The dual negative selection algorithm and its application for network anomaly detection

Negative selection algorithm (NSA) is an important artificial immune detectors generation method for network anomaly detection. In this paper, we put forward the dual negative selection algorithm (DNSA) which includes two negative selection processes. In the first negative selection process, every randomly generated candidate detector tolerates with mature detector set and becomes semi-mature detector when not matches with any existing mature detectors. In the second negative selection process, the semi-mature detector tolerates with self set and becomes mature detector when not matches with any self element. The DNSA avoids the unnecessary and time-consuming self-tolerance process of candidate detector within the coverage of existing mature detectors, thus greatly reduces detector set size, and significantly improves detector generation efficiency. Theoretical analysis and simulations show that the DNSA effectively improves detector generation efficiency, and more suitable for network anomaly detection than traditional NSAs.