Applying Artificial Immune System for Intrusion Detection

The rapid integration of cyberphysical systems (CPSs) and the Industrial Internet of Things (IIoT) has transformed industrial environments, driving advancements in autonomy, flexibility, and interconnectedness. However, this evolution introduces significant cybersecurity challenges, including vulnerability to sophisticated cyberattacks targeting critical infrastructure. Artificial immune systems (AISs), inspired by the human immune system′s adaptive and self‐regulating mechanisms, provide a promising approach for intrusion detection in dynamic industrial networks. This study conducted a systematic literature review (SLR) following the PRISMA methodology to investigate the state‐of‐the‐art applications, challenges, and research trends of AIS in industrial intrusion detection systems (IDSs). From an initial pool of 1320 records retrieved from databases like IEEE Xplore, Scopus, and Web of Science, 50 peer‐reviewed studies were selected for in‐depth analysis. The results highlight a growing adoption of AIS algorithms, including the negative selection algorithm (NSA), clonal selection algorithm (CSA), and dendritic cell algorithm (DCA), for anomaly detection, fault tolerance, and distributed control in industrial settings. Despite promising simulation‐based outcomes, challenges such as real‐time scalability, model interpretability, and infrastructure compatibility remain significant barriers. To address these gaps, this study proposes a novel conceptual framework that integrates AIS with multiagent systems (MASs) and blockchain technology, enabling autonomous detection, context‐aware decision‐making, and secure, decentralized data exchange. Future research should prioritize enhancing AIS scalability, reducing algorithmic complexity, and exploring integration with emerging technologies like explainable AI and blockchain to ensure robust, adaptive, and secure industrial systems. These findings offer critical insights for researchers and practitioners aiming to develop intelligent and resilient industrial cybersecurity solutions.

Intrusion detection system is used to monitor the system and network activities to identify anomalies and attacks so that integrity, availability, and confidentiality can be preserved. Here an intrusion detection system based on Artificial Immune System is proposed based on Natural Killer (NK) cells with immunological memory. NK cells are created and each NK cells detection radius is determined using the negative selection algorithm and is trained to detect various attacks. Effective cells with high fairness values are proliferated and distributed to the network using clonal selection algorithm. In this paper, two types of NK cell are used-a Heavyweight NK cell (HWNK) and a number of Lightweight NK cells (LWNK). The incoming data is vectorized and Major Histocompatibility Complex Class I (MHC1) is created. Then based on this MHC1, any of the receptors i.e. Activating Receptor or Inhibiting Receptor is activated. If it is the signature of an attack, Activating Receptor is activated. Activating receptor activation results in either cytokine release or apoptosis. Here cytokine release means an alarm is generated informing the administrator and apoptosis stands for dropping of the packet. If Inhibiting Receptor is activated, it’s a normal packet there is no action taken. The technique proposed yields high accuracy, better detection rate and quick response time.

A spam detection model based on negative selection algorithm is proposed in this paper. The artificial immune system creates techniques to solve complex computations, aiming to developing immune based models. This is done by distinguishing self from non-self. Preliminary mathematical analysis will expose the computation and experimental description of the method and how it is applied to spam detection. A new detector model and matching rule model are also generated for effective matching of both self and non-self in other to burst the detector performance of the model. Our unique matching technique use in the negative selection algorithm help the model to overcome the limitation of a normal negative selection algorithm in defining harmfulness of self and non-self. This improves the requirement of the model and satisfactory requirement in terms of true positive and false positive rates. The experimental result confirms that the proposed model is able to establish a better true positive on an unknown spam Models and application in artificial immune system is coming up as an active and attractive field of great diversity. Great source of inspiration to computational model are drawn from the already knowledge of the immune system. Over the past years, rapid expansion of computer network system as change the world. It is essential for an effective computer security system because attacks and criminal intend are increasingly popular in computer network(1) . There are several measure put in place by many companies in the area of creating anti spam software based on signatures and have a very efficient performance in detecting spam fast. Though, new variation of spam and unknown spam are very difficult to detect by this software. The traditional way of detecting spam based on signature is no more efficient for today systems. Recent years, researchers are interested in the field of immune system in achieving computer security. Immune theory was first applied to computer abnormality detection by Forrest et al. After then, several proposition in the area of immune system as made tremendous success. Negative selection algorithm, while not reacting to the self cells uses the immune system capability to detect unknown antigens. Its mechanism protects body against self reactive lymphocytes. Receptors are made through a pseudo-random genetic re-arrangement process during the generation of T-cells (2); they then undergo a censoring process in the thymus called the negative selection. In this process T-cells that do not bind to self-proteins are destroyed. Therefore, immunological function and protection of the body against foreign antigens is possible through circulation of matured T-cells. Artificial negative selection algorithm was proposed to follow that pattern; generating random detectors and then discard those that match self samples. It is a spam detection in which training data from only one of the classes are available. With these illustrations, the traditional negative selection algorithm believes that all self are not dangerous and all non- self

The Negative Selection (NS) algorithm is the first algorithm to come from the study of natural immune systems, and is the most widely known and applied algorithm in the field. It has been used to build intrusion detection systems along with many other security-related tasks. However, it has not been possible to use the Negative Selection algorithm on many real-world scenarios. The present research shows an optimization of the negative selection algorithm to make its execution faster. The optimized algorithm remains functionally the same, providing the same results as the unoptimized algorithm. Details are given about the optimization scheme used and the optimized negative selection algorithm is tested on the UCI Breast Cancer data set. The performance of the unoptimized negative selection algorithm is compared to the performance of the algorithm with the proposed optimization. Three claims about the function of the optimized negative selection algorithm are made and tested with four experiments. The results of the experiments are used to demonstrate that the algorithm is faster and does not change the negative selection algorithm or lower its accuracy. Although there has been research into the optimization of the Negative Selection algorithm, this work will only apply to hyper-sphere detectors, which has not been done before.

Two main techniques used to build Intrusion Detection System (IDS), abnormal detection and misuse detection, have their own strengths and limitations respectively. It implies that an effective IDS should employ an abnormal detector and a misuse detector in parallel. While the human immune system (HIS) distinguishes previously known and unknown pathogens from human body via its own passive layers which are called natural immune systems and adaptive immune systems. Natural immune system is akin to the misuse detector of IDS and adaptive immune system is similar to the abnormal detector. Inspired from adaptive immune system, Negative Selection Algorithm (NSA) is applied to abnormal detection. But NSA can not generate dynamic detectors changed with nonselves. Inspired from affinity maturation, Dynamic Negative Selection Algorithm Based on Affinity Maturation (DNSA-AM), where NSA is used to delete detectors which detect any selves, is proposed and can be adapted to the change of nonselves. Match rule with the match threshold (r) is one of the most important components in NSA and DNSA-AM. ‘r’ is related to selves and must be set at first. So DNSA-AM can not be adapted to the change of selves.

Network intrusion detection system (NIDS) monitors network traffic to detect an unauthorized activity in computer networks. The NIDS is classified according to detection technique into signature and anomaly based. Each of them has its own advantage and disadvantage. The signature-based is more effective in detecting known attacks but it is unable to detect new attacks. The anomaly-based is better in detecting new attacks but it may produce many false alarms. NIDS which use both of them try to exploit the strengths of them. In this paper we propose an improvement of the well known Snort NIDS using clonal selection algorithm (CSA). The proposed approach is evaluated using the 1999 DARPA Intrusion Detection Evaluation Data Sets of MIT (Massachusetts Institute of Technology) as a testbed. The conducted experiments compare the recall, precision, and F-score of Snort NIDS on its own, Snort NIDS improved by negative selection algorithm (NSA), and the proposed approach. The obtained results show that the proposed approach is more powerful than the others.

In order to solve the problem that the traditional signature-based detection technology cannot effectively detect unknown malware, we propose in this study a smartphone malware detection model (SP-MDM) based on artificial immune system, in which static malware analysis and dynamic malware analysis techniques are combined, and antigens are generated by encoding the characteristics extracted from the malware. Based on negative selection algorithm, the mature detectors are generated. By introducing clonal selection algorithm, the detectors with higher affinity are selected to undergo a proliferation and somatic hyper-mutation process, so that more excellent detector offspring can be generated. Experimental result shows that the detection model has a higher detection rate for unknown smartphone malware, and better detection performance can be achieved by increasing the clone generation.

Negative selection algorithm is an important algorithm in the artificial immune system, inspired by the biological immune system. Traditional negative selection algorithms lack adaptive learning ability in high-dimensional space due to data sparsity and meaningless distance measurement. To solve these problems, an improved negative selection algorithm called Negative Selection Algorithm with Complete Random Subspace Technique (RS-NSA), is proposed in this paper. It adopts a bootstrap method to reduce the rate of misclassification resulting from the anomalies covered by the regions of normal samples. By using the complete random subspace technology, it reduces dimensionality to alleviate the curse of dimensionality. In addition, the ensemble learning technique is introduced to improve accuracy, in which component classifiers can be replaced by any negative selection algorithm. Empirical evaluation on UCI datasets reveals that, compared with V-detector, our proposed method can not only achieve a higher detection rate and a lower false alarm rate, but also shorten the training time.

The negative selection algorithm (NSA) is one of the important methods in the field of immunological computation (or artificial immune systems). Over the years, some progress was made that turns this algorithm (NSA) into an efficient approach to solve problems in different domain. This review takes into account these signs of progress during the last decade and categorizes those based on different characteristics and performances. Our study shows that NSA’s evolution can be labeled in four ways highlighting the most notable NSA variations and their limitations in different application domains. We also present alternative approaches to NSA for comparison and analysis. It is evident that NSA performs better for nonlinear representation than most of the other methods, and it can outperform neural-based models in computation time. We summarize NSA’s development and highlight challenges in NSA research in comparison with other similar models.

Early detection of threats to electrical energy distribution systems helps professionals make decisions and mitigate interruptions in supply and improper activation of the protection system. Biologically inspired methods, e.g., artificial neural networks, genetic algorithms, and ant colonies, solve optimization problems and facilitate pattern recognition and decision-making. The present work presents a tool for detecting and classifying voltage disturbances based on the negative selection algorithm, which identifies and eliminates self-reactive cells, associated with multiresolution analysis, which analyzes the signal at different scales of detail, allowing a more complete understanding and detailed description of the phenomenon in question. The negative wavelet selection algorithm demonstrates robustness to detect and classify disturbances.

Damage analysis in composite materials using a hybrid artificial immune system

This paper presents a novel approach to an artificial immune system, which uses the rough set theory to improve its classification ability under uncertainty in data. The proposed approach is mainly based on a negative selection algorithm and is suitable to solve problems where the knowledge of non-self is scarce and noisy. The rough set theory is used to deal with uncertainty in data and to obtain rule sets necessary to specify both self and non-self classes. The proposed artificial immune system is implemented with rough valued lymphocytes, which emulate the approximate binding performed by natural immune systems.

Experimenting Dynamic Clonal Selection (DCS) for Parallel Multiple Interest Topics of User Profile Adaptation in Content Based Filtering

This chapter deals with the problem of fitting curves to data points, a classical optimization problem in Computer-Aided Geometric Design (CAGD). This issue plays an important role in real problems such as construction of car bodies, ship hulls, airplane fuselage, and other free-form objects. A typical example comes from reverse engineering where free-form shapes are extracted from clouds of scanned data points. In this chapter we address this issue by applying a powerful bio-inspired method called Artificial Immune Systems (AIS). The AIS can be understood as a computational methodology based upon metaphors of the biological immune system. As such, there is not one but several AIS algorithms. In this chapter we focus on the clonal selection algorithm (CSA), which explicitly takes into account the affinity maturation of the immune response. This algorithm is applied to fit Bezier curves to given sets of data points. Some illustrative examples show the good performance of our approach.

Effective distribution outage cause identification can help expedite the restoration procedure and improve the system availability. The fuzzy classification E-algorithm and the immune system inspired classification algorithm, artificial immune recognition system (AIRS), have demonstrated good capabilities in outage cause identification, especially with the existence of imbalanced data. E-algorithm extracts inference rules but is computational demanding; AIRS has the quick searching capability but is lack of rule extraction capability. In this paper, fuzzy artificial immune recognition system (FAIRS) has been proposed to take advantage of the strengths of E-algorithm and AIRS. FAIRS is applied to Duke Energy outage data for cause identification using three major customer interruption causes (tree, animal, and lightning) as prototypes; and FAIRS achieves comparable fault diagnosis performance with two base algorithms while being able to extract linguistic rules to explain the inference within significantly reduced computing time than E-algorithm.