A Negative Selection Algorithm Integrated with Immune Network Theory

Negative Selection Algorithm (NSA) is an artificial immune system for anomaly detection. Three weaknesses in NSA are the exponential cost of generating detectors, the difficulty to set the matching threshold, and the deviation between the real and the expected miss detection rate. To improve these weaknesses, a new Negative Selection Algorithm Integrated with Immune Network theory (NSA-IN) was proposed. A matching rule with variable threshold was defined, and clonal selection was adopted to rapidly mature the detectors with low similarity to self bodies and self-adaptively get the matching threshold of detectors, and immune network theory was adopted to optimize the distribution of mature detectors and improve detection rate. Experiments show that, NSA-IN can automatically set the matching threshold, and is the linear cost of generating detectors, and reduces the deviation between the real and the expected miss detection rate. In RFID anomaly detection case, the average miss detection rate of NSA-IN is 0.098, and is lower than that of NSA 0.234.