二次否定选择算法
摘要
A negative selection algorithm (NSA) is an important method of generating artificial immune detectors for anomaly detection. However, traditional NSAs aim at eliminating self-recognized invalid detectors by matching randomly generated candidate detectors with the whole self-training set. The matching process of the training set (self-tolerance) contributes the main time cost of such NSAs. The self-tolerance of these NSAs only considers the relationship between candidate detectors and the self-training set, and does not consider the candidate detectors repetitive coverage with the existing detector set, which leads to unnecessary self-tolerance of candidate detectors and thus an excessive count of detectors and much lower efficiency of detector generation. In this paper, we put forward the dual negative selection algorithm (2-NSA), which includes two negative selection processes. In the first negative selection process, each randomly generated candidate detector first tolerates with the existing detector set and becomes a semi-mature detector when it does not match with any existing mature detector in the existing detector set. In the second negative selection process, the semi-mature detector outside the mature detectors coverage tolerates with the self-training set and becomes a mature detector when it does not match with any element in the self-training set. The 2-NSA avoids the time-consuming self-tolerance process of the candidate detector within the coverage of existing mature detectors, and thus greatly reduces the size of the detector set and improves detector generation efficiency. Theoretical analysis shows that 2-NSA effectively improves the efficiency of detector generation, reduces the time cost of the algorithm and reduces the false-positive rate of the detection system. The experimental results show that, for the Iris dataset and 99% expected coverage, 2-NSA has 99.84% and 95.69% fewer detectors, a 60.13% and 50.90% lower false-alarm rate, and a 99.79%