A novel radius adaptive hybrid detector generation algorithm

Abstract

Artificial immune algorithms have been widely used in anomaly detection. Negative selection algorithm (NSA) is one of the most popular detector generation algorithms. However NSA has problems such as large detector size, high overlapping rate and low detection efficiency etc. In order to reduce its overlap rate and detector size in guarantee of high detection efficiency, a novel radius adaptive hybrid detector generation algorithm is proposed, abbreviated as RAH-NSA. In order to reduce the number of self-detectors, the number of self-samples in different directions are evaluated of various radius to make sure the generated detector could cover each direction as possible. Based on the principle that self-set edge will make the number of self-set less in a certain direction, the radius of self-detector is self-adaptive. In this way, the number of self-detectors and the overlapping rate could be reduced sharply. For each non-self-detector, distance from sample self is calculated as its radius threshold to reduce the number of self-samples and false alarm rate. And non-self-detector centers are automatically generated by normalized endpoints. Shortest distance from the initially detector is used to generate two new negative detectors, whose radius are bigger to reduce the overlapping rate and the number of detector. Finally both self-detector and negative detector are applied as hybrid detectors for data sets detection. When the data sample belongs to self-detector means it’s normal, while either detector includes test sample or the test sample belongs to the nearest one. Simulation results testify that proposed RAH-NSA has higher detector accuracy while reducing the negative detector size and overlapping rate compared with other classic detector generation algorithms without obvious execution time increase.