things (IoT) and aircraft system. The literature shows that most of the authors have used the NSL-KDD dataset to evaluate the performance of their proposed work, Euclidean distance as similarity measure, info gain and principal component analysis (PCA) as dimensionality reduction algorithm.
The negative selection algorithm (NSA) is one of the basic algorithms of the artificial immune system. In the traditional negative selection algorithm, candidate detectors are randomly generated without considering th...
详细信息
The negative selection algorithm (NSA) is one of the basic algorithms of the artificial immune system. In the traditional negative selection algorithm, candidate detectors are randomly generated without considering the uneven distributions of self-antigens and nonself-antigens, thereby resulting in many redundant detectors, and it is difficult for these detectors to fully cover the area of nonself-antigens. To overcome the problem of low detector generation efficiency, a negative selection algorithm that is based on antigen density clustering (ADC-NSA) is proposed in this paper. The algorithm divides the process of detector generation into three steps: the first step is to calculate the density of the antigens by using the method of antigen density clustering to select nonself-clusters. The second step is to prioritize the abnormal points (nonself-antigens that are not clustered) as the centers of candidate detectors and to generate the detectors via calculation. The third step is to generate the detectors via the traditional algorithm. Detector generation via these three steps can reduce the randomness of the detector generation in the traditional algorithm, thereby improving the efficiency of detector generation. The experimental results demonstrate that on the BCW and KDD-Cup datasets, the negative selection algorithm that is based on antigen density clustering can effectively increase the detection rate while reducing the false-positive rate compared with the traditional negative selection algorithm (RNSA) and two improved algorithms at the same expected coverage.
negative selection algorithms play an important role in anomaly detection. Interface detectors are a special negative selection algorithm that completely eliminates outer holes, but there are detection blind areas. Th...
详细信息
negative selection algorithms play an important role in anomaly detection. Interface detectors are a special negative selection algorithm that completely eliminates outer holes, but there are detection blind areas. This paper proposes a negative selection algorithm with hypercube interface detectors for anomaly detection. It uses self-sample clusters to construct self-space, and boundary self-sample clusters to describe the interface detectors. It eliminates the detection blind area and improves the detection rate. To validate the performance of the proposed method, experiments were conducted using the iris dataset, the skin segmentation dataset, the Breast Cancer of Wisconsin (BCW) dataset, and the Waveform Database Generator (Version 2) dataset. Experimental results show that the proposed method in this paper has a higher detection rate, lower false alarm rate, and fewer detectors than other anomaly detection methods for the same parameters.
Artificial immune system is derived from the biological immune system. This system is an important method for generating detectors that include self-adaption, self- regulation and self-learning which have self/non-sel...
详细信息
Artificial immune system is derived from the biological immune system. This system is an important method for generating detectors that include self-adaption, self- regulation and self-learning which have self/non-self-detection features. This method is used in anomaly process detection where the anomaly is non-self in the system. We present a new combining technique for anomaly process detection. This combined technique is a unification of both negativeselection and classification algorithm. The main aim of the proposed techniques is to increase the accuracy in this system while decreasing its training time. In this research, CICIDS 2017 and NSL-KDD dataset with different sets of features and the same number of detectors are used. This paper presents a framework for detecting anomaly processes on a host base computer system which is established on the artificial immune system. We evaluate our technique using machine learning algorithms such as: logistic regression, random forest, decision tree and K-neighbors. Moreover, we use WEKA tool classification to perform a correlation based feature selection on the dataset.
The negative selection algorithm(NSA)is an adaptive technique inspired by how the biological immune system discriminates the self from *** asserts itself as one of the most important algorithms of the artificial immun...
详细信息
The negative selection algorithm(NSA)is an adaptive technique inspired by how the biological immune system discriminates the self from *** asserts itself as one of the most important algorithms of the artificial immune system.A key element of the NSA is its great dependency on the random detectors in monitoring for any ***,these detectors have limited *** detectors are generated,leading to difficulties for detectors to effectively occupy the non-self *** alleviate this problem,we propose the nature-inspired metaheuristic cuckoo search(CS),a stochastic global search algorithm,which improves the random generation of detectors in the *** characteristics such as mutation,crossover,and selection operators make the CS attain global *** the use of Lévy flight and a distance measure,efficient detectors are *** results show that integrating CS into the negative selection algorithm elevated the detection performance of the NSA,with an average increase of 3.52%detection rate on the tested *** proposed method shows superiority over other models,and detection rates of 98%and 99.29%on Fisher’s IRIS and Breast Cancer datasets,***,the generation of highest detection rates and lowest false alarm rates can be achieved.
暂无评论