Efficient Negative Selection Algorithms by Sampling and Approximate Counting

Abstract

Negative selection algorithms (NSAs) are immune-inspired anomaly detection schemes that are trained on normal data only: A set of consistent detectors --- i.e., detectors that do not match any element of the training data --- is generated by rejection sampling. Then, input elements that are matched by the generated detectors are classified as anomalous. NSAs generally suffer from exponential runtime. Here, we investigate the possibility to accelerate NSAs by sampling directly from the set of consistent detectors. We identify conditions under which this approach yields fully polynomial time randomized approximation schemes of NSAs with exponentially large detector sets. Furthermore, we prove that there exist detector types for which the approach is feasible even though the only other known method for implementing NSAs in polynomial time fails. These results provide a firm theoretical starting point for implementing efficient NSAs based on modern probabilistic techniques like Markov Chain Monte Carlo approaches.