Negative Selection Approach Application in Network Intrusion Detection Systems

Abstract—Nature has always been an inspiration to researcherswith its diversity and robustness of its systems, and ArtificialImmune Systems are one of them. Many algorithms were inspiredby ongoing discoveries of biological immune systems techniquesand approaches. One of the basic and most common approachis the Negative Selection Approach, which is simple and easy toimplement. It was applied in many fields, but mostly in anomalydetection for the similarity of its basic idea. In this paper, areview is given on the application of negative selection approachin network security, specifically the intrusion detection system.As the work in this field is limited, we need to understand whatthe challenges of this approach are. Recommendations are givenby the end of the paper for future work. I. I NTRODUCTION Networks are more vulnerable by time to intrusions andattacks, from inside and outside. Cyber-attacks are makingnews headlines worldwide, as threats to networks are gettingbolder and more sophisticated. Reports of 2011 and 2012are showing an increase in network attacks, with Denial ofService (DoS) and targeted attacks having a big share in it.As reported by many web sites like [1] [2] [3], figures 1 and 2show motivations behind attacks and targeted customer typesrespectively.Internal threats and Advanced Persistent Threats (APT)are the biggest threats to a network, as they are carefullyconstructed and dangerous, due to internal users’ privilegesto access network resources. Figure 3 shows internal networksecurity concerns. With this in mind, and the increasing so-phistication of attacks, new approaches to protect the networkresources are always under investigation, and the one thatis concerned with inside and outside threats is the IntrusionDetection System.Intrusion detection systems [4] [5] [6] have been around forquite some time, as a successful security system. An IntrusionDetection System (IDS) is a system that defines and detectspossible threats within a computer or a network, by gatheringand analysing information from the surrounding environment.