The Artificial Immune System for Network Intrusion Detection: An Investigation of Clonal Selection with a Negative Selection Operator

This paper explores the use of an artificial immune system (AIS) for network intrusion detection. As one significant component for a complete AIS, static clonal selection with a negative selection operator is developed and the system is described in detail. Two important factors, the detector sample size and the antigen sample size, are investigated in order to generate an appropriate mixture of general and specific detectors for learning non-self antigen patterns. By investigating the results of series of experiments, this paper suggests how to choose appropriate detector and antigen sample sizes. These ideal sizes allow the AIS to achieve a good non-self antigen detection rate with a very low rate of self antigen detection. Furthermore, this paper concludes that the embedded negative selection operator plays an important role in the AIS by helping it to maintain a low false positive detection rate.