A Cuckoo Search Detector Generation-based Negative Selection Algorithm

The negative selection algorithm (NSA) is an adaptive technique inspired by how the biological immune system discriminates the self from non-self. It asserts itself as one of the most important algorithms of the artificial immune system. A key element of the NSA is its great dependency on the random detectors in monitoring for any abnormalities. However, these detectors have limited performance. Redundant detectors are generated, leading to difficulties for detectors to effectively occupy the non-self space. To alleviate this problem, we propose the nature-inspired metaheuristic cuckoo search (CS), a stochastic global search algorithm, which improves the random generation of detectors in the NSA. Inbuilt characteristics such as mutation, crossover, and selection operators make the CS attain global convergence. With the use of Lévy flight and a distance measure, efficient detectors are produced. Experimental results show that integrating CS into the negative selection algorithm elevated the detection performance of the NSA, with an average increase of 3.52% detection rate on the tested datasets. The proposed method shows superiority over other models, and detection rates of 98% and 99.29% on Fisher’s IRIS and Breast Cancer datasets, respectively. Thus, the generation of highest detection rates and lowest false alarm rates can be achieved.     

An antigen space density based real-value negative selection algorithm

The negative selection algorithm (NSA) is an important detector generation algorithm for artificial immune systems. In high-dimensional space, antigens (data samples) distribute sparsely and unevenly, and most of them reside in low-dimensional subspaces. Therefore, traditional NSAs, which randomly generate detectors without considering the distribution of the antigens, cannot effectively distinguish them. To overcome this limitation, the antigen space density based real-value NSA (ASD-RNSA) is proposed in this paper. The ASD-RNSA contains two new processes. First, in order to improve detection efficiency, ASD-RNSA utilizes the antigen space density to calculate the low-dimensional subspaces where antigens are densely gathered and directly generate detectors in these subspaces. Second, to eliminate redundant detectors and prevent the algorithm from prematurely converging in high-dimensional space, ASD-RNSA suppresses candidate detectors that are recognized by other mature detectors and adopts an “antibody suppression rate” to replace the “expected coverage” as the termination condition. Experimental results show that ASD-RNSA achieves a better detection rate and has better generation quality than classical real-value NSAs.     

How commercial involvement affects open source projects: three case studies on issue reporting

Whereas most research on Internetware has focused on new technologies for keeping track of a changing Internet,little attention has been paid to the software development process.A large portion of the software running the Internet is open source software.Open source software is developed both by volunteers and commercial companies,often jointly.Companies get involved in open source projects for commercial reasons,and bring with them a commercial software development process.Thus,it is important to understand how commercial involvement affects the software development process of open source projects.This article presents case studies of three open source application servers that are being developed jointly by a volunteer community and one primary software company.We are interested in better understanding developer behavior,specifically task distribution and performance,based on whether the developer is an external contributor,e.g.,a volunteer working in their spare time,or a commercial developer from inside the primary backing company who is being paid for their time.To achieve this,we look at issue reporting as an example of commercial involvement in open source projects.In particular,we investigate the distribution of tasks among volunteers and commercial developers by studying the source of reported issues and quantify the task performance on user experience via the issue resolution speed.We construct measures based on historical records in issue tracking repositories.Our results show that,with intensified commercial involvement,the majority of issue reporting tasks would be undertaken by commercial developers,and issue resolution time would be reduced,implying a better user experience.We hope our methods and results provide practical insights for designing an efficient hybrid development process in the Internetware environment.     

An efficient proactive artificial immune system based anomaly detection and prevention system

Artificial Immune System (AIS) is inspired from Biological Immune System (BIS) and demonstrates a lot of interesting facets and intelligence that include self-learning, self adaption, self regulatory, distributed with self/non-self detection capabilities. Due to these astonishing qualities AIS are predominantly used in anomaly detection where anomalies are treated as non-self that needs to be detected. Therefore, AIS appears appropriate for development of a proactive system to identify and prevent novel and unseen anomalies. This paper presents “An Efficient Proactive Artificial Immune System based Anomaly Detection and Prevention System (EPAADPS)” which embodies immune attributes to distinguish self and non-self in quest to identify and prevent novel, unseen anomalies. Negative Selection Algorithm (NSA) is a key AIS concept and is used for anomaly detection in various publications. Despite its relative success, detector selection and thereafter anomaly detection demands a more effective algorithm. This paper put forwards concept of self-tuning of detectors and detector power in NSA with the intension to make a detector evolve and facilitate better and correct self and non-self coverage. Thereafter, agents accompanying detectors collaborate and communicate between themselves to proactively discover correct anomalies and then take appropriate preventive measures. The performance of EPAADPS is contrasted with closely related state of art RNS algorithm using real valued representation and Euclidean distance. Experimental results revels promising EPAADPS performance which very comfortably outperforms the RNS. Furthermore, these results also demonstrate that EPAADPS shows remarkable resilience and intelligence in detecting novel unseen anomalies and with preventive measures to overcome the threat perception.     

一种新的多峰值进化异常入侵检测方法

提出一种基于免疫的多峰值进化异常入侵检测方法.self空间表示为一系列超球体,为提高self和non-self之间界线划分的精确度,还引入了可变半径self球体模型,训练检测器时计入self数据点分布特性的影响.改进的多峰值遗传算法使检测器尽量填充self附近以及self超球体之间难以检测的细小区域.实验显示系统获得较好结果,并且可变半径self球体模型在DARPA99网络数据集上提高检测率的同时降低了误报率,该数据集符合模型的假设.     

一种基于受体编辑的实值阴性选择算法

受生物免疫受体编辑理论的启发,提出了一种基于受体编辑的实值阴性选择算法RERNS(Receptor Editinginspired Real Negative Selection Algorithm).对于匹配自体的检测器,该算法采用定向受体编辑使之获得新生,而这些新生的检测器分布在自体与非自体的边界区域,从而增加了检测器的多样性,并改善了算法对边界区域的覆盖情况;对于不匹配自体的检测器,该算法采用识别相同最近自体的定向受体编辑,使检测器在包含原检测范围的情况下扩大了对非自体空间的覆盖.理论分析和实验验证表明,与实值阴性选择算法中具有代表性的RNS算法和V-detector算法相比,RERNS算法生成的未成熟检测器更少,且检测性能更好.     

Improved email spam detection model with negative selection algorithm and particle swarm optimization

The adaptive nature of unsolicited email by the use of huge mailing tools prompts the need for spam detection. Implementation of different spam detection methods based on machine learning techniques was proposed to solve the problem of numerous email spam ravaging the system. Previous algorithm used in email spam detection compares each email message with spam and non-spam data before generating detectors while our proposed system inspired by the artificial immune system model with the adaptive nature of negative selection algorithm uses special features to generate detectors to cover the spam space. To cope with the trend of email spam, a novel model that improves the random generation of a detector in negative selection algorithm (NSA) with the use of stochastic distribution to model the data point using particle swarm optimization (PSO) was implemented. Local outlier factor is introduced as the fitness function to determine the local best (Pbest) of the candidate detector that gives the optimum solution. Distance measure is employed to enhance the distinctiveness between the non-spam and spam candidate detector. The detector generation process was terminated when the expected spam coverage is reached. The theoretical analysis and the experimental result show that the detection rate of NSA–PSO is higher than the standard negative selection algorithm. Accuracy for 2000 generated detectors with threshold value of 0.4 was compared. Negative selection algorithm is 68.86% and the proposed hybrid negative selection algorithm with particle swarm optimization is 91.22%.     

基于改进负选择算法的异常检测

为解决基于负选择的异常检测算法中检测器数目和检测器对非我空间的覆盖二者之间的矛盾问题,采用粒子群优化算法(PSO)来优化负选择算法中随机产生的检测器的位置,从而实现用较少的检测器实现对非我空间更大的覆盖.在保证检测器尽可能小的覆盖自我空间的前提下,扩大检测器集合对非我空间的覆盖,并且在这个过程中检测器的数目是一定的.对正弦时间序列信号(artificial datasets)和轴承滚珠故障的振动信号(real-word datasets)进行了仿真实验.实验结果表明,该算法相对于原始的负选择算法在对非我空间的覆盖和检测率的提高方面有显著的效果.     

A neural networks-based negative selection algorithm in fault diagnosis

Inspired by the self/nonself discrimination theory of the natural immune system, the negative selection algorithm (NSA) is an emerging computational intelligence method. Generally, detectors in the original NSA are first generated in a random manner. However, those detectors matching the self samples are eliminated thereafter. The remaining detectors can therefore be employed to detect any anomaly. Unfortunately, conventional NSA detectors are not adaptive for dealing with time-varying circumstances. In the present paper, a novel neural networks-based NSA is proposed. The principle and structure of this NSA are discussed, and its training algorithm is derived. Taking advantage of efficient neural networks training, it has the distinguishing capability of adaptation, which is well suited for handling dynamical problems. A fault diagnosis scheme using the new NSA is also introduced. Two illustrative simulation examples of anomaly detection in chaotic time series and inner raceway fault diagnosis of motor bearings demonstrate the efficiency of the proposed neural networks-based NSA.     

基于免疫的检测漏洞问题研究

针对已有实值非选择算法中检测漏洞问题,提出一种改进的算法提高对检测漏洞的覆盖。算法基于可变长实值检测器实现,主要思想是把自体样本分为边界自体样本和非边界自体样本。在检测器的生成过程中,鉴别和记录边界自体样本;在对新样本的检测过程中,检测是否匹配边界自体。通过人工合成数据集2DSyntheticData和实际Iris 数据集对算法进行了验证。实验结果表明,算法检测率较高,在覆盖自体和非自体边界处的漏洞方面明显优于已有的算法。     

检测器自适应生成算法研究

如何有效生成检测器是用于异常检测的非选择算法的核心问题,也是非选择算法能否实际应用的关键问题.本文提出了一种有效的检测器自适应生成算法,能够依据实际情况不断调整当前检测器集合,在使得仅用较小的检测器集就能够快速检测到大规模非我空间中的异常变化的同时,也保证了算法的普适性,对各种异常检测问题具有一定的适用性.文中对算法的理论基础进行了分析,给出了算法的实现范例和实验结果.实验结果表明了算法的有效性.     

基于NIS的异常检测算法

该文根据生物免疫系统的免疫识别机理提出了一种基于NIS的异常检测算法来识别计算机系统运行的性能异常,将健康的系统状态作为“自我”,不健康的系统状态作为“非我”,多次应用阴性选择充当过滤器,并以遗传算法进化检测子,最后仿真实验验证了算法具备较好的检测性能。     

基于人工免疫原理的NIDS系统和有关算法设计

给出一种基于人工免疫原理的网络入侵检测系统(NIDS)模型．它以频繁序列模式为基础建立自体模式集和异己模式集，随后给出了一种有效的模式编码算法．在这种编码基础上文章提出一种用于检测器生成的集否定选择和克隆选择为一体的算法．最后给出算法复杂性分析。     

Clonal optimization-based negative selection algorithm with applications in motor fault detection

The Negative Selection Algorithm (NSA) and clonal selection method are two typical kinds of artificial immune systems. In this paper, we first introduce their underlying inspirations and working principles. It is well known that the regular NSA detectors are not guaranteed to always occupy the maximal coverage of the nonself space. Therefore, we next employ the clonal optimization method to optimize these detectors so that the best anomaly detection performance can be achieved. A new motor fault detection scheme using the proposed NSA is also presented and discussed. We demonstrate the efficiency of our approach with an interesting example of motor bearings fault detection, in which the detection rates of three bearings faults are significantly improved.     

一种基于小生境策略的阴性选择算法

阴性选择算法是计算机人工免疫系统的传统核心算法之一,并以此为基础产生了许多改进算法,但这些算法大多存在计算时间过长以及空间资源消耗过大等问题。针对这些问题,提出了一种基于小生境策略的阴性选择算法,算法引入了小生镜策略,增强了检测器生成的多样性,降低了算法的复杂度并减少了检测器的生成时间,提高了阴性选择算法的生成效率。     

嵌入否定算子的网格入侵检测克隆选择算法

网格安全问题是网格普及的一大阻碍,网格入侵检测是解决网格安全瓶颈的方法之一.面向网格入侵检测需求,以现有克隆选择算法为主体,设计了嵌入否定选择算子的克隆选择算法(Negative Seleetion Operator Embedded Clonal Selection Algorithm,NCSA)作为新的检测器算法.否定算子删除了未成熟检测器中耐受性差的检测器,协助记忆检测器实现动态更新;亲和力成熟机制减少了协同刺激数量.通过实验合理设置两个影响NCSA性能的参数:不成熟检测嚣的耐受周期T和成熟检测器的生命周期L,获得满意的检测性能.相同参数和训练环境下,与传统克隆选择算法相比,NCSA获得较高非自我检测率和较低的误报率,整体检测性能有所提高.这也说明NCSA能更好识别未知入侵,适应网格环境.     

基于协同进化的免疫检测器分布优化算法

为解决免疫实值检测器的黑洞问题,分析检测器规模对检测性能的影响,提出一种基于协同进化的免疫实值检测器分布优化算法。将检测器集分成不同子集,寻找每个子集的最优个体,利用各子集问的相互作用与影响对各子集进行优化处理,取并集构成完整检测器集。实验结果表明,与否定选择算法相比,该算法不仅可以有效减少黑洞的产生,并且能以较少的检测器精确地覆盖非自体空间,从而提高检测器性能。     

基于免疫遗传的软件衰退检测算法

本文吸取了免疫学的灵感，提出了一种新的方法来验证软件衰退的出现，也就是检测软件运行中的性能异常。这种方法结合了阴性选择算法和遗传算法，使用模糊逻辑产生模糊集来区分正常和异常的性能状态，使用了阴性选择算法充当过滤嚣来消除不舍法的检测子、降低搜索空间。最后使用Mackey-Glass时间序列产生的数据集和知名的UCI数据库的一组数据进行了仿真实验，来验证本方法的可行性和有效性。     

人工免疫中一种新的基因库初始化方法

在基于人工免疫的入侵检测研究领域,一般都是应用随机产生字符串的方法来生成检测器。这种方法生成检测器的速度较慢,而且生成的检测器集的检测率低。由于非我样本中存在着关于非我空间的信息,提出通过应用非我样本来初始化基因库并应用基因库来生成检测器的方法来检测入侵。应用KDD Cup 1999入侵检测数据集,通过实验证明该方法是有效的,能更快地生成检测率更高的检测器集。     

一种用于网络入侵检测的免疫克隆策略

网络入侵检测当前面临的主要问题是如何迅速有效地检测出未知模式的入侵。借鉴生物免疫系统中的自进化学习机制,我们设计一种免疫克隆算法,该算法以生物免疫的自我非我识别为基础。进一步引入免疫克隆学习机制以提高算法对入侵模式识别的效率和正确率。论述参数的设置,并且系统不再简单地丢弃穷举法中与self匹配的候选检测器,而是对它们进行进化,引导它们偏离self集合,生成检测器。论述免疫克隆算法的具体细节,并完成相应的验证实验。实验表明该算法具有较好的识别未知模式的能力。