Abstract—Nature has always been an inspiration to researcherswith its diversity and robustness of its systems, and ArtiﬁcialImmune Systems are one of them. Many algorithms were inspiredby ongoing discoveries of biological immune systems techniquesand approaches. One of the basic and most common approachis the Negative Selection Approach, which is simple and easy toimplement. It was applied in many ﬁelds, but mostly in anomalydetection for the similarity of its basic idea. In this paper, areview is given on the application of negative selection approachin network security, speciﬁcally the intrusion detection system.As the work in this ﬁeld is limited, we need to understand whatthe challenges of this approach are. Recommendations are givenby the end of the paper for future work. I. I NTRODUCTION Networks are more vulnerable by time to intrusions andattacks, from inside and outside. Cyber-attacks are makingnews headlines worldwide, as threats to networks are gettingbolder and more sophisticated. Reports of 2011 and 2012are showing an increase in network attacks, with Denial ofService (DoS) and targeted attacks having a big share in it.As reported by many web sites like [1] [2] [3], ﬁgures 1 and 2show motivations behind attacks and targeted customer typesrespectively.Internal threats and Advanced Persistent Threats (APT)are the biggest threats to a network, as they are carefullyconstructed and dangerous, due to internal users’ privilegesto access network resources. Figure 3 shows internal networksecurity concerns. With this in mind, and the increasing so-phistication of attacks, new approaches to protect the networkresources are always under investigation, and the one thatis concerned with inside and outside threats is the IntrusionDetection System.Intrusion detection systems [4] [5] [6] have been around forquite some time, as a successful security system. An IntrusionDetection System (IDS) is a system that deﬁnes and detectspossible threats within a computer or a network, by gatheringand analysing information from the surrounding environment.
Gonzalez submitted a PhD thesis @cite_18 in 2002, which was investigating into NSA and proposed new detector generating algorithms for different representation schemes of NSA. In 2003 @cite_19 gave a review over AIS techniques and researches made from 1999 to 2003 on AIS work and applications. Timmis discussed in @cite_0 the challenges AIS applications may face, to take into consideration. He concluded the following challenges of AISs as (1) the need of more interaction with immunologists and mathematicians for the creation of useful models through experimentation, (2) theoretical and formal basis for AIS is required to understand the nature of AIS and the best and more fitting application of it, and (3) more interaction between immune systems with other systems is essential and more attention should be paid to integrations for better functioning.
@cite_0 @cite_19 @cite_18
2976610980 193291750
In this position paper, we argue that the field of Artificial Immune Systems (AIS) has reached an impass. For many years, immune inspired algorithms, whilst having some degree of success, have been limited by the lack of theorectical advances, the adoption of a limited immune inspired approach and the limited application of AIS to hard problems. The main goal of this research is to examine and to improve the anomaly detection function of artificial immune systems, specifically the negative selection algorithm and other self non-self recognition techniques. This research investigates different representation schemes for the negative selection and proposes new detector generation algorithms suitable for such representations. Accordingly, different representations are explored: hyper-rectangles (which can be interpreted as rules), fuzzy rules, and hyper-spheres. Four different detector generation algorithms are proposed: Negative Selection with Detection Rules (NSDR, an evolutionary algorithm to generate hypercube detectors), Negative Selection with Fuzzy Detection Rules (NSFDR, an evolutionary algorithm to generate fuzzy-rule detectors), Real-valued Negative Selection (RNS, a heuristic algorithm to generate hyper-spherical detectors), and Randomized Real-valued Negative Selection (RRNS, an algorithm for generating hyper-spherical detectors based on Monte Carlo methods). Also, a hybrid immune learning algorithm, which combines RNS (or RRNS) and classification algorithms is developed. This algorithm allows the application of a supervised learning technique even when samples from only one class (normal) are available. Different experiments are performed with synthetic and real world data from different sources. The experimental results show that the proposed representations along with the proposed algorithms provide some advantages over the binary negative selection algorithm. The most relevant advantages include improved scalability, more expressiveness that allows the extraction of high-level domain knowledge, non-crisp distinction between normal and abnormal, and better performance in anomaly detection.