An Extended Negative Selection Algorithm for Anomaly Detection

X. Hang,H. Dai

DOI: https://doi.org/10.1007/978-3-540-24775-3_32

2004-05-26

Abstract:

What problem does this paper attempt to address?

Improvement of Negative Selection Algorithm Based on Hamming Distance

ZHANG Yu,ZHOU Xi-chuan,SHEN Hai-bin

DOI: https://doi.org/10.3969/j.issn.1001-4551.2007.09.001

2007-01-01

Abstract:Negative selection algorithm is one of core algorithm of artificial immune system,the quantity of effective detectors and holes are two element of the system using negative select algorithm.A threshold adjustable negative algorithm was presented,which was based on continuous r bits matching rule and hamming distance matching rule.This new algorithm reduces the number of effective detectors and holes,which are inevitable in negative selection algorithm.Experimentations based on this algorithm show that the new algorithm reduces the number of detectors and holes dramatically.
An efficient negative selection algorithm with further training for anomaly detection.

Maoguo Gong,Jian Zhang,Jingjing Ma,Licheng Jiao

DOI: https://doi.org/10.1016/j.knosys.2012.01.004

2012-01-01

Abstract:Negative selection algorithm has been shown to be efficient for anomaly detection problems. This letter presents an improved negative selection algorithm by integrating a novel further training strategy into the training stage. The main process of further training is generating self-detectors to cover the self-region. A primary purpose of adopting further training is reducing self-samples to reduce computational cost in testing stage. It can also improve the self-region coverage. The testing stage focuses on the processing of testing samples lied within the holes. The experimental comparison among the proposed algorithm, the self-detector classification, and the V-detector on seven artificial and real-world data sets shows that the proposed algorithm can get the highest detection rate and the lowest false alarm rate in most cases.
Anomaly Detection Using Neighborhood Negative Selection

Dawei Wang,Yibo Xue,Yingfei Dong

DOI: https://doi.org/10.1080/10798587.2011.10643173

2011-01-01

Abstract:Negative Selection Algorithms (NSAs) have been widely used in anomaly detection. As the security issue becomes more complex, more and more anomaly detection schemes involve high-dimension data. NSAs however perform poorly on effectiveness and efficiency when dealing with high-dimension data. To address these issues, we propose a Neighborhood Negative Selection (NNS) algorithm in this paper. Instead of a single data point, NNS uses a neighborhood to represent a self sample (or a detector). As a result, the training efficiency is greatly improved. We further introduce a special matching mechanism to limit the negative effect of the dimensionality of a shape space and improve the detecting performance in high dimensions. The experimental results show that NNS can provide a more accurate and stable detection performance. Meanwhile, both theoretical analysis and experimental results show that NNS further improves the training efficiency.
A Real Negative Selection Algorithm with Evolutionary Preference for Anomaly Detection

Tao Yang,Wen Chen,Tao Li

DOI: https://doi.org/10.1515/phys-2017-0013

2017-01-01

Open Physics

Abstract:Traditional real negative selection algorithms (RNSAs) adopt the estimated coverage (c0) as the algorithm termination threshold, and generate detectors randomly. With increasing dimensions, the data samples could reside in the low-dimensional subspace, so that the traditional detectors cannot effectively distinguish these samples. Furthermore, in high-dimensional feature space, c0 cannot exactly reflect the detectors set coverage rate for the nonself space, and it could lead the algorithm to be terminated unexpectedly when the number of detectors is insufficient. These shortcomings make the traditional RNSAs to perform poorly in high-dimensional feature space. Based upon "evolutionary preference" theory in immunology, this paper presents a real negative selection algorithm with evolutionary preference (RNSAP). RNSAP utilizes the "unknown nonself space", "low-dimensional target subspace" and "known nonself feature" as the evolutionary preference to guide the generation of detectors, thus ensuring the detectors can cover the nonself space more effectively. Besides, RNSAP uses redundancy to replace c0 as the termination threshold, in this way RNSAP can generate adequate detectors under a proper convergence rate. The theoretical analysis and experimental result demonstrate that, compared to the classical RNSA (V-detector), RNSAP can achieve a higher detection rate, but with less detectors and computing cost.
Anomaly Detection Algorithm Based on Electric Equipment

Yu Sun,Gangfeng Yan,Xiasheng Shi

DOI: https://doi.org/10.1088/1757-899x/631/4/042046

2019-01-01

IOP Conference Series Materials Science and Engineering

Abstract:Abstract Traditional methods for detecting data anomalies of power equipment fail to fully mine the data characteristics. And it has shortcomings such as complex calculation, poor flexibility and low accuracy. To solve the problem of abnormal fault detection of electric equipment, the abnormal detection algorithm based on statistical analysis and machine learning is used in the paper. The reconstruction method based on Long Short Term Memory (LSTM) time sequence is proposed for time series data abnormal detection. Experiments show that the new method is effective in detecting and correcting abnormal data, which reduces the detection time and improves the accuracy of state estimation results. There are huge differences within the positive samples in anomaly detection, so several methods are studied in the paper. One-class SVM algorithm is often used in novelty detection and isolation forest algorithm is used in outlier detection. Machine learning methods which is based on statistical analysis will play an increasingly important role in the fields of equipment monitoring and predictive maintenance, safety of electric equipment.
NNS:A novel neighborhood negative selection algorithm

Wang, Dawei,Yibo Xue,Yingfei Dong

2012-01-01

Abstract:As the security issue becomes more complex, more and more anomaly detection schemes involve high-dimension data. Negative selection algorithms have been widely used in anomaly detection, fault detection, and fraud detection. However, these algorithms perform poorly when dealing with high- dimension data. To address this issue, we propose a novel Neighborhood Negative Selection (NNS) algorithm in this paper. In NNS, we use a neighborhood set to represent a self-sample (or a detector), instead of a single data point. As a result, the delay for training detectors is greatly reduced. We further introduce a special matching mechanism to limit the negative effect of the dimensionality of a shape space and improve the detecting performance in high dimensions. The experimental results show that NNS can provide a more accurate and stable detection performance. Meanwhile, both theoretical analysis and experimental results show that NNS further improves the training efficiency. © 2012 TSI Press.
An Improved Real-Valued Negative Selection Algorithm Based on the Constant Detector for Anomaly Detection

Dong Li,Xin Sun,Furong Gao,Shulin Liu

DOI: https://doi.org/10.3233/jifs-200405

2021-01-01

Journal of Intelligent & Fuzzy Systems

Abstract:Compared with the traditional negative selection algorithms produce detectors randomly in whole state space, the boundary-fixed negative selection algorithm (FB-NSA) non-randomly produces a layer of detectors closely surrounding the self space. However, the false alarm rate of FB-NSA is higher than many anomaly detection methods. Its detection rate is very low when normal data close to the boundary of state space. This paper proposed an improved FB-NSA (IFB-NSA) to solve these problems. IFB-NSA enlarges the state space and adds auxiliary detectors in appropriate places to improve the detection rate, and uses variable-sized training samples to reduce the false alarm rate. We present experiments on synthetic datasets and the UCI Iris dataset to demonstrate the effectiveness of this approach. The results show that IFB-NSA outperforms FB-NSA and the other anomaly detection methods in most of the cases.
New Negative Selection Algorithm and Its Application in Disease Diagnosis

Le SHI,Wenyang BAI

DOI: https://doi.org/10.3778/j.issn.1673-9418.1407041

2015-01-01

Abstract:Aiming at the existing problems of negative selection algorithm, such as low detection rate and large detector set, this paper proposes a new real-valued negative selection algorithm, which considers non-self information and twice move point, called NTMV-detector. This algorithm generates candidate detector center based on the training of non-self and the random method. The main idea of twice move point is:if the candidate detector center matches with mature detectors, it will move out of mature detector set, instead of giving up the detector center. Then, the algorithm adjusts the location of the detector center and determines detector radius through two closest self-data to the detector center. The experiments prove that this algorithm can effectively improve diagnosis rate and reduce misdiagnosis rate.
A Neural Networks-Based Negative Selection Algorithm in Fault Diagnosis

X. Z. Gao,S. J. Ovaska,X. Wang,M. Y. Chow

DOI: https://doi.org/10.1007/s00521-007-0092-z

2007-01-01

Neural Computing and Applications

Abstract:Inspired by the self/nonself discrimination theory of the natural immune system, the negative selection algorithm (NSA) is an emerging computational intelligence method. Generally, detectors in the original NSA are first generated in a random manner. However, those detectors matching the self samples are eliminated thereafter. The remaining detectors can therefore be employed to detect any anomaly. Unfortunately, conventional NSA detectors are not adaptive for dealing with time-varying circumstances. In the present paper, a novel neural networks-based NSA is proposed. The principle and structure of this NSA are discussed, and its training algorithm is derived. Taking advantage of efficient neural networks training, it has the distinguishing capability of adaptation, which is well suited for handling dynamical problems. A fault diagnosis scheme using the new NSA is also introduced. Two illustrative simulation examples of anomaly detection in chaotic time series and inner raceway fault diagnosis of motor bearings demonstrate the efficiency of the proposed neural networks-based NSA.
Multivariate Time Series Anomaly Detection with Few Positive Samples

Feng Xue,Weizhong Yan

DOI: https://doi.org/10.48550/arXiv.2207.00705

2022-07-02

Abstract:Given the scarcity of anomalies in real-world applications, the majority of literature has been focusing on modeling normality. The learned representations enable anomaly detection as the normality model is trained to capture certain key underlying data regularities under normal circumstances. In practical settings, particularly industrial time series anomaly detection, we often encounter situations where a large amount of normal operation data is available along with a small number of anomaly events collected over time. This practical situation calls for methodologies to leverage these small number of anomaly events to create a better anomaly detector. In this paper, we introduce two methodologies to address the needs of this practical situation and compared them with recently developed state of the art techniques. Our proposed methods anchor on representative learning of normal operation with autoregressive (AR) model along with loss components to encourage representations that separate normal versus few positive examples. We applied the proposed methods to two industrial anomaly detection datasets and demonstrated effective performance in comparison with approaches from literature. Our study also points out additional challenges with adopting such methods in practical applications.

Machine Learning,Artificial Intelligence,Neural and Evolutionary Computing
A hybrid real-valued negative selection algorithm with variable-sized detectors and the k-nearest neighbors algorithm

Zhiyong Li,Tao Li,Junjiang He,Yongbin Zhu,Yunpeng Wang

DOI: https://doi.org/10.1016/j.knosys.2021.107477

2021-11-01

Abstract:A negative selection algorithm generates detectors to realize abnormality detection by simulating the maturation process of T cells in human immunity. Holes are areas of feature space that cannot be covered by the detector set and are the major factor in the degradation of algorithm performance. Conventional methods alleviate the hole problem by minimizing the coverage area of the holes. In this study, we approach the issue from a different angle. Holes are prone to form in the boundary area between the self and nonself regions, and when the self and the nonself cross or overlap, the hole problem becomes more serious. The k-nearest neighbors (k-NN) algorithm is more suitable than other methods for pending instance sets where the class domain crosses or overlaps more. Therefore, we propose a hybrid real-valued negative selection algorithm with variable-sized detectors (V-Detector) and the k-NN algorithm, abbreviated as V-Detector-kNN. The V-Detector-kNN hybrid algorithm first uses the V-Detector algorithm to classify, and then, for the problem that the nonself instances in the holes are misclassified as selfs, k-NN is introduced to classify those misclassified instances to improve the detection rate. Theoretical analysis proves that the V-Detector-kNN algorithm that we proposed has a higher detection rate than the V-Detector algorithm in most cases. Comparative experiments with 5 different algorithms on 9 UCI datasets show that our proposed algorithm ranks first in detection rate.

computer science, artificial intelligence
A cosine similarity-based negative selection algorithm for time series novelty detection

Yonggui Dong,Zhaoyan Sun,Huibo Jia

DOI: https://doi.org/10.1016/j.ymssp.2004.12.006

IF: 8.4

2006-01-01

Mechanical Systems and Signal Processing

Abstract:Detecting the new or anomalous signal sequences in the observed time series data is a problem of great practical interest for many applications. The bio-inspired negative selection algorithm, whose main idea is to discriminate the non-self pattern from self pattern, has drawn much attention because only normal information is needed for training. Most of the proposed algorithms are based on binary-valued string matching. A real-valued negative selection algorithm for novelty detection in vibration signal is implemented in this paper. The vector set for calculation is constructed by sampling the discrete time series from a moving time window. The matching affinity between two vectors is measured by cosine similarity. The calculated results show that the cosine similarity-based algorithm is more practical for potential applications in online signal monitoring.
A Novel Fast Negative Selection Algorithm Enhanced by State Graphs

Wenjian Luo,Xin Wang,Xufa Wang

DOI: https://doi.org/10.1007/978-3-540-73922-7_15

2007-01-01

Abstract:Negative Selection Algorithm is widely applied in Artificial Immune Systems, but it is not fast enough when there are mass data need to be processed. Multi-pattern matching algorithms are able to locate all occurrences of multi-patterns in an input string by just one scan operation. Inspired by the multi-pattern matching algorithm proposed by Aho and Corasick in 1975 [1], a novel fast negative selection algorithm is proposed for the "r-contiguous-bits" matching rule in this paper. The algorithm constructs a self state graph and a detector state graph according to the self set and the detector set respectively, and processes input strings using partial matching algorithm based on the state graph. The time complexity of this algorithm when processing an input string of length l is O(l). Experiments are carried out to make comparisons on the time and space costs between this new algorithm and the traditional negative selection algorithm.
Anomaly Detection with Partially Observed Anomalies

Ya-Lin Zhang,Longfei Li,Jun Zhou,Xiaolong Li,Zhi-Hua Zhou

DOI: https://doi.org/10.1145/3184558.3186580

2018-01-01

Abstract:In this paper, we consider the problem of anomaly detection. Previous studies mostly deal with this task in either supervised or unsupervised manner according to whether label information is available. However, there always exists settings which are different from the two standard manners. In this paper, we address the scenario when anomalies are partially observed, i.e., we are given a large amount of unlabeled instances as well as a handful labeled anomalies. We refer to this problem as anomaly detection with partially observed anomalies, and proposed a two-stage method ADOA to solve it. Firstly, by addressing the difference between the anomalies, the observed anomalies are clustered, while the unlabeled instances are filtered to get potential anomalies and reliable normal instances. Then, with the above instances, a weight is attached to each instance according to the confidence of its label, and a weighted multi-class model is built, which will be further used to distinguish different anomalies to the normal instances. Experimental results show that in the aforementioned setting, existing methods behave unsatisfactorily and the proposed method performs significantly better than all these methods, which validates the effectiveness of the proposed approach.
Interpretable, Multidimensional, Multimodal Anomaly Detection with Negative Sampling for Detection of Device Failure

John Sipple

DOI: https://doi.org/10.48550/arXiv.2007.10088

IF: 4.729

2020-07-12

Signal Processing

Abstract:Complex devices are connected daily and eagerly generate vast streams of multidimensional state measurements. These devices often operate in distinct modes based on external conditions (day/night, occupied/vacant, etc.), and to prevent complete or partial system outage, we would like to recognize as early as possible when these devices begin to operate outside the normal modes. Unfortunately, it is often impractical or impossible to predict failures using rules or supervised machine learning, because failure modes are too complex, devices are too new to adequately characterize in a specific environment, or environmental change puts the device into an unpredictable condition. We propose an unsupervised anomaly detection method that creates a negative sample from the positive, observed sample, and trains a classifier to distinguish between positive and negative samples. Using the Contraction Principle, we explain why such a classifier ought to establish suitable decision boundaries between normal and anomalous regions, and show how Integrated Gradients can attribute the anomaly to specific variables within the anomalous state vector. We have demonstrated that negative sampling with random forest or neural network classifiers yield significantly higher AUC scores than Isolation Forest, One Class SVM, and Deep SVDD, against (a) a synthetic dataset with dimensionality ranging between 2 and 128, with 1, 2, and 3 modes, and with and without noise dimensions; (b) four standard benchmark datasets; and (c) a multidimensional, multimodal dataset from real climate control devices. Finally, we describe how negative sampling with neural network classifiers have been successfully deployed at large scale to predict failures in real time in over 15,000 climate-control and power meter devices in 145 Google office buildings.
Learning Competitive and Discriminative Reconstructions for Anomaly Detection

Kai Tian,Shuigeng Zhou,Jianping Fan,Jihong Guan

DOI: https://doi.org/10.48550/arXiv.1903.07058

2019-03-17

Abstract:Most of the existing methods for anomaly detection use only positive data to learn the data distribution, thus they usually need a pre-defined threshold at the detection stage to determine whether a test instance is an outlier. Unfortunately, a good threshold is vital for the performance and it is really hard to find an optimal one. In this paper, we take the discriminative information implied in unlabeled data into consideration and propose a new method for anomaly detection that can learn the labels of unlabelled data directly. Our proposed method has an end-to-end architecture with one encoder and two decoders that are trained to model inliers and outliers' data distributions in a competitive way. This architecture works in a discriminative manner without suffering from overfitting, and the training algorithm of our model is adopted from SGD, thus it is efficient and scalable even for large-scale datasets. Empirical studies on 7 datasets including KDD99, MNIST, Caltech-256, and ImageNet etc. show that our model outperforms the state-of-the-art methods.

Machine Learning
Unsupervised Anomaly Detection with Rejection

Lorenzo Perini,Jesse Davis

2023-10-18

Abstract:Anomaly detection aims at detecting unexpected behaviours in the data. Because anomaly detection is usually an unsupervised task, traditional anomaly detectors learn a decision boundary by employing heuristics based on intuitions, which are hard to verify in practice. This introduces some uncertainty, especially close to the decision boundary, that may reduce the user trust in the detector's predictions. A way to combat this is by allowing the detector to reject examples with high uncertainty (Learning to Reject). This requires employing a confidence metric that captures the distance to the decision boundary and setting a rejection threshold to reject low-confidence predictions. However, selecting a proper metric and setting the rejection threshold without labels are challenging tasks. In this paper, we solve these challenges by setting a constant rejection threshold on the stability metric computed by ExCeeD. Our insight relies on a theoretical analysis of such a metric. Moreover, setting a constant threshold results in strong guarantees: we estimate the test rejection rate, and derive a theoretical upper bound for both the rejection rate and the expected prediction cost. Experimentally, we show that our method outperforms some metric-based methods.

Machine Learning
Anomaly detection based on low probability detection for hyper-spectral image

WANG Yu-lei,ZHAO Chun-hui,WANG Jiang-hong

DOI: https://doi.org/10.3969/j.issn.1001-7011.2010.03.026

2010-01-01

Abstract:Based on the analysis of data characteristics of hyper-spectral image,the method of anomaly detection based on low probability detection is studied systematically. First of all,because of the large data and high dimensions of hyper-spectral image,methods are studied to reduce dimension,in which adaptive subspace decomposition ( ASD) algorithm is deeply studied. And then study anomaly detection algorithm. Anomaly detection algorithm has become an important research focus because of its practice use. This article focuses on the low probability detection ( LPD) algorithm,and puts it into practice use. In addition,other algorithms are studied such as the RX algorithm,and then it is compared with the LPD algorithm. On the basis of this,low probability detection algorithm is improved for the purpose of finding a better algorithm,and finally use integration of the low probability detection algorithm to improve the LPD integration.
Research of Anomaly detection based on Dynamic Anomaly Detection Enhancement Framework

Xiaoxun Zhu,Songwei Weng,Yu Wang,Xiaoxia Gao,Zhen Yang,Jingyuan Cao,Lijiang Dong,Xiang Lin

DOI: https://doi.org/10.1088/1361-6501/ad889b

IF: 2.398

2024-10-20

Measurement Science and Technology

Abstract:Anomaly detection plays a crucial role in various fields, from industrial defect inspection to geological detection. However, traditional approaches often struggle with insufficient discriminability and an inability to generalize to unseen anomalies. These limitations stem from the practical difficulty in gathering a comprehensive set of anomalies and the tendency to overlook anomalous instances in favor of normal samples. To address these challenges, we propose a novel Dynamic Anomaly Detection Enhancement Framework, integrating three key innovations: (1) SaliencyAug: An adaptive saliency-guided augmentation method that generates realistic pseudo-samples to enhance learning of rare anomalies, improving model generalization. (2) DynAB: A dynamic attention block that achieves effective multi-level feature fusion while minimizing redundant information, enhancing detection accuracy. (3) DualOM: A dual-head optimization module which employs separate heads for normal and anomalous sample learning, creating more explicit and discriminative decision boundaries. Extensive experiments across multiple real-world datasets demonstrate our framework's superior performance in detecting a wide range of anomalies, demonstrating 2.4% improvement over state-of-the-art methods.

engineering, multidisciplinary,instruments & instrumentation
Exploring Global and Local Information for Anomaly Detection with Normal Samples

Fan Xu,Nan Wang,Xibin Zhao

2023-06-03

Abstract:Anomaly detection aims to detect data that do not conform to regular patterns, and such data is also called outliers. The anomalies to be detected are often tiny in proportion, containing crucial information, and are suitable for application scenes like intrusion detection, fraud detection, fault diagnosis, e-commerce platforms, et al. However, in many realistic scenarios, only the samples following normal behavior are observed, while we can hardly obtain any anomaly information. To address such problem, we propose an anomaly detection method GALDetector which is combined of global and local information based on observed normal samples. The proposed method can be divided into a three-stage method. Firstly, the global similar normal scores and the local sparsity scores of unlabeled samples are computed separately. Secondly, potential anomaly samples are separated from the unlabeled samples corresponding to these two scores and corresponding weights are assigned to the selected samples. Finally, a weighted anomaly detector is trained by loads of samples, then the detector is utilized to identify else anomalies. To evaluate the effectiveness of the proposed method, we conducted experiments on three categories of real-world datasets from diverse domains, and experimental results show that our method achieves better performance when compared with other state-of-the-art methods.

Machine Learning

An Extended Negative Selection Algorithm for Anomaly Detection

Improvement of Negative Selection Algorithm Based on Hamming Distance

An efficient negative selection algorithm with further training for anomaly detection.

Anomaly Detection Using Neighborhood Negative Selection

A Real Negative Selection Algorithm with Evolutionary Preference for Anomaly Detection

Anomaly Detection Algorithm Based on Electric Equipment

NNS:A novel neighborhood negative selection algorithm

An Improved Real-Valued Negative Selection Algorithm Based on the Constant Detector for Anomaly Detection

New Negative Selection Algorithm and Its Application in Disease Diagnosis

A Neural Networks-Based Negative Selection Algorithm in Fault Diagnosis

Multivariate Time Series Anomaly Detection with Few Positive Samples

A hybrid real-valued negative selection algorithm with variable-sized detectors and the k-nearest neighbors algorithm

A cosine similarity-based negative selection algorithm for time series novelty detection

A Novel Fast Negative Selection Algorithm Enhanced by State Graphs

Anomaly Detection with Partially Observed Anomalies

Interpretable, Multidimensional, Multimodal Anomaly Detection with Negative Sampling for Detection of Device Failure

Learning Competitive and Discriminative Reconstructions for Anomaly Detection

Unsupervised Anomaly Detection with Rejection

Anomaly detection based on low probability detection for hyper-spectral image

Research of Anomaly detection based on Dynamic Anomaly Detection Enhancement Framework

Exploring Global and Local Information for Anomaly Detection with Normal Samples