The International Arab Journal of Information Technology (IAJIT)

..............................
..............................
..............................


Ensemble Voting based Intrusion Detection Technique using Negative Selection Algorithm

This paper proposes an Intrusion Detection Technique (IDT) using an Artificial Immune System (AIS) based on Negative Selection Algorithm (NSA) to distinguish the self and non-self (intrusion) in computer networks. The novelties of the work are 1) use of Stacked Autoencoders (SAEs) and random forest for dimensionality reduction of data, 2) use of AIS to exploit its feature like self-learning, distributed, self-adaption, self-regulation with self and non-self-distinguishing capability, 3) implementation of two algorithms i.e., NSA based on Cosine Distance (NSA_CD) and NSA based on Pearson Distance (NSA_PD) to explore their intrusion detection capabilities, and iv) development of a new ensemble voting based Intrusion Detection Technique (IDT-NSAEV) to detect and test the anomalies in the system. The proposed IDT-NSAEV technique combines the power of NSA_CD, NSA_PD and NSA based on Euclidean distance (NSA_ED) algorithms to enhance the detection rate by reducing the false alarm rate. The performance of the proposed technique is tested on standard benchmark NSL-KDD dataset and the results are compared with the state-of-the-art techniques. The results are in the favour of the proposed technique.

[1] Aziz A., Hanafi S., and Hassanien A., “Multi- Agent Artificial Immune System for Network Intrusion Detection and Classification,” in Proceedings of International Joint Conference SOCO’14-CISIS’14-ICEUTE’14, Bilbao, pp. 145-154, 2014.

[2] Aziz A., Salama M., Hassanien A., and Hanafi S., “Detectors Generation Using Genetic Algorithm for A Negative Selection Inspired Anomaly Network Intrusion Detection System,” in Proceedings of Federated Conference on Ensemble Voting based Intrusion Detection Technique using Negative Selection Algorithm 157 Computer Science and Information Systems, Wroclaw, pp. 597-602, 2012.

[3] Aziz A., Salama M., Hassanien A., and Hanafi S., “Artificial Immune System Inspired Intrusion Detection System using Genetic Algorithm,” Informatica, vol. 36, no. 4, pp. 347-358, 2012.

[4] Aldweesh A., Derhab A., and Emam A., “Deep Learning Approaches for Anomaly-Based Intrusion Detection Systems: A Survey, Taxonomy, and Open Issues,” Knowledge-Based Systems, vol. 189, pp. 105124, 2020.

[5] Abid A., Khan M., and de Silva C., “Layered and Real-Valued Negative Selection Algorithm for Fault Detection,” IEEE Systems Journal, vol. 12, no. 3, pp. 2960-2969, 2017.

[6] Balachandran S., Dasgupta D., Nino F., and Garrett D., “A Framework for Evolving Multi- Shaped Detectors in Negative Selection,” in Proceedings of IEEE Symposium on Foundations of Computational Intelligence, Honolulu, pp. 401-408, 2007.

[7] Belhadj-Aissa N. and Guerroumi M., “A New Classification Process for Network Anomaly Detection Based on Negative Selection Mechanism,” in Proceedings of International Conference on Security, Privacy and Anonymity in Computation, Communication and Storage, Zhangjiajie, pp. 238-248, 2016.

[8] Forrest S., Perelson A., Allen L., and Cherukuri R., “Self-Nonself Discrimination in A Computer,” in Proceedings of IEEE Computer Society Symposium on Research In Security and Privacy, Oakland, pp. 202-212, 1994.

[9] González F., Dasgupta D., and Gómez J., “The Effect of Binary Matching Rules in Negative Selection,” in Proceedings of Genetic and Evolutionary Computation Conference, Chicago, pp. 195-206, 2003.

[10] Gonzalez F., Dasgupta D., and Niño L., “A Randomized Real-Valued Negative Selection Algorithm,” in Proceedings of International Conference on Artificial Immune Systems, pp. 261-272, 2003.

[11] Ji Z. and Dasgupta D., “Real-Valued Negative Selection Algorithm with Variable-Sized Detectors,” in Proceedings of Genetic and Evolutionary Computation Conference, USA, pp. 287-298, 2004.

[12] Ji Z. and Dasgupta D., “Applicability Issues of The Real-Valued Negative Selection Algorithms,” in Proceedings of the 8th Annual Conference on Genetic and Evolutionary Computation, Seattle, pp. 111-118, 2006.

[13] Ji Z. and Dasgupta D., “Revisiting Negative Selection Algorithms,” Evolutionary Computation, vol. 15, no. 2, pp. 223-251, 2007.

[14] Liu M., Xue Z., Xu X., Zhong C., and Chen J., “Host-Based Intrusion Detection System with System Calls: Review and Future Trends,” ACM Computing Surveys (CSUR), vol. 51, no. 5, pp. 1- 36, 2018.

[15] McHugh J., “Testing Intrusion Detection Systems: A Critique of The 1998 and 1999 Darpa Intrusion Detection System Evaluations as Performed by Lincoln Laboratory,” ACM Transactions on Information and System Security, vol. 3, no. 4, pp. 262-294, 2000.

[16] Meftah S., Rachidi T., and Assem N., “Network Based Intrusion Detection using the UNSW- NB15 Dataset,” International Journal of Computing and Digital Systems, vol. 8, no. 5, pp. 478-487, 2019.

[17] Powers S. and He J., “A Hybrid Artificial Immune System and Self-Organising Map for Network Intrusion Detection,” Information Sciences, vol. 178, no. 15, pp. 3024-3042, 2008.

[18] Poggiolini M. and Engelbrecht A., “Application of the Feature-Detection Rule to the Negative Selection Algorithm,” Expert Systems with Applications, vol. 40, no. 8, pp. 3001-3014, 2013.

[19] Sabri F., Norwawi., and Seman K., “Hybrid of Rough Set Theory and Artificial Immune Recognition System as A Solution to Decrease False Alarm Rate in Intrusion Detection System,” in Proceedings of 7th International Conference on Information Assurance and Security, Melacca, pp. 134-138, 2011.

[20] Seresht N. and Azmi R., “MAIS-IDS: A Distributed Intrusion Detection System Using Multi-Agent AIS Approach,” Engineering Applications of Artificial Intelligence, vol. 35, pp. 86-298, 2014.

[21] Silva G., Caminhas W., and Palhares R., “Artificial Immune Systems Applied to Fault Detection and Isolation: A Brief Review of Immune Response-Based Approaches and A Case Study,” Applied Soft Computing, vol. 57, pp. 118-131, 2017.

[22] Singh K., Kaur l., and Maini R., “Efficient Intrusion Detection Technique Using Stacked Autoencoder,” Advances in Mathematics: Scientific Journal, vol. 9, no. 6, pp. 3839-3848, 2020

[23] Stibor T., Timmis J., and Eckert C., “A Comparative Study of Real-Valued Negative Selection to Statistical Anomaly Detection Techniques,” in Proceedings of International Conference on Artificial Immune Systems, Banff, pp. 262-275, 2005.

[24] Saurabh P. and Verma B., “An Efficient Proactive Artificial Immune System Based Anomaly Detection and Prevention System,” Expert Systems with Applications, vol. 60, pp. 311-320, 2016.

[25] Tavallaee M., Bagheri E., Lu W., and Ghorbani A., “A Detailed Analysis of The KDD CUP 99 158 The International Arab Journal of Information Technology, Vol. 20, No. 2, March 2023 Data Set,” in Proceedings of Symposium on Computational Intelligence for Security and Defense Applications, Ottawa, pp. 1-6, 2009.

[26] Tabash M., Abd Allah M., and Tawfik B., “Intrusion Detection Model Using Naive Bayes and Deep Learning Technique,” The International Arab Journal of Information Technology, vol. 17, no. 2, pp. 215-224, 2020.

[27] Van-Truong N. and Hoai N., “A Novel Negative Selection Algorithm with Optimal Worst-Case Training Time Complexity for R-Chunk Detectors,” Indian Journal of Science and Technology, vol. 13, no. 10, pp. 1160-1171, 2020.

[28] Yang T., Wen C., and Tao L., “An Antigen Space Density Based Real-Value Negative Selection Algorithm,” Applied Soft Computing, vol. 61, pp. 860-874, 2017.