Scholarlink

<p>Negative selection algorithms (NSAs), which simulate the human immune mechanism for network anomaly detection, represent a promising approach in this field. Traditional NSAs randomly generate candidate detectors in high-dimensional feature subspaces. However, network anomaly detection datasets such as NSL-KDD typically exhibit sample distributions concentrated in low-dimensional subspaces. This dimensional mismatch causes traditional NSAs to underperform due to insufficient mature detector generation. To address this limitation, we leverage underutilized anomaly samples from the training set as candidate detector centers. Since these samples encode critical information about feature space distribution, they enable effective generation of mature detectors within the relevant low-dimensional subspaces. Furthermore, to mitigate misclassification of anomalies within coverage holes, we implement secondary classification based on the class attributes of nearest neighbor samples. Experiments on the NSL-KDD and UNSW-NB15 datasets showed our method outperforming eight other algorithms.</p>

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

Generating detectors from anomaly samples via negative selection for network intrusion detection

  • 期刊论文

  • 出版模式：

    开放获取

  • 发表日期：

    2025年10月17日

查看全文
  • Zhiyong Li,
  • Xiang Wei,
  • Chunyan Li,
  • Jianhong Sun

摘要

Negative selection algorithms (NSAs), which simulate the human immune mechanism for network anomaly detection, represent a promising approach in this field. Traditional NSAs randomly generate candidate detectors in high-dimensional feature subspaces. However, network anomaly detection datasets such as NSL-KDD typically exhibit sample distributions concentrated in low-dimensional subspaces. This dimensional mismatch causes traditional NSAs to underperform due to insufficient mature detector generation. To address this limitation, we leverage underutilized anomaly samples from the training set as candidate detector centers. Since these samples encode critical information about feature space distribution, they enable effective generation of mature detectors within the relevant low-dimensional subspaces. Furthermore, to mitigate misclassification of anomalies within coverage holes, we implement secondary classification based on the class attributes of nearest neighbor samples. Experiments on the NSL-KDD and UNSW-NB15 datasets showed our method outperforming eight other algorithms.