Generating detectors from anomaly samples via negative selection for network intrusion detection

Area of Science:

• Computer Science
• Cybersecurity
• Artificial Intelligence

Background:

• Network anomaly detection is crucial for cybersecurity.
• Traditional negative selection algorithms (NSAs) struggle with high-dimensional feature spaces and low-dimensional data concentrations.
• Dimensional mismatch limits the effectiveness of existing NSAs.

Purpose of the Study:

• To improve network anomaly detection using a novel NSA approach.
• To address the dimensional mismatch issue in traditional NSAs.
• To enhance the generation of mature detectors in relevant low-dimensional subspaces.

Main Methods:

• Leveraged underutilized anomaly samples from training data as candidate detector centers.
• Utilized anomaly samples to guide detector generation within low-dimensional subspaces.
• Implemented secondary classification based on nearest neighbor attributes to mitigate misclassifications.

Main Results:

• The proposed method demonstrated superior performance compared to eight other algorithms.
• Achieved significant improvements on the NSL-KDD and UNSW-NB15 network anomaly detection datasets.
• Effectively generated mature detectors within relevant low-dimensional subspaces.

Conclusions:

• The novel NSA approach effectively addresses limitations of traditional methods.
• Using anomaly samples as centers enhances detector generation and network anomaly detection accuracy.
• The method shows strong potential for real-world network security applications.