Combining negative selection and classification techniques for anomaly detection

Abstract

This paper presents a novel approach inspired by the immune system that allows the application of conventional classification algorithms to perform anomaly detection. This approach appears to be very useful where only positive samples are available to train an anomaly detection system. The proposed approach uses the positive samples to generate negative samples that are used as training data for a classification algorithm. In particular, the algorithm produces fuzzy characterization of the normal (or abnormal) space. This allows it to assign a degree of normalcy, represented by membership value, to elements of the space.

Bioinformatics data mining using artificial immune systems and neural networks

“…The real-valued negative selection algorithm (RNSA) was first proposed in 2002 [5]. In this algorithm, data (including both training and testing data), detectors, affinity (or performance metrics), and the matching threshold are both represented by real-valued data in an n-dimensional real vector space.…”

A Randomized Real-Valued Negative Selection Algorithm

“…In the original version of the NS algorithm [8], the detectors are used directly to classify new data as self (normal) or non-self (abnormal). Subsequent works have shown the feasibility of combining the NS algorithm with classification algorithms [11]; in this case, the generated detectors are used by the classification algorithm to learn high-level anomaly detection functions. Regardless of how the detectors are used, a good coverage of the non-self space is important for the anomaly detection process.…”

“…González et al [11] proposed a Real-Valued Negative Selection (RNS) algorithm based on heuristics that try to distribute the detectors in the non-self space in order to maximize the coverage. This algorithm uses a real-valued representation for the self/non-self space that differs from the binary representation used in original negative selection algorithms [5,8].…”

“…This algorithm uses a real-valued representation for the self/non-self space that differs from the binary representation used in original negative selection algorithms [5,8]. This higher-level representation provides some advantages such as increased expressiveness, the possibility of extracting high-level knowledge from the generated detectors, and, in some cases, improved scalability [9,11]. However, this algorithm lacks the theoretical support of the binary negative selection algorithm [5,6].…”

“…This paper presents a real-valued negative selection algorithm with good mathematical foundation that solves some of the drawbacks of our previous approach [11]. Specifically, it can produce a good estimate of the optimal number of detectors needed to cover the non-self space, and the maximization of the non-self coverage is done through an optimization algorithm with proven convergence properties.…”