Towards an artificial immune system for network intrusion detection: an investigation of clonal selection with a negative selection operator

Abstract

The paper describes research towards the use of an artificial immune system (AIS) for network intrusion detection. Specifically, we focus on one significant component of a complete AIS, static clonal selection with a negative selection operator, describing this system in detail. Three different data sets from the UCI repository for machine learning are used in the experiments. Two important factors, the detector sample size and the antigen sample size, are investigated in order to generate an appropriate mixture of general and specific detectors for learning non-self antigen patterns. The results of series of experiments suggest how to choose appropriate detector and antigen sample sizes. These ideal sizes allow the AIS to achieve a good non-self antigen detection rate with a very low rate of self antigen detection. We conclude that the embedded negative selection operator plays an important role in the AIS by helping it to maintain a low false positive detection rate.