Generating detectors from anomaly samples via negative selection for network intrusion detection

Negative selection algorithms (NSAs), which simulate the human immune mechanism for network anomaly detection, represent a promising approach in this field. Traditional NSAs randomly generate candidate detectors in high-dimensional feature subspaces. However, network anomaly detection datasets such as NSL-KDD typically exhibit sample distributions concentrated in low-dimensional subspaces. This dimensional mismatch causes traditional NSAs to underperform due to insufficient mature detector generation. To address this limitation, we leverage underutilized anomaly samples from the training set as candidate detector centers. Since these samples encode critical information about feature space distribution, they enable effective generation of mature detectors within the relevant low-dimensional subspaces. Furthermore, to mitigate misclassification of anomalies within coverage holes, we implement secondary classification based on the class attributes of nearest neighbor samples. Experiments on the NSL-KDD and UNSW-NB15 datasets showed our method outperforming eight other algorithms.