Negative Selection Algorithm for Unsupervised Anomaly Detection

Abstract

In this work, we present a modification of the well-known Negative Selection Algorithm (NSA), inspired by the process of T-cell generation in the immune system. The approach employs spherical detectors and was initially developed in the context of semi-supervised anomaly detection. The novelty of this work lies in proposing an adapted version of the NSA for unsupervised anomaly detection. The goal is to develop a method that can be applied to datasets that may not only represent self-data but also contain a small percentage of anomalies, which must be detected without prior knowledge of their locations. The proposed unsupervised algorithm leverages neighborhood sampling and ensemble methods to enhance its performance. We conducted comparative tests with 11 other algorithms across 17 datasets with varying characteristics. The results demonstrate that the proposed algorithm is competitive. The proposed algorithm performs well across multiple metrics, including accuracy, AUC, precision, recall, F1 score, Cohen’s kappa, and Matthews correlation coefficient. It consistently ranks among the top algorithms for recall, indicating its effectiveness in scenarios where detecting all existing anomalies is critical, even at the expense of some increase in false positives. Further research is possible and may focus on exploring normalization procedures, improving threshold automation, and extending the method for more detailed anomaly confidence assessments.