A Self-Adaptive Evolutionary Negative Selection Approach for Anomaly Detection

Forrest et al. (1994; 1997) proposed a negative selection algorithm, also termed the exhaustive detector generating algorithm, for various anomaly detection problems. The negative selection algorithm was inspired by the thymic negative selection process that is intrinsic to natural immune systems, consisting of screening and deleting self-reactive T-cells, i.e., those T-cells that recognize self-cells. The negative selection algorithm takes considerable time (exponential to the size of the self-data) and produces redundant detectors. This time/size limitation motivated the development of different approaches to generate the set of candidate detectors. A reasonable way to find suitable parameter settings is to let an evolutionary algorithm determine the settings itself by using self-adaptive techniques. The objective of the research presented in this dissertation was to analyze, explain, and demonstrate that a novel evolutionary negative selection algorithm for anomaly detection (in non-stationary environments) can generate competent non redundant detectors with better computational time performance than the NSMutation algorithm when the mutation step size of the detectors is self-adapted