Artificial immune system based on real valued negative selection algorithms for anomaly detection

• Main Author: Khairi, Rihab Salah
• Format: Thesis
• Language: English; English; English
• Published: 2015
• Subjects: QA76 Computer software
• Online Access: http://eprints.uthm.edu.my/1446/2/RIHAB%20SALAH%20KHAIRI%20COPYRIGHT%20DECLARATION.pdf; http://eprints.uthm.edu.my/1446/1/24p%20RIHAB%20SALAH%20KHAIRI.pdf; http://eprints.uthm.edu.my/1446/3/RIHAB%20SALAH%20KHAIRI%20WATERMARK.pdf; http://eprints.uthm.edu.my/1446/

The Real-Valued Negative Selection Algorithms, which are the focal point of this research, generate their detector sets based on the points of self data. Self data are regarded as the normal behavioral pattern of the monitored system. In this research, the Real-Valued Negative Selection with fixed-sized detectors (RNSA) and Real-Valued Negative Selection with variable-sized detectors (V-Detector) were applied for classification and detection of anomalies. The issue of integrity and confidentiality of data have been in existence for decades. Data have been tampered and altered either by a computer user or unauthorized access via hacking. In this research, the Negative Selection Algorithms were deployed. On the contrary, the experiments with various and well-known datasets show that NSAs have great flexibility to balance between efficiency and robustness and to accommodate domain-oriented elements in the method. Classifier algorithms, namely the Support Vector Machine and K-Nearest Neighbours were used for benchmarking the performance of the Real-Valued Negative Selection Algorithms. Experimental results illustrate that RNSA and V-Detector algorithms are suitable for the detection of anomalies, with SVM and KNN producing significant efficiency rates and increase in execution time. The results shown in this study illustrate the effectiveness of the anomaly detection techniques on Iris, Balance-Scale, Lenses and Hayes-Roth datasets. On the whole, the RNSA and V-Detector outperformed SVM and KNN on all datasets by producing higher detection rates, lower false alarm rates and execution times. This shows that the Negative Selection Algorithms are equipped with the capabilities of detecting changes in data, thus appropriate for anomaly detection. With respect to all the algorithms, V-Detector proved to be superior and surpassed all other algorithms based on performance and execution time.