V-Detector: An Innovative Negative Selection Algorithm for Enhanced Intrusion Detection
This research paper presents the V-Detector, a novel negative selection algorithm developed to improve intrusion detection systems. Building on concepts from artificial immune systems (AIS), the V-Detector utilizes a unique generation strategy, variable-sized detectors, and boundary-aware implementation for anomaly detection. The algorithm focuses on self/nonself discrimination and memory features akin to the natural immune system. Key challenges include evaluating detector performance and anomaly categorization. The study also highlights the algorithm's extensibility, coverage estimation, and significant levels for hypothesis testing.
V-Detector: An Innovative Negative Selection Algorithm for Enhanced Intrusion Detection
E N D
Presentation Transcript
Computer Science Research Day The University of Memphis March 25, 2005 V-Detector: A Negative Selection Algorithm Zhou Ji, advised by Prof. Dasgupta
Background • Immune system is a group of cells and organs that work together to fight infections in our bodies.
Background • AIS (Artificial Immune Systems) are not just intrusion detection and defense • Immune system’s computational capability • Learning • Memory • Recognition • Feature extraction • Distributed process • Adaptation • Self/nonself discrimination • Prediction • ……
Background • Different models of Artificial Immune Systems • Negative selection algorithms • Immune network model • Clonal selection • Gene library
Background • Negative Selection Algorithms • In natural immune system: T-cells develop in thymus • Random generation + aimed elimination • Represent target concept by negative space • Training only with self samples – “one class” learning
basic idea Algorithm
V-detector Algorithm
Algorithm • V-detector’s features • Simple generation strategy and detector scheme - extensibility • Variable sized detectors • Coverage estimate • Boundary-aware
Implementation • Multiple dimensional, Real-valued representation • Control parameters • Self threshold • Target coverage • Significant level (for hypothesis testing) • Boundary-aware vs. point-wise
User interface Implementation
Summary • A new negative selection algorithm has been developed. • Important unique features. • Challenges: evaluate the detectors and categorize the anomaly.
Bibliography • Ji & Dasgupta, Augmented Negative Selection Algorithm with Variable-Coverage Detectors, CEC 2004 • Ji & Dasgupta, Real-valued Negative Selection Algorithm with Variable-Sized Detectors, GECCO 2004 • Ji & Dasgupta, Estimating the Detector Coverage in a Negative Selection Algorithm, GECCO 2005
